3 ms·
Personally, I think I'd recommend SELinux and SecComp before I use something like gVisor. There's significant performance impact with application kernels.
by kodah 4y ago
Personally, I think I'd recommend SELinux and SecComp before I use something like gVisor. There's significant performance impact with application kernels.
- opportune 4y agoThose are not mutually exclusive, but if you use a syscall blocklist only you will have to refuse certain workloads