gVisor

Apache-2.0 userspace container sandbox — OCI runtime runsc for agent isolation

DevOps / Security · Apache-2.0 · 19.7k

Reviewed 2026-10-06 · last push 2026-10-18 · repo checked 2026-10-19

What's Good

Apache-2.0 (google/gvisor). Free path: install runsc and point Docker/Kubernetes/containerd at it — no account, no SaaS. Implements a Linux-like syscall surface in Go, integrates as a drop-in OCI runtime, and is the isolation layer many agent/sandbox products already sit on. Useful when you need stronger isolation than namespaces+seccomp without standing up a full VM per task. ★~19.6k.

The Catch

Linux only (kernel 5.6+ recommended). Not every syscall is implemented — exotic workloads fail or fall back. Heavy file and network I/O pay a measurable overhead versus runc. This is a runtime, not an SDK or an orchestration product: you still wire Docker/K8s/agent harnesses yourself. Vs Firecracker/Cloud Hypervisor (microVMs) and plain seccomp: gVisor is the userspace kernel middle path.

Verdict

Apache-2.0 OCI sandbox runtime when agent or untrusted containers need more than runc — Linux-only, syscall gaps, and you bring the orchestrator.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/gvisor.svg)](https://stackgems.com/gems/gvisor)

HTML

<a href="https://stackgems.com/gems/gvisor"><img src="https://stackgems.com/badge/gvisor.svg" alt="gVisor reviewed on Stack Gems" height="20"></a>

DevOps →

Related