GVisor

gVisor is an open-source container sandbox developed by Google that focuses on security, efficiency, and ease of use. It provides virtualization-like isolation while maintaining the resource efficiency of standard containers. gVisor intercepts application system calls and implements a large portion of the Linux system call ABI in userspace, offering additional security compared to standard containers that run directly on top of the Linux kernel and are isolated merely with namespaces. Unlike the Linux kernel, gVisor is written in the memory-safe programming language Go to prevent common pitfalls which frequently occur in software written in C. Modern features of the platform include checkpoint/restore functionality and Nvidia GPU/CUDA and Google Cloud TPU support for AI/ML workloads.

According to Google and Brad Fitzpatrick, gVisor is used extensively in Google's production environment, including the App Engine standard environment, Cloud Functions, and Google Cloud Run. Furthermore, gVisor is integrated with Google Kubernetes Engine (GKE Sandbox), allowing users to sandbox their Kubernetes pods for use cases like SaaS and multitenancy. In October 2026, Google announced that it was donating gVisor to the Cloud Native Computing Foundation (CNCF) as a Sandbox project.

Beyond Google, organizations using gVisor include Ant Group, DigitalOcean (for App Platform), Cloudflare (for Cloudflare Pages builds), Snowflake, and the Freedom of the Press Foundation's Dangerzone tool. OpenAI and Anthropic use gVisor to run untrusted or AI-generated code. In addition, Docker (in Docker Desktop for Mac) and Tailscale use gVisor's netstack library for userspace networking. In July 2026, OpenAI reported a sandbox issue to the gVisor team, which said it released a fix the following week and that exploitation required a non-standard configuration its documentation discourages.

Architecture

gVisor acts as an application kernel that intercepts and handles system calls and page faults from the sandboxed workload itself, rather than passing them to the host Linux kernel.

• runsc is gVisor's Open Container Initiative (OCI) container runtime executable, which integrates with Docker, containerd, and Kubernetes to start and manage sandboxed containers.
• The Sentry is the core component of gVisor. It is a userspace kernel, written in Go, that implements a large subset of the Linux system-call interface along with subsystems such as process management, signal handling, and networking (via its userspace network stack, netstack). The logic runs entirely within gVisor's memory-safe code rather than being delegated to the host kernel.
• The Gofer is an optional, separate, slightly more privileged sidecar process that mediates access to the host filesystem and communicates with the Sentry over the LISAFS protocol (which replaced 9P). By default, with directfs enabled, the Gofer passes file descriptors for container mounts to the Sentry so it can perform restricted file-descriptor-relative system calls directly; when directfs is disabled, all file operations are proxied through the Gofer.

To minimize the attack surface exposed to the host, the Sentry runs under a restrictive seccomp filter and in isolated user and mount namespaces, so that even the small set of host system calls it can make is tightly constrained. These restrictions form a second layer of defense, meaning that a vulnerability in the Sentry is not enough on its own to escape to the host. As with other sandboxed runtimes, gVisor generally does not protect against hardware side-channel attacks such as Spectre, which must be mitigated by the host kernel or hardware.

Platforms

gVisor must intercept the sandboxed application's system calls and redirect them to the Sentry. It abstracts this behind a "platform" interface, of which two are currently provided:

• Systrap uses the seccomp-bpf subsystem's SECCOMP_RET_TRAP feature: a sandboxed system call triggers a SIGSYS signal that hands control to gVisor. It requires no hardware virtualization and works even inside virtual machines, making it the most portable option. Systrap replaced the older ptrace platform as the default in mid-2023.

• KVM uses the kernel's KVM functionality, letting the Sentry act as both guest kernel and virtual machine monitor. It performs best on bare-metal hosts but suffers under nested virtualization and is unavailable on hardware lacking the relevant virtualization extensions.

The original ptrace platform, based on PTRACE_SYSEMU, remains in the codebase but is no longer supported.

Features

• Checkpoint and restore: runsc can save the kernel and memory state of a running sandbox to disk and restore it into a new container, including workloads using CUDA GPUs (via NVIDIA's cuda-checkpoint utility).
• GPU and TPU passthrough: Through its nvproxy and tpuproxy drivers, gVisor intercepts ioctl and mmap calls on virtual accelerator device files, translates pointers and file descriptors from the sandbox address space, and forwards an allowlisted subset of calls to the host accelerator drivers. Because these calls are handled by the host kernel driver rather than emulated in the Sentry, vulnerabilities in those drivers remain part of the attack surface.

Performance

Because the Sentry intercepts and handles system calls in userspace, gVisor adds overhead that falls most heavily on system-call-intensive and I/O-intensive workloads, while having little effect on CPU-bound workloads that execute natively within their own address space. gVisor's documentation notes that raw CPU execution, memory access, and disk I/O incur no significant structural overhead once mappings are established. To reduce filesystem overhead, gVisor enables a writable tmpfs root filesystem overlay and directfs by default, avoiding repeated round-trips to the Gofer.

See also

• OS-level virtualization
• User-mode Linux

References