Skip to main content

What is gVisor?

gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system call interface. It provides an additional layer of isolation between running applications and the host operating system.

Overview

gVisor is developed by Google and provides efficient defense-in-depth anywhere by implementing most Linux system calls in a memory-safe language (Go) and speaking directly to the host kernel through a limited set of calls.

Key Features

🛡️ Security

  • Additional layer of isolation between applications and host OS
  • Reduced attack surface with limited host system calls
  • Memory-safe implementation in Go

🚀 Performance

  • Lower overhead than traditional VMs
  • Efficient resource utilization
  • Fast startup times

🔧 Compatibility

  • Implements most Linux system calls
  • Works with existing container runtimes (Docker, containerd, Kubernetes)
  • Supports most Linux applications without modification

🌐 Portability

  • Platform-independent userspace kernel
  • Runs on different host operating systems
  • Multiple platform implementations (KVM, ptrace)

How gVisor Works

gVisor acts as a "guest kernel" running in userspace, intercepting and handling system calls from applications. Instead of allowing direct access to the host kernel, gVisor:

  1. Intercepts system calls from the application
  2. Implements the system call in Go userspace
  3. Makes limited, controlled calls to the host kernel when necessary
  4. Returns results back to the application

This approach provides strong isolation while maintaining compatibility.

Use Cases

Container Security

  • Enhance container isolation beyond traditional namespaces and cgroups
  • Run untrusted workloads safely
  • Multi-tenant environments requiring strong isolation

Cloud Computing

  • Serverless computing platforms
  • Function-as-a-Service (FaaS) environments
  • Microservices with enhanced security

Development & Testing

  • Safe testing environments
  • Sandboxed development workflows
  • CI/CD pipeline isolation

Architecture Components

Sentry

The "kernel" that runs in userspace and implements Linux system calls.

Gofer

A file proxy that provides access to files, implementing the filesystem interface.

runsc

The runtime that integrates with container orchestrators like Docker and Kubernetes.

Comparison with Other Solutions

FeaturegVisorTraditional VMsStandard Containers
Startup TimeFastSlowVery Fast
Memory OverheadLowHighVery Low
Security IsolationStrongVery StrongModerate
CompatibilityHighVery HighVery High
PerformanceGoodModerateExcellent

Getting Started

Ready to try gVisor? Continue with the Installation Guide to set up gVisor on your system.

Resources