gVisor is a user-space kernel, written in Go, that implements a substantial
portion of the Linux system surface. It includes an Open Container Initiative
(OCI) runtime called runsc that provides an isolation boundary between the
application and the host kernel. The runsc runtime integrates with Docker and
Kubernetes, making it simple to run sandboxed containers.