gVisor

gVisor is an application kernel developed by Google that intercepts all system calls and simulates their execution in user space.

gVisor is a user-space kernel open-sourced by Google that provides stronger security isolation than standard Docker containers by inserting a sandbox layer between containers and the host kernel.

Sandbox environments are typically implemented based on container technology (such as Docker) or OS-level isolation (such as Linux namespaces and seccomp filters).

gVisor is an application kernel-level isolation technology open-sourced by Google

The technology stack for cloud computing sandbox implementation forms a spectrum from lightweight to heavyweight: containers provide process-level isolation, micro-virtual machines (AWS Firecracker, Google gVisor) provide near-VM security, and WebAssembly runtimes achieve memory safety at the language level.

Technical approaches to agent workload isolation include containerization (e.g., Docker), lightweight virtual machines (e.g., Firecracker microVM, gVisor), and sandboxing technologies (e.g., seccomp, AppArmor).

gVisor implements a complete Linux kernel interface (called Sentry) in user space, so that system calls within the container do not directly reach the host kernel.

Mature sandbox implementations typically employ multiple layers of defense—containerized execution, read-only file systems, dropping unnecessary Linux capabilities, restricting outbound network access—combined with lightweight virtualization technologies such as gVisor and Firecracker to strengthen isolation.

Compared with ordinary containers (which share the host kernel), gVisor has a smaller isolation surface and greater difficulty of escape, but some programs that depend on special syscalls (such as certain GPU and nested virtualization scenarios) may fail to run, and I/O-intensive workloads also incur considerable overhead.

Kernel-level evidence comes from a layer outside and beneath the agent process, which the agent cannot directly tamper with, and is therefore more trustworthy than application-layer logs.

RayTrace runs AI coding agents inside gVisor-backed sandboxes and collects execution evidence at the kernel level.

Runtime sandboxes use technologies such as gVisor, Kata Containers, and Firecracker microVMs to confine Agent-executed code in an isolated environment, so that even if exploited by a prompt injection attack, it is difficult to move laterally or steal host data.

在 Linux 及其他平台上，Gemini CLI 沙箱依次尝试 Docker、Podman；runsc（gVisor）、lxc、windows-native 仅能显式指定。

The common trend among gVisor, Firecracker, and Kata Containers is the fusion of VM-level security boundaries with container-level lightweight experience.

gVisor is a user-space kernel sandbox open-sourced by Google that achieves isolation by intercepting system calls, known for its security but with some performance overhead.

Sandbox solutions based on micro-virtual machines (such as AWS Firecracker and gVisor) provide more thorough kernel isolation, with each instance having an independent lightweight kernel, offering stronger security boundaries but slightly higher resource overhead.

Container-level isolation (such as Docker and gVisor) provides independent views of the file system and network.

Containerized sandboxes (such as Docker and gVisor) are mature at isolating file systems and processes, but network-layer isolation often relies on the host machine's iptables/nftables rules or the security group configurations of cloud service providers.

Sandbox environments (such as gVisor and Firecracker) introduce additional CPU overhead for security isolation, and each concurrent Agent instance needs to maintain an independent execution context.

Security isolation for code execution in production environments typically relies on container sandboxes (such as gVisor and Firecracker microVM) or dedicated code execution services (such as E2B and Modal).