Frequently Asked Question

What is gVisor and why is it stronger than Docker?

gVisor, invoked as runsc, implements a substantial portion of the Linux system call interface in user space. A containerised process makes its syscalls to gVisor rather than directly to your kernel, and gVisor in turn makes a much smaller and more carefully chosen set of calls to the host.

An ordinary Docker or Podman container is isolated by namespaces and cgroups but shares the host kernel, so the full syscall surface of that kernel is reachable from inside it. Kernel vulnerabilities have historically been the route out of containers. gVisor shrinks that surface to an auditable Go program.

The costs are compatibility and performance: some workloads need syscalls gVisor does not implement, and the indirection is not free. It sits conceptually between an ordinary container and a virtual machine on the isolation spectrum, which makes it a reasonable choice for running code you actively do not trust.