A New Secure Container Solution on Arm Platform: gVisor
summary
gVisor is running on Arm64 with a working user-space kernel in Go and the OCI runtime runsc integrated for Docker/Kubernetes; two isolation backends exist on Arm now: ptrace & KVM isolation, with KVM providing vCPU support and four-level page tables (4K/64K variants) and a working hello-world demo. Work addresses syscall name mismatches (single-digit differences), memory mapping (HVA↔GPA/IPAs), slow 9p storage replacement, and Go-specific signal and VM-exit handling.
AI-written summary · about
chapters (11)
- 0:00gVisor introduction
- 1:11gVisor on Arm architecture
- 3:03Isolation implementation
- 6:26KVM on Arm specifics
- 12:25Hello world on Arm
- 15:05System call interception
- 17:17KVM memory management
- 22:36Signal handling
- 27:32System call support
- 28:19Demo and performance
- 30:27Conclusion
related talks
37mA New Secure Container Solution on Arm Platform: gVisor
27mgVisor Container on Arm64: Let‘s Talk about Our Progress!
40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
30mAccelerating AI Securely with GVisor
35mThe Enemy Within: Running Untrusted Code with gVisor
25mIsolating Kubernetes Workloads with gVisor
35mNanoVisor: Modernizing Container Runtime with an Architecture Refactor..
38mSecure Containers in Embedded Deployments