mirror of
https://github.com/netbirdio/gvisor.git
synced 2026-05-22 17:12:49 -07:00
Add solutions, features, and use cases to gvisor.dev index page.
PiperOrigin-RevId: 547580406
This commit is contained in:
Steve Silva
gVisor bot
@@ -37,6 +37,20 @@ a {
|
||||
}
|
||||
}
|
||||
|
||||
a.feature-link {
|
||||
color: $primary;
|
||||
|
||||
&:hover,
|
||||
&:focus {
|
||||
color: $link-hover-color;
|
||||
text-decoration: none;
|
||||
}
|
||||
}
|
||||
|
||||
span {
|
||||
color: $primary;
|
||||
}
|
||||
|
||||
h1,
|
||||
h2,
|
||||
h3,
|
||||
@@ -99,6 +113,14 @@ li {
|
||||
line-height: 22px;
|
||||
}
|
||||
|
||||
.info-text {
|
||||
color: $text-color-secondary;
|
||||
font-size: 16px;
|
||||
line-height: 24px;
|
||||
margin-top: 30px;
|
||||
margin-bottom: 30px;
|
||||
}
|
||||
|
||||
code {
|
||||
font-family: $code-font-family;
|
||||
font-size: 13px;
|
||||
@@ -172,3 +194,38 @@ table th {
|
||||
*/
|
||||
margin-bottom: 0px;
|
||||
}
|
||||
|
||||
@media (min-width: 480px) {
|
||||
/* Set panel height smart phones landscape. */
|
||||
.panel-solution {
|
||||
height: 300px;
|
||||
}
|
||||
}
|
||||
|
||||
@media (min-width: 600px) {
|
||||
/* Set panel height tablets portrait. */
|
||||
.panel-solution {
|
||||
height: 260px;
|
||||
}
|
||||
}
|
||||
|
||||
@media (min-width: 768px) {
|
||||
/* Set panel height tablets. */
|
||||
.panel-solution {
|
||||
height: 240px;
|
||||
}
|
||||
}
|
||||
|
||||
@media (min-width: 992px) {
|
||||
/* Set panel height tablets landscape. */
|
||||
.panel-solution {
|
||||
height: 330px;
|
||||
}
|
||||
}
|
||||
|
||||
@media (min-width: 1200px) {
|
||||
/* Set panel height laptops and desktops. */
|
||||
.panel-solution {
|
||||
height: 300px;
|
||||
}
|
||||
}
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 15 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 35 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 7.4 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 6.7 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 18 KiB |
+360
-38
@@ -4,10 +4,17 @@
|
||||
<div class="col-md-3"></div>
|
||||
<div class="col-md-6">
|
||||
<h1 style="color:white;">The Container Security Platform</h1>
|
||||
<p>Run untrusted workloads, block container escapes, and mitigate unauthorized host access.</p>
|
||||
<p>Improve your container security, deliver security-imperative apps,
|
||||
increase security productivity, and enforce compliance.</p>
|
||||
<p style="margin-top: 20px;">
|
||||
<a class="btn" href="/docs/user_guide/install/">Get started <i class="fas fa-arrow-alt-circle-right ml-2"></i></a>
|
||||
<a class="btn" href="/docs/">What is gVisor? <i class="fas fa-arrow-alt-circle-right ml-2"></i></a>
|
||||
<a class="btn" href="/docs/user_guide/install/">
|
||||
Get started
|
||||
<i class="fas fa-arrow-alt-circle-right ml-2"></i>
|
||||
</a>
|
||||
<a class="btn" href="/docs/">
|
||||
What is gVisor?
|
||||
<i class="fas fa-arrow-alt-circle-right ml-2"></i>
|
||||
</a>
|
||||
</p>
|
||||
</div>
|
||||
<div class="col-md-3"></div>
|
||||
@@ -15,40 +22,355 @@
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<div class="container"> <!-- Full page container. -->
|
||||
<div class="row">
|
||||
<div class="col-md-4">
|
||||
<div align="center"><i class="fas fa-shield-alt fa-2x"></i></div>
|
||||
<h3 id="seamless-security">Strengthen Kubernetes Security</h3>
|
||||
<p>gVisor delivers an additional security boundary for containers by
|
||||
intercepting and monitoring workload runtime instructions in user space
|
||||
before they are able to reach the underlying host. This protection
|
||||
mitigates threats and reduces host attack surface. gVisor seamlessly
|
||||
integrates with existing container workflows and ecosystem.</p>
|
||||
<a class="button" href="/docs/user_guide/quick_start/kubernetes/">Learn More »</a>
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div align="center"><i class="fas fa-lock fa-2x"></i></div>
|
||||
<h3 id="seamless-security">Protect Workloads and Infrastructure</h3>
|
||||
<p>Run untrusted workloads without compromising other workloads or the
|
||||
underlying infrastructure. Block container escapes by keeping attackers
|
||||
from breaking out of containers and into hosts or other containers.
