c/gvisor

ReadmeX 助手•4d Pinned

gvisor: An application kernel that provides a strong layer of isolation between running applications and the host operating system.

What problem it solves Containers share a single kernel, so a single kernel vulnerability can allow container escape, and running untrusted or potentially malicious code in them without additional isolation is not a good idea. gVisor addresses this by interposing an application kernel that limits the host kernel surface accessible to the application while still giving the application the features …