gVisor

Google’s container sandboxing kernel‑userland layer that provides an additional security boundary (lightweight syscall interception sandbox) for multi‑tenant and hardened container workloads.