How to Deploy gVisor on Ubuntu VPS

This article provides a guide demonstrating how to deploy gVisor on Ubuntu VPS.

Introduction

gVisor is an open-source application kernel developed by Google that provides an additional security layer between containerized applications and the Linux kernel. Unlike traditional containers that share the host kernel directly, gVisor intercepts system calls through a user-space kernel (runsc), significantly reducing the attack surface available to compromised containers.

This guide demonstrates how to deploy gVisor on Ubuntu VPS using Docker.

What You’ll Learn

After completing this guide, you’ll have:

• Docker installed
• gVisor installed
• Docker configured to use the gVisor runtime
• A working sandboxed container environment
• The ability to choose between standard Docker (runc) and secure (runsc) runtimes

Recommended Server Requirements

Understanding gVisor

Normally a container runs like this:

Application
      │
Container
      │
Linux Kernel
      │
Hardware

With gVisor:

Application
      │
Container
      │
gVisor (runsc)
      │
Linux Kernel
      │
Hardware

The container communicates with the gVisor user-space kernel rather than directly with the host kernel, preventing many classes of kernel escape attacks.

Compare Ubuntu VPS Plans

How to Deploy gVisor on Ubuntu VPS

To deploy gVisor on Ubuntu VPS, follow the steps below:

1. Update Ubuntu

   sudo apt update
   sudo apt upgrade -y
   sudo reboot
   

   Reconnect after reboot.

2. Install Docker

   Install prerequisites:

   sudo apt install -y \
       ca-certificates \
       curl \
       gnupg \
       lsb-release
   

   Create Docker keyring:

   sudo mkdir -p /etc/apt/keyrings
   
   curl -fsSL https://download.docker.com/linux/ubuntu/gpg | \
   sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
   

   Add the Docker repository:

   echo \
   "deb [arch=$(dpkg --print-architecture) \
   signed-by=/etc/apt/keyrings/docker.gpg] \
   https://download.docker.com/linux/ubuntu \
   $(lsb_release -cs) stable" | \
   sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
   

   Install Docker:

   sudo apt update
   
   sudo apt install -y \
   docker-ce \
   docker-ce-cli \
   containerd.io \
   docker-buildx-plugin \
   docker-compose-plugin
   

   Verify:

   docker --version
   

   Example:

   Docker version 28.x.x
   

3. Install gVisor

   Install prerequisites:

   sudo apt install -y \
   apt-transport-https \
   ca-certificates \
   curl \
   gnupg
   

   Add the gVisor signing key:

   curl -fsSL https://gvisor.dev/archive.key | \
   sudo gpg --dearmor \
   -o /usr/share/keyrings/gvisor-archive-keyring.gpg
   

   Add the repository:

   echo \
   "deb [arch=$(dpkg --print-architecture) \
   signed-by=/usr/share/keyrings/gvisor-archive-keyring.gpg] \
   https://storage.googleapis.com/gvisor/releases release main" | \
   sudo tee /etc/apt/sources.list.d/gvisor.list
   

   Install:

   sudo apt update
   sudo apt install -y runsc
   

   The apt package automatically configures Docker when Docker is present.

4. Verify Installation

   runsc --version
   

   Example:

   runsc version release-2026...
   

5. Configure Docker Runtime

   If Docker was already installed before gVisor, configure it:

   sudo runsc install
   

   Reload Docker:

   sudo systemctl restart docker
   

   This registers a runtime named:

   runsc
   

   with Docker.

6. Verify Runtime

   Run:

   docker info
   

   Look for:

   Runtimes:
       io.containerd.runc.v2
       runc
       runsc
   

7. Test gVisor

   Run:

   docker run --runtime=runsc --rm hello-world
   

   Expected:

   Hello from Docker!
   

8. Confirm You’re Running Under gVisor

   Execute:

   docker run \
   --runtime=runsc \
   -it ubuntu dmesg
   

   Instead of the host kernel log, you’ll see gVisor’s distinctive startup messages (for example, “Starting gVisor…” followed by humorous initialization lines), indicating the container is communicating with the gVisor kernel rather than the host kernel.

