gVisor
Open-source application kernel from Google that sandboxes containers by intercepting Linux system calls.
HN commenters recommend gVisor for sandboxing AI agents and untrusted code by reducing kernel attack surface,1234 with less overhead and simpler operations than microVMs.567 The most common caveat is that it is not as secure as VM-based isolation,89 and escapes can still happen, so it should be paired with seccomp and AppArmor/SELinux.10
Why people recommend it
Agent sandboxing · 3
Commenters use it to sandbox coding agents and run code sandboxes.
“I also built a multi-agent manager on top of gvisor”
“Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run)”
Show 1 more
“Your system's use of gVisor sandboxes for running coding agents is intriguing.”
Kernel attack surface · 3
It shrinks the kernel attack surface and makes privilege escalation far more costly.
“gvisor in particular helps you further reduce attack surface for root.”
“it pairs well with other mitigations”
Show 1 more
“Glad to see this coming with gVisor support to help secure the Kernel”
Simpler than microVMs · 3
Commenters describe it as easier to operate and lighter than Firecracker microVMs.
“I decided to use Linux containers with the gVisor sandbox.”
“Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.”
Show 1 more
“gvisor in particular helps you further reduce attack surface for root.”
Production satisfaction · 1
A team with strict security requirements reported being very happy with it.
“we went with gVisor and have been very happy with it.”
Self-hosting building block · 2
It is listed as a component for hand-rolling self-hosted sandboxes or mini VPS setups.
“You can handroll a lot with:”
“hook up to any podman/gvisor instance to build your own mini vps”
Caveats and dissent
Weaker than VMs · 2
Commenters say it does not reach the security level of microVM isolation.
“Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.”
“I decided to use Linux containers with the gVisor sandbox.”
Escapes possible · 1
gVisor escapes can happen, so it should be combined with seccomp and AppArmor/SELinux.
“it pairs well with other mitigations”
Often compared with
Who recommends it in their own words
From the makers not counted in the ranking
“Since we run GVisor for container isolation”
“we love more contributions”
Threads where it came up
- Show HN: Drop – A rootless Linux sandbox with gVisor support 2 mentions
- Show HN: Cosplay as a tech lead, using gVisor to sandbox agents 1 mention
- Linux containers in 500 lines of code (2016) 1 mention
- Omarchy: Any User Process Can Escalate to Root 1 mention
- Pacing model development in an era of cyber-critical capabilities 1 mention
- Choose Boring Technology (2015) 1 mention
Data: gvisor.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 14
“I also built a multi-agent manager on top of gvisor”
“Firecracker and gvisor are nice systems not horrible to use, gvisor isn't quite the same security level though.”
“Generate bwrap options (for use in bwrap or gVisor) rather than build the sandbox itself”
“Glad to see this coming with gVisor support to help secure the Kernel”
“gvisor in particular helps you further reduce attack surface for root.”
“it pairs well with other mitigations”
“we went with gVisor and have been very happy with it.”
“that might be better for agent sessions: gVisor, firecracker vm”
“Your system's use of gVisor sandboxes for running coding agents is intriguing.”
“Has anyone had luck moving more things to run under gvisor or firecracker or such?”
“You can handroll a lot with:”
“hook up to any podman/gvisor instance to build your own mini vps”
“I decided to use Linux containers with the gVisor sandbox.”
“Check out this sample of using gVisor to spin up code sandboxes (potentially running on Cloud Run)”