{"slug": "gvisor", "name": "gVisor", "category": "security", "category_name": "Security and passwords", "description": "Open-source application kernel from Google that sandboxes containers by intercepting Linux system calls.", "recommenders": 9, "commenters": 13, "warners": 0, "score": 9.327, "rising": 3.69, "first": "2025-12-24", "latest": "2026-10-18", "why": "HN commenters recommend gVisor for sandboxing AI agents and untrusted code by reducing kernel attack surface, with less overhead and simpler operations than microVMs.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 9, "neutral": 3, "compare": 1, "warn": 0}, "spark": [0, 1, 1, 0, 0, 1, 0, 0, 1, 2, 1, 2], "listed": true, "loved": ["Agent sandboxing", "Kernel attack surface"], "caveat": "Weaker than VMs", "short_quote": "we went with gVisor and have been very happy with it.", "icon": true, "domain": null, "github_repo": "github.com/googlecloudplatform/cloud-run-sandbox", "official_url": "https://gvisor.dev", "pricing": "open source", "aliases": ["gVisor"], "verdict": [{"text": "HN commenters recommend gVisor for sandboxing AI agents and untrusted code by reducing kernel attack surface,", "cites": [{"id": 802264480, "item_id": 50141530, "url": "https://news.ycombinator.com/item?id=50141530", "by": "salt-licker", "date": "2026-10-18", "stance": "recommend", "quote": "I also built a multi-agent manager on top of gvisor", "excerpt": "I\u2019m glad to find other people who actually care enough to sandbox their agents. I don\u2019t have a kanban board, but I also built a multi-agent manager on top of gvisor (also kubernetes, but still runs on a single machine with kind). Recently switched to git reference clones instead of worktrees for better security. The transparent egress proxy + secure credential isolation was also kind of a pain to figure out. Thought ", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Show HN: Cosplay as a tech lead, using gVisor to sandbox agents"}, {"id": 796869968, "item_id": 49804373, "url": "https://news.ycombinator.com/item?id=49804373", "by": "gregwebs", "date": "2026-09-22", "stance": "recommend", "quote": "Glad to see this coming with gVisor support to help secure the Kernel", "excerpt": "Glad to see this coming with gVisor support to help secure the Kernel- IMHO we should expect frontier models to find Kernel exploits. I am working on a project similar in spirit that uses microsandbox (libkrun) to run inside a tiny and fast VM. It includes other security properties that are needed for some workloads. * network allow lists * credential masking * github allow list https://github.com/gregwebs/agent-vm/#", "context": "", "use_case": "sandbox kernel security", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 742099328, "item_id": 46381208, "url": "https://news.ycombinator.com/item?id=46381208", "by": "steren", "date": "2025-12-24", "stance": "recommend", "quote": "Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run)", "excerpt": "Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run): https://github.com/GoogleCloudPlatform/cloud-run-sandbox", "context": "", "use_case": "code sandboxes", "switched_from": "", "story": "Fabrice Bellard Releases MicroQuickJS"}, {"id": 792113889, "item_id": 49507118, "url": "https://news.ycombinator.com/item?id=49507118", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "gvisor in particular helps you further reduce attack surface for root.", "excerpt": "A bit more than experimenting. I have designed several security hardened linux operating systems for major financial institutions. There are many well established patterns for further segmenting user workloads, once far removed from real system root which is there is no good reason to expose. In my case each of those unprivileged apps runs in a dedicated virtual machine because I use QubesOS, though for many use case", "context": "designs security hardened Linux systems for financial institutions", "use_case": "sandboxing workloads", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}]}, {"text": " with less overhead and simpler operations than microVMs.", "cites": [{"id": 743366977, "item_id": 46460436, "url": "https://news.ycombinator.com/item?id=46460436", "by": "ammmir", "date": "2026-01-01", "stance": "recommend", "quote": "I decided to use Linux containers with the gVisor sandbox.", "excerpt": "I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor). While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot", "context": "built sandbox platforms", "use_case": "agent sandboxing", "switched_from": "Firecracker", "story": "Ask HN: What is the best microVMs for AI agents?"