### Build and Install containerd-shim-runsc-v1 using go get Source: https://github.com/google/gvisor/blob/master/README.md After installing 'runsc', use this command to build and install the shim binary for containerd. This command assumes 'runsc' has already been successfully installed. ```sh GO111MODULE=on sudo -E go build -o /usr/local/bin/containerd-shim-runsc-v1 gvisor.dev/gvisor/shim ``` -------------------------------- ### Example Pod Output Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/tutorials/knative.md Sample output from 'kubectl get pods' showing a pod running with 'gvisor' as its runtime class and 'Running' status. ```text NAME RUNTIME CLASS STATUS helloworld-go-00002-deployment-646c87b7f5-5v68s gvisor Running ``` -------------------------------- ### Start Falco with gVisor Monitoring Enabled Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/tutorials/falco.md Starts Falco with flags to enable gVisor monitoring, specifying the configuration and root paths. Ensure Falco and gVisor are installed and configured. ```shell sudo falco \ -c /etc/falco/falco.yaml \ --gvisor-config /etc/falco/pod-init.json \ --gvisor-root /var/run/docker/runtime-runc/moby ``` -------------------------------- ### gVisor Trace Output Example Source: https://github.com/google/gvisor/blob/master/examples/seccheck/README.md Example of the trace output received by the monitoring server when a container starts and performs syscalls. ```text Connection accepted Start => id: "runsc-329739" cwd: "/home/fvoznika" args: "echo" args: "123" E Open sysno: 257 fd: -100 pathname: "/usr/lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v3/libc.so.6" flags: 524288 X Open exit { errorno: 2 } sysno: 257 fd: -100 pathname: "/usr/lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v3/libc.so.6" flags: 524288 E Open sysno: 257 fd: -100 pathname: "/usr/lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v2/libc.so.6" flags: 524288 X Open exit { errorno: 2 } sysno: 257 fd: -100 pathname: "/usr/lib/x86_64-linux-gnu/glibc-hwcaps/x86-64-v2/libc.so.6" flags: 524288 ... TaskExit => Connection closed ``` -------------------------------- ### Install CheckLocks Analyzer Source: https://github.com/google/gvisor/blob/master/tools/checklocks/README.md Install the CheckLocks analyzer tool using `go install`. This command fetches and installs the latest version of the tool. ```sh go install gvisor.dev/gvisor/tools/checklocks/cmd/checklocks@go ``` -------------------------------- ### Install gVisor and Configure Docker Source: https://github.com/google/gvisor/blob/master/website/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md Installs gVisor and configures Docker to use it as a runtime. Ensure you have the necessary prerequisites like curl and gnupg installed. ```shell sudo apt-get update && \ sudo apt-get install -y \ apt-transport-https \ ca-certificates \ curl \ gnupg && \ curl -fsSL https://gvisor.dev/archive.key | sudo gpg --dearmor -o /usr/share/keyrings/gvisor-archive-keyring.gpg && \ echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gvisor-archive-keyring.gpg] https://storage.googleapis.com/gvisor/releases release main" | sudo tee /etc/apt/sources.list.d/gvisor.list > /dev/null && \ sudo apt-get update && sudo apt-get install -y runsc && \ sudo runsc install -- --nvproxy=true --nvproxy-allowed-driver-capabilities=all --net-raw=true --allow-packet-socket-write=true --host-uds=all --debug-log=/tmp/runsc/ && \ sudo systemctl restart docker ``` -------------------------------- ### Build and Install runsc using go get Source: https://github.com/google/gvisor/blob/master/README.md Use this command to build and install the 'runsc' binary directly from the synthetic 'go' branch. Ensure you have a 'go.mod' file in your current directory. ```sh echo "module runsc" > go.mod GO111MODULE=on go get gvisor.dev/gvisor/runsc@go CGO_ENABLED=0 GO111MODULE=on sudo -E go build -o /usr/local/bin/runsc gvisor.dev/gvisor/runsc ``` -------------------------------- ### C++ Remote Sink Example Source: https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/sinks/remote/README.md This