# gVisor

Application Kernel for Containers

Repository: https://github.com/google/gvisor
Canonical: https://ross.abutalabs.com/products/gvisor
Homepage: https://gvisor.dev
Language: Go
License: Apache-2.0
License Family: permissive
Topics: sandbox, containers, oci, docker, kubernetes, linux, kernel
Last push: 2026-08-27T00:16:35+00:00
Link (homepage): https://gvisor.dev
Link (site_page): https://gvisor.dev/docs/user_guide/compatibility
Link (site_page): https://gvisor.dev/docs/architecture_guide/security
Link (site_page): https://gvisor.dev/docs
Link (site_page): https://gvisor.dev/docs/user_guide/install

## Health v2 (maintenance only)
Score: 88/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 67, longevity 100
- inputs: {"age_days": 3051, "days_push": 7, "days_rel": 8, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 19163, forks 1937 (observed 2026-08-28T04:11:27.467973+00:00)

## What it is
gVisor is an application kernel written in Go that implements a Linux-compatible syscall interface in userspace, providing strong isolation between containers and the host kernel. It ships as an OCI runtime (runsc) that integrates with Docker and Kubernetes to sandbox untrusted workloads.

## Use cases
- run untrusted or user-uploaded code in containers safely
- sandbox LLM-generated code execution
- add defense-in-depth isolation to Kubernetes pods
- protect multi-tenant SaaS workloads from container escapes
- run sandboxed containers in CI/CD pipelines
- detect abnormal container behavior with runtime monitoring

## When to choose
- you need to run untrusted or third-party code with strong host isolation
- you want VM-like security with container-like startup speed and resource footprint
- you use Docker or Kubernetes and want a drop-in OCI runtime sandbox
- you need syscall-level runtime visibility for threat detection

## When to avoid
- you need maximum native performance or low syscall overhead
- your workloads depend on unimplemented Linux features like io_uring
- you need full Linux syscall ABI compatibility for exotic software
- you are running inside nested VMs where KVM platform is unavailable

## Facets
- artifact type: application
- maturity: stable
- function: security, container-runtime, networking, monitoring
- domain: security, cloud-computing, self-hosted
- platform: go, cloud, self-hosted
- tags: sandbox, oci-runtime, runsc, container-isolation, userspace-kernel, syscall-interception, untrusted-code, defense-in-depth, checkpoint-restore, netstack, virtualization, containers, devops, linux, docker, kubernetes

## Member repositories
- google/gvisor (main) score 88
- google/netstack (mirror) score 10

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:27.467973+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:00:24.906604+00:00, confidence not recorded.
  - readme: https://github.com/google/gvisor (fetched 2026-08-28T04:11:27.467973+00:00, sha 4af4bbb73d45)
  - homepage: https://gvisor.dev (fetched 2026-08-29T07:58:51.559823+00:00, sha 999a8fa19da7)
  - site_page: https://gvisor.dev/docs/architecture_guide/platforms (fetched 2026-08-29T07:58:51.576507+00:00, sha 1770c984d62d)
  - site_page: https://gvisor.dev/docs/user_guide/compatibility (fetched 2026-08-29T07:58:51.578967+00:00, sha 4f0386ba7bde)
  - site_page: https://gvisor.dev/docs/architecture_guide/security (fetched 2026-08-29T07:58:51.574075+00:00, sha 6b3173f869a5)
  - site_page: https://gvisor.dev/docs (fetched 2026-08-29T07:58:51.569525+00:00, sha 416673183996)
  - site_page: https://gvisor.dev/docs/user_guide/install (fetched 2026-08-29T07:58:51.571736+00:00, sha 184c1a2651be)
  - site_page: https://gvisor.dev/docs/architecture_guide/performance (fetched 2026-08-29T07:58:51.581922+00:00, sha 13eebcfd11cd)
  - site_page: https://gvisor.dev/docs/user_guide/checkpoint_restore (fetched 2026-08-29T07:58:51.584184+00:00, sha f76a5a71114f)
  - site_page: https://gvisor.dev/docs/user_guide/runtimemonitor (fetched 2026-08-29T07:58:51.587143+00:00, sha b207760fa2b6)
- Data as of 2026-08-30T08:39:29.467469+00:00.