}, {"id": 792113889, "item_id": 49507118, "url": "https://news.ycombinator.com/item?id=49507118", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "gvisor in particular helps you further reduce attack surface for root.", "excerpt": "A bit more than experimenting. I have designed several security hardened linux operating systems for major financial institutions. There are many well established patterns for further segmenting user workloads, once far removed from real system root which is there is no good reason to expose. In my case each of those unprivileged apps runs in a dedicated virtual machine because I use QubesOS, though for many use case", "context": "designs security hardened Linux systems for financial institutions", "use_case": "sandboxing workloads", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 799520832, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "recommend", "quote": "Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "container sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}]}, {"text": " The most common caveat is that it is not as secure as VM-based isolation,", "cites": [{"id": 799520832, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "recommend", "quote": "Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "container sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}, {"id": 743366977, "item_id": 46460436, "url": "https://news.ycombinator.com/item?id=46460436", "by": "ammmir", "date": "2026-01-01", "stance": "recommend", "quote": "I decided to use Linux containers with the gVisor sandbox.", "excerpt": "I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor). While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot", "context": "built sandbox platforms", "use_case": "agent sandboxing", "switched_from": "Firecracker", "story": "Ask HN: What is the best microVMs for AI agents?"}]}, {"text": " and escapes can still happen, so it should be paired with seccomp and AppArmor/SELinux.", "cites": [{"id": 789940528, "item_id": 49371283, "url": "https://news.ycombinator.com/item?id=49371283", "by": "insanitybit", "date": "2026-08-19", "stance": "recommend", "quote": "it pairs well with other mitigations", "excerpt": "> Moving code into gvisor virtually eliminates privilege escalation. Rereading this, it's an overstatement. It doesn't \"virtually eliminate\" it. It drives the cost up by like 3 orders of magnitude and it pairs well with other mitigations. gVisor escapes can and will happen, I highly recommend you do more than just stuff something into gvisor - additional seccomp can go a long way, and apparmor/selinux pair incredibly", "context": "", "use_case": "sandboxing code", "switched_from": "", "story": "Pacing model development in an era of cyber-critical capabilities"}]}], "praise": [{"label": "Agent sandboxing", "summary": "Commenters use it to sandbox coding agents and run code sandboxes.", "quotes": [{"id": 802264480, "item_id": 50141530, "url": "https://news.ycombinator.com/item?id=50141530", "by": "salt-licker", "date": "2026-10-18", "stance": "recommend", "quote": "I also built a multi-agent manager on top of gvisor", "excerpt": "I\u2019m glad to find other people who actually care enough to sandbox their agents. I don\u2019t have a kanban board, but I also built a multi-agent manager on top of gvisor (also kubernetes, but still runs on a single machine with kind). Recently switched to git reference clones instead of worktrees for better security. The transparent egress proxy + secure credential isolation was also kind of a pain to figure out. Thought ", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Show HN: Cosplay as a tech lead, using gVisor to sandbox agents"}, {"id": 742099328, "item_id": 46381208, "url": "https://news.ycombinator.com/item?id=46381208", "by": "steren", "date": "2025-12-24", "stance": "recommend", "quote": "Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run)", "excerpt": "Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run): https://github.com/GoogleCloudPlatform/cloud-run-sandbox", "context": "", "use_case": "code sandboxes", "switched_from": "", "story": "Fabrice Bellard Releases MicroQuickJS"}, {"id": 779895584, "item_id": 48743474, "url": "https://news.ycombinator.com/item?id=48743474", "by": "ipotapov", "date": "2026-07-01", "stance": "neutral", "quote": "Your system's use of gVisor sandboxes for running coding agents is intriguing.", "excerpt": "Your system's use of gVisor sandboxes for running coding agents is intriguing. If you're considering adding voice capabilities on Linux, Windows, or Android, speech-core (which I maintain) could complement your setup with its C++17 engine and ONNX Runtime support