A New Secure Container Solution on Arm Platform: gVisor
summary
gVisor’s Go user-space kernel and runsc OCI runtime are ported to Arm64 and run with both ptrace and KVM isolation; a working Hello World demo shows containers entering EL1 as vCPUs and basic syscall interception is functional. Work includes Arm page‑table support (identity and section mappings, four‑level 4K/64K modes), set_memory_region and HVA↔GPA mapping, and a 9P→virtio/virtio‑fs I/O path under replacement; syscall name mismatches are single‑digit and being unified, performance tuning ongoing.
AI-written summary · about
chapters (10)
- 0:00Agenda
- 1:29Concept
- 3:05Architecture
- 9:41Storage
- 10:36Network Stack
- 14:01Hello World Demo
- 14:47KVM Platform
- 22:02Prepare Mechanism
- 27:26System Calls
- 28:28Operating Environment
related talks
37mA New Secure Container Solution on Arm Platform: gVisor
27mgVisor Container on Arm64: Let‘s Talk about Our Progress!
40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
30mAccelerating AI Securely with GVisor
35mThe Enemy Within: Running Untrusted Code with gVisor
25mIsolating Kubernetes Workloads with gVisor
35mNanoVisor: Modernizing Container Runtime with an Architecture Refactor..
38mSecure Containers in Embedded Deployments