gVisor
gvisor.dev
What it is
gVisor is a free, open-source Linux-compatible sandbox and application kernel for running containers while isolating the host from untrusted code. It is intended for workloads such as user-uploaded, LLM-generated, and third-party code. Instead of passing sandboxed applications’ system calls directly to the host, its Sentry handles them; a Gofer process mediates filesystem access. The project describes a least-privilege design with a restrictive system call filter. It documents use with Docker, Kubernetes, containerd, and OCI runtimes, including Kubernetes configurations using GKE Sandbox, Minikube, or containerd with the gVisor shim. gVisor can stream application trace points to an external threat detection engine such as Falco, and can checkpoint and restore containers. Most CUDA applications can run unmodified in the sandbox with selected NVIDIA driver versions, but GPU support is restricted to certain models, drivers, capabilities, device files, ioctl calls, and platforms. Installation requires Linux 5.6 or later on x86_64 or ARM64. Compatibility is best-effort, and some applications may not work because not every system call, /proc file, or /sys file is implemented. Hardware side-channel protection is generally not provided.
Spec sheet
- Purpose
- gVisor is an open-source Linux-compatible sandbox and application kernel that isolates containers from the host operating system.Read 4 Oct 2026 · gvisor.dev
- Product
- gVisor is an open-source Linux-compatible sandbox for running containers.Read 4 Oct 2026 · gvisor.dev
- Support
- The project directs users to GitHub issues, documentation, and mailing lists for support and community discussion.Read 4 Oct 2026 · gvisor.dev
- Architecture
- A sandbox includes a Sentry application kernel that handles system calls and a Gofer process that mediates filesystem access.Read 4 Oct 2026 · gvisor.dev
- Checkpoint and restore
- gVisor can checkpoint and restore containers for uses such as caching warmed services, resuming workloads on other machines, and saving state for forensics.Read 4 Oct 2026 · gvisor.dev
- Compatibility caveat
- The application compatibility list is best-effort and does not guarantee that applications marked compatible are fully functional.Read 4 Oct 2026 · gvisor.dev
- Compatibility limit
- gVisor does not implement every system call, /proc file, or /sys file, so some application incompatibilities may occur.Read 4 Oct 2026 · gvisor.dev
- Container integrations
- The OCI runtime runsc integrates with Docker, Kubernetes, and containerd.Read 4 Oct 2026 · gvisor.dev
- Defense in depth
- The Sentry’s access to host system calls is minimized, and the site says gVisor runs with least privileges and a strict system call filter.Read 4 Oct 2026 · gvisor.dev
- GPU limits
- GPU support is limited to selected models, driver versions, capabilities, device files, ioctl calls, and platforms.Read 4 Oct 2026 · gvisor.dev
- GPU support
- gVisor supports most CUDA applications on selected NVIDIA driver versions, and the GPU application can run unmodified inside the sandbox.Read 4 Oct 2026 · gvisor.dev
- Hardware security limit
- gVisor generally does not protect against hardware side channels and relies on the host operating system and platform for those defenses.Read 4 Oct 2026 · gvisor.dev
- Kubernetes options
- The documentation describes running gVisor with GKE Sandbox, Minikube, or Kubernetes nodes configured with containerd and the gVisor shim.Read 4 Oct 2026 · gvisor.dev
- License and availability
- gVisor is described on its official site as open-source software.Read 4 Oct 2026 · gvisor.dev
- Performance trade-off
- The documentation notes that gVisor has higher per-system-call overhead and reduced application compatibility compared with other isolation approaches.Read 4 Oct 2026 · gvisor.dev
- Requirements
- The installation guide says gVisor supports x86_64 and ARM64 and requires Linux 5.6 or later.Read 4 Oct 2026 · gvisor.dev
- Runtime monitoring
- gVisor can stream application trace points to an external threat detection engine such as Falco to generate alerts.Read 4 Oct 2026 · gvisor.dev
- Security design
- The Linux kernel and network stack components are written in Go, and gVisor runs with least privileges and a restrictive system call filter.Read 4 Oct 2026 · gvisor.dev
- Security reporting
- The project asks that sensitive security reports be sent to its security mailing list or submitted privately through GitHub advisories, and says a response is typically provided within 48 hours.Read 4 Oct 2026 · gvisor.dev
- Supported host
- Installation requires Linux 5.6 or later and supports x86_64 and ARM64.Read 4 Oct 2026 · gvisor.dev
- System call isolation
- gVisor intercepts sandboxed applications’ system calls and implements them in its Sentry instead of passing them directly to the host.Read 4 Oct 2026 · gvisor.dev
- Untrusted workloads
- It is intended to help safely run user-uploaded, LLM-generated, third-party, and other untrusted code.Read 4 Oct 2026 · gvisor.dev
- Use case
- It is designed to isolate hosts from untrusted code, including user-uploaded, LLM-generated, and third-party code.Read 4 Oct 2026 · gvisor.dev
Plans and prices
gVisor Free Open-source Linux-compatible sandbox; requires Linux 5.6+ and x86_64 or ARM64 Read 4 Oct 2026 · gvisor.dev
Strong points and limits
Strong points
- Free and open-source software.
- Supports Docker, Kubernetes, containerd, and OCI runtimes.
- Can checkpoint and restore containers.
- Rootless mode and Kubernetes CRI are supported.
- Supports x86_64 and ARM64 hosts.
Limits
- Requires Linux 5.6 or later.
- Some system calls and /proc or /sys files are unimplemented.
- Application compatibility is best-effort.
- Generally does not protect against hardware side channels.
Who it suits
It suits teams that need to isolate container workloads, including untrusted code, on Linux hosts. Users considering CUDA workloads should check the listed GPU limits and compatibility caveats.
Verdict
gVisor describes a distinct application-kernel approach to container isolation and documents integrations, host requirements, and checkpointing. Its compatibility and hardware-security limits make workload fit and host defenses important considerations.
Where Specifiction places it
- Container Engines#6 of 318.3
- Container Runtime Software#7 of 288.3