for ASR and TTS. https://github.com/soniqo/speech-core", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Show HN: 143.dev \u2013 we open-sourced our internal coding-agent infrastructure"}]}, {"label": "Kernel attack surface", "summary": "It shrinks the kernel attack surface and makes privilege escalation far more costly.", "quotes": [{"id": 792113889, "item_id": 49507118, "url": "https://news.ycombinator.com/item?id=49507118", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "gvisor in particular helps you further reduce attack surface for root.", "excerpt": "A bit more than experimenting. I have designed several security hardened linux operating systems for major financial institutions. There are many well established patterns for further segmenting user workloads, once far removed from real system root which is there is no good reason to expose. In my case each of those unprivileged apps runs in a dedicated virtual machine because I use QubesOS, though for many use case", "context": "designs security hardened Linux systems for financial institutions", "use_case": "sandboxing workloads", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 789940528, "item_id": 49371283, "url": "https://news.ycombinator.com/item?id=49371283", "by": "insanitybit", "date": "2026-08-19", "stance": "recommend", "quote": "it pairs well with other mitigations", "excerpt": "> Moving code into gvisor virtually eliminates privilege escalation. Rereading this, it's an overstatement. It doesn't \"virtually eliminate\" it. It drives the cost up by like 3 orders of magnitude and it pairs well with other mitigations. gVisor escapes can and will happen, I highly recommend you do more than just stuff something into gvisor - additional seccomp can go a long way, and apparmor/selinux pair incredibly", "context": "", "use_case": "sandboxing code", "switched_from": "", "story": "Pacing model development in an era of cyber-critical capabilities"}, {"id": 796869968, "item_id": 49804373, "url": "https://news.ycombinator.com/item?id=49804373", "by": "gregwebs", "date": "2026-09-22", "stance": "recommend", "quote": "Glad to see this coming with gVisor support to help secure the Kernel", "excerpt": "Glad to see this coming with gVisor support to help secure the Kernel- IMHO we should expect frontier models to find Kernel exploits. I am working on a project similar in spirit that uses microsandbox (libkrun) to run inside a tiny and fast VM. It includes other security properties that are needed for some workloads. * network allow lists * credential masking * github allow list https://github.com/gregwebs/agent-vm/#", "context": "", "use_case": "sandbox kernel security", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}]}, {"label": "Simpler than microVMs", "summary": "Commenters describe it as easier to operate and lighter than Firecracker microVMs.", "quotes": [{"id": 743366977, "item_id": 46460436, "url": "https://news.ycombinator.com/item?id=46460436", "by": "ammmir", "date": "2026-01-01", "stance": "recommend", "quote": "I decided to use Linux containers with the gVisor sandbox.", "excerpt": "I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor). While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot", "context": "built sandbox platforms", "use_case": "agent sandboxing", "switched_from": "Firecracker", "story": "Ask HN: What is the best microVMs for AI agents?"}, {"id": 799520832, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "recommend", "quote": "Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "container sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}, {"id": 792113889, "item_id": 49507118, "url": "https://news.ycombinator.com/item?id=49507118", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "gvisor in particular helps you further reduce attack surface for root.", "excerpt": "A bit more than experimenting. I have designed several security hardened linux operating systems for major financial institutions. There are many well established patterns for further segmenting user workloads, once far removed from real system root which is there is no good reason to expose. In my case each of those unprivileged apps runs in a dedicated virtual machine because I use QubesOS, though for many use case", "context": "designs security hardened Linux systems for financial institutions", "use_case": "sandboxing workloads", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}]}, {"label": "Production satisfaction", "summary": "A team with strict security requirements reported being very happy with it.", "quotes": [{"id": 788790817, "item_id": 