gVisor.

gVisor is an open-source application kernel from Google that intercepts container system calls in user space, shrinking the host kernel attack surface exposed to untrusted workloads. It belongs to the Cloud Security category of cybersecurity.

gVisor is an open-source application kernel from Google that intercepts container system calls in user space, shrinking the host kernel attack surface exposed to untrusted workloads.

gVisor's Sentry process implements a substantial portion of the Linux syscall surface in user-mode Go, while only a small set of host syscalls is allowed via seccomp-bpf and routed through a Gofer for filesystem I/O. Because containers talk to Sentry instead of the host kernel directly, kernel exploits in the workload must escape the user-space sandbox first. gVisor runs as a Docker or CRI runtime (runsc) and powers Google Cloud Run, App Engine standard, and GKE Sandbox. The trade-off is incomplete syscall compatibility and per-call performance overhead, which makes gVisor most useful for short-lived, multi-tenant, or untrusted workloads.

Defences for gVisor typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: runsc, gVisor Sentry.