gVisor is an open-source application kernel and container runtime for adding defense-in-depth or sandboxing workloads safely and easily. gVisor is a container-native technology, designed to improve container isolation without sacrificing the benefits of container efficiency and portability.

Container-native Security

By providing each container with its own application kernel instance, gVisor limits the attack surface of the host while still integrating seamlessly with popular container orchestration systems, such as Docker and Kubernetes. This includes support for advanced features, such as a volumes, terminals and sidecars, and still providing visibility into the application behavior through cgroups and other monitoring mechanisms.

Resource Efficiency

Containers are efficient because workloads of different shapes and sizes can be packed together by sharing host resources. By using host native abstractions such as threads and memory mappings, gVisor closely co-operates with the host to enable the same resource model as native containers. Sandboxed containers can safely and securely share host resources with each other and native containers on the same system.

Platform Portability

Modern infrastructure spans multiple clouds and data centers, often using a mix of virtualized instances and traditional servers. The pluggable platform architecture of gVisor allows it to run anywhere, enabling security policies to be enforced consistently across multiple environments. Sandboxing requirements need not dictate where workloads can run.