> that the only practical way that would maintain userspace compatibility would be to run the Linux kernel itself Meanwhile, Google Container Engine uses gViso

> that the only practical way that would maintain userspace compatibility would be to run the Linux kernel itself Meanwhile, Google Container Engine uses gVisor, where the syscalls are implemented by some Go libraries with a very narrow seccomp interface to the actual host.