Inside gVisor: How User-Space Kernels Sandbox Containers at the Syscall Boundary
gVisor moves the Linux kernel into userspace to sandbox containers at the syscall boundary, trading raw throughput for a dramatically smaller attack surface.
Syscalls
gVisor moves the Linux kernel into userspace to sandbox containers at the syscall boundary, trading raw throughput for a dramatically smaller attack surface.