gVisor

gVisor is an application kernel developed by Google that intercepts all system calls and simulates their execution in user space.

gVisor is a user-space kernel open-sourced by Google that provides stronger security isolation than standard Docker containers by inserting a sandbox layer between containers and the host kernel.

Sandbox environments are typically implemented based on container technology (such as Docker) or OS-level isolation (such as Linux namespaces and seccomp filters).

gVisor is an application kernel-level isolation technology open-sourced by Google

The technology stack for cloud computing sandbox implementation forms a spectrum from lightweight to heavyweight: containers provide process-level isolation, micro-virtual machines (AWS Firecracker, Google gVisor) provide near-VM security, and WebAssembly runtimes achieve memory safety at the language level.

Technical approaches to agent workload isolation include containerization (e.g., Docker), lightweight virtual machines (e.g., Firecracker microVM, gVisor), and sandboxing technologies (e.g., seccomp, AppArmor).

gVisor implements a complete Linux kernel interface (called Sentry) in user space, so that system calls within the container do not directly reach the host kernel.

Public technical details of Google ACE are limited; the specific microVM implementation (whether based on Firecracker, gVisor, etc.), the credential injection mechanism, default network policy configuration, and pricing model have not all been fully disclosed.

Solutions such as gVisor improve security by intercepting system calls and adding a user-space kernel layer between the container and the kernel.

gVisor uses a user-space application kernel to handle system calls, reducing direct exposure to the host kernel, but there are trade-offs in system call compatibility and workload performance.

The verification pipeline contains three key steps: dependency locking, sandboxed execution (microVMs such as Firecracker or gVisor), and semantic diffing.

Mature sandbox implementations typically employ multiple layers of defense—containerized execution, read-only file systems, dropping unnecessary Linux capabilities, restricting outbound network access—combined with lightweight virtualization technologies such as gVisor and Firecracker to strengthen isolation.

RayTrace runs AI coding agents inside gVisor-backed sandboxes and collects execution evidence at the kernel level.

Kernel-level evidence comes from a layer outside and beneath the agent process, which the agent cannot directly tamper with, and is therefore more trustworthy than application-layer logs.

Compared with ordinary containers (which share the host kernel), gVisor has a smaller isolation surface and greater difficulty of escape, but some programs that depend on special syscalls (such as certain GPU and nested virtualization scenarios) may fail to run, and I/O-intensive workloads also incur considerable overhead.

Mainstream AI Agent tools adopt the principle of least privilege, letting users designate a specific folder as the workspace, and the Agent can only operate within the sandbox.

Runtime sandboxes use technologies such as gVisor, Kata Containers, and Firecracker microVMs to confine Agent-executed code in an isolated environment, so that even if exploited by a prompt injection attack, it is difficult to move laterally or steal host data.

在 Linux 及其他平台上，Gemini CLI 沙箱依次尝试 Docker、Podman；runsc（gVisor）、lxc、windows-native 仅能显式指定。

gVisor is a user-space kernel sandbox open-sourced by Google that achieves isolation by intercepting system calls, known for its security but with some performance overhead.

The common trend among gVisor, Firecracker, and Kata Containers is the fusion of VM-level security boundaries with container-level lightweight experience.