gVisor The Future of Container Security - Andy Nguyen

Abstract: gVisor is an application kernel, written in Go, that implements a substantial portion of the Linux system call interface. It provides an additional layer of isolation between running applications and the host operating system.

In this talk, we will dive into the architecture and some of the platforms of gVisor, and what security boundaries it provides for untrusted workloads. Next, we will explain its threat model and Google’s approach to continuously securing it. Finally, we will do a case …

application applications architecture call container container security dive future host interface isolation kernel linux nguyen operating system platforms running security system written