example demonstrates how to implement a remote sink monitoring process using C++. It provides a starting point for consuming trace points generated by gVisor sandboxes. ```C++ #include #include #include #include // Assume necessary headers for Protocol Buffers and Unix domain sockets are included. // For example: // #include // #include // #include // Placeholder for Protocol Buffers generated code for trace points. // namespace gvisor { // namespace seccheck { // namespace points { // class TraceEvent; // } // } // } int main() { // Define the Unix domain socket path. const char* socket_path = "/tmp/remote-sink.sock"; // Create a Unix domain socket client. // int sock_fd = socket(AF_UNIX, SOCK_SEQPACKET, 0); // if (sock_fd < 0) { // std::cerr << "Error creating socket." << std::endl; // return 1; // } // struct sockaddr_un addr; // addr.sun_family = AF_UNIX; // strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path) - 1); // Connect to the remote sink. // if (connect(sock_fd, (struct sockaddr*)&addr, sizeof(addr)) < 0) { // std::cerr << "Error connecting to socket." << std::endl; // close(sock_fd); // return 1; // } std::cout << "Connected to remote sink." << std::endl; // Perform handshake (simplified). // const char* handshake_msg = "gvisor-remote-sink-v1\n"; // if (send(sock_fd, handshake_msg, strlen(handshake_msg), 0) < 0) { // std::cerr << "Error sending handshake." << std::endl; // close(sock_fd); // return 1; // } // Buffer for receiving messages. // std::vector buffer(4096); // Read trace points in a loop. // while (true) { // ssize_t bytes_received = recv(sock_fd, buffer.data(), buffer.size(), 0); // if (bytes_received < 0) { // std::cerr << "Error receiving data." << std::endl; // break; // } // if (bytes_received == 0) { // std::cout << "Connection closed by server." << std::endl; // break; // } // Process received data. // In a real implementation, parse the header and deserialize the payload // using Protocol Buffers. // std::cout << "Received " << bytes_received << " bytes." << std::endl; // Example: Deserialize a TraceEvent proto. // gvisor::seccheck::points::TraceEvent event; // if (!event.ParseFromArray(buffer.data(), bytes_received)) { // std::cerr << "Failed to parse message as TraceEvent." << std::endl; // continue; // } // std::cout << "Received TraceEvent: " << event.ShortDebugString() << std::endl; // } // close(sock_fd); return 0; } ``` -------------------------------- ### Build and Install runsc Binary Source: https://github.com/google/gvisor/blob/master/README.md Builds the 'runsc' binary and installs it to the system. Ensure you have 'bazel' and other build dependencies installed. ```sh mkdir -p bin make copy TARGETS=runsc DESTINATION=bin/ sudo cp ./bin/runsc /usr/local/bin ``` -------------------------------- ### Go Remote Sink Server Example Source: https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/sinks/remote/README.md Example implementation of a remote sink server in Go. This code can serve as a starting point for creating a monitoring process that consumes trace points from gVisor sandboxes. ```Go package main import ( "context" "flag" "fmt" "io" "log" "net" "os" "github.com/google/gvisor/pkg/sentry/seccheck/points" "github.com/google/gvisor/runsc/secchemp" ) var ( addr = flag.String("addr", "/tmp/remote-sink.sock", "Unix domain socket address") ) func main() { flag.Parse() ctx := context.Background() // Remove the socket if it already exists. if err := os.RemoveAll(*addr); err != nil { log.Fatalf("Failed to remove socket %q: %v", *addr, err) } // Listen for connections. list, err := net.Listen("unix", *addr) if err != nil { log.Fatalf("Failed to listen on %q: %v", *addr, err) } log.Printf("Listening on %q", *addr) for { conn, err := list.Accept() if err != nil { log.Printf("Failed to accept connection: %v", err) continue } go handleConnection(ctx, conn) } } func handleConnection(ctx context.Context, conn net.Conn) { defer conn.Close() log.Printf("Accepted connection from %v", conn.RemoteAddr()) // The remote sink protocol requires a handshake. // See pkg/sentry/seccheck/sinks/remote/wire/wire.go