gvisor

gVisor provides a strong layer of isolation between running applications and the host operating system. It is an application kernel that implements a Linux-like interface, but unlike Linux it is written in the memory-safe language Go and runs in userspace. gVisor includes an Open Container Initiative (OCI) runtime called runsc that integrates with Docker and Kubernetes, making it simple to run sandboxed containers. It is not a syscall filter such as seccomp-bpf, nor a wrapper over Linux isolation primitives like firejail or AppArmor, and it is not a traditional VM. Instead, gVisor takes a third approach: it provides many security benefits of VMs while maintaining the lower resource footprint, fast startup, and flexibility of regular userspace applications. It limits the host kernel surface accessible to the application while still giving the application access to expected features, effectively implementing Linux by way of Linux. The project builds on x86_64 and ARM64. Build instructions cover using a wrapped build container with Bazel, building directly with Bazel, running unit and standard test suites, and testing on macOS. A synthetic go branch is maintained for compatibility with standard Go tooling so external packages can import gVisor subpackages such as userspace networking via Netstack, though runsc builds from that branch are not supported. Documentation, quick start guides, and technical architecture are available at gvisor.dev. The repository also includes governance, adopters, security policy, and contributing information.