Hacker News Reader

Hello, cool project!

Can you explain to me what the benefit of using this is versus something like an LXC container? It is currently my preferred "temp dev env" that behaves like a full system. It can also be customized with cloud-init to load up my preferred settings.

View on HN

gVisor virtualizes all syscalls which pass through a host userspace golang process that then maps onto the host's syscalls.

That sounds like a huge hit to performance

Per syscall performance overhead has surprisingly low impact on overall performance of programs. gVisor's benchmarks are here: https://gvisor.dev/docs/architecture_guide/performance/

Nice, albeit I am not sure I understand the threat profile. I see something like gvisor making sense in a multi-tenant enviroment, but presumably OP is not pulling in the sketchiest of sketchy dependencies and build artifacts. Further, I cannot see how something like this protects you against something like a typical supplychain attack.

Reply on news.ycombinator.com