for details. // For simplicity, we just send a dummy handshake response. // In a real implementation, you would parse the client's handshake // and send a compatible response. _, err := conn.Write([]byte("gvisor-remote-sink-v1\n")) if err != nil { log.Printf("Failed to send handshake: %v", err) return } // Read trace points from the socket. for { // The protocol uses SOCK_SEQPACKET, so each read should yield a full message. // We need to read the header first, then the payload. // For simplicity, we'll read into a buffer that's large enough for most messages. // A more robust implementation would dynamically size the buffer based on the header. buf := make([]byte, 4096) n, err := conn.Read(buf) if err != nil { if err == io.EOF { log.Printf("Connection closed by client: %v", conn.RemoteAddr()) } else { log.Printf("Failed to read from connection: %v", err) } return } // Process the received message. // In a real implementation, you would parse the header and payload // using the protobuf definitions. log.Printf("Received %d bytes: % x...", n, buf[:n]) // Example: Deserialize a trace point event if it's a trace point message. // This requires knowledge of the message type from the header. // For demonstration, we'll assume all messages are trace points and try to unmarshal. // In practice, you'd use the header to determine the correct proto type. // Placeholder for actual message processing: // msgType := getMessageType(buf[:n]) // Function to extract message type from header // switch msgType { // case secchemp.MsgTypeTracePoint: // var tp points.TraceEvent // if err := proto.Unmarshal(payload, &tp); err != nil { // log.Printf("Failed to unmarshal TraceEvent: %v", err) // continue // } // fmt.Printf("Trace Event: %+v\n", tp) // // Handle other message types... // } } } ``` -------------------------------- ### Build gVisor and Install Dev Runtime Source: https://github.com/google/gvisor/blob/master/images/systemd/README.md Build gVisor and install the development runtime (runsc-d). This is a prerequisite for running systemd tests. ```bash make dev ``` -------------------------------- ### Start Wordpress Containers with Docker Compose Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/tutorials/docker-compose.md Command to build and start the services defined in the docker-compose.yaml file. ```bash docker-compose up ``` -------------------------------- ### Install NVIDIA Driver and Build Tools Source: https://github.com/google/gvisor/blob/master/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md Installs necessary build tools and the specific NVIDIA driver version compatible with gVisor. Ensure DRIVER_VERSION is set correctly. ```shell $ sudo apt-get update && sudo apt-get -y upgrade $ sudo apt-get install -y build-essential linux-headers-$(uname -r) $ runsc nvproxy list-supported-drivers $ DRIVER_VERSION=some-driver-version # Get from your runsc binary. $ curl -fSsl -O "https://us.download.nvidia.com/tesla/$DRIVER_VERSION/NVIDIA-Linux-x86_64-$DRIVER_VERSION.run" $ sudo sh NVIDIA-Linux-x86_64-$DRIVER_VERSION.run ``` -------------------------------- ### Install Docker Runtime with Tracing Source: https://github.com/google/gvisor/blob/master/examples/seccheck/README.md Installs a custom Docker runtime that uses gVisor with tracing enabled, specifying the pod initialization configuration. ```shell $ sudo runsc install --runtime=runsc-trace -- --pod-init-config=$PWD/examples/seccheck/pod_init.json $ sudo systemctl restart docker $ docker run --rm --runtime=runsc-trace hello-world ``` -------------------------------- ### Build and Install runsc with Docker Source: https://github.com/google/gvisor/blob/master/CONTRIBUTING.md Use 'make dev' to build and install 'runsc' as a Docker runtime. Refresh the binary after changes with 'make refresh'. ```bash make dev docker run --rm --runtime=my-branch --rm hello-world make refresh ``` -------------------------------- ### Start nginx Container using crictl Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/containerd/containerd_11.md Execute the command to start the created nginx container. ```shell sudo