Skip to content
Documentation
gVisor

gVisor

Drop supports two runtimes:

  • native - sandboxed programs run directly on the host kernel. Linux namespaces are used for isolation.
  • gvisor - for added isolation, alongside Linux namespaces, sandboxed programs run on the gVisor user-space kernel.
Drop native vs gvisor runtimeIn the native runtime, the sandboxed program runs isolated inside Linux namespaces and its syscalls go straight to the host kernel. In the gvisor runtime, the same Linux namespaces wrap both the sandboxed program and the gVisor Sentry, a user-space kernel that implements syscalls itself and forwards only a filtered set of calls to the host kernel.nativeLinux namespacesSandboxed ProgramsyscallsHost KernelgvisorLinux namespacesSandboxed ProgramsyscallsgVisor Sentry(user-space kernel)limited syscallsHost Kernel

To use the gVisor runtime, you need runsc installed. Then select the gVisor runtime either in the Drop TOML config by changing runtime = "native" to runtime = "gvisor", or by passing the --runtime=gvisor parameter to the drop run command, like:

$ drop run --runtime gvisor ps aux

Both runtimes support the same config options and create identically configured sandboxes. The runtime can be changed back and forth for existing Drop environments.

gVisor adds some performance overhead to system calls and is not 100% compatible with the vanilla Linux kernel, although compatibility issues are rare.

ConfigurationEnvironment variables