google/gvisor on Hacker News

Recently gVisor added cuda checkpoint automation support, please consider using that: https://github.com/google/gvisor/commit/b3c184ce6b808648ddca...

comment by ranjanayush · 2026-07-03 · in Reduce GVisor Cold Starts with GPU Snapshotting

Us and the team from Modal have been upstreaming things to the GVisor repo ( https://github.com/google/gvisor/pulls ) in order to make it compatible with cuda-checkpoint and other parts of our system. While we are both contributing fixes…

comment by za_mike157 · 2026-07-01 · in Reduce GVisor Cold Starts with GPU Snapshotting

…which appears to perform better. There is also KVM. Both of these are options for gVisor: < https://github.com/google/gvisor > [1] < https://github.com/google/gvisor/blob/master/pkg/sentry/plat... >

comment by coppsilgold · 2026-04-18 · in Rewriting Every Syscall in a Linux Binary at Load Time

…gVisor is allowed to make to the host are listed right here in their seccomp filters[2]. [1] https://github.com/google/gvisor/blob/master/pkg/sentry/sysc... [2] https://github.com/google/gvisor/tree/master/runsc/boot/filt...

comment by syzcowboy99 · 2026-02-05 · in Coding Agent VMs on NixOS with Microvm.nix

…anyone out there who thinks that containers are a sandbox... There's a reason why gVisor exists: https://github.com/google/gvisor#why-does-gvisor-exist There's a reason why secureblue doesn't use containers:…

comment by subsection1h · 2025-12-27 · in Ask HN: How are you sandboxing coding agents?

…gVisor[1] runtime - "an application kernel that implements a Linux-like interface" - not Linux. [1] https://github.com/google/gvisor

comment by vidarh · 2025-09-10 · in Claude now has access to a server-side container environment

…kernel. It's not. That's the whole point of gVisor. You don't get to talk to the real kernel. [1] https://github.com/google/gvisor/blob/c68fb3199281d6f8fe02c7...

comment by rfoo · 2025-03-12 · in Reverse engineering OpenAI code execution to make it run C and JavaScript

Container security boundary can be much stronger if one wants. One can use something like https://github.com/google/gvisor as a container runtime for podman or docker. It's a good hybrid between VMs and containers. The container is put…

comment by p12tic · 2025-02-12 · in WASM will replace containers

One can use something like https://github.com/google/gvisor as a container runtime for podman or docker. It's a good hybrid between VMs and containers. The container is put into sort of VM via kvm, but it does not supply a kernel and talks…

comment by p12tic · 2025-02-12 · in WASM will replace containers

I find the README of the repo much better to quickly understand what this software is and isn't. https://github.com/google/gvisor

comment by mkayokay · 2024-10-16 · in GVisor: Linux-Compatible Sandbox

sort of reminds me of https://github.com/google/gvisor , re syscall interception and checking. gvisor had some significant performance impacts for io/syscall heavy workloads, but potentially seccomp/bpf could do better albeit that's mostly…

comment by kapilvt · 2024-07-17 · in Syd the perhaps most sophisticated sandbox for Linux

If you want to use netstack without Bazel, just use the go branch: https://github.com/google/gvisor/tree/go go get gvisor.dev/gvisor/pkg/tcpip@go The go branch is auto generated with all of the generated code checked in.

comment by iangudger · 2024-06-05 · in We improved the performance of a userspace TCP stack in Go

They upstreamed their gVisor changes: https://github.com/google/gvisor/pull/10287

comment by tazjin · 2024-06-05 · in We improved the performance of a userspace TCP stack in Go

…- https://github.com/kata-containers/kata-containers - https://github.com/QuarkContainer/Quark - https://github.com/google/gvisor - https://github.com/containers/libkrun

comment by flanked-evergl · 2024-05-14 · in My VM is lighter (and safer) than your container (2017)

…and runs as a normal process. In other words, gVisor implements Linux by way of Linux." https://github.com/google/gvisor

comment by mikepurvis · 2024-01-03 · in Maestro: A Linux-compatible kernel in Rust

…untrusted code, at least not without other layers of protection added on top. Otherwise stuff like https://github.com/google/gvisor would not need to exist. And even then as long as processes are sharing a host kernel they are always…

comment by paxys · 2023-12-20 · in How to Escape a Container

…red herring, as gVisor also “rolls it own” VMM [1] and certainly makes use of VMX and friends. [1] https://github.com/google/gvisor/tree/master/pkg/sentry/plat...

