Jump to content

gVisor

Edit links
From Wikipedia, the free encyclopedia
gVisor
DeveloperGoogle
Release2 May 2018; 8 years ago (2018-05-02)
Written inGo
Operating systemLinux
Platformx86-64, ARM64
LicenseApache License 2.0
Websitegvisor.dev
Repositorygithub.com/google/gvisor

gVisor is an open-source container sandbox developed by Google that focuses on security, efficiency, and ease of use.[1][2] It provides virtualization-like isolation while maintaining the resource efficiency of standard containers. gVisor intercepts application system calls and implements a large portion of the Linux system call ABI in userspace, offering additional security compared to standard containers that run directly on top of the Linux kernel and are isolated merely with namespaces.[3][4] Unlike the Linux kernel, gVisor is written in the memory-safe programming language Go to prevent common pitfalls which frequently occur in software written in C.[5] Modern features of the platform include checkpoint/restore functionality and Nvidia GPU/CUDA and Google Cloud TPU support for AI/ML workloads.[2][6][7]

According to Google[8] and Brad Fitzpatrick,[9] gVisor is used extensively in Google's production environment, including the App Engine standard environment, Cloud Functions, and Google Cloud Run.[10] Furthermore, gVisor is integrated with Google Kubernetes Engine (GKE Sandbox), allowing users to sandbox their Kubernetes pods for use cases like SaaS and multitenancy.[11] In October 2026, Google announced that it was donating gVisor to the Cloud Native Computing Foundation (CNCF) as a Sandbox project.[12]

Beyond Google, organizations using gVisor include Ant Group, DigitalOcean (for App Platform), Cloudflare (for Cloudflare Pages builds), Snowflake, and the Freedom of the Press Foundation's Dangerzone tool. OpenAI and Anthropic use gVisor to run untrusted or AI-generated code. In addition, Docker (in Docker Desktop for Mac) and Tailscale use gVisor's netstack library for userspace networking.[13] In July 2026, OpenAI reported a sandbox issue to the gVisor team, which said it released a fix the following week and that exploitation required a non-standard configuration its documentation discourages.[14]

Architecture

[edit]

gVisor acts as an application kernel that intercepts and handles system calls and page faults from the sandboxed workload itself, rather than passing them to the host Linux kernel.[15]

  • runsc is gVisor's Open Container Initiative (OCI) container runtime executable, which integrates with Docker, containerd, and Kubernetes to start and manage sandboxed containers.[15]
  • The Sentry is the core component of gVisor. It is a userspace kernel, written in Go, that implements a large subset of the Linux system-call interface along with subsystems such as process management, signal handling, and networking (via its userspace network stack, netstack).[16] The logic runs entirely within gVisor's memory-safe code rather than being delegated to the host kernel.[15][17]
  • The Gofer is an optional, separate, slightly more privileged sidecar process that mediates access to the host filesystem and communicates with the Sentry over the LISAFS protocol (which replaced 9P). By default, with directfs enabled, the Gofer passes file descriptors for container mounts to the Sentry so it can perform restricted file-descriptor-relative system calls directly; when directfs is disabled, all file operations are proxied through the Gofer.[15][18][19]

To minimize the attack surface exposed to the host, the Sentry runs under a restrictive seccomp filter and in isolated user and mount namespaces, so that even the small set of host system calls it can make is tightly constrained.[15] These restrictions form a second layer of defense, meaning that a vulnerability in the Sentry is not enough on its own to escape to the host.[15][20] As with other sandboxed runtimes, gVisor generally does not protect against hardware side-channel attacks such as Spectre, which must be mitigated by the host kernel or hardware.[15][21]

Platforms

[edit]

gVisor must intercept the sandboxed application's system calls and redirect them to the Sentry. It abstracts this behind a "platform" interface, of which two are currently provided:

  • Systrap uses the seccomp-bpf subsystem's SECCOMP_RET_TRAP feature: a sandboxed system call triggers a SIGSYS signal that hands control to gVisor. It requires no hardware virtualization and works even inside virtual machines, making it the most portable option. Systrap replaced the older ptrace platform as the default in mid-2023.[22]
  • KVM uses the kernel's KVM functionality, letting the Sentry act as both guest kernel and virtual machine monitor. It performs best on bare-metal hosts but suffers under nested virtualization and is unavailable on hardware lacking the relevant virtualization extensions.[22]

