gVisor+Kubernetes=Isola

[benldrmn]

Hey everyone, wanted to share https://github.com/isola-run/isola that is built on top of gVisor.

It is a Kubernetes sandboxing platform allowing users (human or not) to easily spawn gVisor-isolated pods, manage and communicate with them via a REST api / SDKs and snapshot their rootfs to bucket storage for later restore.

It builds on some of the features I have contributed to gVisor, like egress rate limiting with gVisor's token bucket filter qdisc.

Next release will include an easy way to install gVisor on the cluster, adapted to the new gVisor release model, as part of the simple helm chart used to install Isola.

Happy to get feedback or feature requests (that might find their way to upstream gVisor)!

[EtiennePerot]

Excellent. Would love to see the sandbox startup speed metrics once adapted to the new release model, as that's what it should unlock.

If you find a way to easily deploy gVisor to an arbitrary Kubernetes cluster, that's something that would be nice to have in runsc itself the same way there is runsc install which does easy setup for Docker. I'm thinking something like being able to run runsc setup-k8s that does all the right things to install in the default kubectl context.