gVisor vs LXC
gVisor
gvisor.devLXC
linuxcontainers.orgSide by side
| Figure | gVisor | LXC |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · Container Engines | 8.3 (#6) | 7.6 (#15) |
| Spec score · Container Runtime Software | 8.3 (#7) | 7.6 (#17) |
| Purpose | gVisor is an open-source Linux-compatible sandbox and application kernel that isolates containers from the host operating system. | LXC is a userspace interface to Linux kernel containment features for creating and managing system or application containers. |
| Security reporting | The project asks that sensitive security reports be sent to its security mailing list or submitted privately through GitHub advisories, and says a response is typically provided within 48 hours. | Security issues can be reported by email to the project security address or through a private GitHub security advisory. |
Plans
In their own words
gVisor
gVisor is a free, open-source Linux-compatible sandbox and application kernel for running containers while isolating the host from untrusted code. It is intended for workloads such as user-uploaded, LLM-generated, and third-party code. Instead of passing sandboxed applications’ system calls directly to the host, its Sentry handles them; a Gofer process mediates filesystem access. The project describes a least-privilege design with a restrictive system call filter. It documents use with Docker, Kubernetes, containerd, and OCI runtimes, including Kubernetes configurations using GKE Sandbox, Minikube, or containerd with the gVisor shim. gVisor can stream application trace points to an external threat detection engine such as Falco, and can checkpoint and restore containers. Most CUDA applications can run unmodified in the sandbox with selected NVIDIA driver versions, but GPU support is restricted to certain models, drivers, capabilities, device files, ioctl calls, and platforms. Installation requires Linux 5.6 or later on x86_64 or ARM64. Compatibility is best-effort, and some applications may not work because not every system call, /proc file, or /sys file is implemented. Hardware side-channel protection is generally not provided.
LXC
LXC is free software for creating and managing Linux system or application containers through Linux kernel containment features. It aims to make each container resemble a standard Linux installation without a separate kernel. The project includes the liblxc library, container control tools, distribution templates and API bindings for Python 3, Lua, Go, Ruby and Haskell. Process containment uses kernel namespaces, AppArmor and SELinux profiles, seccomp policies, chroots, kernel capabilities and cgroups. Unprivileged containers map container root to an unprivileged host user. LXC is included in most Linux distributions and is generally installed through the distribution package manager. Listed requirements include a supported C library and Linux kernel 2.6.32 or later. LXC 7.0 and 6.0 are listed as long-term support releases through June 1, 2031 and June 1, 2029. Most code uses GNU LGPLv2.1+, with some BSD 2-clause or GNU GPLv2 components.