gVisor: Architecture and Security Boundaries for Container Isolation

Explore the architecture, platforms, and security boundaries of gVisor, an application kernel written in Go that implements Linux system call interface, in this 21-minute conference talk. Gain insights into how gVisor provides an additional isolation layer between applications and host operating systems, understand its threat model, and learn about Google's continuous security approach. Examine real-world case studies of discovered vulnerabilities and their exploitability analysis to better comprehend container security implications.