49299426, "url": "https://news.ycombinator.com/item?id=49299426", "by": "insanitybit", "date": "2026-08-14", "stance": "recommend", "quote": "we went with gVisor and have been very happy with it.", "excerpt": "I don't have a technology stack. Do you just mean what am I using for current projects? At work we use Rust primarily for services. It was chosen because we're doing a lot of low level and performance sensitive work. The risk we discussed most was devs not knowing the language, which we decided to hedge against in various ways and accepted that risk. We use Postgres for a lot of data. We've used it a ton at the compa", "context": "strict security requirements", "use_case": "isolation", "switched_from": "", "story": "Choose Boring Technology (2015)"}]}, {"label": "Self-hosting building block", "summary": "It is listed as a component for hand-rolling self-hosted sandboxes or mini VPS setups.", "quotes": [{"id": 762627265, "item_id": 47664204, "url": "https://news.ycombinator.com/item?id=47664204", "by": "benswerd", "date": "2026-04-06", "stance": "recommend", "quote": "You can handroll a lot with:", "excerpt": "Self hosting can be doable for constant small/medium size workloads You can handroll a lot with: https://github.com/nestybox/sysbox?tab=readme-ov-file https://gvisor.dev https://github.com/containers/bubblewrap?tab=readme-ov-file For hardware virtualized machines it much harder but you can do it via: https://github.com/firecracker-microvm/firecracker/ https://github.com/cloud-hypervisor/cloud-hypervisor Freestyle/oth", "context": "", "use_case": "self-hosted sandboxes", "switched_from": "", "story": "Launch HN: Freestyle: Sandboxes for AI Coding Agents"}, {"id": 748351763, "item_id": 46771985, "url": "https://news.ycombinator.com/item?id=46771985", "by": "Imustaskforhelp", "date": "2026-01-26", "stance": "neutral", "quote": "hook up to any podman/gvisor instance to build your own mini vps", "excerpt": "I love golang man! And I use it for the same thing too!! I mean people mention rust and everything and how AI can write proper rust code with linter and some other thing but man trust me that AI can write some pretty good golang code. I mean though, I don't want everyone to write golang code with AI of all of a sudden because I have been doing it for over an year and its something that I vibe with and its my personal", "context": "", "use_case": "VPS sandboxing", "switched_from": "", "story": "ChatGPT Containers can now run bash, pip/npm install packages and download files"}]}], "caveats": [{"label": "Weaker than VMs", "summary": "Commenters say it does not reach the security level of microVM isolation.", "quotes": [{"id": 799520832, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "recommend", "quote": "Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "container sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}, {"id": 743366977, "item_id": 46460436, "url": "https://news.ycombinator.com/item?id=46460436", "by": "ammmir", "date": "2026-01-01", "stance": "recommend", "quote": "I decided to use Linux containers with the gVisor sandbox.", "excerpt": "I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor). While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot", "context": "built sandbox platforms", "use_case": "agent sandboxing", "switched_from": "Firecracker", "story": "Ask HN: What is the best microVMs for AI agents?"}]}, {"label": "Escapes possible", "summary": "gVisor escapes can happen, so it should be combined with seccomp and AppArmor/SELinux.", "quotes": [{"id": 789940528, "item_id": 49371283, "url": "https://news.ycombinator.com/item?id=49371283", "by": "insanitybit", "date": "2026-08-19", "stance": "recommend", "quote": "it pairs well with other mitigations", "excerpt": "> Moving code into gvisor virtually eliminates privilege escalation. Rereading this, it's an overstatement. It doesn't \"virtually eliminate\" it. It drives the cost up by like 3 orders of magnitude and it pairs well with other mitigations. gVisor escapes can and will happen, I highly recommend you do more than just stuff something into gvisor - additional seccomp can go a long way, and apparmor/selinux pair incredibly", "context": "", "use_case": "sandboxing code", "switched_from": "", "story": "Pacing model development in an era of cyber-critical capabilities"}]}], "who": [{"by": "lrvick", "context": "designs security hardened Linux systems for financial institutions", "url": "https://news.ycombinator.com/item?id=49507118", "date": "2026-08-31"}, {"by": "insanitybit", "context": "strict security requirements", "url": "https://news.ycombinator.com/item?id=49299426", "date": "2026-08-14"}, {"by": "ammmir", "context": "built sandbox