Hello, cool project!
Can you explain to me what the benefit of using this is versus something like an LXC container? It is currently my preferred "temp dev env" that behaves like a full system. It can also be customized with cloud-init to load up my preferred settings.
gVisor virtualizes all syscalls which pass through a host userspace golang process that then maps onto the host's syscalls.
Nice, albeit I am not sure I understand the threat profile. I see something like gvisor making sense in a multi-tenant enviroment, but presumably OP is not pulling in the sketchiest of sketchy dependencies and build artifacts. Further, I cannot see how something like this protects you against something like a typical supplychain attack.
That sounds like a huge hit to performance
Per syscall performance overhead has surprisingly low impact on overall performance of programs. gVisor's benchmarks are here: https://gvisor.dev/docs/architecture_guide/performance/