# gVisor 45 Hacker News commenters recommended gVisor and 16 criticized it, November 2025 to November 2026. It was recommended in 12 of 13 months. It meets the Hacker Approved badge rule. **Verdict:** Recommended as a sandbox that intercepts syscalls so workloads never touch the host kernel, and it works without KVM. Main caveat: performance overhead and compatibility gaps. ## Why people recommend it - Strong isolation from the host kernel (4 comments): "you can use the runsc (gvisor) runtime for docker, if you are careful not to expose vulnerable protocols to the container there will be nothing escaping it with that runtime" ([source](https://news.ycombinator.com/item?id=46508099)) "we use gVisor to intercept syscalls so the workload is fully isolated from the host" ([source](https://news.ycombinator.com/item?id=46851196)) "even with the exploit you're trapped in a sandbox with no access to the host node" ([source](https://news.ycombinator.com/item?id=46849436)) - Works without KVM or nested virtualization (3 comments): "we didn't want to require KVM/ hardware support so we went with gVisor and have been very happy with it" ([source](https://news.ycombinator.com/item?id=49299426)) "One of the big benefits that gVisor offers is that it doesn't require nested virtualization" ([source](https://news.ycombinator.com/item?id=46999119)) "gVisor is still pretty useful for untrusted workloads when you don't have KVM" ([source](https://news.ycombinator.com/item?id=49955217)) - Small attack surface (3 comments): "really strong sandboxing solutions, such as gvisor or firecracker, do a really good job of having very little attack surface" ([source](https://news.ycombinator.com/item?id=47726293)) "something like gVisor to limit the attack surface of a containerized process" ([source](https://news.ycombinator.com/item?id=46306196)) "gvisor in particular helps you further reduce attack surface for root" ([source](https://news.ycombinator.com/item?id=49507118)) - Drop-in runtime for containers (3 comments): "You can also try changing the underlying container runtime to something like gVisor if you want more security" ([source](https://news.ycombinator.com/item?id=46692176)) "If I want to use gVisor instead of Docker, that should be a very small adaptation." ([source](https://news.ycombinator.com/item?id=46849090)) "consider alternative runtimes such as runsc (also known as gVisor)" ([source](https://news.ycombinator.com/item?id=46733322)) ## What people warn about - Heavy syscall and memory overhead (9 comments): "theoretically you can get to fairly complete security via containers + a gVisor setup but at the expense of a ton of syscall performance" ([source](https://news.ycombinator.com/item?id=47668300)) "It drives the cost up by like 3 orders of magnitude and it pairs well with other mitigations." ([source](https://news.ycombinator.com/item?id=49371283)) "Memory overhead is real—about 120MB per sandbox vs 15MB for raw containers." ([source](https://news.ycombinator.com/item?id=47365698)) - Compatibility gaps and limitations (5 comments): "gVisor does have some compatibility issue, as it is re-implementation of the kernel in Go." ([source](https://news.ycombinator.com/item?id=49804039)) "it has a pretty long list of limitations that make it difficult to deploy transparently" ([source](https://news.ycombinator.com/item?id=49955050)) "DNS resolution is completely different with runsc vs runc and had to switch back." ([source](https://news.ycombinator.com/item?id=48351240)) - Hard to set up (2 comments): "Standalone gvisor (not the 'do' subcommand) used to be a mess with the OCI json requirement" ([source](https://news.ycombinator.com/item?id=48690216)) "I did like gVisor from Google. It wasn't easy to figure out how to get it working tho." ([source](https://news.ycombinator.com/item?id=49770821)) - Weaker isolation than hypervisors (2 comments): "exposes a slightly broader attack surface due to the tighter integration model" ([source](https://news.ycombinator.com/item?id=49454115)) "gvisor isn't quite the same security level though" ([source](https://news.ycombinator.com/item?id=49970052)) ## Alternatives hackers recommend - [Podman](https://hackerapproved.com/p/podman.md): 276 recommend - [OrbStack](https://hackerapproved.com/p/orbstack.md): 97 recommend - [Apple container](https://hackerapproved.com/p/apple-container.md): 56 recommend - [Colima](https://hackerapproved.com/p/colima.md): 39 recommend - [LXC](https://hackerapproved.com/p/lxc.md): 34 recommend ## Cite as Hacker Approved, "gVisor", https://hackerapproved.com/p/gvisor/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).