Go to file
Michael Pratt fb053829f9 Update testDeps definition for https://golang.org/cl/354632
The in-progress Go 1.18's testing.corpusEntry changed definition slightly in
https://golang.org/cl/354632. Update our definition to the new version.

PiperOrigin-RevId: 404040853
2021-10-18 13:15:59 -07:00
.buildkite tools/show_paths.bzl: check that provider_map isn't None 2021-09-13 15:35:22 -07:00
.github use github issue templates 2021-07-14 13:10:55 -07:00
.vscode
debian Use --output=starlark trick for all build path parsing. 2021-08-23 10:53:38 -07:00
g3doc Merge pull request #6654 from nickkelley42:documentation-nits 2021-10-12 18:30:16 -07:00
images [bm-dashboard] Upgrade vulnerable node packages. 2021-10-01 09:56:59 -07:00
pkg Support distinction for RWMutex and read-only locks. 2021-10-18 11:09:39 -07:00
runsc Mount namespace can be nil after task exits 2021-10-18 11:46:35 -07:00
shim Add internal staging tags to //runsc and //shim binaries. 2021-04-07 17:13:11 -07:00
test Update testDeps definition for https://golang.org/cl/354632 2021-10-18 13:15:59 -07:00
tools Add hook to add addition build tags 2021-10-18 12:16:53 -07:00
vdso Internal change. 2020-05-04 12:49:29 -07:00
webhook
website gVisor rack blog 2021-09-01 10:46:27 -07:00
.bazelignore
.bazelrc
.devcontainer.json
.gitignore Refactor the Makefile to avoid recursive Make. 2020-12-09 15:53:23 -08:00
AUTHORS
BUILD Export faketime to go branch 2021-03-03 12:37:23 -08:00
CODE_OF_CONDUCT.md Merge pull request #2513 from amscanne:website-integrated 2020-05-12 12:55:23 -07:00
CONTRIBUTING.md Merge pull request #6484 from dqminh:fix-go-mod-instructions 2021-08-20 11:46:55 -07:00
GOVERNANCE.md Merge pull request #2513 from amscanne:website-integrated 2020-05-12 12:55:23 -07:00
LICENSE
Makefile Use --output=starlark trick for all build path parsing. 2021-08-23 10:53:38 -07:00
README.md Fix "Installing from source" instructions 2021-10-05 17:32:15 -07:00
SECURITY.md Drop unused markdown links. 2020-06-25 09:18:30 -07:00
WORKSPACE Update bazel packages 2021-10-04 18:33:58 -07:00
go.mod Update dependencies so that the 'go' branch builds. 2021-06-07 10:56:56 -07:00
go.sum Update dependencies so that the 'go' branch builds. 2021-06-07 10:56:56 -07:00
nogo.yaml Remove SA5011 suppressions 2021-10-15 15:53:25 -07:00

README.md

gVisor

Build status Issue reviver gVisor chat code search

What is gVisor?

gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system surface. It includes an Open Container Initiative (OCI) runtime called runsc that provides an isolation boundary between the application and the host kernel. The runsc runtime integrates with Docker and Kubernetes, making it simple to run sandboxed containers.

Why does gVisor exist?

Containers are not a sandbox. While containers have revolutionized how we develop, package, and deploy applications, using them to run untrusted or potentially malicious code without additional isolation is not a good idea. While using a single, shared kernel allows for efficiency and performance gains, it also means that container escape is possible with a single vulnerability.

gVisor is an application kernel for containers. It limits the host kernel surface accessible to the application while still giving the application access to all the features it expects. Unlike most kernels, gVisor does not assume or require a fixed set of physical resources; instead, it leverages existing host kernel functionality and runs as a normal process. In other words, gVisor implements Linux by way of Linux.

gVisor should not be confused with technologies and tools to harden containers against external threats, provide additional integrity checks, or limit the scope of access for a service. One should always be careful about what data is made available to a container.

Documentation

User documentation and technical architecture, including quick start guides, can be found at gvisor.dev.

Installing from source

gVisor builds on x86_64 and ARM64. Other architectures may become available in the future.

For the purposes of these instructions, bazel and other build dependencies are wrapped in a build container. It is possible to use bazel directly, or type make help for standard targets.

Requirements

Make sure the following dependencies are installed:

Building

Build and install the runsc binary:

mkdir -p bin
make copy TARGETS=runsc DESTINATION=bin/
sudo cp ./bin/runsc /usr/local/bin

Testing

To run standard test suites, you can use:

make unit-tests
make tests

To run specific tests, you can specify the target:

make test TARGETS="//runsc:version_test"

Using go get

This project uses bazel to build and manage dependencies. A synthetic go branch is maintained that is compatible with standard go tooling for convenience.

For example, to build and install runsc directly from this branch:

echo "module runsc" > go.mod
GO111MODULE=on go get gvisor.dev/gvisor/runsc@go
CGO_ENABLED=0 GO111MODULE=on sudo -E go build -o /usr/local/bin/runsc gvisor.dev/gvisor/runsc

Subsequently, you can build and install the shim binary for containerd:

GO111MODULE=on sudo -E go build -o /usr/local/bin/containerd-shim-runsc-v1 gvisor.dev/gvisor/shim

Note that this branch is supported in a best effort capacity, and direct development on this branch is not supported. Development should occur on the master branch, which is then reflected into the go branch.

Community & Governance

See GOVERNANCE.md for project governance information.

The gvisor-users mailing list and gvisor-dev mailing list are good starting points for questions and discussion.

Security Policy

See SECURITY.md.

Contributing

See Contributing.md.