|
||||
Mitigate privilege escalations that provide unauthorized access to other
|
||||
systems and services. Deliver strong isolation between containers for
|
||||
multitenant environments.</p>
|
||||
<a class="button" href="/docs/architecture_guide/security/">Learn More »</a>
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div align="center"><i class="fas fa-exclamation-triangle fa-2x"></i></div>
|
||||
<h3 id="seamless-security">Reduce Vulnerability and Mitigate Risk</h3>
|
||||
<p>Deliver a hardened Kubernetes that provides defense-in-depth
|
||||
runtime protection and monitoring for container workloads. Enable
|
||||
third-party customers to safely deliver code and highly secure services.
|
||||
Keep infrastructure resilient and operating during adverse cyber events.
|
||||
Use gVisor with threat detection engines to quickly identify threats and
|
||||
reduce risk with alerts.</p>
|
||||
<a class="button" href="/docs/architecture_guide/security/">Learn More »</a>
|
||||
</div>
|
||||
<!-- gVisor Use Cases -->
|
||||
|
||||
<section id="use-cases">
|
||||
<div class="container">
|
||||
<div class="row">
|
||||
<div class="col-md-6 pull-right gallery-popup">
|
||||
<a href="/assets/images/gvisor-high-level-arch.png">
|
||||
<img
|
||||
src="/assets/images/gvisor-high-level-arch.png"
|
||||
alt="gVisor high-level architecture"
|
||||
title="gVisor high-level architecture"
|
||||
class="img-responsive"
|
||||
>
|
||||
</a>
|
||||
</div>
|
||||
<div class="col-md-6 pull-left">
|
||||
<div class="divide-xl"></div>
|
||||
<h2><span><b>gVisor</b></span> is the <span><b>missing security layer</b></span> for
|
||||
running containers efficiently and securely.
|
||||
</h2>
|
||||
<p class="info-text">gVisor is an open-source Linux-compatible sandbox
|
||||
that runs anywhere existing container tooling does. It enables
|
||||
cloud-native container security and portability. gVisor leverages
|
||||
years of experience isolating production workloads at Google.
|
||||
</p>
|
||||
<div class="divide-xl"></div>
|
||||
</div>
|
||||
</div> <!-- end row -->
|
||||
</div> <!-- end container -->
|
||||
<div class="container" style="margin-top:20px">
|
||||
<div class="row">
|
||||
<div class="col-md-4 pull-left">
|
||||
<img
|
||||
src="/assets/images/gvisor-run-untrusted.png"
|
||||
alt="gVisor can run untrusted code"
|
||||
title="gVisor can run untrusted code"
|
||||
class="img-responsive"
|
||||
>
|
||||
</div>
|
||||
<div class="col-md-8 pull-right">
|
||||
<div class="divide-xl"></div>
|
||||
<h2>Run Untrusted Code</h2>
|
||||
<p class="info-text">Isolate Linux hosts from containers so you can
|
||||
safely run user-uploaded or third-party code. Add defense-in-depth
|
||||
measures to your stack, bringing additional security to your
|
||||
infrastructure.
|
||||
</p>
|
||||
<div class="divide-xl"></div>
|
||||
</div>
|
||||
</div> <!-- end row -->
|
||||
</div> <!-- end container -->
|
||||
<div class="container" style="margin-top:20px">
|
||||
<div class="row">
|
||||
<div class="col-md-4 pull-right">
|
||||
<img
|
||||
src="/assets/images/gvisor-secure-by-default.png"
|
||||
alt="gVisor secure by default"
|
||||
title="gVisor secure by default"
|
||||
class="img-responsive"
|
||||
>
|
||||
</div>
|
||||
<div class="col-md-8 pull-left">
|
||||
<div class="divide-xl"></div>
|
||||
<h2>Protect Workloads & Infrastructure</h2>
|
||||
<p class="info-text">Fortify hosts and containers against escapes and
|
||||
privilege escalation CVEs, enabling strong isolation for
|
||||
security-critical workloads as well as multi-tenant safety.
