google/gvisor

Features

• Container Runtimes - Implements a sandboxed runtime that provides kernel-level isolation for OCI-compliant containers.
• Hardware Passthrough Proxies - Provides secure hardware passthrough proxies to enable containerized access to specialized devices like GPUs while maintaining kernel-level isolation.
• Userspace Kernels - Implements a userspace kernel to intercept system calls and isolate application workloads from the host kernel.
• Process Isolation - Encapsulates application processes within an opaque sandbox that hides them from the host and restricts interaction methods.
• System Call Interceptors - Executes application system calls within a secure, isolated environment by intercepting them and limiting the host kernel surface area.
• Userspace Kernels - Executes application system calls within a restricted, memory-safe userspace kernel implementation.
• Container Security - Runs containerized applications in a hardened environment that intercepts system calls to minimize the host kernel attack surface.
• Container-Based Sandboxes - Provides a security-focused execution environment that minimizes the host kernel attack surface.
• System Call Surface Minimizers - Minimizes the host kernel attack surface by restricting the available system call interface to a strictly controlled and enumerated set.
• Userspace Network Stacks - Implements an independent userspace network stack to isolate traffic and prevent direct application access to the host kernel networking subsystem.
• Virtualized Filesystem Layers - Routes filesystem operations through a proxy process to enforce strict isolation between containers and host storage.
• Session State Serializers - Captures and serializes the memory and process state of running containers to enable migration and resumption.
• Container Orchestration Integrations - Functions as a drop-in engine for standard container management platforms to secure existing application workflows.
• Container Networking Tools - Integrates standard network interface plugins to manage namespaces, IP assignment, and routing for isolated application environments.
• Network Stacks - Provides an independent network stack within the sandbox to isolate network resources from the host.
• Virtual Network Bridging - Implements independent userspace network stacks to isolate traffic and manage connectivity for containerized applications.
• Security Monitoring - Streams system call events to external threat detection engines to identify suspicious behavior and generate security alerts.
• Execution Checkpointing - Saves and restores container states to disk to enable service migration and persistence across host machines.
• User Namespace Mappings - Defines identity mappings within container configurations to control privilege translation between the host and the isolated runtime environment.
• Cloud Platform Security - Provides an isolation boundary between applications and the host kernel.
• Container Management - Sandboxed container runtime for improved isolation.
• Container Runtimes and Platforms - Sandboxed container runtime.
• DevOps & Infrastructure - Container runtime sandbox for improved security and isolation.
• Container Runtimes - Application kernel for secure container isolation.
• Hypervisor Implementations - User-space kernel for secure container isolation.
• Container Security Tools - Implements a user-space kernel to isolate container system calls.
• Security Tools - Sandboxed container runtime for secure workload isolation.
• Model State Restoration - Recreates a container from a saved snapshot directory to resume the application process from a specific checkpoint.
• State Checkpointing - Saves the current memory and process state of a running container to a directory for later restoration.
• Container Lifecycle Management - Manages the lifecycle of containers using standard filesystem bundles compatible with orchestration tools.
• Hardware Acceleration - Exposes host hardware resources like GPUs to containerized workloads through secure passthrough proxies.
• Resource Management - Offloads container cgroup creation and resource limit enforcement to the host system manager for consistent accounting.
• Memory Management - Implements demand-paging and internal page caching for application memory backed by a single memory file descriptor.
• Network Isolation - Blocks all external network access for a container while maintaining an internal loopback interface for complete isolation.
• Resource Constraints - Applies container-level limits to sandbox threads and memory usage while allowing dynamic adjustments.
• System Activity Monitoring - Streams system calls and container lifecycle events to external processes for real-time behavioral analysis of isolated workloads.
• Hardware Acceleration - Connects containerized applications to specialized hardware processors to speed up complex mathematical calculations.
• System Resource Accounting - Offloads container resource limit enforcement to the host system manager for consistent accounting.
• Filesystem Mounts - Allows registration of custom handlers to serve specific mount points using alternative storage protocols.
• CPU Feature Normalization - Restricts exposed CPU features to a predefined list to ensure compatibility when migrating container snapshots.
• Filesystem Storage Drivers - Captures root filesystem states into directories to enable rapid restoration of sandboxed environments.
• Traffic Shaping - Limits outbound container bandwidth using a token bucket filter to control sustained throughput and burst capacity.
• GPU Acceleration - Automates the suspension and resumption of hardware-accelerated processes during container snapshot operations.
• System Time Virtualization - Maintains an independent clock and timer implementation for the sandbox that operates separately from the host.
• Prometheus Exporters - Exposes container telemetry data via a standardized HTTP interface for Prometheus scraping.
• Filesystem Synchronization - Enables shared mount modes to synchronize filesystem changes between host and sandbox environments.
• Bare Metal Environments - Operates on common Linux environments including bare-metal and virtual machines without specialized hardware.
• High-Performance Networking - Routes network traffic directly through the host kernel to reduce latency for performance-critical applications.
• Filesystem Caching Policies - Adjusts file input and output policies to improve throughput for workloads with specific access patterns.
• Runtime Path Resolvers - Caches directory entries to minimize the time spent performing repeated filesystem lookups and path traversals.
• Metrics Exporters - Extracts performance and operational data from containers for analysis via snapshots or HTTP endpoints.

Star history