Nice, albeit I am not sure I understand the threat profile. I see something like gvisor making sense in a multi-tenant enviroment, but presumably OP is not pulling in the sketchiest of sketchy dependencies and build artifacts. Further, I cannot see how something like this protects you against something like a typical supplychain attack.
Nice, albeit I am not sure I understand the threat profile. I see something like gvisor making sense in a multi-tenant enviroment, but presumably OP is not pulling in the sketchiest of sketchy dependencies and build artifacts. Further, I cannot see how something like this protects you against something like a typical supplychain attack.
That sounds like a huge hit to performance
Per syscall performance overhead has surprisingly low impact on overall performance of programs. gVisor's benchmarks are here: https://gvisor.dev/docs/architecture_guide/performance/