mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Add ADOPTERS.md as single source of truth for gvisor users
Create ADOPTERS.md in the repository root documenting known production users and adopters of gVisor. Connect ADOPTERS.md directly to the website build system so the website is generated from this markdown document, eliminating the need to maintain a separate HTML page. PiperOrigin-RevId: 971782795
This commit is contained in:
+235
@@ -0,0 +1,235 @@
|
||||
# Who's Using gVisor
|
||||
|
||||
> **Note:** Using gVisor? You can add yourself to this page, contact
|
||||
> [[email protected]](mailto:[email protected]).
|
||||
|
||||
This page lists companies and organizations that are known to use gVisor. This
|
||||
does not constitute an endorsement.
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
## Companies and organizations using gVisor
|
||||
|
||||
### [3B](https://www.tines.com/3b/)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/tines_logo.svg" alt="Tines logo" height="40" align="right" />
|
||||
|
||||
Tines 3B is an AI-native platform for building agents, apps, and automations. It
|
||||
gives IT and security teams the visibility and control to govern that work.
|
||||
|
||||
> gVisor gives 3B a strong isolation boundary for running untrusted code. We use
|
||||
> checkpoint and restore to start each execution in a fresh, single-use sandbox.
|
||||
> Its filesystem extension points let us present durable, versioned storage as
|
||||
> familiar files and directories, while its network stack helps us control each
|
||||
> step's network access and bandwidth.
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Ant Group](https://www.antgroup.com/en)
|
||||
|
||||
Ant Group, develops online payment platforms. The company offers a wide range of
|
||||
financial services to consumers and businesses worldwide.
|
||||
|
||||
> At Ant Group, we are committed to keeping online transactions safe and
|
||||
> efficient. Continuously improving security for potential system-level attacks
|
||||
> is one of many measures. As a container runtime, gVisor provides
|
||||
> container-native security without sacrificing resource efficiency. Therefore,
|
||||
> it has been on our radar since it was released.
|
||||
|
||||
Read Ant Group's blog post on running gVisor in production at scale
|
||||
([source](https://gvisor.dev/blog/2021/12/02/running-gvisor-in-production-at-scale-in-ant/)).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Anthropic](https://www.anthropic.com/)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/anthropic_logo.png" alt="Anthropic logo" height="35" align="right" />
|
||||
|
||||
Anthropic is a leading AI safety and research company. They are known for
|
||||
building reliable, interpretable, and steerable AI systems.
|
||||
|
||||
Anthropic is a regular open-source contributor to gVisor. They use gVisor to
|
||||
securely contain code execution within claude.ai.
|
||||
|
||||
> The hypervisor, seccomp, and gVisor across our products have been dependable.
|
||||
> ([How we contain Claude across products](https://www.anthropic.com/engineering/how-we-contain-claude))
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Beam](https://www.beam.cloud/)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/logo_beam.png" alt="Beam logo" height="40" align="right" />
|
||||
|
||||
Beam is a cloud platform for running application workloads on GPUs and
|
||||
serverless CPUs, specializing in stateful code execution sandboxes for AI
|
||||
agents.
|
||||
|
||||
> Beam combines stateful snapshots, gVisor isolation, GPU acceleration, and
|
||||
> bring-your-own-compute so agents operate against a continuous, secure,
|
||||
> production-grade workspace.
|
||||
> ([Best Stateful Sandboxes for Code Execution in 2026](https://www.beam.cloud/blog/best-stateful-sandbox-code-execution-2026))
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Blink](https://www.blinkops.com/)
|
||||
|
||||
Blink is a company that specializes in security automation and orchestration
|
||||
powered by generative AI.
|
||||
|
||||
Blink uses gVisor to run pods with full isolation including system calls
|
||||
([source](https://www.blinkops.com/blog/run-containers-securely-with-gvisor-on-eks)).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Cloudflare](https://www.cloudflare.com)
|
||||
|
||||
Cloudflare is a content delivery network (CDN) and cloud computing security
|
||||
company. It provides a range of services to businesses of all sizes.
|
||||
|
||||
> It takes just a few seconds for a new gVisor container to start up and begin
|
||||
> executing meaningful work in a secure sandbox with near native performance.
|
||||
> ([A new era for Cloudflare Pages builds](https://blog.cloudflare.com/cloudflare-pages-build-improvements/))
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Deductive AI](https://deductive.ai/)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/deductive_ai_logo.svg" alt="Deductive AI logo" height="35" align="right" />
|
||||
|
||||
Deductive AI builds AI SRE agents for investigating production systems.
|
||||
|
||||
> Deductive uses gVisor as the compute isolation boundary for disposable
|
||||
> sandboxes that execute agent-generated code, combined with Cilium network
|
||||
> isolation and direct mTLS communication.
|
||||
> ([Building Secure Sandboxes for AI Agent Execution](https://deductive.ai/blogs/building-secure-sandboxes-for-ai-agent-execution))
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [DigitalOcean](https://www.digitalocean.com/)
|
||||
|
||||
DigitalOcean is a cloud computing provider that offers cloud infrastructure
|
||||
services to developers and businesses.
|
||||
|
||||
DigitalOcean uses gVisor in
|
||||
[App Platform](https://docs.digitalocean.com/products/app-platform/) as a
|
||||
container runtime sandbox
|
||||
([source](https://docs.digitalocean.com/products/app-platform/details/limits/)).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Docker](https://www.docker.com/)
|
||||
|
||||
Docker is a popular container management engine.
|
||||
|
||||
Docker for Mac
|
||||
[uses the gVisor network stack library](https://docs.docker.com/desktop/release-notes/#4190)
|
||||
for better performance than `vpnkit`. Note that on Docker for Linux, you can
|
||||
[use gVisor as a container runtime](https://gvisor.dev/docs/user_guide/quick_start/docker/).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Freedom of the Press Foundation](https://freedom.press/)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/freedom_of_the_press_foundation.svg" alt="Freedom of the Press Foundation logo" height="80" align="right" />
|
||||
|
||||
The Freedom of the Press Foundation is a non-profit supporting free speech and
|
||||
freedom of the press.
|
||||
|
||||
The [Dangerzone](https://dangerzone.rocks/) application converts potentially
|
||||
dangerous PDFs, office documents, or images and convert them to safe PDFs for
|
||||
use by journalists. The document conversion process runs in a
|
||||
[gVisor sandbox](https://github.com/freedomofpress/dangerzone/blob/main/docs/developer/gvisor.md).
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Google](https://www.google.com)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/logo_goog.png" alt="Google logo" height="45" align="right" />
|
||||
|
||||
gVisor was designed and developed to efficiently isolate production workloads at
|
||||
scale for Google services. There are millions of gVisor sandbox instances
|
||||
running daily. gVisor powers Google Cloud offerings
|
||||
[GKE Sandbox](https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods),
|
||||
[Cloud Run](https://cloud.google.com/run),
|
||||
[App Engine](https://cloud.google.com/appengine), and more.
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Grist](https://www.getgrist.com/)
|
||||
|
||||
Grist combines the flexibility and familiarity of spreadsheets with the power of
|
||||
databases.
|
||||
|
||||
Grist uses gVisor to isolate documents from each other and the network
|
||||
([source](https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents)).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Modal](https://www.modal.com)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/logo_modal.png" alt="Modal logo" height="40" align="right" />
|
||||
|
||||
Modal is a cloud platform that simplifies the execution and management of
|
||||
various computing workloads for data teams and application developers
|
||||
(particularly those working in the field of generative AI).
|
||||
|
||||
> Compute jobs at Modal are containerized and virtualized using gVisor.
|
||||
> ([Security at Modal](https://modal.com/docs/guide/security).)
|
||||
|
||||
Modal labs tweeted about fully running on gVisor
|
||||
([source](https://twitter.com/bernhardsson/status/1708929516955930699)).
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Northflank](https://northflank.com/)
|
||||
|
||||
Northflank is a developer platform that simplifies building, deploying, and
|
||||
scaling applications, databases, and jobs.
|
||||
|
||||
> Northflank uses gVisor to run GPU workloads inside sandboxed environments when
|
||||
> nested virtualization is unavailable on the underlying infrastructure.
|
||||
> ([GPU sandboxes: isolation models and platform support in 2026](https://northflank.com/blog/gpu-sandboxes)).
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [OpenAI](https://openai.com/)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/openai_logo.svg" alt="OpenAI logo" height="40" align="right" />
|
||||
|
||||
OpenAI develops Artificial Intelligence systems.
|
||||
|
||||
OpenAI uses gVisor for
|
||||
"[some higher-risk tasks](https://openai.com/index/securing-research-infrastructure-for-advanced-ai/)",
|
||||
such as
|
||||
[code execution](https://drive.google.com/file/d/1jjqrV76-86rdEcmFNnxMs4lI-ncAookn/view?resourcekey).
|
||||
|
||||
<br clear="right" />
|
||||
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
### [Tailscale](https://tailscale.com)
|
||||
|
||||
<img src="https://gvisor.dev/assets/logos/tailscale_logo.svg" alt="Tailscale logo" height="40" align="right" />
|
||||
|
||||
Tailscale provides a mesh-based VPN service designed to simplify secure
|
||||
networking between devices and servers.
|
||||
|
||||
> In userspace mode, Tailscale uses the gVisor netstack library, implementing
|
||||
> networking in userspace.
|
||||
> ([Kernel vs. netstack subnet routing & exit nodes](https://tailscale.com/kb/1177/kernel-vs-userspace-routers).)
|
||||
|
||||
<br clear="right" />
|
||||
@@ -21,6 +21,7 @@ exports_files([
|
||||
"SECURITY.md",
|
||||
"GOVERNANCE.md",
|
||||
"MAINTAINERS.md",
|
||||
"ADOPTERS.md",
|
||||
])
|
||||
|
||||
release_files(
|
||||
@@ -69,6 +70,16 @@ doc(
|
||||
weight = "20",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "adopters",
|
||||
src = "ADOPTERS.md",
|
||||
category = "Project",
|
||||
permalink = "/users/",
|
||||
subcategory = "Community",
|
||||
visibility = ["//website:__pkg__"],
|
||||
weight = "25",
|
||||
)
|
||||
|
||||
doc(
|
||||
name = "code_of_conduct",
|
||||
src = "CODE_OF_CONDUCT.md",
|
||||
|
||||
@@ -159,6 +159,9 @@ the `master` branch, which is then reflected into the `go` branch.
|
||||
|
||||
See [GOVERNANCE.md](GOVERNANCE.md) for project governance information.
|
||||
|
||||
See [ADOPTERS.md](ADOPTERS.md) for a list of known production users and
|
||||
adopters.
|
||||
|
||||
The [gvisor-users mailing list][gvisor-users-list] and
|
||||
[gvisor-dev mailing list][gvisor-dev-list] are good starting points for
|
||||
questions and discussion.
|
||||
|
||||
+1
-1
@@ -118,7 +118,6 @@ pkg_tar(
|
||||
"//website/application_compatibility:index.html",
|
||||
"//website/blog:index.html",
|
||||
"//website/security_track_record:index.html",
|
||||
"//website/users:index.html",
|
||||
] + glob([
|
||||
"_data/**",
|
||||
"assets/**",
|
||||
@@ -143,6 +142,7 @@ docs(
|
||||
name = "docs",
|
||||
deps = [
|
||||
":index",
|
||||
"//:adopters",
|
||||
"//:code_of_conduct",
|
||||
"//:contributing",
|
||||
"//:governance",
|
||||
|
||||
@@ -1,7 +0,0 @@
|
||||
package(
|
||||
default_applicable_licenses = ["//:license"],
|
||||
default_visibility = ["//website:__pkg__"],
|
||||
licenses = ["notice"],
|
||||
)
|
||||
|
||||
exports_files(["index.html"])
|
||||
@@ -1,493 +0,0 @@
|
||||
---
|
||||
title: Who's Using gVisor
|
||||
layout: base
|
||||
---
|
||||
|
||||
<div class="container">
|
||||
<div class="users-content">
|
||||
<h1>{{ page.title }}</h1>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<strong>Note:</strong>
|
||||
<span>
|
||||
Using gVisor? You can add yourself to this page, contact
|
||||
<a href="mailto:[email protected]"> [email protected]</a>
|
||||
</span>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
<p>
|
||||
This page lists companies that are known to use gVisor. This does not constitute an
|
||||
endorsement.
|
||||
</p>
|
||||
<h1>Companies using gVisor</h1>
|
||||
<hr />
|
||||
<!-- 3B -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://www.tines.com/3b/" class="feature-link"> 3B </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
Tines 3B is an AI-native platform for building agents, apps, and automations. It gives IT
|
||||
and security teams the visibility and control to govern that work.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
gVisor gives 3B a strong isolation boundary for running untrusted code. We use
|
||||
checkpoint and restore to start each execution in a fresh, single-use sandbox. Its
|
||||
filesystem extension points let us present durable, versioned storage as familiar
|
||||
files and directories, while its network stack helps us control each step's network
|
||||
access and bandwidth.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/tines_logo.svg"
|
||||
alt="Tines logo"
|
||||
title="Tines logo"
|
||||
class="img-responsive img-vert-center"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Ant Group -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://www.antgroup.com/en" class="feature-link"> Ant Group </a>
|
||||
</h2>
|
||||
<p class="info-users-text">
|
||||
Ant Group, develops online payment platforms. The company offers a wide range of financial
|
||||
services to consumers and businesses worldwide.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
At Ant Group, we are committed to keeping online transactions safe and efficient.
|
||||
Continuously improving security for potential system-level attacks is one of many
|
||||
measures. As a container runtime, gVisor provides container-native security without
|
||||
sacrificing resource efficiency. Therefore, it has been on our radar since it was
|
||||
released.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
<p class="info-users-text">
|
||||
Read Ant Group's blog post on running gVisor in production at scale (<a
|
||||
href="/blog/2021/12/02/running-gvisor-in-production-at-scale-in-ant/"
|
||||
>source</a
|
||||
>).
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Anthropic -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://www.anthropic.com/" class="feature-link"> Anthropic </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
Anthropic is a leading AI safety and research company. They are known for building
|
||||
reliable, interpretable, and steerable AI systems.
|
||||
</p>
|
||||
<p class="info-users-text">
|
||||
Anthropic is a regular open-source contributor to gVisor. They use gVisor to securely
|
||||
contain code execution within claude.ai.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
The hypervisor, seccomp, and gVisor across our products have been dependable. (<a
|
||||
href="https://www.anthropic.com/engineering/how-we-contain-claude"
|
||||
>How we contain Claude across products</a
|
||||
>)
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/anthropic_logo.png"
|
||||
alt="Anthropic logo"
|
||||
title="Anthropic logo"
|
||||
class="img-responsive img-vert-center"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Beam -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://www.beam.cloud/" class="feature-link"> Beam </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
Beam is a cloud platform for running application workloads on GPUs and serverless CPUs,
|
||||
specializing in stateful code execution sandboxes for AI agents.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
Beam combines stateful snapshots, gVisor isolation, GPU acceleration, and
|
||||
bring-your-own-compute so agents operate against a continuous, secure,
|
||||
production-grade workspace. (<a
|
||||
href="https://www.beam.cloud/blog/best-stateful-sandbox-code-execution-2026"
|
||||
>Best Stateful Sandboxes for Code Execution in 2026</a
|
||||
>)
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/logo_beam.png"
|
||||
alt="Beam logo"
|
||||
title="Beam logo"
|
||||
class="img-responsive img-vert-center"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Blink -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://www.blinkops.com/" class="feature-link"> Blink </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
Blink is a company that specializes in security automation and orchestration powered by
|
||||
generative AI.
|
||||
</p>
|
||||
<p class="info-users-text">
|
||||
Blink uses gVisor to run pods with full isolation including system calls (<a
|
||||
href="https://www.blinkops.com/blog/run-containers-securely-with-gvisor-on-eks"
|
||||
>source</a
|
||||
>).
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Cloudflare -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://www.cloudflare.com" class="feature-link"> Cloudflare </a>
|
||||
</h2>
|
||||
<p class="info-users-text">
|
||||
Cloudflare is a content delivery network (CDN) and cloud computing security company. It
|
||||
provides a range of services to businesses of all sizes.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
It takes just a few seconds for a new gVisor container to start up and begin executing
|
||||
meaningful work in a secure sandbox with near native performance. (<a
|
||||
href="https://blog.cloudflare.com/cloudflare-pages-build-improvements/"
|
||||
>A new era for Cloudflare Pages builds</a
|
||||
>)
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Deductive AI -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://deductive.ai/" class="feature-link">
|
||||
Deductive AI
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text"> Deductive AI builds AI SRE agents for
|
||||
investigating production systems.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text"> Deductive uses gVisor as the compute
|
||||
isolation boundary for disposable sandboxes that execute
|
||||
agent-generated code, combined with Cilium network isolation and
|
||||
direct mTLS communication.
|
||||
(<a href="https://deductive.ai/blogs/building-secure-sandboxes-for-ai-agent-execution">Building Secure Sandboxes for AI Agent Execution</a>)
|
||||
</p>
|
||||
</div>
|
||||
</div> <!-- end panel -->
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/deductive_ai_logo.svg"
|
||||
alt="Deductive AI logo"
|
||||
title="Deductive AI logo"
|
||||
class="img-responsive img-vert-center"
|
||||
style="min-width: 85%; max-height: 120px;" />
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- DigitalOcean -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://www.digitalocean.com/" class="feature-link"> DigitalOcean </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
DigitalOcean is a cloud computing provider that offers cloud infrastructure services to
|
||||
developers and businesses.
|
||||
</p>
|
||||
<p class="info-users-text">
|
||||
DigitalOcean uses gVisor in
|
||||
<a href="https://docs.digitalocean.com/products/app-platform/">App Platform</a>
|
||||
as a container runtime sandbox (<a
|
||||
href="https://docs.digitalocean.com/products/app-platform/details/limits/"
|
||||
>source</a
|
||||
>).
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Docker -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://www.docker.com/" class="feature-link"> Docker </a>
|
||||
</h2>
|
||||
<p class="info-text">Docker is a popular container management engine.</p>
|
||||
<p class="info-users-text">
|
||||
Docker for Mac
|
||||
<a href="https://docs.docker.com/desktop/release-notes/#4190"
|
||||
>uses the gVisor network stack library</a
|
||||
>
|
||||
for better performance than <code>vpnkit</code>. Note that on Docker for Linux, you can
|
||||
<a href="/docs/user_guide/quick_start/docker/">use gVisor as a container runtime</a>.
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Freedom of the Press Foundation -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://freedom.press/" class="feature-link">
|
||||
Freedom of the Press Foundation
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
The Freedom of the Press Foundation is a non-profit supporting free speech and freedom of
|
||||
the press.
|
||||
</p>
|
||||
<p class="info-users-text">
|
||||
The <a href="https://dangerzone.rocks/">Dangerzone</a> application converts potentially
|
||||
dangerous PDFs, office documents, or images and convert them to safe PDFs for use by
|
||||
journalists. The document conversion process runs in a
|
||||
<a href="https://github.com/freedomofpress/dangerzone/blob/main/docs/developer/gvisor.md">
|
||||
gVisor sandbox</a
|
||||
>.
|
||||
</p>
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/freedom_of_the_press_foundation.svg"
|
||||
alt="Freedom of the Press Foundation logo"
|
||||
title="Freedom of the Press Foundation logo"
|
||||
class="img-responsive img-vert-center"
|
||||
style="min-width: 90%"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Google -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://www.google.com" class="feature-link"> Google </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
gVisor was designed and developed to efficiently isolate production workloads at scale for
|
||||
Google services. There are millions of gVisor sandbox instances running daily. gVisor
|
||||
powers Google Cloud offerings
|
||||
<a href="https://cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods">
|
||||
GKE Sandbox</a
|
||||
>, <a href="https://cloud.google.com/run">Cloud Run</a>,
|
||||
<a href="https://cloud.google.com/appengine">App Engine</a>, and more.
|
||||
</p>
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/logo_goog.png"
|
||||
alt="Google logo"
|
||||
title="Google logo"
|
||||
class="img-responsive img-vert-center"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Grist -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://www.getgrist.com/" class="feature-link"> Grist </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
Grist combines the flexibility and familiarity of spreadsheets with the power of
|
||||
databases.
|
||||
</p>
|
||||
<p class="info-users-text">
|
||||
Grist uses gVisor to isolate documents from each other and the network (<a
|
||||
href="https://support.getgrist.com/self-managed/#how-do-i-sandbox-documents"
|
||||
>source</a
|
||||
>).
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Modal -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://www.modal.com" class="feature-link"> Modal </a>
|
||||
</h2>
|
||||
<p class="info-users-text">
|
||||
Modal is a cloud platform that simplifies the execution and management of various
|
||||
computing workloads for data teams and application developers (particularly those working
|
||||
in the field of generative AI).
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
Compute jobs at Modal are containerized and virtualized using gVisor. (<a
|
||||
href="https://modal.com/docs/guide/security"
|
||||
>Security at Modal</a
|
||||
>.)
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
<p class="info-users-text">
|
||||
Modal labs tweeted about fully running on gVisor (<a
|
||||
href="https://twitter.com/bernhardsson/status/1708929516955930699"
|
||||
>source</a
|
||||
>).
|
||||
</p>
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/logo_modal.png"
|
||||
alt="Modal logo"
|
||||
title="Modal logo"
|
||||
class="img-responsive img-vert-center"
|
||||
/>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Northflank -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-12">
|
||||
<h2>
|
||||
<a href="https://northflank.com/" class="feature-link"> Northflank </a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
Northflank is a developer platform that simplifies building, deploying, and scaling
|
||||
applications, databases, and jobs.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text">
|
||||
Northflank uses gVisor to run GPU workloads inside sandboxed environments when nested
|
||||
virtualization is unavailable on the underlying infrastructure. (<a
|
||||
href="https://northflank.com/blog/gpu-sandboxes"
|
||||
>GPU sandboxes: isolation models and platform support in 2026</a
|
||||
>).
|
||||
</p>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end panel -->
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- OpenAI -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://openai.com/" class="feature-link">
|
||||
OpenAI
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-text">
|
||||
OpenAI develops Artificial Intelligence systems.
|
||||
</p>
|
||||
<p class="info-users-text">
|
||||
OpenAI uses gVisor for
|
||||
"<a href="https://openai.com/index/securing-research-infrastructure-for-advanced-ai/">some higher-risk tasks</a>",
|
||||
such as
|
||||
<a href="https://drive.google.com/file/d/1jjqrV76-86rdEcmFNnxMs4lI-ncAookn/view?resourcekey">code execution</a>.
|
||||
</p>
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/openai_logo.svg"
|
||||
alt="OpenAI logo"
|
||||
title="OpenAI logo"
|
||||
class="img-responsive img-vert-center"
|
||||
style="max-height: 120px;" />
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<hr />
|
||||
<!-- Tailscale -->
|
||||
<div class="row display-flex no-space">
|
||||
<div class="col-md-8">
|
||||
<h2>
|
||||
<a href="https://tailscale.com" class="feature-link">
|
||||
Tailscale
|
||||
</a>
|
||||
</h2>
|
||||
<p class="info-users-text"> Tailscale provides a mesh-based VPN service
|
||||
designed to simplify secure networking between devices and servers.
|
||||
</p>
|
||||
<div class="panel panel-default">
|
||||
<div class="panel-body">
|
||||
<p class="info-users-text"> In userspace mode, Tailscale uses the
|
||||
gVisor netstack library, implementing networking in userspace.
|
||||
(<a href="https://tailscale.com/kb/1177/kernel-vs-userspace-routers">Kernel vs. netstack subnet routing & exit nodes</a>.)
|
||||
</p>
|
||||
</div>
|
||||
</div> <!-- end panel -->
|
||||
</div>
|
||||
<div class="col-md-4">
|
||||
<div>
|
||||
<img
|
||||
src="/assets/logos/tailscale_logo.svg"
|
||||
alt="Tailscale logo"
|
||||
title="Tailscale logo"
|
||||
class="img-responsive img-vert-center"
|
||||
style="max-height: 120px;" />
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<!-- end div with padding -->
|
||||
</div>
|
||||
<!-- end container -->
|
||||
Reference in New Issue
Block a user