Skip to content

/ gvisor

Application Kernel for Containers
sandbox containers oci docker kubernetes linux kernel
Go C++ Starlark Python Assembly Shell Other
  1. Go 74.0%
  2. C++ 20.0%
  3. Starlark 3.1%
  4. Python 1.0%
  5. Assembly 0.8%
  6. Shell 0.7%
  7. Other 0.4%
Branch: master
Find file
Clone or download

Clone with HTTPS

Use Git or checkout with SVN using the web URL.

Open in Desktop Download ZIP

Latest commit

@iangudger @gvisor-bot
iangudger and gvisor-bot Allow reading IP_MULTICAST_LOOP and IP_MULTICAST_TTL on TCP sockets. 
I am not really sure what the point of this is, but someone filed a bug about
it, so I assume something relies on it.

PiperOrigin-RevId: 316225127
Latest commit 3b5eaad Jun 13, 2020

Files

Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
.github Add stale issue & PR cleanup. Jun 5, 2020
benchmarks Bump puma from 3.12.4 to 3.12.6 in /benchmarks/workloads/ruby_template Jun 5, 2020
g3doc Fix typo in Wordpress tutorial page May 25, 2020
images Merge pull request #2789 from Rajpratik71:optimization/git-clone Jun 5, 2020
pkg Allow reading IP_MULTICAST_LOOP and IP_MULTICAST_TTL on TCP sockets. Jun 13, 2020
runsc Set the HOME environment variable for sub-containers. Jun 12, 2020
scripts Invoke bazel query via bash function. Jun 9, 2020
test Allow reading IP_MULTICAST_LOOP and IP_MULTICAST_TTL on TCP sockets. Jun 13, 2020
tools Enable nogo again Jun 12, 2020
vdso Internal change. May 4, 2020
website Ensure sitemap is generated. May 27, 2020
.bazelrc Use existing bazeldefs with top-level BUILD file. Apr 28, 2020
.gitignore Add .gitignore May 1, 2018
.travis.yml travis: set the pipefail option Jun 11, 2020
AUTHORS Change copyright notice to "The gVisor Authors" Apr 29, 2019
BUILD Adapt website to use g3doc sources and bazel. May 6, 2020
CODE_OF_CONDUCT.md Merge pull request #2513 from amscanne:website-integrated May 12, 2020
CONTRIBUTING.md Adapt website to use g3doc sources and bazel. May 6, 2020
GOVERNANCE.md Merge pull request #2513 from amscanne:website-integrated May 12, 2020
LICENSE Check in gVisor. Apr 28, 2018
Makefile Fix test release commands to work with older GPG. Jun 3, 2020
README.md Add back gitter badge. Jun 5, 2020
SECURITY.md Add governance and security policies. May 6, 2020
WORKSPACE Automated rollback of changelist 312522097 May 20, 2020
go.mod Update golang.org/x/sys Mar 2, 2020
go.sum Update golang.org/x/sys Mar 2, 2020

README.md

gVisor

gVisor chat

What is gVisor?

gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.

Why does gVisor exist?

Containers are not a sandbox. While containers have revolutionized how we develop, package, and deploy applications, using them to run untrusted or potentially malicious code without additional isolation is not a good idea. While using a single, shared kernel allows for efficiency and performance gains, it also means that container escape is possible with a single vulnerability.

gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux.

gVisor should not be confused with technologies and tools to harden containers against external threats, provide additional integrity checks, or limit the scope of access for a service. One should always be careful about what data is made available to a container.

Documentation

User documentation and technical architecture, including quick start guides, can be found at gvisor.dev.

Installing from source

gVisor builds on x86_64 and ARM64. Other architectures may become available in the future.

For the purposes of these instructions, bazel and other build dependencies are wrapped in a build container. It is possible to use bazel directly, or type make help for standard targets.

Requirements

Make sure the following dependencies are installed:

Building

Build and install the runsc binary:

make runsc
sudo cp ./bazel-bin/runsc/linux_amd64_pure_stripped/runsc /usr/local/bin

Testing

To run standard test suites, you can use:

make unit-tests
make tests

To run specific tests, you can specify the target:

make test TARGETS="//runsc:version_test"

Using go get

This project uses bazel to build and manage dependencies. A synthetic go branch is maintained that is compatible with standard go tooling for convenience.

For example, to build runsc directly from this branch:

echo "module runsc" > go.mod
GO111MODULE=on go get gvisor.dev/gvisor/runsc@go
CGO_ENABLED=0 GO111MODULE=on go install gvisor.dev/gvisor/runsc

Note that this branch is supported in a best effort capacity, and direct development on this branch is not supported. Development should occur on the master branch, which is then reflected into the go branch.

Community & Governance

See GOVERNANCE.md for project governance information.

The gvisor-users mailing list and gvisor-dev mailing list are good starting points for questions and discussion.

Security Policy

See SECURITY.md.

Contributing

See Contributing.md.

You can’t perform that action at this time.