Skip to content

gVisor

gVisor is a container runtime that adds isolation between an application and the host it runs on.

Visit gVisor

Does it give you a browser or change how a container runs?

gVisor changes the runtime that starts a container. Its application kernel handles many requests that would normally go straight to the host’s kernel. You still provide the browser or program and choose its input and output. Verify that your own workload works with the runtime.

What does your team still control?

Choose the files, network access and resources the container receives. Check compatibility and the time your own job takes on a disposable host. Keep the app image and runtime setup, and save selected output separately. Extra isolation does not change which information you explicitly give the app.

Which files would a fictional container need to read?

Draw an owned demo container that reads a sample menu and reports its title.

  1. Limit the input
    Mark only the invented menu as available to the container.
  2. Choose the expected result
    Write the returned title and which configuration a maintainer would need to reproduce it.