README

!gVisor






 What is gVisor?

gVisor provides a strong layer of isolation between running applications and
the host operating system. It is an application kernel that implements a
[Linux-like interface][linux]. Unlike Linux, it is written in a memory-safe
language (Go) and runs in userspace.

gVisor includes an [Open Container Initiative (OCI)][oci] runtime called runsc
that makes it easy to work with existing container tooling. The runsc runtime
integrates with Docker and Kubernetes, making it simple to run sandboxed
containers.

 What isn't gVisor?

   gVisor is not a syscall filter (e.g. seccomp-bpf), nor a wrapper over
    Linux isolation primitives (e.g. firejail, AppArmor, etc.).
   gVisor is also not a VM in the everyday sense of the term (e.g.
    VirtualBox, QEMU).

gVisor takes a distinct third approach, providing many security benefits of
VMs while maintaining the lower resource footprint, fast startup, and
flexibility of regular userspace applications.

 Why does gVisor exist?

Containers are not a [sandbox][sandbox]. While containers have
revolutionized how we develop, package, and deploy applications, using them to
run untrusted or potentially malicious code without additional isolation is not
a good idea. While using a single, shared kernel allows for efficiency and
performance gains, it also means that container escape is possible with a single
vulnerability.

gVisor is an application kernel for containers. It limits the host kernel
surface accessible to the application while still giving the application access
to all the features it expects. Unlike most kernels, gVisor does not assume or
require a fixed set of physical resources; instead, it leverages existing host
kernel functionality and runs as a normal process. In other words, gVisor
implements Linux by way of Linux.

gVisor should not be confused with technologies and tools to harden containers
against external threats, provide additional integrity checks, or limit the
scope of access for a service. One should always be careful about what data is
made available to a container.

 Documentation

User documentation and technical architecture, including quick start guides, can
be found at [gvisor.dev][gvisor-dev].

 Installing from source

gVisor builds on x86_64 and ARM64. Other architectures may become available in
the future.

For the purposes of these instructions, [bazel][bazel] and other build
dependencies are wrapped in a build container. It is possible to use
[bazel][bazel] directly, or type make help for standard targets.

 Requirements

Make sure the following dependencies are installed:

   Linux 5.6+
   [Docker version 17.09.0 or greater][docker]

 Building

Build a release tarball containing runsc, the containerd-shim-runsc-v1
containerd shim, and a few sidecar binaries that runsc expects to find in a
gvisor-bin/ directory next to itself, then extract it to /usr/local/bin:

sh
make release-tarball DESTINATION=bin/
sudo tar -C /usr/local/bin -xf bin/gvisor.tar.bz2

Top issues

Discussions

Latest release

gVisor release 20261102.0

Binaries are also available from the apt repository and the release bucket;
see Installation.

 Changes since release-20261026.0

text
proc: generate /proc/cpuinfo on read (7a675ac66)
proc, sys, kernfs: lazily populate /proc/sys and /sys/devices/system/cpu (8a719e832)
kernfs, proc, sys: Evict cached dentries in PrepareSave (918aefd5f)
Start the gofer with GOMAXPROCS bounded by its cgroup and capped at 8. (0cf7325e4)
pkg/state, runsc: switch default state engine to graph (6e6276344)
runsc/cmd, pkg/state: harden statefile output, HTML, and HMAC checks (85dbf4e65)
pkg/s