9. Run Ubuntu Under gVisor

   docker run \
   --runtime=runsc \
   -it ubuntu bash
   

   Install software normally:

   apt update
   
   apt install -y nginx
   

10. Make gVisor the Default Runtime (Optional)

    Edit:

    sudo nano /etc/docker/daemon.json
    

    Example:

    {
        "default-runtime": "runsc",
        "runtimes": {
            "runsc": {
                "path": "/usr/bin/runsc"
            }
        }
    }
    

    Restart Docker:

    sudo systemctl restart docker
    

    Now all containers use gVisor unless another runtime is specified.

11. Run Specific Containers Normally

    If gVisor is your default but a workload needs the standard runtime:

    docker run \
    --runtime=runc \
    ubuntu
    

Using Docker Compose

Example:

services:

  web:

    image: nginx

    runtime: runsc

    ports:
      - "80:80"

Then:

docker compose up -d

Viewing Installed Runtimes

docker info | grep Runtime

or

docker info

Benchmark Performance

Standard runtime:

time docker run --rm ubuntu echo Hello

gVisor:

time docker run --runtime=runsc --rm ubuntu echo Hello

Expect some performance overhead—especially for syscall-heavy and I/O-intensive workloads—in exchange for stronger isolation.

Using the KVM Platform

gVisor supports multiple execution platforms:

• ptrace
• systrap
• KVM

The KVM platform can improve performance on supported bare-metal systems with hardware virtualization enabled. It requires /dev/kvm and appropriate permissions (typically membership in the kvm group). It is generally not available on many virtual private servers because nested virtualization is often disabled.

Security Best Practices

• Keep Ubuntu updated.
• Use minimal container images.
• Avoid privileged containers.
• Mount host volumes as read-only where possible.
• Drop unnecessary Linux capabilities.
• Limit CPU and memory resources.
• Run containers as non-root users.
• Use Docker secrets for sensitive data.
• Scan images with tools such as Trivy or Docker Scout.
• Keep runsc updated to receive the latest security improvements.

Common Commands

Check version:

runsc --version

Install Docker runtime:

sudo runsc install

Restart Docker:

sudo systemctl restart docker

Run container:

docker run --runtime=runsc ubuntu

Interactive shell:

docker run --runtime=runsc -it ubuntu bash

Troubleshooting

• runsc: command not found

  which runsc
  

  If absent:

  sudo apt install runsc
  

• Docker Doesn’t Show runsc

  Reinstall the runtime:

  sudo runsc install
  sudo systemctl restart docker
  

• Verify Docker Configuration

  cat /etc/docker/daemon.json
  

  You should see:

  "runtimes": {
      "runsc": {
          "path": "/usr/bin/runsc"
      }
  }
  

• Container Won’t Start

  Inspect logs:

  journalctl -u docker
  

• Check Runtime

  docker inspect 
  

  Look for:

  Runtime: runsc
  

Production Recommendations

For production deployments:

• Use Ubuntu 24.04 LTS.
• Keep Docker and gVisor current.
• Integrate with CI/CD image scanning.
• Monitor container performance and syscall overhead.
• Pair gVisor with AppArmor or SELinux (where applicable), read-only root filesystems, seccomp profiles, and network policies for layered defense.
• Test application compatibility before switching all workloads to runsc, as some low-level kernel features and privileged operations are intentionally restricted.

Conclusion

You now know how to deploy gVisor on Ubuntu VPS.

gVisor provides a strong additional security boundary for containerized workloads by placing a user-space kernel between applications and the host Linux kernel. While it introduces some performance overhead, it significantly reduces the impact of many container escape techniques and is well suited for multi-tenant platforms, CI/CD runners, code execution services, and other environments where workload isolation is a priority.

By combining gVisor with Docker best practices and regular updates, you can substantially improve the security posture of your Ubuntu VPS container infrastructure.