What is gVisor?

gVisor is an open-source application kernel developed by Google that enhances container security by intercepting system calls in user space, functioning as a middle layer between containerized workloads and the host kernel. Unlike traditional virtual machines or syscall filters, gVisor employs a unique approach with its user-space kernel, the Sentry, which handles syscalls and ensures that workloads do not directly interact with the host kernel, thus reducing the attack surface. It integrates seamlessly with Docker, containerd, and Kubernetes through its OCI runtime, runsc, offering a practical solution for situations where standard container isolation is insufficient but the overhead of a full microVM is unnecessary. gVisor supports two execution platforms: Systrap, which is more portable and does not require hardware virtualization, and KVM, which offers better performance on bare-metal hosts with virtualization support but without running a full guest OS. While it provides a significant isolation improvement over standard containers, it has limitations such as syscall compatibility issues and potential I/O overhead, making it less suitable than microVMs for environments with adversarial threat models. Northflank utilizes gVisor alongside other technologies like Firecracker and Kata Containers, applying the appropriate isolation technology based on specific workload requirements, demonstrating gVisor's role as part of a broader security strategy rather than a standalone solution.