website/index.md
</div>
<div class="col-md-6 pull-left">
<div class="divide-xl"></div>
<h2><span><b>gVisor</b></span> is the <span><b>missing security layer</b></span> for
running containers efficiently and securely.
</h2>
<p class="info-text">gVisor is an open-source Linux-compatible sandbox
that runs anywhere existing container tooling does. It enables
cloud-native container security and portability. gVisor leverages
years of experience isolating production workloads at Google.
</p>
<div class="divide-xl"></div>
</div>
</div> <!-- end row -->
</div>
<div class="col-md-8 pull-right">
<div class="divide-xl"></div>
<h2>Run Untrusted Code</h2>
<p class="info-text">Isolate Linux hosts from containers so you can
<strong>safely run user-uploaded, LLM-generated, or third-party
code</strong>. Add defense-in-depth measures to your stack, bringing
additional security to your infrastructure.
</p>
<div class="divide-xl"></div>
</div>
</div> <!-- end row -->
</div>
<div class="col-md-8 pull-left">
<div class="divide-xl"></div>
<h2>Protect Workloads & Infrastructure</h2>
<p class="info-text">Fortify hosts and containers against
<strong>escapes and privilege escalation CVEs</strong>, enabling
strong isolation for security-critical workloads as well as
multi-tenant safety.
</p>
<div class="divide-xl"></div>
</div>
</div> <!-- end row -->
</div>
<div class="col-md-8 pull-right">
<div class="divide-xl"></div>
<h2>Reduce Risk</h2>
<p class="info-text">Deliver runtime visibility that integrates
with popular <strong>threat detection tools</strong> to quickly
identify threats, generate alerts, and enforce policies.
</p>
<div class="divide-xl"></div>
</div>
</div> <!-- end row -->
</div>
<h1 align="center" style="margin-top:3px">gVisor Features</h1>
<!-- Start features list -->
<div class="row">
<div class="container">
<div class="col-md-1"></div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2>
<a href="docs/architecture_guide/security/#principles-defense-in-depth" class="feature-link">
Defense in Depth
</a>
</h2>
<p class="info-text" style="margin-bottom:0px">
<strong>gVisor implements the Linux API</strong>: by
intercepting all sandboxed application system calls to the
kernel, it protects the host from the application. In
addition, <strong>gVisor also sandboxes itself from the
host</strong> using Linux's isolation capabilities.
Through these layers of defense, gVisor achieves true
defense-in-depth while still providing
<strong>VM-like performance</strong> and
<strong>container-like resource efficiency</strong>.
</p>
</div>
</div>
</div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2>
<a href="docs/architecture_guide/security/" class="feature-link">
Secure by Default
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">gVisor runs with
the <strong>least amount of privileges</strong> and the
strictest possible system call filter needed to function. gVisor
implements the Linux kernel and its network stack using Go, a
memory-safe and type-safe language.
</p>
</div>
</div>
</div>
<div class="col-md-1"></div>
</div> <!-- end row container -->
</div><!-- /row -->
<div class="row" style="margin-top:0px">
<div class="container">
<div class="col-md-1"></div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2>
<a href="docs/architecture_guide/platforms/" class="feature-link">
Runs Anywhere
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">gVisor
<strong>runs anywhere Linux does</strong>. It works on x86 and
ARM, on VMs or bare-metal, and does not require virtualization
support. gVisor works well on all popular cloud providers.
</p>
</div>
</div>
</div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2 style="color:#272261">
<a href="docs/user_guide/compatibility/" class="feature-link">
Cloud Ready
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">gVisor
<strong>works with Docker, Kubernetes, and
containerd</strong>. Many popular applications and images are
deployed in production environments on gVisor.
</p>
</div>
</div>
</div>
<div class="col-md-1"></div>
</div> <!-- end row container -->
</div><!-- /row -->
<div class="row" style="margin-top:0px">
<div class="container">
<div class="col-md-1"></div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2 style="color:#272261">
<a href="docs/architecture_guide/performance/" class="feature-link">
Fast Startups and Execution
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">gVisor
containers start up in milliseconds and have minimal resource
overhead. They act like, feel like, and <em>actually are</em>
containers, not VMs. Their resource consumption can scale up
and down at runtime, enabling <strong>container-native
resource efficiency</strong>.
</p>
</div>
</div>
</div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2 style="color:#272261">
<a href="docs/user_guide/checkpoint_restore/" class="feature-link">
Checkpoint and Restore
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">gVisor can
<strong>checkpoint and restore containers</strong>. Use it to
cache warmed-up services, resume workloads on other machines,
snapshot execution, save state for forensics, or branch
interactive REPL sessions.
</p>
</div>
</div>
</div>
<div class="col-md-1"></div>
</div> <!-- end row container -->
</div><!-- /row -->
<div class="row" style="margin-top:0px">
<div class="container">
<div class="col-md-1"></div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2 style="color:#272261">
<a href="/docs/user_guide/runtimemonitor/" class="feature-link">
Runtime Monitoring
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">Observe runtime
behavior of your applications by streaming application actions
(trace points) to an external <strong>threat detection
engine</strong> like
<a href="https://falco.org" style="color:#272261">Falco</a>
and generate alerts.
</p>
</div>
</div>
</div>
<div class="col-md-5">
<div class="panel panel-default" style="border:none;box-shadow:none;">
<div class="panel-body">
<h2 style="color:#272261">
<a href="docs/user_guide/gpu/" class="feature-link">
GPU & CUDA Support
</a>
</h2>
<p class="info-text" style="margin-bottom:0px;">gVisor
applications can <strong>use CUDA on Nvidia GPUs</strong>,
bringing isolation to AI/ML workloads.
</p>
</div>
</div>
</div>
<div class="col-md-1"></div>
</div> <!-- end row container -->
</div><!-- /row -->
</div> <!-- /container -->