# gVisor

![](https://2146076455-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnkD4RCjP1WLRakyVkU17%2Fuploads%2FC5lPcs0eejbFsOjeF09O%2Fimage.png?alt=media\&token=294406b4-c23f-496e-b450-4b0668e31a10)&#x20;

An **application kernel** for **containers** that provides efficient defense-in-depth anywhere.

## Container-native Security

By providing each container with its own application kernel, gVisor limits the attack surface of the host. This protection does not limit functionality: gVisor runs unmodified binaries and integrates with container orchestration systems, such as Docker and Kubernetes, and supports features such as volumes and sidecars.

## Resource Efficiency

Containers are efficient because workloads of different shapes and sizes can be packed together by sharing host resources. gVisor uses host-native abstractions, such as threads and memory mappings, to co-operate with the host and enable the same resource model as native containers.

## Platform Portability

Modern infrastructure spans multiple cloud services and data centers, often with a mix of managed services and virtualized or traditional servers. The pluggable platform architecture of gVisor allows it to run anywhere, enabling consistent security policies across multiple environments without having to rearchitect your infrastructure.



For more information, please visit [gVisor Documentation](https://gvisor.dev/docs/).