platforms", "url": "https://news.ycombinator.com/item?id=46460436", "date": "2026-01-01"}], "tags": ["for AI agent sandboxes", "for untrusted code", "self-hostable", "for Kubernetes"], "use_cases": ["sandboxing agents", "container sandboxing", "sandboxing", "sandbox kernel security", "sandboxing workloads", "sandboxing code"], "compared": [{"slug": "firecracker", "name": "Firecracker", "co": 7, "switched_from": 1, "switched_to": 0}, {"slug": "podman", "name": "Podman", "co": 3, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 780005040, "item_id": 48750315, "url": "https://news.ycombinator.com/item?id=48750315", "by": "za_mike157", "date": "2026-07-01", "stance": "neutral", "quote": "Since we run GVisor for container isolation", "excerpt": "No we don't use it. CRIU is used for normal checkpoint/restore of Linux processes. Since we run GVisor for container isolation we use their checkpoint/restore support for the sandboxed process state. Both approaches still need NVIDIA\u2019s cuda-checkpoint for the GPU side, because CUDA/GPU memory and driver state are not something a normal process checkpointing tool can handle on its own.", "context": "", "use_case": "container isolation", "switched_from": "", "story": "Reduce GVisor Cold Starts with GPU Snapshotting"}, {"id": 779086768, "item_id": 48692923, "url": "https://news.ycombinator.com/item?id=48692923", "by": "eperot", "date": "2026-06-26", "stance": "recommend", "quote": "we love more contributions", "excerpt": "Thanks. We're working on rootless network setup to make `runsc do --rootless` work with networking enabled when `passt` is installed right now. See issue #13337 (yes that's a cool issue number) which should unblock this. The tty issue is known, should be fixed soon too, though contributions welcome as it sounds like it should be simple fix and we love more contributions :) FWIW, X11 apps work well, I have a personal ", "context": "works on gVisor", "use_case": "sandboxing applications", "switched_from": "", "story": "Run isolated sandboxes with full lifecycle control: AWS introduces MicroVMs"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49801329", "title": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50137043", "title": "Show HN: Cosplay as a tech lead, using gVisor to sandbox agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49965118", "title": "Linux containers in 500 lines of code (2016)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49499854", "title": "Omarchy: Any User Process Can Escalate to Root", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49350031", "title": "Pacing model development in an era of cyber-critical capabilities", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49289512", "title": "Choose Boring Technology (2015)", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {"recommend": 1}, "2026-01": {"recommend": 1, "neutral": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {"compare": 1}, "2026-06": {}, "2026-07": {"neutral": 1, "recommend": 1}, "2026-08": {"recommend": 2}, "2026-09": {"recommend": 1, "neutral": 1}, "2026-10": {"recommend": 2}}, "quotes": [{"id": 802264480, "item_id": 50141530, "url": "https://news.ycombinator.com/item?id=50141530", "by": "salt-licker", "date": "2026-10-18", "stance": "recommend", "quote": "I also built a multi-agent manager on top of gvisor", "excerpt": "I\u2019m glad to find other people who actually care enough to sandbox their agents. I don\u2019t have a kanban board, but I also built a multi-agent manager on top of gvisor (also kubernetes, but still runs on a single machine with kind). Recently switched to git reference clones instead of worktrees for better security. The transparent egress proxy + secure credential isolation was also kind of a pain to figure out. Thought ", "context": "", "use_case": "sandboxing agents", "switched_from": "", "story": "Show HN: Cosplay as a tech lead, using gVisor to sandbox agents"}, {"id": 799520832, "item_id": 49970052, "url": "https://news.ycombinator.com/item?id=49970052", "by": "johnsmith1840", "date": "2026-10-05", "stance": "recommend", "quote": "Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.", "excerpt": "I've deploy gvisor, done basic test of firecracker and an honest attempt at production kata. Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though. Kata is HARD to make. The technical know how to make that in production is awe inspiring. I wanted to use it but it was so complicated to integrate into a cluster I literally just gave up and mirrored raw VMs into t", "context": "", "use_case": "container sandboxing", "switched_from": "", "story": "Linux containers in 500 lines of code (2016)"}, {"id": 796882386, "item_id": 49805149, "url": "https://news.ycombinator.com/item?id=49805149", "by": "XJ6w9dTdM", "date": "2026-09-22", "stance": "neutral", "quote": "Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself", "excerpt": "As everyone mention, there are a lot of implementations of this idea, and not only for agent workflows. My own approach has the following features, hopefully that gets stolen into an actual softawre package at some point: - Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself. I wont't trust a random sandbox. - UDS based automatic HTTP proxy with popup or allowlist and reverse prox", "context": "", "use_case": "sandboxing", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 796869968, "item_id": 49804373, "url": "https://news.ycombinator.com/item?id=49804373", "by": "gregwebs", "date": "2026-09-22", "stance": "recommend", "quote": "Glad to see this coming with gVisor support to help secure the Kernel", "excerpt": "Glad to see this coming with gVisor support to help secure the Kernel- IMHO we should expect frontier models to find Kernel exploits. I am working on a project similar in spirit that uses microsandbox (libkrun) to run inside a tiny and fast VM. It includes other security properties that are needed for some workloads. * network allow lists * credential masking * github allow list https://github.com/gregwebs/agent-vm/#", "context": "", "use_case": "sandbox kernel security", "switched_from": "", "story": "Show HN: Drop \u2013 A rootless Linux sandbox with gVisor support"}, {"id": 792113889, "item_id": 49507118, "url": "https://news.ycombinator.com/item?id=49507118", "by": "lrvick", "date": "2026-08-31", "stance": "recommend", "quote": "gvisor in particular helps you further reduce attack surface for root.", "excerpt": "A bit more than experimenting. I have designed several security hardened linux operating systems for major financial institutions. There are many well established patterns for further segmenting user workloads, once far removed from real system root which is there is no good reason to expose. In my case each of those unprivileged apps runs in a dedicated virtual machine because I use QubesOS, though for many use case", "context": "designs security hardened Linux systems for financial institutions", "use_case": "sandboxing workloads", "switched_from": "", "story": "Omarchy: Any User Process Can Escalate to Root"}, {"id": 789940528, "item_id": 49371283, "url": "https://news.ycombinator.com/item?id=49371283", "by": "insanitybit", "date": "2026-08-19", "stance": "recommend", "quote": "it pairs well with other mitigations", "excerpt": "> Moving code into gvisor virtually eliminates privilege escalation. Rereading this, it's an overstatement. It doesn't \"virtually eliminate\" it. It drives the cost up by like 3 orders of magnitude and it pairs well with other mitigations. gVisor escapes can and will happen, I highly recommend you do more than just stuff something into gvisor - additional seccomp can go a long way, and apparmor/selinux pair incredibly", "context": "", "use_case": "sandboxing code", "switched_from": "", "story": "Pacing model development in an era of cyber-critical capabilities"}, {"id": 788790817, "item_id": 49299426, "url": "https://news.ycombinator.com/item?id=49299426", "by": "insanitybit", "date": "2026-08-14", "stance": "recommend", "quote": "we went with gVisor and have been very happy with it.", "excerpt": "I don't have a technology stack. Do you just mean what am I using for current projects? At work we use Rust primarily for services. It was chosen because we're doing a lot of low level and performance sensitive work. The risk we discussed most was devs not knowing the language, which we decided to hedge against in various ways and accepted that risk. We use Postgres for a lot of data. We've used it a ton at the compa", "context": "strict security requirements", "use_case": "isolation", "switched_from": "", "story": "Choose Boring Technology (2015)"}, {"id": 782301604, "item_id": 48893850, "url": "https://news.ycombinator.com/item?id=48893850", "by": "westurner", "date": "2026-07-13", "stance": "recommend", "quote": "that might be better for agent sessions: gVisor, firecracker vm", "excerpt": "(Years ago I had puppet and cobbler provisioning VMs over PXE and then iPXE. FWIU foreman is more actively maintained than cobbler, which is built on Django web framework.) Vagrant manages VMs and virtual networks, in Ruby. ansible-molecule creates, converges, and destroys VM(s) and containers, in order to test ansible playbooks and ansible roles in clean build roots. podman machine manages VMs: - podman-container-to", "context": "", "use_case": "agent session isolation", "switched_from": "", "story": "Show HN: Clawk \u2013 Give coding agents a disposable Linux VM, not your laptop"}, {"id": 779895584, "item_id": 48743474, "url": "https://news.ycombinator.com/item?id=48743474", "by": "ipotapov", "date": "2026-07-01", "stance": "neutral", "quote": "Your system's use of gVisor sandboxes for running coding agents is intriguing.", "excerpt": "Your system's use of gVisor sandboxes for running coding agents is intriguing. If you're considering adding voice capabilities on Linux, Windows, or Android, speech-core (which I maintain) could complement your setup with its C++17 engine and ONNX Runtime support for ASR and TTS. https://github.com/soniqo/speech-core", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "Show HN: 143.dev \u2013 we open-sourced our internal coding-agent infrastructure"}, {"id": 771143392, "item_id": 48196462, "url": "https://news.ycombinator.com/item?id=48196462", "by": "yjftsjthsd-h", "date": "2026-05-19", "stance": "compare", "quote": "Has anyone had luck moving more things to run under gvisor or firecracker or such?", "excerpt": "> We recommend exploring ways to automate upgrading your kernel Like, running emerge -u @world on a regular basis, or ... /me searches Okay, so https://wiki.gentoo.org/wiki/Live_patching exists but says, > A note of caution: Kernel live patching is risky. Count on hard freezing or panics to become normal... That's not encouraging. --- Another approach: Can we make the kernel vulns less important? Has anyone had luck ", "context": "Gentoo user", "use_case": "mitigating kernel vulnerabilities", "switched_from": "", "story": "Gentoo News: Copy Fail, Dirty Frag, and Fragnesia Kernel Vulnerabilities"}, {"id": 762627265, "item_id": 47664204, "url": "https://news.ycombinator.com/item?id=47664204", "by": "benswerd", "date": "2026-04-06", "stance": "recommend", "quote": "You can handroll a lot with:", "excerpt": "Self hosting can be doable for constant small/medium size workloads You can handroll a lot with: https://github.com/nestybox/sysbox?tab=readme-ov-file https://gvisor.dev https://github.com/containers/bubblewrap?tab=readme-ov-file For hardware virtualized machines it much harder but you can do it via: https://github.com/firecracker-microvm/firecracker/ https://github.com/cloud-hypervisor/cloud-hypervisor Freestyle/oth", "context": "", "use_case": "self-hosted sandboxes", "switched_from": "", "story": "Launch HN: Freestyle: Sandboxes for AI Coding Agents"}, {"id": 748351763, "item_id": 46771985, "url": "https://news.ycombinator.com/item?id=46771985", "by": "Imustaskforhelp", "date": "2026-01-26", "stance": "neutral", "quote": "hook up to any podman/gvisor instance to build your own mini vps", "excerpt": "I love golang man! And I use it for the same thing too!! I mean people mention rust and everything and how AI can write proper rust code with linter and some other thing but man trust me that AI can write some pretty good golang code. I mean though, I don't want everyone to write golang code with AI of all of a sudden because I have been doing it for over an year and its something that I vibe with and its my personal", "context": "", "use_case": "VPS sandboxing", "switched_from": "", "story": "ChatGPT Containers can now run bash, pip/npm install packages and download files"}, {"id": 743366977, "item_id": 46460436, "url": "https://news.ycombinator.com/item?id=46460436", "by": "ammmir", "date": "2026-01-01", "stance": "recommend", "quote": "I decided to use Linux containers with the gVisor sandbox.", "excerpt": "I've built the same thing twice, first with Firecracker microVM, and second time using containers (gVisor). While the microVM route is more secure, it's more complicated and ops are tricky, but you can do some cool things to optimize startup time like when I was working on a function as a service platform, and to reduce TTFB, I trapped the `listen()` call, sent a VSOCK message to the VMM to trigger a freeze, snapshot", "context": "built sandbox platforms", "use_case": "agent sandboxing", "switched_from": "Firecracker", "story": "Ask HN: What is the best microVMs for AI agents?"}, {"id": 742099328, "item_id": 46381208, "url": "https://news.ycombinator.com/item?id=46381208", "by": "steren", "date": "2025-12-24", "stance": "recommend", "quote": "Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run)", "excerpt": "Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run): https://github.com/GoogleCloudPlatform/cloud-run-sandbox", "context": "", "use_case": "code sandboxes", "switched_from": "", "story": "Fabrice Bellard Releases MicroQuickJS"}]}