One of the big benefits that gVisor offers is that it doesn't require nested virtualization (or any virtualization). They released a new version that improves performance when not using virtualization a while back: https://gvisor.dev/blog/2023/04/28/systrap-release/
It could be that you happened to find a period of rapid change, but it is also possible that you ran into the issue that raggi mentioned in the sibling comment.
I don't work on gVisor anymore. That said, I think it would be a tough sell. It would be a pretty big breaking change. Also, there is already a problem with people trying to send patches against the go branch and making it the default would make that much worse.
I think the solution is an automatically exported repository at a different path. Kind of (or maybe exactly) like what Tailscale/bradfitz used to maintain.
> That obviously doesn't work for a linux-on-fuschia compat layer.
This isn’t actually true. gVisor contains full implementations of Linux syscalls and only relies on host syscalls being the same for some interoperability features between sandboxed and host applications. It would be completely possible to port gVisor to a non-Linux operating system.
Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.
Stairwell Inc. | REMOTE USA, VISA | Full-Time Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.
Technologies
Stairwell Inc. | REMOTE USA, VISA | Full-Time
Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.
Stairwell is seed funded and recently came out of stealth mode as a new cybersecurity company that seeks to empower any team to defend against every attacker. It is composed of security industry leaders and engineers from Microsoft and Google and is backed by Accel, Sequoia Capital, Allen & Company, and Gradient Ventures.
I used 20% time for things that were related to my work, but out of scope for my team. For example, I wrote a DNS library in Go for work and then I open sourced it [1] and used it to rewrite the standard library DNS client [2] as a 20% project. It actually worked out really well for me. The promo committee specifically called out my DNS project when they approved my promotion and ignored the stuff that I had been doing for my team.
I work on gVisor. gVisor supports concurrent multi-treading, but should not be vulnerable to TOCTTOU, even in ptrace mode. gVisor handles system calls itself, it does not simply verify the args for app system calls and then pass them on to the host. That said, if you find any security issues, please let us know. There is a security email address in the github issue template.
App Engine Flex is a version of App Engine that uses VMs with Linux. You can find a comparison between the standard and flexible environments here:
I work on gVisor. The answer is that having a separate kernel is required to achieve a high degree of isolation and by definition Linux containers share a kernel with the host. A separate Linux kernel could work as well, but gVisor tries to achieve a different set of trade-offs.
If you want something faster than github.com/miekg/dns, there is golang.org/x/net/dns. I am the author, but I promise it is a lot faster. It is about an order of magnitude faster in my benchmarks.