Investigate gVisor

[xunholy]

Details

https://github.com/google/gvisor

Note: Currently supports ARM64

[issue-label-bot]

Issue-Label Bot is automatically applying the label feature_request to this issue, with a confidence of 0.83. Please mark this comment with 👍 or 👎 to give our bot feedback!

Links: app homepage, dashboard and code for this bot.

[carpenike]

Interesting...

https://gvisor.dev/docs/user_guide/containerd/quick_start/

I get the feeling this would introduce a layer that would become a pita to troubleshoot.

[xunholy]

@carpenike gvisor provides a lot of additional security if my k8s cluster were to be compromised.

Interestingly I have found some open issues in conjunction with using gvisor and istio together - google/gvisor#170