comment by amscanne · 2023-07-28 · in Faster filesystem access with Directfs

…in-process overlay...), all while maintaining a well-documented and super clean code base. [1]: https://github.com/google/gvisor [2]: https://github.com/usbarmory/tamago [3]: https://gvisor.dev/blog/2023/04/28/systrap-release

comment by lima · 2023-05-21 · in OS in Go? Why Not

…there isn't anything similar to it on the other side. [1] https://en.wikipedia.org/wiki/GVisor [2] https://github.com/google/gvisor/issues/1270

comment by simcop2387 · 2023-04-14 · in Searchable Linux Syscall Table for x86 and x86_64

…run a raw socket on it. Dumping packet from raw socket has faster interface than the device itself. https://github.com/google/gvisor/blob/master/pkg/tcpip/link/... https://github.com/google/gvisor/issues/210

comment by majke · 2022-12-13 · in Userspace isn't slow, some kernel interfaces are

google/gvisor could be useful for this? https://github.com/google/gvisor : > gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI)…

comment by westurner · 2022-10-25 · in The Docker+WASM Technical Preview

…more tools to detect bugs. gVisor, for example, has a really interesting tool called checklocks: https://github.com/google/gvisor/tree/master/tools/checklock... While it definitely has some caveats, ideas like these should help Go programs…

comment by jchw · 2022-06-10 · in Data Race Patterns in Go

…Do MS not have enough top-flight kernel engineers any more to do an in-kernel version of gvisor? https://github.com/google/gvisor Others have done it. Joyent enhanced the old Solaris `lxrun` environment to bring it to 64-bit and kernel 3.x…

comment by lproven · 2022-03-21 · in Windows needs a change in priorities

https://github.com/google/gvisor gives you essentially the same benefits as a unikernel without having to compromise on compatibility or recompile your apps, and integrates nicely with Kubernetes already. It also doesn't require a…

comment by marmarama · 2022-02-16 · in Unikernels

The main thing I'm missing with podman is gVisor support https://github.com/google/gvisor/issues/311 . Would be happy to switch once that is available!

comment by madars · 2021-09-04 · in Migrating from Docker to Podman

This is perhaps a better example: https://github.com/google/gvisor/blob/master/pkg/tcpip/trans... Also, some networking tests use separate frameworks (which look more like the setup the original post is describing, since those are needed…

comment by amscanne · 2021-08-28 · in Unit testing a TCP stack (2015)

…alone the harder parts. Also, take a look at gvisor's network stack. It's definitely unit tested. https://github.com/google/gvisor/tree/master/pkg/tcpip/link/... (an example)

comment by eatonphil · 2021-08-28 · in Unit testing a TCP stack (2015)

Is this what gvisor is? https://github.com/google/gvisor

comment by mikepurvis · 2021-06-16 · in Execute Docker Containers as QEMU MicroVMs

I’m not making a claim about its quality but gvisor is another isolation focused runtime https://github.com/google/gvisor

comment by kasey_junk · 2021-05-09 · in Ask HN: Best container runtime for process isolation / security?

…have to re-implement missing pieces in Mach kernel though so maybe it would not be as easy. [1] https://github.com/google/gvisor

comment by neop1x · 2021-03-22 · in Docker for Mac M1 RC

See also, for something surprisingly and alarmingly close to this, gvisor: https://github.com/google/gvisor

comment by tptacek · 2020-09-24 · in Biscuit: A monolithic, POSIX-subset operating system kernel in Go

…path of adding more functionality? Is it fair to think of NestyBox as a type of sandbox? https://pkg.go.dev/github.com/google/gvisor/runsc?tab=overvi...

comment by leetrout · 2020-08-07 · in Launch HN: Nestybox (YC S20) – Containers beyond microservices

…thinks otherwise, https://www.f-secure.com/en/consulting/foundry/usb-armory As does Google, https://github.com/google/gvisor https://github.com/google/gapid Naturally if one is talking about specific uses cases like IoT with a couple of…

comment by pjmlp · 2020-04-14 · in Tell HN: C Experts Panel – Ask us anything about C

> Linux containers are processes with better sandboxing simply not true: https://github.com/google/gvisor#why-does-gvisor-exist

comment by merb · 2020-03-11 · in Bottlerocket: An operating system designed for hosting containers

