My intuition is that gVisor is never going to be stronger in a fair comparison. Almost all the vulns are in I/O code and every type of container/VM/sandbox has I/O.
replyFYI, gvisor also uses KVM under the hood; it's not completely orthogonal to [micro]VMs.
replyThat's not the default gvisor option. It can use kvm, but by default (and most common setup in my limited experience) it doesn't.
replyYou mean virtualised hardware ? That's still technically software
reply