gVisor
Named by 5 kept items in this workspace.
The items that name it 5
User-space sandbox. OpenAI contributed a fix for file-descriptor handling.
Sandboxed container runtime that separates the agent's code from the host system; Agent Sandbox orchestrates it.
Sandboxed container runtime (RuntimeClass gvisor, handler runsc) that isolates the sandbox from node processes; the default runtime is runc if not specified
A microVM technology that closes the kernel gap containers leave open, at the cost of startup time and memory.
Intercepts syscalls in a userspace kernel so the host kernel sees a much smaller attack surface, used for running genuinely untrusted workloads at container density
In every workspace you can read 14
AI
Security
All technologies in this workspace.