crictl start ${CONTAINER_ID} ``` -------------------------------- ### Install runsc with Default kubectl Context Source: https://github.com/google/gvisor/blob/master/tools/gvisor_k8s_tool/README.md Use this command to install runsc using your current default kubectl context. Ensure the `my-runsc-installer` image is available. ```shell # Install using default kubectl context: $ ./gvisor_k8s_tool install --cluster=kube: --image=my-runsc-installer ``` -------------------------------- ### Install crictl binary Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/containerd/containerd_11.md Download and install the crictl binary for interacting with containerd's CRI. ```shell { wget https://github.com/kubernetes-sigs/cri-tools/releases/download/v1.13.0/crictl-v1.13.0-linux-amd64.tar.gz tar xf crictl-v1.13.0-linux-amd64.tar.gz sudo mv crictl /usr/local/bin } ``` -------------------------------- ### Install Nvidia User-Space Driver Components Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/gpu.md Install the user-space NVIDIA GPU driver components using the .run file after building and installing the kernel modules. The --no-kernel-modules flag is used to avoid rebuilding the kernel modules. ```bash # Install the user-space NVIDIA GPU driver components using the .run file. sudo sh NVIDIA-Linux-x86_64-$DRIVER_VERSION.run --no-kernel-modules ``` -------------------------------- ### Start Container and Fetch Metrics Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/observability.md Start a container using the runsc runtime and then fetch the exposed metrics using `curl`. The container ID is used to label the metrics. ```bash $ docker run -d --runtime=runsc --name=foobar debian sleep 1h 32beefcafe $ curl http://localhost:1337/metrics # Data for runsc metric server exporting data for sandboxes in root directory /var/run/docker/runtime-runc/moby # Writing data from 3 snapshots: [...] # HELP process_start_time_seconds Unix timestamp at which the process started. Used by Prometheus for counter resets. # TYPE process_start_time_seconds gauge process_start_time_seconds 1674599158.286067 1674599159819 # HELP runsc_fs_opens Number of file opens. # TYPE runsc_fs_opens counter runsc_fs_opens{iteration="42asdf",sandbox="32beefcafe"} 12 1674599159819 # HELP runsc_fs_read_wait Time waiting on file reads, in nanoseconds. # TYPE runsc_fs_read_wait counter runsc_fs_read_wait{iteration="42asdf",sandbox="32beefcafe"} 0 1674599159819 # [...] # End of metric data. ``` -------------------------------- ### Example: Setting up a TCP connection for testing Source: https://github.com/google/gvisor/blob/master/test/packetimpact/README.md Demonstrates how to set up a TCP connection for testing using `packetimpact`. This involves creating a DUT, setting up a listener, and then creating a `TCPIPv4` connection to perform a handshake. ```go func TestMyTcpTest(t *testing.T) { // Prepare a DUT for communication. dut := testbench.NewDUT(t) // This does: // dut.Socket() // dut.Bind() // dut.Getsockname() to learn the new port number // dut.Listen() listenFD, remotePort := dut.CreateListener(unix.SOCK_STREAM, unix.IPPROTO_TCP, 1) defer dut.Close(listenFD) // Tell the DUT to close the socket at the end of the test. // Monitor a new TCP connection with sniffer, injector, sequence number tracking, // and reasonable outgoing and incoming packet field default IPs, MACs, and port numbers. conn := testbench.NewTCPIPv4(t, dut, remotePort) // Perform a 3-way handshake: send SYN, expect SYNACK, send ACK. conn.Handshake() // Tell the DUT to accept the new connection. acceptFD := dut.Accept(acceptFd) } ``` -------------------------------- ### Go Benchmark Example using testing.B Source: https://github.com/google/gvisor/blob/master/test/benchmarks/README.md This Go benchmark demonstrates how to set up a machine and container, reset the timer, run a containerized command, and report custom metrics. Ensure to respect b.N for scaling and handle errors appropriately. ```golang func BenchmarkMyCoolOne(b *testing.B) { machine, err := harness.GetMachine() // check err defer machine.CleanUp() ctx := context.Background() container := machine.GetContainer(ctx, b) defer container.CleanUp(ctx) b.ResetTimer() // Respect b.N. for i := 0; i < b.N; i++ { out, err := container.Run(ctx, dockerutil.RunOpts{ Image: "benchmarks/my-cool-image", Env: []string{"MY_VAR=awesome"}, // other options...see dockerutil }, "sh", "-c", "echo MY_VAR") // check err... b.StopTimer() // Do parsing and reporting outside of the timer. number := parseMyMetric(out) b.ReportMetric(number, "my-cool-custom-metric") b.StartTimer() } } func TestMain(m *testing.M) { harness.Init() os.Exit(m.Run()) } ``` -------------------------------- ### Create Root Filesystem Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/quick_start/oci.md Sets up the container's root filesystem using the `hello-world` Docker image. This command exports the image and extracts it into the `rootfs` directory. ```bash mkdir --mode=0755 rootfs docker export $(docker create hello-world) | sudo tar -xf - -C rootfs --same-owner --same-permissions ``` -------------------------------- ### Example SELinux Denial Log Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/FAQ.md This is an example of an SELinux denial message that might appear in system audit logs when GVisor encounters permission issues within a nested container setup. ```text AVC avc: denied { mounton } for ... scontext=... tcontext=... permissive=0 ``` -------------------------------- ### Install Docker-in-gVisor Runtime Source: https://github.com/google/gvisor/blob/master/website/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md Installs the 'docker-in-gvisor' runtime with specific network and host-uds configurations required for Docker to function within gVisor. This setup is necessary for Hermes Agent's Docker backend. ```shell $ export CASPER="$HOME/agents/casper-3" $ runsc install --runtime=docker-in-gvisor -- --net-raw=true --allow-packet-socket-write=true --host-uds=all ``` -------------------------------- ### Example Test Workflow in Go Source: https://github.com/google/gvisor/blob/master/test/packetimpact/README.md Demonstrates a common testing pattern using `Drain`, `Send`, and `Expect` for verifying network frame handling. ```go conn.Drain() // Discard all outstanding frames. conn.Send(...) // Send a frame with overrides. // Now expect a frame with a certain header and fail if it doesn't arrive. if _, err := conn.Expect(...); err != nil { t.Fatal(...) } ``` ```go if gotOne, _ := conn.Expect(...); gotOne != nil { t.Fatal(...) } ``` -------------------------------- ### Create and Run a Docker Container Source: https://github.com/google/gvisor/blob/master/pkg/test/dockerutil/README.md This snippet demonstrates how to create a Docker container using dockerutil and run a command within it. Ensure the 'basic/alpine' image is available. ```go func TestSuperCool(t *testing.T) { ctx := context.Background() c := dockerutil.MakeContainer(ctx, t) got, err := c.Run(ctx, dockerutil.RunOpts{ Image: "basic/alpine" }, "echo", "super cool") if err != nil { t.Fatalf("err was not nil: %v", err) } want := "super cool" if !strings.Contains(got, want){ t.Fatalf("want: %s, got: %s", want, got) } } ``` -------------------------------- ### Configure Automatic Trace Connection Source: https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/README.md Installs runsc with tracing enabled and configures it to automatically connect to a monitoring process before the application starts, using a specified session configuration file. ```shell $ sudo runsc --install --runtime=runsc-trace -- --pod-init-config=$PWD/session.json ``` -------------------------------- ### Create Socket with Error Handling (Go) Source: https://github.com/google/gvisor/blob/master/test/packetimpact/README.md Demonstrates creating a socket using the testbench framework, including error checking for the file descriptor. ```go dut := testbench.NewDut(t) fd, err := dut.SocketWithErrno(unix.AF_INET, unix.SOCK_STREAM, unix.IPPROTO_IP) if fd < 0 { t.Fatalf(...) } ``` -------------------------------- ### Define Hermes Agent Dockerfile Source: https://github.com/google/gvisor/blob/master/website/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md