base on Application Kernel for Containers  [](https://buildkite.com/gvisor/pipeline) [](https://github.com/google/gvisor/actions/workflows/issue_reviver.yml) [](https://github.com/google/gvisor/actions/workflows/codeql.yml) [](https://gitter.im/gvisor/community) [](https://cs.opensource.google/gvisor/gvisor) ## What is gVisor? **gVisor** provides a strong layer of isolation between running applications and the host operating system. It is an application kernel that implements a [Linux-like interface][linux]. Unlike Linux, it is written in a memory-safe language (Go) and runs in userspace. gVisor includes an [Open Container Initiative (OCI)][oci] runtime called `runsc` that makes it easy to work with existing container tooling. The `runsc` runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers. ## What **isn't** gVisor? * gVisor is **not a syscall filter** (e.g. `seccomp-bpf`), nor a wrapper over Linux isolation primitives (e.g. `firejail`, AppArmor, etc.). * gVisor is also **not a VM** in the everyday sense of the term (e.g. VirtualBox, QEMU). **gVisor takes a distinct third approach**, providing many security benefits of VMs while maintaining the lower resource footprint, fast startup, and flexibility of regular userspace applications. ## Why does gVisor exist? Containers are not a [**sandbox**][sandbox]. While containers have revolutionized how we develop, package, and deploy applications, using them to run untrusted or potentially malicious code without additional isolation is not a good idea. While using a single, shared kernel allows for efficiency and performance gains, it also means that container escape is possible with a single vulnerability. gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux. gVisor should not be confused with technologies and tools to harden containers against external threats, provide additional integrity checks, or limit the scope of access for a service. One should always be careful about what data is made available to a container. ## Documentation User documentation and technical architecture, including quick start guides, can be found at [gvisor.dev][gvisor-dev]. ## Installing from source gVisor builds on x86_64 and ARM64. Other architectures may become available in the future. For the purposes of these instructions, [bazel][bazel] and other build dependencies are wrapped in a build container. It is possible to use [bazel][bazel] directly, or type `make help` for standard targets. ### Requirements Make sure the following dependencies are installed: * Linux 4.14.77+ ([older linux][old-linux]) * [Docker version 17.09.0 or greater][docker] ### Building Build and install the `runsc` binary: ```sh mkdir -p bin make copy TARGETS=runsc DESTINATION=bin/ sudo cp ./bin/runsc /usr/local/bin ``` To build specific libraries or binaries, you can specify the target: ```sh make build TARGETS="//pkg/tcpip:tcpip" ``` ### Testing To run standard test suites, you can use: ```sh make unit-tests make tests ``` To run specific tests, you can specify the target: ```sh make test TARGETS="//runsc:version_test" ``` ### Using `go get` This project uses [bazel][bazel] to build and manage dependencies. A synthetic `go` branch is maintained that is compatible with standard `go` tooling for convenience. For example, to build and install `runsc` directly from this branch: ```sh echo "module runsc" > go.mod GO111MODULE=on go get gvisor.dev/gvisor/runsc@go CGO_ENABLED=0 GO111MODULE=on sudo -E go build -o /usr/local/bin/runsc gvisor.dev/gvisor/runsc ``` Subsequently, you can build and install the shim binary for `containerd`: ```sh GO111MODULE=on sudo -E go build -o /usr/local/bin/containerd-shim-runsc-v1 