runsc

Runsc is a container runtime component of the gVisor project, an open-source effort from Google that provides a user-space kernel. Runsc runs containers inside a sandbox that intercepts and handles Linux system calls in user space, rather than letting them execute directly on the host kernel. The aim is to provide stronger isolation between container workloads and the host system while preserving compatibility with standard container tooling.

Runsc launches a gVisor user-space kernel within a host process and executes the container's processes inside that sandbox. It uses a combination of syscall interception (via seccomp filters and other mechanisms) and a user-space kernel to emulate Linux kernel interfaces for the container. It provides a virtualized file system, network stack, and other kernel services through the gVisor runtime. The host kernel handles resource scheduling and I/O, while the gVisor kernel handles the container's syscalls.

Runsc implements the OCI runtime interface, so it can be used with container runtimes such as Docker, containerd, or CRI-O, including Kubernetes deployments that rely on CRI. Containers run under runsc with gVisor without requiring changes to container images, though performance characteristics differ from traditional host-kernel execution.

Runsc is part of the gVisor project, originally developed by Google. It is open source and maintained by Google with community contributions, and has been associated with the Cloud Native Computing Foundation ecosystem. It is primarily used where stronger sandboxing and defense-in-depth are prioritized for multi-tenant or untrusted workloads.