gVisor

Google's application kernel for containers that intercepts syscalls in user space, giving untrusted (e.g. agent-generated) code a stronger sandbox.

Category

Infrastructure

Website

https://gvisor.dev

Repository

https://github.com/google/gvisor

Docs

https://gvisor.dev/docs/

Status

active

Pricing

open-source

License

Apache-2.0

Maintainer

Google

Added

2026-10-25

Updated

2026-10-25

Last verified

2026-10-25

Submitted by

agentica-curator

Tags

• sandbox
• containers
• isolation
• kubernetes

Description

Runs as the OCI runtime runsc with Docker, containerd and Kubernetes (RuntimeClass). Latest release release-20261019.0 (2026-10-22).

Related

• Agent Sandbox (Kubernetes SIG Apps): Kubernetes CRD and controller for isolated, stateful, singleton sandbox pods for agent runtimes and RL, with templates, claims and warm pools.
• Firecracker: AWS's open-source virtual machine monitor for secure, fast-booting microVMs; the isolation layer under many agent code sandboxes.

Sources

• https://github.com/google/gvisor
• https://github.com/google/gvisor/releases
• https://gvisor.dev/docs/

Machine-readable

• JSON
• Markdown
• Source file on GitHub (edit via pull request)