|
||||
</p>
|
||||
<div class="divide-xl"></div>
|
||||
</div>
|
||||
</div> <!-- end row -->
|
||||
</div> <!-- end container -->
|
||||
<div class="container" style="margin-top:20px">
|
||||
<div class="row">
|
||||
<div class="col-md-4 pull-left">
|
||||
<img src="/assets/images/gvisor-reduce-risk.png"
|
||||
alt="gVisor reduces risk"
|
||||
title="gVisor reduces risk"
|
||||
class="img-responsive">
|
||||
</div>
|
||||
<div class="col-md-8 pull-right">
|
||||
<div class="divide-xl"></div>
|
||||
<h2>Reduce Risk</h2>
|
||||
<p class="info-text">Deliver runtime visibility that integrates
|
||||
with popular threat detection tools to quickly identify threats,
|
||||
generate alerts, and enforce policies.
|
||||
</p>
|
||||
<div class="divide-xl"></div>
|
||||
</div>
|
||||
</div> <!-- end row -->
|
||||
</div> <!-- end container -->
|
||||
</section> <!-- end use case section -->
|
||||
|
||||
<!-- gVisor Solutions -->
|
||||
|
||||
<section id="solutions">
|
||||
<div class="info-section-gray">
|
||||
<div class="container-fluid" style="margin-top:50px;background-color:#171433">
|
||||
<div class="row">
|
||||
<h1 align="center" style="color:white;font-size:38px">
|
||||
The way containers should run
|
||||
</h1>
|
||||
<div class="container" style="margin-top:20px">
|
||||
<div class="col-md-1"></div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default panel-solution">
|
||||
<div class="panel-body">
|
||||
<div align="center"><span><i class="fas fa-shield-alt fa-2x"></i></span></div>
|
||||
<h2 align="center"><span>Improve your container security</span></h2>
|
||||
<p class="info-text">Give your K8s, SaaS, or Serverless
|
||||
infrastructure additional layers of protection when running
|
||||
end-user code, untrusted code, or third-party code. Enable
|
||||
strong isolation for sharing resources and delivering
|
||||
multi-tenant environments.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default panel-solution">
|
||||
<div class="panel-body">
|
||||
<div align="center"><span><b><i class="fas fa-cogs fa-2x"></i></b></span></div>
|
||||
<h2 align="center"><span>Deliver security-imperative apps</span></h2>
|
||||
<p class="info-text">gVisor adds defense-in-depth measures to
|
||||
your containers, allowing you to safeguard security-sensitive
|
||||
workloads like financial transactions, healthcare services,
|
||||
personal identifiable information, and other
|
||||
security-imperative applications.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-1"></div>
|
||||
</div> <!-- end row container -->
|
||||
</div><!-- /row -->
|
||||
<div class="row">
|
||||
<div class="container" style="margin-bottom:40px">
|
||||
<div class="col-md-1"></div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default panel-solution">
|
||||
<div class="panel-body">
|
||||
<div align="center"><span><b><i class="fas fa-rocket fa-2x"></i></b></span></div>
|
||||
<h2 align="center"><span>Increase security productivity</span></h2>
|
||||
<p class="info-text">Isolating your K8s, SaaS, Serverless,
|
||||
DevSecOps lifecycle or CI/CD pipeline is easy with gVisor.
|
||||
gVisor helps you achieve a secure-by-default posture. Spend
|
||||
less time staying on top of security disclosures, and more
|
||||
time building what matters.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default panel-solution">
|
||||
<div class="panel-body">
|
||||
<div align="center"><span><b><i class="fas fa-check fa-2x"></i></b></span></div>
|
||||
<h2 align="center"><span>Enforce compliance</span></h2>
|
||||
<p class="info-text">gVisor safeguards against many
|
||||
cloud-native attacks by reducing the attack surface exposed
|
||||
to your containers. Shield services like APIs, configs,
|
||||
infrastructure as code, DevOps tooling, and supply chains,
|
||||
lowering the risk present in a typical cloud-native stack.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-1"></div>
|
||||
</div> <!-- end row container -->
|
||||
</div><!-- /row -->
|
||||
</div><!-- /container -->
|
||||
</div>
|
||||
</div> <!-- container -->
|
||||
</section>
|
||||
|
||||
<!-- gVisor Features -->
|
||||
|
||||
<section id="features">
|
||||
<div class="info-section-gray">
|
||||
<div class="container" style="margin-top:30px">
|
||||
<!-- Helmet universe image -->
|
||||
<div align="center">
|
||||
<img
|
||||
src="/assets/images/gvisor-helmet-universe.png"
|
||||
alt="gVisor features"
|
||||
title="gVisor features"
|
||||
class="img-responsive"
|
||||
>
|
||||
</div>
|
||||
<h1 align="center" style="margin-top:3px">gVisor Features</h1>
|
||||
<!-- Start features list -->
|
||||
<div class="row">
|
||||
<div class="container">
|
||||
<div class="col-md-1"></div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="margin-top:0px;">
|
||||
<a href="docs/architecture_guide/security/#principles-defense-in-depth" class="feature-link">
|
||||
Defense in Depth
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px">
|
||||
gVisor implements the Linux API: by intercepting all
|
||||
sandboxed application system calls to the kernel, it protects
|
||||
the host from the application. In addition, gVisor sandboxes
|
||||
itself from the host using Linux's isolation capabilities.