The original ptrace platform, based on PTRACE_SYSEMU, remains in the codebase but is no longer supported.[22]

Features

[edit]
  • Checkpoint and restore: runsc can save the kernel and memory state of a running sandbox to disk and restore it into a new container, including workloads using CUDA GPUs (via NVIDIA's cuda-checkpoint utility).[23]
  • GPU and TPU passthrough: Through its nvproxy and tpuproxy drivers, gVisor intercepts ioctl and mmap calls on virtual accelerator device files, translates pointers and file descriptors from the sandbox address space, and forwards an allowlisted subset of calls to the host accelerator drivers. Because these calls are handled by the host kernel driver rather than emulated in the Sentry, vulnerabilities in those drivers remain part of the attack surface.[6][7]

Performance

[edit]

Because the Sentry intercepts and handles system calls in userspace, gVisor adds overhead that falls most heavily on system-call-intensive and I/O-intensive workloads, while having little effect on CPU-bound workloads that execute natively within their own address space. gVisor's documentation notes that raw CPU execution, memory access, and disk I/O incur no significant structural overhead once mappings are established.[24] To reduce filesystem overhead, gVisor enables a writable tmpfs root filesystem overlay and directfs by default, avoiding repeated round-trips to the Gofer.[18][19]

See also

[edit]

References

[edit]
  1. ↑ Lacasse, Nicolas (2 May 2018). "Open-sourcing gVisor, a sandboxed container runtime". Google Cloud Blog. Retrieved 21 October 2026.
  2. 1 2 "The Container Security Platform". gvisor.dev. Retrieved 21 October 2026.
  3. ↑ "Updates in container isolation". LWN.net. Retrieved 18 February 2019.
  4. ↑ "Sandboxing with gVisor". 17 June 2018. Retrieved 18 February 2019 – via Medium.
  5. ↑ Cutler, Cody; Kaashoek, M. Frans; Morris, Robert T. (2018). The benefits and costs of writing a POSIX kernel in a high-level language. pp. 89–105. ISBN 978-1-939133-08-3.
  6. 1 2 "GPU Support". gvisor.dev. Retrieved 20 October 2026.
  7. 1 2 "TPU Support". gvisor.dev. Retrieved 20 October 2026.
  8. ↑ "GKE Sandbox: Bring defense in depth to your pods". Google Cloud Blog. Archived from the original on 2019-05-21. Retrieved 2019-05-28.
  9. ↑ "Brad Fitzpatrick Twitter". Retrieved 18 February 2019 – via Twitter.
  10. ↑ "Container runtime contract | Cloud Run". Google Cloud. Retrieved 2019-04-10.
  11. ↑ "GKE Sandbox". Google Cloud Documentation. Retrieved 27 October 2026.
  12. ↑ "gVisor is being donated to CNCF". gvisor.dev. 2 October 2026. Retrieved 20 October 2026.
  13. ↑ "Who's Using gVisor". gvisor.dev. Retrieved 20 October 2026.
  14. ↑ Emerson Redding (2026-10-23). "Exclusive: gVisor says OpenAI's sandbox issue required a discouraged configuration". RuntimeWire. Retrieved 2026-10-29.
  15. 1 2 3 4 5 6 7 "Introduction to gVisor security". gvisor.dev. Retrieved 25 June 2026.
  16. ↑ "Networking Guide". gvisor.dev. Retrieved 20 October 2026.
  17. ↑ Li, Yuwei; et al. (2024). "G-Fuzz: A Directed Fuzzing Framework for gVisor". arXiv:2409.13139 [cs.CR].
  18. 1 2 "Filesystem". gvisor.dev. Retrieved 20 October 2026.
  19. 1 2 "Faster filesystem access with Directfs". gvisor.dev. 27 June 2023. Retrieved 20 October 2026.
  20. ↑ "Security and Vulnerability Reporting". gvisor.dev. Retrieved 20 October 2026.
  21. ↑ "Security Model". gvisor.dev. Retrieved 20 October 2026.
  22. 1 2 3 "Platform Guide". gvisor.dev. Retrieved 25 June 2026.
  23. ↑ "Checkpoint/Restore". gvisor.dev. Retrieved 20 October 2026.
  24. ↑ "Performance Guide". gvisor.dev. Retrieved 20 October 2026.
Retrieved from "https://en.wikipedia.org/w/index.php?title=GVisor&oldid=1382643466"