Skip to content

/ gvisor

Application Kernel & Container Runtime
sandbox containers oci docker kubernetes linux kernel
Go C++ Starlark Python Assembly Shell Other
  1. Go 73.6%
  2. C++ 20.2%
  3. Starlark 3.1%
  4. Python 1.0%
  5. Assembly 0.9%
  6. Shell 0.8%
  7. Other 0.4%
Branch: master
Find file
Clone or download

Clone with HTTPS

Use Git or checkout with SVN using the web URL.

Open in Desktop Download ZIP

Latest commit

@amscanne @gvisor-bot
amscanne and gvisor-bot Minor formatting updates for gvisor.dev. 
* Aggregate architecture Overview in "What is gVisor?" as it makes more sense
  in one place.

* Drop "user-space kernel" and use "application kernel". The term "user-space
  kernel" is confusing when some platform implementation do not run in
  user-space (instead running in guest ring zero).

* Clear up the relationship between the Platform page in the user guide and the
  Platform page in the architecture guide, and ensure they are cross-linked.

* Restore the call-to-action quick start link in the main page, and drop the
  GitHub link (which also appears in the top-right).

* Improve image formatting by centering all doc and blog images, and move the
  image captions to the alt text.

PiperOrigin-RevId: 311845158
Latest commit 420b791 May 15, 2020

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Run issue_reviver via GitHub. May 14, 2020
benchmarks FIFO QDisc implementation Apr 30, 2020
g3doc Minor formatting updates for gvisor.dev. May 16, 2020
images Enable overlayfs_stale_read by default for runsc. May 13, 2020
pkg Minor formatting updates for gvisor.dev. May 16, 2020
runsc Minor formatting updates for gvisor.dev. May 16, 2020
scripts Allow to run kvm syscall tests on the RBE cluster Apr 30, 2020
test Make utimes_test pass on VFS2. May 15, 2020
tools Update vm scripts to handle existing kbuilder user. May 15, 2020
vdso Internal change. May 4, 2020
website Minor formatting updates for gvisor.dev. May 16, 2020
.bazelrc Use existing bazeldefs with top-level BUILD file. Apr 28, 2020
.gitignore Add .gitignore May 1, 2018
.travis.yml Standardize all Docker images. Apr 24, 2020
AUTHORS Change copyright notice to "The gVisor Authors" Apr 29, 2019
BUILD Adapt website to use g3doc sources and bazel. May 6, 2020
CODE_OF_CONDUCT.md Merge pull request #2513 from amscanne:website-integrated May 12, 2020
CONTRIBUTING.md Adapt website to use g3doc sources and bazel. May 6, 2020
GOVERNANCE.md Merge pull request #2513 from amscanne:website-integrated May 12, 2020
LICENSE Check in gVisor. Apr 28, 2018
Makefile Merge pull request #2513 from amscanne:website-integrated May 12, 2020
README.md Minor formatting updates for gvisor.dev. May 16, 2020
SECURITY.md Add governance and security policies. May 6, 2020
WORKSPACE Update minor formatting issues. May 6, 2020
go.mod Update golang.org/x/sys Mar 2, 2020
go.sum Update golang.org/x/sys Mar 2, 2020

README.md

gVisor

Status gVisor chat

What is gVisor?

gVisor is a application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.

Why does gVisor exist?

Containers are not a sandbox. While containers have revolutionized how we develop, package, and deploy applications, using them to run untrusted or potentially malicious code without additional isolation is not a good idea. While using a single, shared kernel allows for efficiency and performance gains, it also means that container escape is possible with a single vulnerability.

gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux.

gVisor should not be confused with technologies and tools to harden containers against external threats, provide additional integrity checks, or limit the scope of access for a service. One should always be careful about what data is made available to a container.

Documentation

User documentation and technical architecture, including quick start guides, can be found at gvisor.dev.

Installing from source

gVisor builds on x86_64 and ARM64. Other architectures may become available in the future.

For the purposes of these instructions, bazel and other build dependencies are wrapped in a build container. It is possible to use bazel directly, or type make help for standard targets.

Requirements

Make sure the following dependencies are installed:

Building

Build and install the runsc binary:

make runsc
sudo cp ./bazel-bin/runsc/linux_amd64_pure_stripped/runsc /usr/local/bin

Testing

To run standard test suites, you can use:

make unit-tests
make tests

To run specific tests, you can specify the target:

make test TARGET="//runsc:version_test"

Using go get

This project uses bazel to build and manage dependencies. A synthetic go branch is maintained that is compatible with standard go tooling for convenience.

For example, to build runsc directly from this branch:

echo "module runsc" > go.mod
GO111MODULE=on go get gvisor.dev/gvisor/runsc@go
CGO_ENABLED=0 GO111MODULE=on go install gvisor.dev/gvisor/runsc

Note that this branch is supported in a best effort capacity, and direct development on this branch is not supported. Development should occur on the master branch, which is then reflected into the go branch.

Community & Governance

See GOVERNANCE.md for project governance information.

The gvisor-users mailing list and gvisor-dev mailing list are good starting points for questions and discussion.

Security Policy

See SECURITY.md.

Contributing

See Contributing.md.

You can’t perform that action at this time.