netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Unify gVisor description across README.md and g3doc/README.md.

Browse Source 
PiperOrigin-RevId: 647867188
This commit is contained in:
Etienne Perot
2024-06-28 20:11:03 -07:00
committed by gVisor bot
parent a24378c6bc
commit e36c063c7c
2 changed files with 27 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+11 -7
View File
@@ -8,12 +8,15 @@
## What is gVisor?
**gVisor** is an application kernel that implements a Linux-like interface.
Unlike Linux, it is written in a memory-safe language (Go) and runs in
userspace. It includes an [Open Container Initiative (OCI)][oci] runtime called
`runsc` that provides an isolation boundary between the application and the host
kernel. The `runsc` runtime integrates with Docker and Kubernetes, making it
simple to run sandboxed containers.
**gVisor** provides a strong layer of isolation between running applications and
the host operating system. It is an application kernel that implements a
[Linux-like interface][linux]. Unlike Linux, it is written in a memory-safe
language (Go) and runs in userspace.
gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc`
that makes it easy to work with existing container tooling. The `runsc` runtime
integrates with Docker and Kubernetes, making it simple to run sandboxed
containers.
## What **isn't** gVisor?
@@ -22,7 +25,7 @@ simple to run sandboxed containers.
* gVisor is also **not a VM** in the everyday sense of the term (e.g.
VirtualBox, QEMU).
**gVisor exists somewhere in the middle**, providing many security benefits of
**gVisor takes a distinct third approach**, providing many security benefits of
VMs while maintaining the lower resource footprint, fast startup, and
flexibility of regular userspace applications.
@@ -138,6 +141,7 @@ See [Contributing.md](CONTRIBUTING.md).
[gvisor-users-list]: https://groups.google.com/forum/#!forum/gvisor-users
[gvisor-dev]: https://gvisor.dev
[gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev
[linux]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces
[oci]: https://www.opencontainers.org
[old-linux]: https://gvisor.dev/docs/user_guide/networking/#gso
[sandbox]: https://en.wikipedia.org/wiki/Sandbox_(computer_security)
g3doc/README.md
+16 -4
View File
@@ -1,8 +1,9 @@
# What is gVisor?
gVisor is an application kernel, written in Go, that implements a substantial
portion of the [Linux system call interface][linux]. It provides an additional
layer of isolation between running applications and the host operating system.
**gVisor** provides a strong layer of isolation between running applications and
the host operating system. It is an application kernel that implements a
[Linux-like interface][linux]. Unlike Linux, it is written in a memory-safe
language (Go) and runs in userspace.
gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc`
that makes it easy to work with existing container tooling. The `runsc` runtime
@@ -33,6 +34,17 @@ utilization.
Two other approaches are commonly taken to provide stronger isolation than
native containers.
* gVisor is **not a syscall filter** (e.g. `seccomp-bpf`), nor a wrapper over
Linux isolation primitives (e.g. `firejail`, AppArmor, etc.).
* gVisor is also **not a VM** in the everyday sense of the term (e.g.
VirtualBox, QEMU).
**gVisor takes a distinct third approach**, providing many security benefits of
VMs while maintaining the lower resource footprint, fast startup, and
flexibility of regular userspace applications.
Let's take a closer look.
**Machine-level virtualization**, such as [KVM][kvm] and [Xen][xen], exposes
virtualized hardware to a guest kernel via a Virtual Machine Monitor (VMM). This
virtualized hardware is generally enlightened (paravirtualized) and additional
@@ -110,7 +122,7 @@ Each container running in the sandbox has its own isolated instance of:
The entrypoint to running a sandboxed container is the `runsc` executable.
`runsc` implements the [Open Container Initiative (OCI)][oci] runtime
specification, which is used by Docker and Kubernetes. This means that OCI
compatible _filesystem bundles_ can be run by `runsc`. Filesystem bundles are
compatible *filesystem bundles* can be run by `runsc`. Filesystem bundles are
comprised of a `config.json` file containing container configuration, and a root
filesystem for the container. Please see the [OCI runtime spec][runtime-spec]
for more information on filesystem bundles. `runsc` implements multiple commands