gVisor Support comes to MCR

This new runtime option provides stronger isolation for container workloads, without moving them into virtual machines

Starting with release 29.6.1, Mirantis Container Runtime (MCR) supports gVisor as an OCI runtime. OCI runtimes are the low-level components that create and run containers. MCR uses runc by default and also supports crun. With gVisor, MCR adds a third supported runtime option for teams that need stronger workload isolation without moving those workloads into full virtual machines.

That matters because containers are no longer used only as a convenient packaging format for trusted application code. Increasingly, they are part of the infrastructure layer itself. Service providers use Mirantis software to build public cloud and managed cloud services where customer workloads may arrive from many sources and run on shared infrastructure. Enterprises build private clouds that serve many internal business units, application teams, and development groups, each with different security practices, maturity levels, and operational requirements. For communications service providers, containerized network functions and cloud-native network functions may run on shared infrastructure that handles traffic or control-plane data for many customers. gVisor does not secure those streams inside the workload, but it can help reduce the risk that a compromised container escapes to the shared host or affects neighboring workloads. AI cloud providers and enterprise AI platforms must keep tenant workflows, models, prompts, embeddings, and datasets isolated even when GPUs, storage, and cluster infrastructure are shared.

In these environments, stronger runtime isolation is not just a defense-in-depth feature. It is part of the platform trust model. Operators need ways to reduce the risk that a compromised, misconfigured, experimental, or simply unknown container workload can expose the host, affect neighboring workloads, or reach sensitive infrastructure services. gVisor gives MCR users another tool for making those risk-based placement decisions: run workloads that need stronger isolation with gVisor, while continuing to use runc or crun where standard container behavior, compatibility, or performance characteristics are the better fit.

gVisor is designed to improve container security by placing an additional isolation layer between the application and the host operating system. It acts as an application kernel: a user-space runtime that implements a Linux-like interface for containerized applications while reducing the host-kernel surface exposed to those applications. This gives operators a middle path between standard container isolation and full VM isolation.

That makes gVisor especially useful for environments where containers may run less-trusted, externally supplied, or multi-tenant workloads. In many cases, it can be used as a drop-in replacement for the default runtime, allowing existing container workflows to stay largely unchanged while adding an extra security boundary.

As with any sandboxing technology, gVisor involves tradeoffs. Because it intercepts and handles system calls differently from a standard Linux container runtime, syscall-heavy or performance-sensitive workloads may see additional overhead. There are also compatibility considerations: gVisor implements a large portion of the Linux system interface, but not every syscall or kernel feature is fully supported. Most common applications and language runtimes work well, but operators should test workloads with specialized kernel, filesystem, networking, device, or performance requirements before adopting gVisor broadly.

MCR can use multiple OCI runtimes on the same machine, so you do not need to choose one runtime for every workload. You can run security-sensitive workloads with gVisor and continue using runc or crun where compatibility or performance characteristics make them a better fit.

Get started

For installation and configuration instructions, see the MCR documentation for using gVisor as an alternative container runtime. The docs include the current package names, supported operating systems, repository setup requirements, and runtime configuration steps.

The Leading, Fully-Supported Secure Container Runtime

If your container applications require exceptional compatibility, reliability, and security, learn more about MCR, the leading fully-supported enterprise container runtime or contact us.