Go to file
Adin Scannell b06e5bc5b0 Add benchmarks targets to BuildKite.
This includes minor fix-ups:

* Handle SIGTERM in runsc debug, to exit gracefully.
* Fix cmd.debug.go opening all profiles as RDONLY.
* Fix the test name in fio_test.go, and encode the block size in the test.

PiperOrigin-RevId: 350205718
2021-01-05 13:21:54 -08:00
.buildkite Add benchmarks targets to BuildKite. 2021-01-05 13:21:54 -08:00
.github Change the build badge to point to BuildKite. 2021-01-05 12:40:22 -08:00
debian use is-active instead of status 2020-08-26 10:57:52 +09:00
g3doc Proposal for runtime.DedicateOSThread(). 2020-12-10 15:19:10 -08:00
images Tweak aarch64 support. 2020-12-09 18:51:17 -08:00
pkg Add benchmarks targets to BuildKite. 2021-01-05 13:21:54 -08:00
runsc Add benchmarks targets to BuildKite. 2021-01-05 13:21:54 -08:00
shim Remove legacy bazel configurations. 2020-10-19 16:28:40 -07:00
test Add benchmarks targets to BuildKite. 2021-01-05 13:21:54 -08:00
tools Merge pull request #5169 from laijs:fix-typo-whicy 2021-01-05 12:54:23 -08:00
vdso Internal change. 2020-05-04 12:49:29 -07:00
webhook Add the gVisor admission webhook 2020-10-30 12:02:09 -07:00
website Add simple guidelines & instructions for blog contribution 2020-12-10 18:06:46 -08:00
.bazelrc Remove remote execution support. 2020-12-30 16:54:16 -08:00
.gitignore Refactor the Makefile to avoid recursive Make. 2020-12-09 15:53:23 -08:00
.travis.yml Fix PHONY target typos 2020-07-31 16:20:35 -07:00
AUTHORS Change copyright notice to "The gVisor Authors" 2019-04-29 14:26:23 -07:00
BUILD Add YAML validation for configuration files. 2021-01-05 10:43:04 -08:00
CODE_OF_CONDUCT.md Merge pull request #2513 from amscanne:website-integrated 2020-05-12 12:55:23 -07:00
CONTRIBUTING.md Remove legacy bazel configurations. 2020-10-19 16:28:40 -07:00
GOVERNANCE.md Merge pull request #2513 from amscanne:website-integrated 2020-05-12 12:55:23 -07:00
LICENSE Add MIT license to top-level LICENSE file. 2020-07-28 16:06:06 -07:00
Makefile Add benchmarks targets to BuildKite. 2021-01-05 13:21:54 -08:00
README.md Change the build badge to point to BuildKite. 2021-01-05 12:40:22 -08:00
SECURITY.md Drop unused markdown links. 2020-06-25 09:18:30 -07:00
WORKSPACE Add YAML validation for configuration files. 2021-01-05 10:43:04 -08:00
go.mod Update containerd/cgroups 2020-12-14 21:18:06 -08:00
go.sum Update containerd/cgroups 2020-12-14 21:18:06 -08:00
nogo.yaml Remove existing nogo exceptions. 2020-12-11 12:06:49 -08:00

README.md

gVisor

Build status gVisor chat code search

What is gVisor?

gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.

Why does gVisor exist?

Containers are not a sandbox. While containers have revolutionized how we develop, package, and deploy applications, using them to run untrusted or potentially malicious code without additional isolation is not a good idea. While using a single, shared kernel allows for efficiency and performance gains, it also means that container escape is possible with a single vulnerability.

gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux.

gVisor should not be confused with technologies and tools to harden containers against external threats, provide additional integrity checks, or limit the scope of access for a service. One should always be careful about what data is made available to a container.

Documentation

User documentation and technical architecture, including quick start guides, can be found at gvisor.dev.

Installing from source

gVisor builds on x86_64 and ARM64. Other architectures may become available in the future.

For the purposes of these instructions, bazel and other build dependencies are wrapped in a build container. It is possible to use bazel directly, or type make help for standard targets.

Requirements

Make sure the following dependencies are installed:

Building

Build and install the runsc binary:

make runsc
sudo cp ./bazel-bin/runsc/linux_amd64_pure_stripped/runsc /usr/local/bin

Testing

To run standard test suites, you can use:

make unit-tests
make tests

To run specific tests, you can specify the target:

make test TARGETS="//runsc:version_test"

Using go get

This project uses bazel to build and manage dependencies. A synthetic go branch is maintained that is compatible with standard go tooling for convenience.

For example, to build and install runsc directly from this branch:

echo "module runsc" > go.mod
GO111MODULE=on go get gvisor.dev/gvisor/runsc@go
CGO_ENABLED=0 GO111MODULE=on sudo -E go build -o /usr/local/bin/runsc gvisor.dev/gvisor/runsc

Subsequently, you can build and install the shim binaries for containerd:

GO111MODULE=on sudo -E go build -o /usr/local/bin/gvisor-containerd-shim gvisor.dev/gvisor/shim/v1
GO111MODULE=on sudo -E go build -o /usr/local/bin/containerd-shim-runsc-v1 gvisor.dev/gvisor/shim/v2

Note that this branch is supported in a best effort capacity, and direct development on this branch is not supported. Development should occur on the master branch, which is then reflected into the go branch.

Community & Governance

See GOVERNANCE.md for project governance information.

The gvisor-users mailing list and gvisor-dev mailing list are good starting points for questions and discussion.

Security Policy

See SECURITY.md.

Contributing

See Contributing.md.