Accelerating AI Securely with GVisor
summary
gVisor is an application kernel OCI runtime that intercepts syscalls in user space, implementing a Linux ABI in Go and using a seccomp RET trap platform that benchmarks roughly 10x faster than ptrace. Internal telemetry shows gVisor blocks almost every pod-to-guest escalation and mitigates over half of historical CVEs by reducing kernel attack surface. Recent work adds GPU access via EnV proxy with negligible measured GPU overhead and a checkpoint/restore flow that restores GPU-accelerated containers.
AI-written summary · about
chapters (5)
- 0:00The need for sandboxing
- 5:39Sandboxing methodologies
- 10:41Internal gVisor architecture
- 15:13Workload scenarios
- 17:49GPU support and future goals
related talks
35mThe Enemy Within: Running Untrusted Code with gVisor
25mIsolating Kubernetes Workloads with gVisor
35mThe Enemy Within: Running Untrusted Code with gVisor
40mContainer Isolation at Scale (Introducing gVisor) - Dawn Chen & Zhengyu He, Google
27mgVisor Container on Arm64: Let‘s Talk about Our Progress!
37mA New Secure Container Solution on Arm Platform: gVisor
37mA New Secure Container Solution on Arm Platform: gVisor
35mNanoVisor: Modernizing Container Runtime with an Architecture Refactor..