{"data":{"slug":"gvisor","name":"gVisor","tagline":"Apache-2.0 userspace container sandbox — OCI runtime runsc for agent isolation","category":"devops","categoryName":"DevOps","url":"https://gvisor.dev","github":"https://github.com/google/gvisor","pricing":"open-source","hook":"gVisor is Google’s userspace application kernel for containers: the runsc OCI runtime sits between your workload and the host kernel so an agent sandbox (or any untrusted container) cannot treat “container escape” as a single kernel bug away.","whatsGood":"Apache-2.0 (google/gvisor). Free path: install runsc and point Docker/Kubernetes/containerd at it — no account, no SaaS. Implements a Linux-like syscall surface in Go, integrates as a drop-in OCI runtime, and is the isolation layer many agent/sandbox products already sit on. Useful when you need stronger isolation than namespaces+seccomp without standing up a full VM per task. ★~19.6k.","theCatch":"Linux only (kernel 5.6+ recommended). Not every syscall is implemented — exotic workloads fail or fall back. Heavy file and network I/O pay a measurable overhead versus runc. This is a runtime, not an SDK or an orchestration product: you still wire Docker/K8s/agent harnesses yourself. Vs Firecracker/Cloud Hypervisor (microVMs) and plain seccomp: gVisor is the userspace kernel middle path.","verdict":"Apache-2.0 OCI sandbox runtime when agent or untrusted containers need more than runc — Linux-only, syscall gaps, and you bring the orchestrator.","addedAt":"2026-10-06","featured":false,"domain":"DevOps","subSpecialty":"Security","subcategory":"Security","tags":["self-host","permissive","sandbox","containers","active"],"capabilities":["sandbox","containers","runtime"],"surfaces":["Self-host","Hosted"],"ecosystem":["Go","Multi-platform"],"licenseModel":"Apache-2.0","githubStars":19708,"starsPerWeek":45,"access":"free","archived":false,"repo":{"createdAt":"2018-04-26","pushedAt":"2026-10-18","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"github-actions","name":"GitHub Actions","tagline":"CI/CD that lives where your code does"},{"slug":"docker","name":"Docker","tagline":"Container runtime that changed deployment"},{"slug":"kubernetes","name":"Kubernetes","tagline":"Container orchestration at scale"},{"slug":"pulumi","name":"Pulumi","tagline":"Infrastructure as code in real languages"},{"slug":"fly-io","name":"Fly.io","tagline":"Deploy apps to VMs close to your users"}],"links":{"self":"/api/gems/gvisor","html":"/gems/gvisor","markdown":"/gems/gvisor.md","category":"/api/gems?category=devops","categoryPage":"/stacks/devops"}}