gVisor vs LXD

gVisor is a free, open-source Linux-compatible sandbox and application kernel for running containers while isolating the host from untrusted code. It is intended for workloads such as user-uploaded, LLM-generated, and third-party code. Instead of passing sandboxed applications’ system calls directly to the host, its Sentry handles them; a Gofer process mediates filesystem access. The project describes a least-privilege design with a restrictive system call filter. It documents use with Docker, Kubernetes, containerd, and OCI runtimes, including Kubernetes configurations using GKE Sandbox, Minikube, or containerd with the gVisor shim. gVisor can stream application trace points to an external threat detection engine such as Falco, and can checkpoint and restore containers. Most CUDA applications can run unmodified in the sandbox with selected NVIDIA driver versions, but GPU support is restricted to certain models, drivers, capabilities, device files, ioctl calls, and platforms. Installation requires Linux 5.6 or later on x86_64 or ARM64. Compatibility is best-effort, and some applications may not work because not every system call, /proc file, or /sys file is implemented. Hardware side-channel protection is generally not provided.

LXD is an open-source platform for managing system containers and virtual machines on Linux. It brings LXC-based containers and KVM-based virtual machines together, with images for many Linux distributions and Windows virtual machines. Management options include a command line, REST API, web UI and third-party tools; the same HTTP API supports local and remote access. An official web UI is available by default starting with LXD 5.21.0 LTS. Features include resource limits, scheduled and expiring snapshots, projects, hardware passthrough, live migration and advanced networking. Containers run unprivileged by default, and virtual machines support UEFI Secure Boot and vTPM. LXD can run from a laptop to a data-center deployment; documentation describes clusters of up to 50 servers with thousands of instances. LXD is free, with the open-source plan listed at free. Ubuntu Pro Personal is also free for up to five physical Ubuntu systems. Enterprise workstation and server subscriptions are $25 a year and $500 a year, respectively.