Hacker News Reader

This is very interesting! I’m not well versed in runc and friends but I was just exploring runsc[0] and gvisor.

Is there any overlap here even though your project seems to go the path of adding more functionality? Is it fair to think of NestyBox as a type of sandbox?

https://pkg.go.dev/github.com/google/gvisor/runsc?tab=overvi...

View on HN

I understand gvisor's main goal is to improve container isolation by intercepting and inspecting syscalls before they reach the kernel to reduce the attack surface. Sysbox on the other hand is meant as a way to run system software (in addition to apps/microservices) easily inside a Docker container, so its focus is on enabling this functionality. Having said this, Sysbox always enables the Linux user-namespace in containers, and thus also improves container isolation.

Reply on news.ycombinator.com