gVisor

gVisor is a free, open-source Linux-compatible sandbox and application kernel for running containers while isolating the host from untrusted code. It is intended for workloads such as user uploads, LLM-generated code and third-party applications. A Sentry handles sandboxed application system calls rather than passing them directly to the host, while a Gofer process mediates filesystem access. The project describes least-privilege operation and a restrictive system call filter. It documents use with Docker, Kubernetes, containerd and OCI runtimes, and can stream application trace points to an external threat detection engine such as Falco. It also supports checkpointing and restoring containers. Most CUDA applications can run unmodified within the sandbox on selected NVIDIA driver versions, but GPU support is restricted by models, drivers, capabilities, device files, ioctl calls and platforms. Installation requires Linux 5.6 or later on x86_64 or ARM64. Compatibility is not guaranteed: some system calls and /proc or /sys files are not implemented. gVisor generally does not protect against hardware side channels.

gVisor adds a sandboxing layer for container workloads, with documented integrations and checkpointing. Check workload compatibility and the Linux host requirements, especially if GPU support is needed.

gVisor suits teams running containers that include untrusted code on Linux hosts. It may also fit Kubernetes deployments using the documented options, provided the workloads fit its compatibility and hardware requirements.

gVisor is a free, open-source Linux sandbox that inserts an application kernel between containers and the host. It is best for teams running user uploads, generated code, or other untrusted workloads on Linux infrastructure. Its isolation model is focused and serious, but compatibility and system-call overhead make workload selection essential.

Overview

Instead of forwarding sandboxed applications’ system calls directly to Linux, gVisor intercepts them in its Sentry application kernel. A separate Gofer process mediates filesystem access, while the Sentry is designed for least-privilege operation with a restrictive system-call filter. The Linux-kernel and network-stack components are written in Go.

This defense-in-depth design is a strong fit for services that execute code supplied by users, LLM pipelines, or third parties. It is not a complete answer to every threat: gVisor generally does not protect against hardware side channels and depends on the host operating system and platform for those defenses.

Key features

Container integrations

Documented integrations cover Docker, Kubernetes, containerd, and OCI runtimes. Kubernetes deployments can use GKE Sandbox, Minikube, or nodes configured with containerd and the gVisor shim. Rootless mode, Kubernetes CRI support, and both image formats help it fit varied container pipelines. Windows containers are not supported, so mixed-platform estates need another runtime for those workloads.

Monitoring and recovery

gVisor can stream application trace points to an external threat-detection engine such as Falco, allowing security teams to turn runtime events into alerts. Checkpoint and restore supports caching warmed services, moving a workload to another machine, and preserving state for forensic work. Those capabilities are valuable operational additions, particularly for services that are expensive to initialize or need repeatable incident analysis.

GPU workloads

Most CUDA applications can run unmodified inside the sandbox on selected NVIDIA driver versions. The qualification is substantial: supported models, drivers, capabilities, device files, ioctl calls, and platforms are limited. GPU-heavy teams should verify their exact stack rather than assume general CUDA compatibility.

Compatibility and performance

The application compatibility list is best-effort and does not promise that a marked application will be fully functional. gVisor does not implement every system call, /proc entry, or /sys file, and its documentation notes higher per-system-call overhead and reduced compatibility versus other isolation approaches. It is therefore a deliberate security trade, not a transparent drop-in for every container.

Pricing

gVisor costs nothing under its open-source plan. The plan includes the Linux-compatible sandbox, rootless operation, image building, Kubernetes CRI support, and support for x86_64 or ARM64 hosts. There are no paid tiers, seat charges, quotas, or trial-renewal terms to weigh. The practical cost is engineering time: teams must provide a Linux 5.6-or-later host and accommodate compatibility checks and possible performance overhead.

Platforms

gVisor is self-hosted software for Linux. Installation requires Linux 5.6 or later and supports x86_64 and ARM64. It does not provide a Windows host option, and Windows containers are outside its supported scope.

Who it's for

Choose gVisor when a Linux service must execute untrusted code and you want a syscall boundary plus documented Docker, Kubernetes, containerd, or OCI integration. It is especially relevant to multi-tenant platforms, upload-processing services, and systems that run generated code. Teams with strict latency requirements, applications dependent on uncommon kernel interfaces, or broad GPU and cross-platform needs should expect additional validation or consider another runtime.

Pros and cons

• Pro: The Sentry and Gofer architecture limits direct host-kernel exposure, adding a clear isolation layer for untrusted containers.
• Pro: Docker, Kubernetes, containerd, and OCI documentation reduces friction for established container operations.
• Pro: Trace streaming, checkpoint/restore, rootless mode, and Kubernetes CRI support extend it beyond basic sandboxing.
• Con: Higher system-call overhead and incomplete syscall, /proc, and /sys coverage can break or slow workloads.
• Con: GPU support depends on a narrow set of hardware, drivers, interfaces, and platforms.
• Con: Hardware side-channel defenses remain the host platform’s responsibility.

Alternatives

Pick Apptainer if you need a free open-source container platform spanning Linux, macOS, Windows, and self-hosted or API environments. crun is a free Linux OCI runtime when a lightweight runtime focus matters more than gVisor’s sandbox kernel. Docker Desktop suits users who want a freemium desktop package with Docker Engine, Kubernetes, Hub, Scout, and Debug; its Personal plan is free and Pro is $9 a month.

Incus is another free option for software spanning system containers and broader platform targets. Choose LXD when KVM-based virtual machines and system containers are the priority. Rancher Desktop is a free open-source desktop application across Linux, macOS, and Windows. youki is free Apache-2.0 software for a Linux runtime, while Colima provides free MIT-licensed container runtimes on macOS and Linux.

Verdict

gVisor is a strong choice for Linux teams that need an extra isolation boundary around untrusted container workloads and can validate compatibility. Choose it for its least-privilege syscall architecture, broad container integrations, and checkpointing. Look elsewhere when application compatibility, low syscall overhead, broad GPU support, or Windows hosts are non-negotiable.