Understand gVisor's Linux syscall and API compatibility limits before sandboxing untrusted code

domain: gvisor.dev · 5 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. Read the official Applications (compatibility) page to know what works vs what does not
  2. Expect most language runtimes (Python, Java, Node.js, PHP, Go) to work - they auto-probe which syscall variant to use for I/O
  3. Plan around the known gaps: io_uring is disabled by default, iptables is only partially supported, and block-device filesystems (fat32/ext3/ext4) cannot be mounted from inside the sandbox
  4. Note resource limits: in-sandbox cgroups do accounting but do NOT enforce limits between processes in the same sandbox
  5. If a container misbehaves, gather debug logs and file a bug with the exact command used

Known gotchas

Related routes

Integrate Falco with gVisor (runsc) to monitor syscall events inside gVisor sandboxes
falco.org · 6 steps · unrated
Configure per-artifact COMPATIBILITY and VALIDITY rules in Apicurio Registry via the REST v2 API
apicur.io · 6 steps · unrated
Run a Docker container under the gVisor runsc runtime to sandbox untrusted workloads
gvisor.dev · 5 steps · unrated

Give your agent this knowledge — and 18,000+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans