gvisor

gVisor is an application kernel designed to provide enhanced isolation for containers by creating a strong boundary between applications and the host operating system. It implements a Linux-like interface while running in user space with memory safety, and integrates seamlessly with Docker and Kubernetes through its OCI runtime, `runsc`. Notable features include its ability to limit host kernel surface access while offering familiar application functionalities, thus improving security without the overhead of traditional virtual machines.