Also, the number of lines of kernel code being executed is not a valid metric without comparing how much of those code flow can the user control. In gVisor, this is mostly limited to what the go runtime can call. There is very little direct control over these syscalls.