gVisor is an application kernel for containers that provides strong isolation between running applications and the host operating system by implementing a Linux-like interface in userspace using Go.
gVisor addresses the security risk that containers share a kernel with the host, making container escape possible through a single vulnerability. Rather than filtering syscalls or wrapping Linux isolation primitives, it takes a distinct approach by implementing a full Linux kernel in userspace as a memory-safe application. This allows it to limit the host kernel surface accessible to applications while maintaining the lower resource footprint and fast startup of regular processes. The project includes runsc, an OCI-compliant runtime that integrates with Docker and Kubernetes to make sandboxed containers work with existing container tooling.
Adoption suits teams running untrusted or potentially malicious code who need stronger isolation than standard containers provide but want to avoid the overhead of full virtual machines. The tool works on x86_64 and ARM64 architectures and requires Linux 5.6 or later. It is explicitly not a syscall filter, a wrapper over Linux isolation primitives, or a traditional VM, but rather occupies a distinct middle ground offering security benefits of VMs with the efficiency of containerized applications.
The project receives almost all of its open issues from outside users rather than the core team, indicating a substantial base of adopters reporting real-world use. Maintainers typically respond to new issues and pull requests within a day. Work in the issue tracker is dominated by bug reports, enhancement requests, and stale issue management.
