diff --git a/website/_sass/style.scss b/website/_sass/style.scss index 9d68404d0..0e74a45f8 100644 --- a/website/_sass/style.scss +++ b/website/_sass/style.scss @@ -195,6 +195,18 @@ table th { margin-bottom: 0px; } +/* Reduce h2 margins in the big "solution" panels on the homepage. */ +.panel-solution h2 { + margin-top: 1em; + margin-bottom: 1em; +} + +/* Same, but also remove the top-margin for the "features" panels. */ +.panel-default h2 { + margin-top: 0em; + margin-bottom: 1em; +} + @media (min-width: 480px) { /* Set panel height smart phones landscape. */ .panel-solution { diff --git a/website/assets/images/gvisor-helmet-universe.png b/website/assets/images/gvisor-helmet-universe.png index 785478c13..c7f31ae25 100644 Binary files a/website/assets/images/gvisor-helmet-universe.png and b/website/assets/images/gvisor-helmet-universe.png differ diff --git a/website/assets/images/gvisor-high-level-arch.png b/website/assets/images/gvisor-high-level-arch.png index 88d173aad..a0647be70 100644 Binary files a/website/assets/images/gvisor-high-level-arch.png and b/website/assets/images/gvisor-high-level-arch.png differ diff --git a/website/index.md b/website/index.md index 8e57086cd..1a4e60e02 100644 --- a/website/index.md +++ b/website/index.md @@ -28,14 +28,12 @@
- gVisor high-level architecture - + />
@@ -59,15 +57,15 @@ alt="gVisor can run untrusted code" title="gVisor can run untrusted code" class="img-responsive" - > + />

Run Untrusted Code

Isolate Linux hosts from containers so you can - safely run user-uploaded or third-party code. Add defense-in-depth - measures to your stack, bringing additional security to your - infrastructure. + safely run user-uploaded, LLM-generated, or third-party + code. Add defense-in-depth measures to your stack, bringing + additional security to your infrastructure.

@@ -81,14 +79,15 @@ alt="gVisor secure by default" title="gVisor secure by default" class="img-responsive" - > + />

Protect Workloads & Infrastructure

-

Fortify hosts and containers against escapes and - privilege escalation CVEs, enabling strong isolation for - security-critical workloads as well as multi-tenant safety. +

Fortify hosts and containers against + escapes and privilege escalation CVEs, enabling + strong isolation for security-critical workloads as well as + multi-tenant safety.

@@ -100,14 +99,15 @@ gVisor reduces risk + class="img-responsive" + />

Reduce Risk

Deliver runtime visibility that integrates - with popular threat detection tools to quickly identify threats, - generate alerts, and enforce policies. + with popular threat detection tools to quickly + identify threats, generate alerts, and enforce policies.

@@ -127,29 +127,31 @@
-
+
-
+

Improve your container security

Give your K8s, SaaS, or Serverless infrastructure additional layers of protection when running - end-user code, untrusted code, or third-party code. Enable - strong isolation for sharing resources and delivering - multi-tenant environments. + end-user code, untrusted code, LLM-generated code, or + third-party code. Enable strong isolation for + sharing resources and delivering multi-tenant + environments.

-
+
-
+

Deliver security-imperative apps

gVisor adds defense-in-depth measures to - your containers, allowing you to safeguard security-sensitive - workloads like financial transactions, healthcare services, - personal identifiable information, and other - security-imperative applications. + your containers, allowing you to safeguard + security-sensitive workloads like financial + transactions, healthcare services, personal identifiable + information, and other security-imperative + applications.

@@ -161,29 +163,31 @@
-
+
-
+

Increase security productivity

-

Isolating your K8s, SaaS, Serverless, - DevSecOps lifecycle or CI/CD pipeline is easy with gVisor. +

Isolate your K8s, SaaS, Serverless, + DevSecOps lifecycle or CI/CD pipeline. gVisor helps you achieve a secure-by-default posture. Spend - less time staying on top of security disclosures, and more - time building what matters. + less time staying on top of security + disclosures, and more time building what + matters.

-
+
-
+

Enforce compliance

gVisor safeguards against many - cloud-native attacks by reducing the attack surface exposed - to your containers. Shield services like APIs, configs, - infrastructure as code, DevOps tooling, and supply chains, - lowering the risk present in a typical cloud-native stack. + cloud-native attacks by reducing the attack + surface exposed to your containers. Shield services + like APIs, configs, infrastructure as code, DevOps tooling, + and supply chains, lowering the risk present in a typical + cloud-native stack.

@@ -217,19 +221,21 @@
-

+

Defense in Depth

- gVisor implements the Linux API: by intercepting all - sandboxed application system calls to the kernel, it protects - the host from the application. In addition, gVisor sandboxes - itself from the host using Linux's isolation capabilities. + gVisor implements the Linux API: by + intercepting all sandboxed application system calls to the + kernel, it protects the host from the application. In + addition, gVisor also sandboxes itself from the + host using Linux's isolation capabilities. Through these layers of defense, gVisor achieves true - defense-in-depth while still providing VM-like performance and - container-like resource efficiency. + defense-in-depth while still providing + VM-like performance and + container-like resource efficiency.

@@ -237,16 +243,16 @@
-

+

Secure by Default

gVisor runs with - the least amount of privileges and the strictest possible - system call filter needed to function. gVisor implements the - Linux kernel and its network stack using Go, a memory-safe and - type-safe language. + the least amount of privileges and the + strictest possible system call filter needed to function. gVisor + implements the Linux kernel and its network stack using Go, a + memory-safe and type-safe language.

@@ -260,15 +266,15 @@
-

+

Runs Anywhere

-

gVisor runs - anywhere Linux does. It works on x86 and ARM, on VMs or - bare-metal, and does not require virtualization support. - gVisor works well on all popular cloud providers. +

gVisor + runs anywhere Linux does. It works on x86 and + ARM, on VMs or bare-metal, and does not require virtualization + support. gVisor works well on all popular cloud providers.

@@ -276,15 +282,15 @@
-

+

Cloud Ready

-

gVisor works - with Docker, Kubernetes, and containerd. Many popular - applications and images are deployed in production - environments on gVisor. +

gVisor + works with Docker, Kubernetes, and + containerd. Many popular applications and images are + deployed in production environments on gVisor.

@@ -298,7 +304,7 @@
-

+

Fast Startups and Execution @@ -307,8 +313,8 @@ containers start up in milliseconds and have minimal resource overhead. They act like, feel like, and actually are containers, not VMs. Their resource consumption can scale up - and down at runtime, enabling container-native levels of - scheduling efficiency. + and down at runtime, enabling container-native + resource efficiency.

@@ -316,16 +322,16 @@
-

+

Checkpoint and Restore

gVisor can - checkpoint and restore containers. Use it to cache warmed up - services, resume workloads on other machines, snapshot - execution, save state for forensics, or branch interactive - REPL sessions. + checkpoint and restore containers. Use it to + cache warmed-up services, resume workloads on other machines, + snapshot execution, save state for forensics, or branch + interactive REPL sessions.

@@ -339,16 +345,17 @@
-

+

Runtime Monitoring

Observe runtime behavior of your applications by streaming application actions - (trace points) to an external threat detection engine like - - Falco and generate alerts. + (trace points) to an external threat detection + engine like + Falco + and generate alerts.

@@ -356,14 +363,14 @@
-

+

- GPU Support + GPU & CUDA Support

gVisor - applications can use CUDA on Nvidia GPUs, bringing isolation - to AI/ML workloads. + applications can use CUDA on Nvidia GPUs, + bringing isolation to AI/ML workloads.