|
||||
Through these layers of defense, gVisor achieves true
|
||||
defense-in-depth while still providing VM-like performance and
|
||||
container-like resource efficiency.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="margin-top:0px;">
|
||||
<a href="docs/architecture_guide/security/" class="feature-link">
|
||||
Secure by Default
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">gVisor runs with
|
||||
the least amount of privileges and the strictest possible
|
||||
system call filter needed to function. gVisor implements the
|
||||
Linux kernel and its network stack using Go, a memory-safe and
|
||||
type-safe language.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-1"></div>
|
||||
</div> <!-- end row container -->
|
||||
</div><!-- /row -->
|
||||
<div class="row" style="margin-top:0px">
|
||||
<div class="container">
|
||||
<div class="col-md-1"></div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="margin-top:0px;">
|
||||
<a href="docs/architecture_guide/platforms/" class="feature-link">
|
||||
Runs Anywhere
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">gVisor runs
|
||||
anywhere Linux does. It works on x86 and ARM, on VMs or
|
||||
bare-metal, and does not require virtualization support.
|
||||
gVisor works well on all popular cloud providers.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="color:#272261;margin-top:0px;">
|
||||
<a href="docs/user_guide/compatibility/" class="feature-link">
|
||||
Cloud Ready
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">gVisor works
|
||||
with Docker, Kubernetes, and containerd. Many popular
|
||||
applications and images are deployed in production
|
||||
environments on gVisor.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-1"></div>
|
||||
</div> <!-- end row container -->
|
||||
</div><!-- /row -->
|
||||
<div class="row" style="margin-top:0px">
|
||||
<div class="container">
|
||||
<div class="col-md-1"></div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="color:#272261;margin-top:0px;">
|
||||
<a href="docs/architecture_guide/performance/" class="feature-link">
|
||||
Fast Startups and Execution
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">gVisor
|
||||
containers start up in milliseconds and have minimal resource
|
||||
overhead. They act like, feel like, and <em>actually are</em>
|
||||
containers, not VMs. Their resource consumption can scale up
|
||||
and down at runtime, enabling container-native levels of
|
||||
scheduling efficiency.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="color:#272261;margin-top:0px;">
|
||||
<a href="docs/user_guide/checkpoint_restore/" class="feature-link">
|
||||
Checkpoint and Restore
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">gVisor can
|
||||
checkpoint and restore containers. Use it to cache warmed up
|
||||
services, resume workloads on other machines, snapshot
|
||||
execution, save state for forensics, or branch interactive
|
||||
REPL sessions.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-1"></div>
|
||||
</div> <!-- end row container -->
|
||||
</div><!-- /row -->
|
||||
<div class="row" style="margin-top:0px">
|
||||
<div class="container">
|
||||
<div class="col-md-1"></div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="color:#272261;margin-top:0px;">
|
||||
<a href="/docs/user_guide/runtimemonitor/" class="feature-link">
|
||||
Runtime Monitoring
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">Observe runtime
|
||||
behavior of your applications by streaming application actions
|
||||
(trace points) to an external threat detection engine like
|
||||
<a href="https://falco.org" style="color:#272261">
|
||||
Falco</a> and generate alerts.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-5">
|
||||
<div class="panel panel-default" style="border:none;box-shadow:none;">
|
||||
<div class="panel-body">
|
||||
<h2 style="color:#272261;margin-top:0px;">
|
||||
<a href="blog/2023/06/20/gpu-pytorch-stable-diffusion/" class="feature-link">
|
||||
GPU Support
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text" style="margin-bottom:0px;">gVisor
|
||||
applications can use CUDA on Nvidia GPUs, bringing isolation
|
||||
to AI/ML workloads.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="col-md-1"></div>
|
||||
</div> <!-- end row container -->
|
||||
</div><!-- /row -->
|
||||
</div> <!-- /container -->
|
||||
</div>
|
||||
</section>
|
||||
|
||||
Reference in New Issue
Block a user