gvisor.dev/gvisor/shim ``` Note that this branch is supported in a best effort capacity, and direct development on this branch is not supported. Development should occur on the `master` branch, which is then reflected into the `go` branch. ## Community & Governance See [GOVERNANCE.md](GOVERNANCE.md) for project governance information. The [gvisor-users mailing list][gvisor-users-list] and [gvisor-dev mailing list][gvisor-dev-list] are good starting points for questions and discussion. ## Security Policy See [SECURITY.md](SECURITY.md). ## Contributing See [Contributing.md](CONTRIBUTING.md). [bazel]: https://bazel.build [docker]: https://www.docker.com [gvisor-users-list]: https://groups.google.com/forum/#!forum/gvisor-users [gvisor-dev]: https://gvisor.dev [gvisor-dev-list]: https://groups.google.com/forum/#!forum/gvisor-dev [linux]: https://en.wikipedia.org/wiki/Linux_kernel_interfaces [oci]: https://www.opencontainers.org [old-linux]: https://gvisor.dev/docs/user_guide/networking/#gso [sandbox]: https://en.wikipedia.org/wiki/Sandbox_(computer_security) ", Assign "at most 3 tags" to the expected json: {"id":"5479","tags":[]} "only from the tags list I provide: [{"id":77,"name":"3d"},{"id":89,"name":"agent"},{"id":17,"name":"ai"},{"id":54,"name":"algorithm"},{"id":24,"name":"api"},{"id":44,"name":"authentication"},{"id":3,"name":"aws"},{"id":27,"name":"backend"},{"id":60,"name":"benchmark"},{"id":72,"name":"best-practices"},{"id":39,"name":"bitcoin"},{"id":37,"name":"blockchain"},{"id":1,"name":"blog"},{"id":45,"name":"bundler"},{"id":58,"name":"cache"},{"id":21,"name":"chat"},{"id":49,"name":"cicd"},{"id":4,"name":"cli"},{"id":64,"name":"cloud-native"},{"id":48,"name":"cms"},{"id":61,"name":"compiler"},{"id":68,"name":"containerization"},{"id":92,"name":"crm"},{"id":34,"name":"data"},{"id":47,"name":"database"},{"id":8,"name":"declarative-gui "},{"id":9,"name":"deploy-tool"},{"id":53,"name":"desktop-app"},{"id":6,"name":"dev-exp-lib"},{"id":59,"name":"dev-tool"},{"id":13,"name":"ecommerce"},{"id":26,"name":"editor"},{"id":66,"name":"emulator"},{"id":62,"name":"filesystem"},{"id":80,"name":"finance"},{"id":15,"name":"firmware"},{"id":73,"name":"for-fun"},{"id":2,"name":"framework"},{"id":11,"name":"frontend"},{"id":22,"name":"game"},{"id":81,"name":"game-engine "},{"id":23,"name":"graphql"},{"id":84,"name":"gui"},{"id":91,"name":"http"},{"id":5,"name":"http-client"},{"id":51,"name":"iac"},{"id":30,"name":"ide"},{"id":78,"name":"iot"},{"id":40,"name":"json"},{"id":83,"name":"julian"},{"id":38,"name":"k8s"},{"id":31,"name":"language"},{"id":10,"name":"learning-resource"},{"id":33,"name":"lib"},{"id":41,"name":"linter"},{"id":28,"name":"lms"},{"id":16,"name":"logging"},{"id":76,"name":"low-code"},{"id":90,"name":"message-queue"},{"id":42,"name":"mobile-app"},{"id":18,"name":"monitoring"},{"id":36,"name":"networking"},{"id":7,"name":"node-version"},{"id":55,"name":"nosql"},{"id":57,"name":"observability"},{"id":46,"name":"orm"},{"id":52,"name":"os"},{"id":14,"name":"parser"},{"id":74,"name":"react"},{"id":82,"name":"real-time"},{"id":56,"name":"robot"},{"id":65,"name":"runtime"},{"id":32,"name":"sdk"},{"id":71,"name":"search"},{"id":63,"name":"secrets"},{"id":25,"name":"security"},{"id":85,"name":"server"},{"id":86,"name":"serverless"},{"id":70,"name":"storage"},{"id":75,"name":"system-design"},{"id":79,"name":"terminal"},{"id":29,"name":"testing"},{"id":12,"name":"ui"},{"id":50,"name":"ux"},{"id":88,"name":"video"},{"id":20,"name":"web-app"},{"id":35,"name":"web-server"},{"id":43,"name":"webassembly"},{"id":69,"name":"workflow"},{"id":87,"name":"yaml"}]" returns me the "expected json"