Runtime gives each sandbox its own Linux kernel, inside a Firecracker microVM. Code runs on a real guest kernel behind a hardware virtualization boundary.
How does gVisor work?
gVisor sits between an application and the host kernel. In the project's words, it "intercepts application system calls and acts as the guest kernel, without the need for translation through virtualized hardware." It has three parts:
- Sentry, the application kernel. It implements system calls, signal delivery, memory management and the threading model.
- Gofer, a host process that mediates file access for the Sentry.
- runsc, the OCI runtime that plugs gVisor into Docker and Kubernetes.
The Sentry itself calls only "a minimal set of host system calls". In the default modes, these calls do not include opening files or creating sockets. How system calls reach the Sentry depends on the platform. Systrap, the default since mid-2023, uses seccomp to trap them. A KVM platform uses virtualization extensions. ptrace is no longer supported.
Facts
| Property | gVisor, as the project states it |
|---|---|
| What it is | An application kernel that implements a Linux-like interface |
| Language | Go, memory-safe, running in user space |
| Kernel boundary | Sentry in user space; no guest kernel, no device emulation |
| Interface | runsc, an OCI runtime for Docker and Kubernetes |
| Overhead | "A small, mostly fixed amount of memory"; no single start-time figure |
| Trade-off | "Reduced application compatibility and higher per-system call overhead" |
| Used in | GKE Sandbox, Cloud Run, App Engine; Modal and Northflank are listed as users |
Is gVisor a virtual machine?
No. The project says gVisor is not "a VM in the everyday sense". It also says gVisor is not "a syscall filter". gVisor boots no guest kernel and emulates no devices. The project also warns that "one should not assume that the mere use of virtualization hardware makes a system more or less secure". Its README says gVisor provides "many security benefits of VMs while maintaining the lower resource footprint, fast startup, and flexibility of regular userspace applications."
How Runtime relates to gVisor
Runtime uses a Firecracker microVM instead of gVisor. Each sandbox runs its own
real Linux kernel, and sudo works inside it. Docker Engine runs in a sandbox
after sudo enable-docker (sandbox environment).
Modal's sandboxes use gVisor (Runtime vs Modal).
Related: microVM, Firecracker, Firecracker vs gVisor, gVisor vs Docker.
Sources
Checked 25 October 2026.
- gVisor documentation, gVisor README
- gVisor security model
- gVisor platforms
- gVisor performance guide
- gVisor users
Facts on this page were checked on 25 October 2026.