containerd vs gVisor
containerd
containerd.iogVisor
gvisor.devSide by side
| Figure | containerd | gVisor |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | Yes | — |
| Linux | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Container Engines | 8.0 (#9) | 8.3 (#6) |
| Spec score · Container Runtime Software | 8.1 (#11) | 8.3 (#7) |
| Purpose | containerd is an industry-standard container runtime for managing a host’s container lifecycle, including image transfer and storage, execution, and supervision. | gVisor is an open-source Linux-compatible sandbox and application kernel that isolates containers from the host operating system. |
| Support | Nightly builds are available for Linux and Windows, but may contain critical bugs, are not recommended for production, and receive no support. | The project directs users to GitHub issues, documentation, and mailing lists for support and community discussion. |
Plans
In their own words
containerd
containerd is a free container runtime for managing a host’s container lifecycle. It handles image transfer and storage, execution, and supervision, and is designed to be embedded in a larger system rather than used directly by developers or end users. It supports OCI images and image push and pull operations, and uses runc by default while allowing other OCI-compliant runtimes. Its built-in CRI plugin can make it the container runtime for a Kubernetes cluster, and it supports registries compliant with the OCI Distribution Specification. The daemon is available for Linux and Windows. Network-interface management and image building are outside containerd’s first-class scope, so higher-level systems or tools handle those jobs. Its ctr command-line tool is intended for development and debugging, without a guarantee of a stable interface or a human-friendly experience. Users typically also need runc and CNI plugins. The plan is free; free plan available, with no free trial.
gVisor
gVisor is a free, open-source Linux-compatible sandbox and application kernel for running containers while isolating the host from untrusted code. It is intended for workloads such as user-uploaded, LLM-generated, and third-party code. Instead of passing sandboxed applications’ system calls directly to the host, its Sentry handles them; a Gofer process mediates filesystem access. The project describes a least-privilege design with a restrictive system call filter. It documents use with Docker, Kubernetes, containerd, and OCI runtimes, including Kubernetes configurations using GKE Sandbox, Minikube, or containerd with the gVisor shim. gVisor can stream application trace points to an external threat detection engine such as Falco, and can checkpoint and restore containers. Most CUDA applications can run unmodified in the sandbox with selected NVIDIA driver versions, but GPU support is restricted to certain models, drivers, capabilities, device files, ioctl calls, and platforms. Installation requires Linux 5.6 or later on x86_64 or ARM64. Compatibility is best-effort, and some applications may not work because not every system call, /proc file, or /sys file is implemented. Hardware side-channel protection is generally not provided.