Google Open Source Blog gVisor is a sandboxing technology that provides a secure environment for running untrusted code. Directfs is a new filesystem access mode that uses these primitives to expose the container filesystem to the sandbox in a secure manner. The sandbox process is not given access to anything mounted on the broader host.
Table of contents
Origins of the GoferIsolating the Container Filesystem in runscDirectfsPerformanceConclusionSort: