gVisor

Health v2 · maintenance only

Adoption not part of the score

19163 stars · 1937 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

gVisor is an application kernel written in Go that implements a Linux-compatible syscall interface in userspace, providing strong isolation between containers and the host kernel. It ships as an OCI runtime (runsc) that integrates with Docker and Kubernetes to sandbox untrusted workloads.

Use cases

• run untrusted or user-uploaded code in containers safely
• sandbox LLM-generated code execution
• add defense-in-depth isolation to Kubernetes pods
• protect multi-tenant SaaS workloads from container escapes
• run sandboxed containers in CI/CD pipelines
• detect abnormal container behavior with runtime monitoring

When to choose

• you need to run untrusted or third-party code with strong host isolation
• you want VM-like security with container-like startup speed and resource footprint
• you use Docker or Kubernetes and want a drop-in OCI runtime sandbox
• you need syscall-level runtime visibility for threat detection

When to avoid

• you need maximum native performance or low syscall overhead
• your workloads depend on unimplemented Linux features like io_uring
• you need full Linux syscall ABI compatibility for exotic software
• you are running inside nested VMs where KVM platform is unavailable

Facets

application · maturity stable

security container-runtime networking monitoring security cloud-computing self-hosted go cloud self-hosted sandbox oci-runtime runsc container-isolation userspace-kernel syscall-interception untrusted-code defense-in-depth checkpoint-restore netstack virtualization containers devops linux docker kubernetes

Member repositories

For agents

markdown · JSON · MCP: product_card(name="google/gvisor")