GitHub - google/gvisor: Application Kernel for Containers

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert

[nilab]

"gVisor is a user-space kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel."

[prototechno]

#eLV勉強会

[castaneai]

Why Go? gVisor was written in Go in order to avoid security pitfalls that can plague kernels. With Go, there are strong types, built-in bounds checks, no uninitialized variables, no use-after-free, no stack overflow, and a built-in race detector. (The use of Go has its challenges too, and isn't free

[goofmint]

コンテナランタイム

[yosida95]

“gVisor does not simply redirect application system calls through to the host kernel. Instead, gVisor implements most kernel primitives and has complete system call handlers”

[fcicq]

ptrace for syscall layer. Note: maybe move to fuchsia?