GVisor

“Copy Fail? Also looks like memory safety, but is actually complexity. xint.io/blog/copy-fa... I am going to link to this while rejecting changes to Go crypto for years. Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security bound...”

“Hi HN, I've been building Nucleus, a lightweight Linux container runtime focused on two workloads: ephemeral AI-agent sandboxes and declarative NixOS services. It's a single Rust binary, no daemon.It is not a Docker replacement and not a strict subset of Docker either. I dropped ...”

“We performed an extensive comparison of Linux vs. TamaGo network performance under a VM. TamaGo+gVisor outperforms Linux (native or gVisor) by a ratio range of 50% - 500% (depending on packet size and core count). Test envs are simpler than prod, but I think this is promising.”

“support guest Landlock syscalls for in-sandbox application sandboxing. ### Description gVisor currently does not expose the Linux Landlock ABI. Tools such as nono and openai codex use Landlock as an unprivileged, inherited, kernel-enforced sandbox for filesystem, networking, and ...”

“Use a node-local overlayfs rootfs cache to eliminate per-restore untar during actor resume. # Summary During actor resume, nearly all wall-clock time is spent rebuilding the OCI rootfs from scratch (prepareOCIDirectory → untar), not restoring the checkpoint. This proposal builds ...”