docker in gVisor: I am one with the force, the force is with me

[amscanne]

Startup is currently blocked by oom_score_adj, but there are many additional blockers.

[akoenig]

Running Docker in a gVisor shielded container would be such a nice feature :slightly_smiling_face: - The dream of actual lightweight "VMs" in which you could land a user without having sleepless nights would come true.

[grzesiek]

+1

[anorth2]

+1

[ianlewis]

This is now blocked on some kind of cgroups support inside the sandbox Related: #906 #1906

[lining2020x]

+1

[pkit]

This is now blocked on some kind of cgroups support inside the sandbox Related: #906 #1906

A lot more it's blocked on: no support for bind mounts, no support for CLONE_NEWNS, etc. etc. I will try to fix all of that. On the other hand running it in a real docker daemon is probably too much of a task, because it will always fail at the various "security" measures that docker tries to set up and which are not needed.

[github-actions[bot]]

A friendly reminder that this issue had no activity for 120 days.

[ayushr2]

@avagin has made good amounts of progress on this.

[github-actions[bot]]

A friendly reminder that this issue had no activity for 120 days.

[github-actions[bot]]

This issue has been closed due to lack of activity.

[avagin]

https://gvisor.dev/docs/tutorials/docker-in-gvisor/

[hbhasker]

This is awesome. I figured this was coming when I saw the veth device support being added!

[avagin]

@hbhasker Hi Bhasker. Good to see you here:). Right now, we support only the host network mode. The bridge mode is coming soon. veth and bridges are still in development.

[hbhasker]

I lurk and follow random PRs:) Good to see you too! Looking forward to the rest landing!