gVisor

gVisor is a user-space kernel that serves a workload's system calls itself, so that only a narrow, filtered set of calls reaches the host kernel.

gVisor is a user-space kernel that sits between a workload and the host kernel. gVisor reimplements much of the Linux system call interface in a user-space process, and that process serves the system calls of the workload. Only a narrow, filtered set of calls ever reaches the host kernel, so the workload never talks to the host kernel directly.