What gVisor does
A container normally sends its system calls straight to the kernel of the host. gVisor puts its own kernel in between. That kernel is written in Go, runs in user space and implements the Linux system call interface itself. Only a small, filtered set of calls goes on to the host.
How it compares with a microVM
gVisor needs no hardware virtualization, so it runs where virtual machines are not available. A microVM gives each sandbox a separate guest kernel. gVisor gives each sandbox a separate user-space kernel in front of the shared host kernel.
Referencegvisor.dev