Creates a Dockerfile for the Hermes Agent, starting from a base image and installing necessary system packages, Python dependencies for Matrix support and TTS, and the Docker client. ```dockerfile FROM nousresearch/hermes-agent:v2026.4.13 # Install basic packages. RUN export DEBIAN_FRONTEND=noninteractive; apt update -y && \ apt install -y sudo wget curl git build-essential python3-pip # Install dependencies for Hermes Agent's Matrix.org support. RUN export DEBIAN_FRONTEND=noninteractive; apt update -y && \ apt install -y libolm-dev && \ python3 -m pip config set global.break-system-packages true && \ pip install 'matrix-nio' 'mautrix[encryption]' # Install espeak-ng and NeuTTS model for local text-to-speech capabilities. RUN export DEBIAN_FRONTEND=noninteractive; apt update -y && \ apt install -y espeak-ng && \ pip install 'neutts[all]' # Install Docker; not required for dockerd since that's running in a separate # container, but Hermes Agent still needs the Docker **client** CLI. RUN export DEBIAN_FRONTEND=noninteractive; apt update -y && \ apt install -y docker.io ``` -------------------------------- ### Query Metric Server Metrics Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/observability.md After starting the metric server, you can query its metrics using `curl` via the Unix domain socket. This example shows how to retrieve metrics and filter for a specific sandbox ID. ```shell $ metric_server_id="$(docker inspect --format='{{.ID}}' runsc-metric-server)" $ sudo curl --unix-socket /run/docker/runsc-metrics.sock http://runsc-metrics/metrics | grep "$metric_server_id" # - Snapshot with 175 data points taken at 2023-01-25 15:45:33.70256855 -0800 -0800: map[iteration:2407456650315156914 sandbox:737ce142058561d764ad870d028130a29944821dd918c7979351b249d5d30481] runsc_fs_opens{iteration="2407456650315156914",sandbox="737ce142058561d764ad870d028130a29944821dd918c7979351b249d5d30481"} 54 1674690333702 runsc_fs_read_wait{iteration="2407456650315156914",sandbox="737ce142058561d764ad870d028130a29944821dd918c7979351b249d5d30481"} 0 1674690333702 runsc_fs_reads{iteration="2407456650315156914",sandbox="737ce142058561d764ad870d028130a29944821dd918c7979351b249d5d30481"} 52 1674690333702 # [...] ``` -------------------------------- ### Configure gvisor-containerd-shim TOML Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/containerd/containerd_11.md Create the configuration file for the gvisor shim, specifying the path to the default runc containerd-shim. ```shell cat </dev/null && \ apt install -y curl jq >/dev/null && \ tabId="$(curl -q -X POST http://127.0.0.1:3000/tabs -H "Content-Type: application/json" -d "{\"userId\": \"me\", \"sessionKey\": \"task\", \"url\": \"https://gvisor.dev\"}" | jq -r .tabId)" && \ curl -q --output - "http://127.0.0.1:3000/tabs/${tabId}/screenshot?userId=me"' > /tmp/screenshot.png ``` -------------------------------- ### Install NVIDIA Container Toolkit Source: https://github.com/google/gvisor/blob/master/website/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md Installs the NVIDIA Container Toolkit for Docker on Ubuntu. This involves adding the NVIDIA repository, installing GPG keys, and then installing the toolkit and related base packages. ```shell sudo apt-get update && sudo apt-get install -y --no-install-recommends \ ca-certificates \ curl \ gnupg2 && \ curl -fsSL https://nvidia.github.io/libnvidia-container/gpgkey | sudo gpg --dearmor -o /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg && \ curl -s -L https://nvidia.github.io/libnvidia-container/stable/deb/nvidia-container-toolkit.list | \ sed 's#deb https://#deb [signed-by=/usr/share/keyrings/nvidia-container-toolkit-keyring.gpg] https://#g' | \ sudo tee /etc/apt/sources.list.d/nvidia-container-toolkit.list && \ sudo apt-get update && \ export NVIDIA_CONTAINER_TOOLKIT_VERSION=1.19.0-1 && \ sudo apt-get install -y \ nvidia-container-toolkit=${NVIDIA_CONTAINER_TOOLKIT_VERSION} \ nvidia-container-toolkit-base=${NVIDIA_CONTAINER_TOOLKIT_VERSION} \ lib-nvidia-container-tools=${NVIDIA_CONTAINER_TOOLKIT_VERSION} \ lib-nvidia-container1=${NVIDIA_CONTAINER_TOOLKIT_VERSION} ``` -------------------------------- ### Create a directory and file in a gVisor container Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/rootfs_snapshot.md Use this command to create sample changes within a running gVisor container that can later be snapshotted. ```bash $ docker run --rm -it --runtime=runsc alpine / # mkdir dir / # echo "hello world" > dir/file ``` -------------------------------- ### Install runsc Docker Runtime Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/quick_start/docker.md Installs the 'runsc' runtime for Docker. Ensure Docker is installed and version 17.09.0 or greater. ```bash sudo runsc install ``` -------------------------------- ### Configure gVisor apt Repository Key and Source Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/install.md Adds the gVisor archive signing key to the system's keyring and configures the apt repository source list for gVisor. Ensure the key is updated if it has expired. ```bash curl -fsSL https://gvisor.dev/archive.key | sudo gpg --dearmor -o /usr/share/keyrings/gvisor-archive-keyring.gpg echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/gvisor-archive-keyring.gpg] https://storage.googleapis.com/gvisor/releases release main" | sudo tee /etc/apt/sources.list.d/gvisor.list > /dev/null ``` -------------------------------- ### Install Docker Engine Source: https://github.com/google/gvisor/blob/master/website/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md Commands to install Docker CE, CLI, containerd.io, and plugins on Ubuntu. It configures the Docker APT repository and installs the necessary packages. ```shell sudo apt update && \ sudo apt install -y ca-certificates curl && \ sudo install -m 0755 -d /etc/apt/keyrings && \ sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc && \ sudo chmod a+r /etc/apt/keyrings/docker.asc sudo tee /etc/apt/sources.list.d/docker.sources < rootfs/var/www/html/index.html' ``` -------------------------------- ### Create Dockerfile for Whalesay Image Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/tutorials/docker-in-gvisor.md Defines a Dockerfile to build a 'whalesay' image. It installs 'cowsay' and 'curl', downloads a 'docker.cow' file, and sets the entrypoint to run 'cowsay' with the downloaded cow file. ```dockerfile FROM ubuntu RUN apt-get update && apt-get install -y cowsay curl RUN mkdir -p /usr/share/cowsay/cows/ RUN curl -o /usr/share/cowsay/cows/docker.cow https://raw.githubusercontent.com/docker/whalesay/master/docker.cow ENTRYPOINT ["/usr/games/cowsay", "-f", "docker.cow"] ``` -------------------------------- ### Install Docker on Debian Source: https://github.com/google/gvisor/blob/master/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md Installs Docker CE and its CLI on a Debian system. This is a prerequisite for using Docker with gVisor. ```shell $ sudo apt-get install -y ca-certificates curl gnupg $ sudo install -m 0755 -d /etc/apt/keyrings $ curl -fsSL https://download.docker.com/linux/debian/gpg | sudo gpg --dearmor --batch --yes -o /etc/apt/keyrings/docker.gpg $ sudo chmod a+r /etc/apt/keyrings/docker.gpg $ echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null $ sudo apt-get update && sudo apt-get install -y docker-ce docker-ce-cli ``` -------------------------------- ### Verify NVIDIA GPU Installation Source: https://github.com/google/gvisor/blob/master/website/blog/2023-06-20-gpu-pytorch-stable-diffusion.md Checks if the NVIDIA drivers are installed correctly, with the right version, and if a supported GPU is attached to the system. ```shell # Check that the NVIDIA drivers are installed, with the right version, and with # a supported GPU attached $ sudo nvidia-smi -L GPU 0: Tesla T4 (UUID: GPU-6a96a2af-2271-5627-34c5-91dcb4f408aa) ``` -------------------------------- ### Deploy a Knative Service with gVisor Source: https://github.com/google/gvisor/blob/master/g3doc/user_guide/tutorials/knative.md Apply a Knative Service definition using kubectl. This example deploys a 'helloworld-go' service configured to use gVisor. ```bash cat <