Stack Exchange Network
Stack Exchange network consists of 181 Q&A communities including
Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
Visit Stack Exchange
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Anybody can ask a question
The best answers are voted up and rise to the top
1 year, 4 months ago
This question is
. It is not currently accepting answers.
This question does not appear to be about Information security within the scope defined in the
I learned about
gVisor from https://security.stackexchange.com/a/259275/133925 . It runs containers under a custom kernel, written in Go, with very intense security.
My question is: The whole point of Docker is to use the
host kernel. How does gVisor run it under a custom kernel of their own?
Feb 3, 2022 at 2:31
platform blog post gives an overview of how gVisor intercept application operations.
The short summary is that there are multiple approaches, but the simplest, default mechanism uses the ‘ptrace’ system calls on the host kernel to request all system calls made by the untrusted application are forwarded to the user space kernel rather than being handled by the host kernel.
Feb 7, 2022 at 6:35
Not the answer you're looking for? Browse other questions tagged
By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our
Accept all cookies
Necessary cookies only
syscallop and direct it to its usermode app? Won't the CPU act on
syscallthe way it always does: e.g. switching to kernel mode?