gVisor (runsc)
hardened-systemoci-runtimeopen sourceGoogle's userspace kernel that intercepts a container's , shrinking host-kernel attack surface without a VM.
gVisor (runsc) puts a userspace kernel between the container and the host: it intercepts guest and services most of them in user space, and seccomp-confines that interceptor, so the host kernel's attack surface is greatly reduced. It runs anywhere with no nested virtualization, at some compatibility and performance cost. It powers GKE Sandbox and Cloud Run and is Modal's isolation choice. Crucially it is still a shared-kernel boundary, stronger than plain runc, weaker than a hardware VM, because the host kernel remains underneath.
Strengths
- Interposes a userspace kernel, cutting host-kernel attack surface (33 distinct syscalls behind an 84-syscall ceiling as measured in June 2026)
- Applies four of seven standard hardening layers by default, the most of any product in that study, as Sentry infrastructure rather than operator work
- Rolling releases, so it has no pin lag by construction, the structural problem that bit e2b and arrakis
- Zero escape-class CVEs in that study's 24-month window
- Runs anywhere, no nested virtualization required
- Proven at scale (GKE Sandbox, Cloud Run, Modal)
Limitations
- Shared kernel, the host kernel is still underneath; gVisor CVEs escape it, and 7 of 14 kernel-LPE primitives stayed reachable under measurement
- Compatibility gaps and some performance cost from syscall interposition
- Architecturally not a hardware boundary, so for hostile code a microVM is the stronger design, even though gVisor's measured escape record over 2024-2026 was the better one. Architecture and track record genuinely disagree here
- A silent-fix-first disclosure model means fixes often ship months before a CVE is assigned, which makes the security investment behind it hard to see from the outside
Files & editor
desktop-mountRun your container with a bind mount and edit on the host, though the mount is a hole in gVisor's boundary.
How you get your project into the environment and edit it. Shared-kernel routes bind-mount host files for your desktop editor; own-kernel routes keep files in the guest, so a desktop editor attaches over remote, or you edit inside. Mounts and remote editing.