Re:Python 3 is now available on App Engine standard environment
by iangudger on Wednesday August 08, 2018 @08:38PM
(#17720878)
I work on gVisor. The answer is that having a separate kernel is required to achieve a high degree of isolation and by definition Linux containers share a kernel with the host. A separate Linux kernel could work as well, but gVisor tries to achieve a different set of trade-offs.
https://cloud.google.com/blog/products/gcp/open-sourcing-gvi...
That said, they don't quite go into the details of what type of isolation is missing from standard containers - I'm curious. It does seem like it would have been ideal for everyone if LXC would have had better isolation, rather than having to run a userspace kernel emulator thingy for each container, but c'est la vie!