Isolating Kubernetes Workloads with gVisor
summary
gVisor implements a user‑mode mini‑kernel that intercepts syscalls instead of letting containers talk straight to the host kernel, shipping two components Sentry and Gopher that talk over 9p. It currently implements roughly 200 syscalls (vs ~3000 in Linux), integrates as the runsc runtime for Docker and as an “untrusted workload” annotation in Minikube, uses ~15 MB of memory and starts in ~100 ms, but penalizes syscall‑heavy or GPU/pass‑through workloads.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker
- 1:48Containers history and basics
- 10:38Security problems with containers
- 13:32Requirements for isolation tech
- 17:25What is gVisor and how it works
- 20:17gVisor use cases and limits
- 21:00Demo with Docker and gVisor
- 23:54Resources and closing
related talks
35mThe Enemy Within: Running Untrusted Code with gVisor
35mThe Enemy Within: Running Untrusted Code with gVisor
40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
30mAccelerating AI Securely with GVisor
27mgVisor Container on Arm64: Let‘s Talk about Our Progress!
37mA New Secure Container Solution on Arm Platform: gVisor
37mA New Secure Container Solution on Arm Platform: gVisor
35mNanoVisor: Modernizing Container Runtime with an Architecture Refactor..