Presentation: Introduction to gVisor: Sandboxed Linux Container Runtime

I am focused on application development, specifically Ruby development, and working to deliver content for application developers to run their applications on cloud. I encourage application developers to use Google Cloud in addition to their current infrastructure by explaining why Google Cloud is efficient and secure on its own.

gVisor is an open source user-space kernel that Google released a few months back. It's a container runtime, you can use it along with the regular container engine like Docker, you just swap it with your existing container runtime. This is a new way of running applications in a sandbox environment.

In the case of containers, you share the same kernel and your container applications are just like those normal processes from the kernel’s perspective. There is little to no overhead. It’s just a regular process. On the other hand, you can use gVisor to create a separate isolation layer between user application processes and the Linux kernel. So even if there is a vulnerability, the application couldn’t escape the isolation and get onto the kernel’s environment.

gVisor is a new way to secure your servers, especially when you want to run “untrusted code” (like user uploaded code). If you are providing a cloud infrastructure, you are basically running code that you don't trust. Using gVisor is one of the ways to run various types of code in a secure environment.

I'd say the most important trend in the software today is the move towards simplicity and choosing the right components. There are a lot of technologies and a lot of layers between hardware and software. In order to be efficient and secure, you need to pick the right component and the right environment that fits your application.