Open-sourcing gVisor, a sandboxed container runtime
&gt; &quot;Since gVisor is itself a user-space application, it will make some host system calls to support its operation, but much like a VMM, it will not allow the application to directly control the system calls it makes.&quot; [<a href="https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;gvisor" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;google&#x2F;gvisor</a>]<p>TLDR; This is a user-space process that hooks syscalls&#x2F;ioctls made by your &quot;containerised&quot; applications.<p>(1) This is hardly a strong security model. Proper security cannot be guaranteed by simply hooking API calls in user-space alone.<p>(2) With this framework in mind, developers now need to worry about yet another layer of indirection. Assume &lt;application&gt; was tested to work on Ubuntu, that fact alone is not sufficient to assume it will keep running under gVisor.<p>(3) I would personally like to see more documentation&#x2F;benchmarks regarding the performance impacts that come with using this.<p>(4) This is strongly coupled with internal Kernel implementations. It will not be easy to port and maintain this across different Kernels.<p>&gt; &quot;but much like a VMM, it will not allow the application to directly control the system calls it makes.&quot;<p>From user-space? hold my beer.