gvisor
gVisor is an application kernel written in the Go language that provides insulation between applications and the main operating system. It contains runsc, a OCI compatible runtime, to work compatible with existing container tools. It combines the security advantages of traditional virtual machines with the resource efficiency of user space applications.
gvisor
100google · Containers & Kubernetes
Common commercial products in this category: Docker Desktop, Red Hat OpenShift, Amazon EKS
- You run an isolated container in Docker and Kubernetes environments.
- You restrict the app's access to the main operating system kernel.
- You run untrusted codes in an isolated environment with low resource consumption.
- • High number of open issues (985)
- • NeutralHacker News
Open-sourcing gVisor, a sandboxed container runtime
“Sadly, at least without violating NVidia's license agreement, you can't without a Tesla-series GPU. The consumer drivers won't let you put them in a VM using an IOMMU, which is the "right" way to do it. Your main options are a Tesla P40 if you've got six grand to drop, which you…”
- • NeutralHacker News
Open-sourcing gVisor, a sandboxed container runtime
“Clear Containers has merged into Kata Containers -- gVisor offers a different set of tradeoffs than Kata (or CC). The big one is resource footprint -- gVisor will typically be lower, often much lower than Kata. On the other hand, for very syscall heavy workloads Kata needn't…”
My note
Alternative pages
More in: Containers & Kubernetes
- kubernetes★ 128,554 · today
- etcd★ 52,432 · 2 days ago
- awesome-cheatsheets★ 46,600 · 14 days ago
- full-stack-fastapi-template★ 46,127 · 5 days ago
- compose★ 38,532 · yesterday
- istio★ 38,476 · today