…for handing out FDs and other handles, presenting the filesystem to the user, etc). [1] - https://github.com/google/gvisor

comment by q3k · 2020-01-13 · in Show HN: Sandy – A tiny Sandbox to run untrusted code ️

https://github.com/knative https://github.com/google/gvisor

comment by wstrange · 2020-01-12 · in Deploy your side-projects at scale for basically nothing – Google Cloud Run

…code. [1] https://github.com/firecracker-microvm/firecracker [2] https://aws.amazon.com/lambda [3] https://github.com/google/gvisor

comment by nnspace · 2019-09-15 · in Show HN: CoderTest – TDD/BDD focused programming interviews

Here is an example: https://github.com/google/gvisor - https://github.com/google/gvisor/tree/master/tools/go_generi... It was useful enough that someone made a standalone package: https://github.com/mmatczuk/go_generics

comment by zigara · 2019-06-18 · in Go Creeping In

…from having the Linux kernel completely other than as the native API / ABI for apps. Projects like https://github.com/google/gvisor are very promising in that regard even if they end up playing no part in how this eventually happens for…

comment by strcat · 2019-06-10 · in GrapheneOS – A privacy and security-focused mobile OS with Android compatibility

…be kept around in virtual machines or replaced with a compatibility layer on top of a microkernel. https://github.com/google/gvisor is an existing project which could be ported to arm64, expanded as needed and adjusted to run on top of…

comment by strcat · 2019-06-10 · in GrapheneOS – A privacy and security-focused mobile OS with Android compatibility

…files or create sockets on the host (those operations are controlled by an external agent). [1] https://github.com/google/gvisor/tree/master/test/syscalls/l... [2] https://github.com/google/syzkaller [3]…

comment by prattmic · 2019-05-16 · in GKE Sandbox: Independent operating system kernel to each container

…additional security controls of some form if you're really running untrusted stuff in there. [1] https://github.com/google/gvisor/tree/master/pkg/sentry/plat...

comment by amscanne · 2019-05-15 · in GKE Sandbox: Independent operating system kernel to each container

…be a pretty good sign this works in real life. [1] https://gvisor.dev/docs/architecture_guide/ [2] https://github.com/google/gvisor [3] https://gvisor.dev/

comment by WestCoastJustin · 2019-05-15 · in GKE Sandbox: Independent operating system kernel to each container

There's also Google's Gvisor, for also running containers as VMs: https://github.com/google/gvisor (Handily it works with standard Docker, just put in an extra line in your /etc/docker/daemon.json)

comment by fulafel · 2019-04-24 · in Nemu – Modern Hypervisor for the Cloud by Intel

Cloud Run engineer here. Containers are run in gVisor https://github.com/google/gvisor as the container sandbox.

comment by mikehelmick · 2019-04-09 · in Cloud Run – Newest member of our serverless compute stack

…runs as a non-root user in its own container under docker, on top of Google's gVisor kernel ( https://github.com/google/gvisor ). I've also limited the containers in their resource usage and mounted a read-only root FS (there's also a…

comment by cplan · 2019-03-30 · in Show HN: Emissary – a Slack bot for running and scheduling shell commands

…[3] https://cloud.google.com/kubernetes-engine/ [4] https://docs.microsoft.com/en-us/azure/aks/ [5] https://github.com/google/gvisor [6] https://www.datadoghq.com/docker-adoption/

comment by WestCoastJustin · 2019-03-10 · in Goodbye Docker and Thanks for all the Fish

gVisor is also pretty neat, they say KVM support is experiemental though: https://github.com/google/gvisor gVisor is used behind Go 1.11 on App Engine so Google must be fairly confident that it's a sufficient security boundary though I'm…

comment by bpye · 2019-02-12 · in CVE-2019-5736: runc container breakout

gVisor is pretty interesting, it kinda takes this idea when you run it on KVM. https://github.com/google/gvisor

comment by bpye · 2018-12-07 · in Nginx on Wasmjit

…Engine to build the various first-generation container runtimes... ...and considering that GVisor ( https://github.com/google/gvisor ) is now used by Google for that same use-case... ...then perhaps GVisor (or a thin "make everything…

comment by derefr · 2018-10-31 · in Two Objects Not Namespaced by the Linux Kernel (2017)