Container Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
summary
gVisor is a user‑space kernel written in Go that implements about 200 Linux syscalls to sandbox untrusted containers without a full VM, using a user‑space Sentry plus optional KVM backing. Startup latency is sub‑second (about 115 ms measured) and memory overhead is small (~15 MB), so it targets high‑density, short‑lived workloads and Node/JS style apps; not recommended for trusted images or heavy syscall/hardware access.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:31Containers are amazing!
- 5:12Run as unprivileged user
- 6:26Drop capabilities
- 7:57Apply CGroups
- 8:40Apply namespace
- 12:38As a Container Fan, I wish
- 13:48As a Security Engineer, I know
- 14:26Rethink Container Isolation
- 14:58Linux Fun Facts
- 17:27Linux Security Modules
- 18:29Syscall Filtering
- 23:15Lesson Learned
- 24:59Our Approach -- Visor
- 25:52What is it really?
- 31:04Made for Containers
- 31:58Cautions
related talks
35mThe Enemy Within: Running Untrusted Code with gVisor
35mThe Enemy Within: Running Untrusted Code with gVisor
25mIsolating Kubernetes Workloads with gVisor
30mAccelerating AI Securely with GVisor
37mA New Secure Container Solution on Arm Platform: gVisor
27mgVisor Container on Arm64: Let‘s Talk about Our Progress!
37mA New Secure Container Solution on Arm Platform: gVisor
35mNanoVisor: Modernizing Container Runtime with an Architecture Refactor..