Latest News And Updates - Rad Web Hosting Blog

Learn How to Deploy gVisor on Ubuntu VPS! This article provides a guide demonstrating how to deploy gVisor on Ubuntu VPS. Introduction gVisor is an open-source application kernel developed by Google that provides an additional security layer between containerized applications and the Linux kernel. Unlike traditional containers that share the host kernel directly, gVisor intercepts system calls through a user-space kernel (runsc), significantly reducing the attack surface available to compromised containers. This guide demonstrates how to deploy gVisor on Ubuntu VPS using Docker. What You'll Learn After completing this guide, you'll have: Docker installed gVisor installed Docker configured to use the gVisor runtime A working sandboxed container environment The ability to choose between standard Docker (runc) and secure (runsc) runtimes Recommended Server Requirements Resource Minimum Recommended Ubuntu 22.04 LTS 24.04 LTS CPU 2 vCPU 4+ vCPU RAM 2 GB 4 GB+ Disk 20 GB SSD 40 GB SSD Architecture x86_64 or ARM64 x86_64 Understanding gVisor Normally a container runs like this: Application │ Container │ Linux Kernel │ Hardware With gVisor: Application │ Container │ gVisor (runsc) │ Linux Kernel │ Hardware The container communicates with the gVisor user-space kernel rather than directly with the host kernel, preventing many classes of kernel escape attacks. How to Deploy gVisor on Ubuntu VPS To deploy gVisor on Ubuntu VPS, follow the steps below: Update Ubuntu sudo apt update sudo apt upgrade -y sudo reboot Reconnect after reboot. Install Docker Install prerequisites: sudo apt install -y \ ca-certificates \ curl \ gnupg \ lsb-release Create Docker keyring: sudo mkdir -p /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \ sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg Add the Docker repository: echo \ "deb [arch$(dpkg --print-architecture) \ signed-by/etc/apt/keyrings/docker.gpg] \ https://download.docker.com/linux/ubuntu \ $(lsb_release -cs) stable" | \ sudo tee /etc/apt/sources.list.d/docker.list > /dev/null Install Docker: sudo apt update sudo apt install -y \ docker-ce \ docker-ce-cli \ containerd.io \ docker-buildx-plugin \ docker-compose-plugin Verify: docker --version Example: Docker version 28.x.x Install gVisor Install prerequisites: sudo apt install -y \ apt-transport-https \ ca-certificates \ curl \ gnupg Add the gVisor signing key: curl -fsSL https://gvisor.dev/archive.key | \ sudo gpg --dearmor \ -o /usr/share/keyrings/gvisor-archive-keyring.gpg Add the repository: echo \ "deb [arch$(dpkg --print-architecture) \ signed-by/usr/share/keyrings/gvisor-archive-keyring.gpg] \ https://storage.googleapis.com/gvisor/releases release main" | \ sudo tee /etc/apt/sources.list.d/gvisor.list Install: sudo apt update sudo apt install -y runsc The apt package automatically configures Docker when Docker is present. Verify Installation runsc --version Example: runsc version release-2026... Configure Docker Runtime If Docker was already installed before gVisor, configure it: sudo runsc install Reload Docker: sudo systemctl restart docker This registers a runtime named: runsc with Docker. Verify Runtime Run: docker info Look for: Runtimes: io.containerd.runc.v2 runc runsc Test gVisor Run: docker run --runtimerunsc --rm hello-world Expected: Hello from Docker! Confirm You're Running Under gVisor Execute: docker run \ --runtimerunsc \ -it ubuntu dmesg Instead of the host kernel log, you'll see gVisor's distinctive startup messages (for example, "Starting gVisor…" followed by humorous initialization lines), indicating the container is communicating with the gVisor kernel rather than the host kernel. Run Ubuntu Under gVisor docker run \ --runtimerunsc \ -it ubuntu bash Install software normally: apt update apt install -y nginx Make gVisor the Default Runtime (Optional) Edit: sudo nano /etc/docker/daemon.json Example: { "default-runtime": "runsc", "runtimes": { "runsc": { "path": "/usr/bin/runsc" } } } Restart Docker: sudo systemctl restart docker Now all containers use gVisor unless another runtime is specified. Run Specific Containers Normally If gVisor is your default but a workload needs the standard runtime: docker run \ --runtimerunc \ ubuntu Using Docker Compose Example: services: web: image: nginx runtime: runsc ports: - "80:80" Then: docker compose up -d Viewing Installed Runtimes docker info | grep Runtime or docker info Benchmark Performance Standard runtime: time docker run --rm ubuntu echo Hello gVisor: time docker run --runtimerunsc --rm ubuntu echo Hello Expect some performance overhead—especially for syscall-heavy and I/O-intensive workloads—in exchange for stronger isolation. Using the KVM Platform gVisor supports multiple execution platforms: ptrace systrap KVM The KVM platform can improve performance on supported bare-metal systems with hardware virtualization enabled. It requires /dev/kvm and appropriate permissions (typically membership in the kvm group). It is generally not available on many virtual private servers because nested virtualization is often disabled. Security Best Practices Keep Ubuntu updated. Use minimal container images. Avoid privileged containers. Mount host volumes as read-only where possible. Drop unnecessary Linux capabilities. Limit CPU and memory resources. Run containers as non-root users. Use Docker secrets for sensitive data. Scan images with tools such as Trivy or Docker Scout. Keep runsc updated to receive the latest security improvements. Common Commands Check version: runsc --version Install Docker runtime: sudo runsc install Restart Docker: sudo systemctl restart docker Run container: docker run --runtimerunsc ubuntu Interactive shell: docker run --runtimerunsc -it ubuntu bash Troubleshooting runsc: command not found which runsc If absent: sudo apt install runsc Docker Doesn't Show runsc Reinstall the runtime: sudo runsc install sudo systemctl restart docker Verify Docker Configuration cat /etc/docker/daemon.json You should see: "runtimes": { "runsc": { "path": "/usr/bin/runsc" } } Container Won't Start Inspect logs: journalctl -u docker Check Runtime docker inspect Look for: Runtime: runsc Production Recommendations For production deployments: Use Ubuntu 24.04 LTS. Keep Docker and gVisor current. Integrate with CI/CD image scanning. Monitor container performance and syscall overhead. Pair gVisor with AppArmor or SELinux (where applicable), read-only root filesystems, seccomp profiles, and network policies for layered defense. Test application compatibility before switching all workloads to runsc, as some low-level kernel features and privileged operations are intentionally restricted. Conclusion You now know how to deploy gVisor on Ubuntu VPS. gVisor provides a strong additional security boundary for containerized workloads by placing a user-space kernel between applications and the host Linux kernel. While it introduces some performance overhead, it significantly reduces the impact of many container escape techniques and is well suited for multi-tenant platforms, CI/CD runners, code execution services, and other environments where workload isolation is a priority. By combining gVisor with Docker best practices and regular updates, you can substantially improve the security posture of your Ubuntu VPS container infrastructure.

Rad Web Hosting Blog

Recent Posts

Nothing Found

My Feed at https://radwebhosting.com

Services

Categories

Recent Posts

Save on VPS Hosting!

We’re Social!

Rad Web Hosting Blog