gVisor
An application kernel that sandboxes containers to isolate them from the host Linux kernel.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About gVisor
gVisor adds a layer of isolation between containers and the host operating system. It is an application kernel written in Go that implements a Linux-like interface in userspace, so a container escape has far less of the host kernel to attack. It is neither a syscall filter nor a conventional virtual machine.
It ships an OCI runtime called runsc that plugs into Docker and Kubernetes. It suits people running untrusted, user-uploaded, third-party or LLM-generated code in containers.
Strengths
- Strong isolation without a full virtual machine
- runsc runtime works with Docker and Kubernetes
- Written in a memory-safe language
Limitations
- Implements a Linux-like interface, so some applications may not be compatible
- Linux hosts only
Details
- Pricing
- FreeFree and open source under the Apache 2.0 licence.
- License
- Apache-2.0
- Developer
- Platforms
- Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Best suited for
- Running untrusted code in containers with stronger isolation
- Categories
- Container tools, Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 2 sources on file.
Alternatives to gVisor
Compare allSoftware that can replace gVisor for an important use case, and what changes if you switch.
Firejail
A SUID sandbox program that restricts Linux applications using kernel namespaces and seccomp-bpf.
Firejail confines existing Linux applications with namespaces and seccomp-bpf, aimed at desktop programs rather than containers, and runs as a SUID program.
Bubblewrap
A low-level Linux command-line tool that runs programs in unprivileged sandboxes, used by Flatpak.
Bubblewrap runs programs in unprivileged Linux sandboxes and underpins Flatpak, but every sandbox is configured by hand and it lacks gVisor's separate application kernel.
gVisor as an alternative
Listings that name gVisor as an alternative.
AppArmor
A Linux kernel security module that confines programs to the actions allowed in per-application profiles.
gVisor sandboxes containers with an application kernel for stronger isolation, focused on running untrusted code rather than confining desktop services.
Sysbox
A container runtime that lets rootless containers run systemd, Docker and Kubernetes like virtual machines.
gVisor sandboxes containers with an application kernel through its runsc runtime for Docker and Kubernetes, though some applications may not be compatible.
Similar software
Related functionality, not necessarily a direct replacement.
SELinux
The userland libraries and tools for Security Enhanced Linux, the kernel's mandatory access control system.
Kyverno
A policy engine for Kubernetes that validates, mutates, generates and cleans up resources using YAML policies.
Tetragon
An eBPF-based security observability and runtime enforcement tool for Linux hosts and Kubernetes clusters.
Falco
Detect unusual runtime behavior on Linux systems.
Tracee
A Linux runtime security and forensics tool that traces system events using eBPF.
