gVisor

gVisor is an OCI container runtime that provides increased isolation and sandboxing for applications. It can securely host untrusted, third-party code. As an OCI container runtime, gVisor can replace the default runC runtime.

Important

• Prior to deployment, review the upstream gVisor documentation. gVisor is not a 1:1 drop-in replacement for runC and might include limitations or compatibility considerations that can affect your application.

• Due to a known upstream issue, gVisor must be run with a TTY (-t in the docker run commands).

• gVisor is incompatibile with SELinux, as noted in the SELinux FAQ.

Note

• A FIPS version of gVisor is not available.

Install gVisor

gVisor is distributed as the runsc-ee package through the Mirantis repository:

1. Install Mirantis Container Runtime on a Linux Distribution.

2. Install the runsc-ee package for your distribution:

   Ubuntu:

   sudo apt-get install runsc-ee
   

   RHEL:

   sudo dnf install runsc-ee
   

Configure gVisor

After installation, you can run gVisor without explicit configuration by invoking the shim directly:

docker run --runtime io.containerd.runsc.v1 hello-world

To define a runtime alias or configure additional options, add the required configuration to the daemon.json file. For example:

{
  "runtimes": {
    "runsc": {
      "runtimeType": "io.containerd.runsc.v1",
      "options": {
        "TypeUrl": "io.containerd.runsc.v1.options",
        "ConfigPath": "/etc/containerd/runsc.toml"
      }
    }
  }
}

Reload or restart the daemon to apply the configuration changes.

sudo systemctl restart docker.service

You can then start containers by using runsc as the runtime:

docker run --runtime runsc hello-world