gVisor is an application kernel that implements a portion of the Linux call interface. Written in Go, gVisor provides a layer of isolation between the host operating system and running applications.
It includes runsc, an Open Container Initiative (OCI) runtime that simplifies work with an existing container stack. The runtime integrates with Kubernetes and Docker to simplify running sandboxed containers. You can use gVisor directly using runsc or with Docker or Kubernetes.