From e36c063c7cadfde6f5bf6012cea2653eaeba4001 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Fri, 28 Jun 2024 20:07:27 -0700 Subject: [PATCH] Unify gVisor description across `README.md` and `g3doc/README.md`. PiperOrigin-RevId: 647867188 --- README.md | 18 +++++++++++------- g3doc/README.md | 20 ++++++++++++++++---- 2 files changed, 27 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 874a8ffce..1944c971f 100644 --- a/README.md +++ b/README.md @@ -8,12 +8,15 @@ ## What is gVisor? -**gVisor** is an application kernel that implements a Linux-like interface. -Unlike Linux, it is written in a memory-safe language (Go) and runs in -userspace. It includes an [Open Container Initiative (OCI)][oci] runtime called -`runsc` that provides an isolation boundary between the application and the host -kernel. The `runsc` runtime integrates with Docker and Kubernetes, making it -simple to run sandboxed containers. +**gVisor** provides a strong layer of isolation between running applications and +the host operating system. It is an application kernel that implements a +[Linux-like interface][linux]. Unlike Linux, it is written in a memory-safe +language (Go) and runs in userspace. + +gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc` +that makes it easy to work with existing container tooling. The `runsc` runtime +integrates with Docker and Kubernetes, making it simple to run sandboxed +containers. ## What **isn't** gVisor? @@ -22,7 +25,7 @@ simple to run sandboxed containers. * gVisor is also **not a VM** in the everyday sense of the term (e.g. VirtualBox, QEMU). -**gVisor exists somewhere in the middle**, providing many security benefits of +**gVisor takes a distinct third approach**, providing many security benefits of VMs while maintaining the lower resource footprint, fast startup, and flexibility of regular userspace applications. @@ -138,6 +141,7 @@ See [Contributing.md](CONTRIBUTING.md). [gvisor-users-list]: https://groups.google.com/forum/#!forum/gvisor-users [gvisor-dev]: https://gvisor.dev [gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev +[linux]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces [oci]: https://www.opencontainers.org [old-linux]: https://gvisor.dev/docs/user_guide/networking/#gso [sandbox]: https://en.wikipedia.org/wiki/Sandbox_(computer_security) diff --git a/g3doc/README.md b/g3doc/README.md index 5e23aa5ec..ca7546b72 100644 --- a/g3doc/README.md +++ b/g3doc/README.md @@ -1,8 +1,9 @@ # What is gVisor? -gVisor is an application kernel, written in Go, that implements a substantial -portion of the [Linux system call interface][linux]. It provides an additional -layer of isolation between running applications and the host operating system. +**gVisor** provides a strong layer of isolation between running applications and +the host operating system. It is an application kernel that implements a +[Linux-like interface][linux]. Unlike Linux, it is written in a memory-safe +language (Go) and runs in userspace. gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc` that makes it easy to work with existing container tooling. The `runsc` runtime @@ -33,6 +34,17 @@ utilization. Two other approaches are commonly taken to provide stronger isolation than native containers. +* gVisor is **not a syscall filter** (e.g. `seccomp-bpf`), nor a wrapper over + Linux isolation primitives (e.g. `firejail`, AppArmor, etc.). +* gVisor is also **not a VM** in the everyday sense of the term (e.g. + VirtualBox, QEMU). + +**gVisor takes a distinct third approach**, providing many security benefits of +VMs while maintaining the lower resource footprint, fast startup, and +flexibility of regular userspace applications. + +Let's take a closer look. + **Machine-level virtualization**, such as [KVM][kvm] and [Xen][xen], exposes virtualized hardware to a guest kernel via a Virtual Machine Monitor (VMM). This virtualized hardware is generally enlightened (paravirtualized) and additional @@ -110,7 +122,7 @@ Each container running in the sandbox has its own isolated instance of: The entrypoint to running a sandboxed container is the `runsc` executable. `runsc` implements the [Open Container Initiative (OCI)][oci] runtime specification, which is used by Docker and Kubernetes. This means that OCI -compatible _filesystem bundles_ can be run by `runsc`. Filesystem bundles are +compatible *filesystem bundles* can be run by `runsc`. Filesystem bundles are comprised of a `config.json` file containing container configuration, and a root filesystem for the container. Please see the [OCI runtime spec][runtime-spec] for more information on filesystem bundles. `runsc` implements multiple commands