Repolode
Submit
google

google/gvisor

An application kernel written in Go that sandboxes containers by intercepting Linux system calls in userspace, runnable as the runsc OCI runtime.

View on GitHubWebsite
Stars
19,738
Forks
2,025
Open issues
1,005
Last commit
3 hours ago

What is it?

gVisor is an application kernel that implements a Linux-like interface and sits between containerized applications and the host operating system. Because it runs in userspace and is written in a memory-safe language (Go), it limits how much of the host kernel a container can reach, which reduces the impact of container escape vulnerabilities.

gVisor ships an OCI runtime called runsc that integrates with Docker and Kubernetes, so existing container tooling can run sandboxed containers with little change. It runs as a normal host process rather than a virtual machine, and the project positions itself as a middle ground between syscall filtering such as seccomp-bpf and full VMs.

The repository builds on x86_64 and ARM64 hosts with Linux 5.6 or newer, using Bazel wrapped in a build container. It also provides a Go-compatible branch for importing packages such as the Netstack TCP/IP stack into other Go projects.

Key features

  • 01Implements a Linux-like system call interface in userspace
  • 02Ships the runsc OCI runtime for Docker and Kubernetes
  • 03Written in Go, a memory-safe language
  • 04Runs as a normal host process without a full virtual machine
  • 05Builds on x86_64 and ARM64

Use cases

  • Running untrusted or third-party code in sandboxed containers
  • Adding an extra isolation layer to multi-tenant Kubernetes workloads
  • Importing the Netstack userspace TCP/IP stack into Go projects

Quick start

  1. 1

    Check requirements: Linux 5.6+ and Docker 17.09.0 or later

  2. 2

    Build the release tarball containing runsc

    make release-tarball DESTINATION=bin/
  3. 3

    Extract the tarball to /usr/local/bin

    sudo tar -C /usr/local/bin -xf bin/gvisor.tar.bz2

Things to know

  • Runs only on Linux 5.6 or newer and builds only on x86_64 and ARM64.
  • Building from source relies on a Docker-based build container or a manually configured Bazel toolchain.
  • Builds from the go branch are not supported for runsc.

Topics

#containers#sandbox#kubernetes#docker#linux#security#oci#go#kernel

FAQ

What is gvisor?
An application kernel written in Go that sandboxes containers by intercepting Linux system calls in userspace, runnable as the runsc OCI runtime. gVisor is an application kernel that implements a Linux-like interface and sits between containerized applications and the host operating system. Because it runs in userspace and is written in a memory-safe language (Go), it limits how much of the host kernel a container can reach, which reduces the impact of container escape vulnerabilities.
Is gvisor free to use? What license does it have?
gvisor is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is gvisor still maintained?
Actively maintained. The last commit to gvisor was on Oct 22, 2026.
What can I use gvisor for?
Running untrusted or third-party code in sandboxed containers Adding an extra isolation layer to multi-tenant Kubernetes workloads Importing the Netstack userspace TCP/IP stack into Go projects
How do I install gvisor?
Check requirements: Linux 5.6+ and Docker 17.09.0 or later Build the release tarball containing runsc: make release-tarball DESTINATION=bin/ Extract the tarball to /usr/local/bin: sudo tar -C /usr/local/bin -xf bin/gvisor.tar.bz2
Where can I get gvisor?
The source code and installation instructions are on GitHub: https://github.com/google/gvisor

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects