From fe55dade2f48b91b33669afd3a298fe83d7c5ffb Mon Sep 17 00:00:00 2001 From: Paul Hinze Date: Fri, 24 Jul 2026 16:13:11 -0500 Subject: [PATCH] docs: sandboxes run under runc, not gvisor The terminology entry claimed sandboxes use gvisor for security isolation. Both container specs pass io.containerd.runc.v2, so they're ordinary runc containers isolated by kernel namespaces and cgroups, each with its own network namespace unless HostNetwork is set. Nothing in the tree references runsc at all. Layering in gvisor, or another execution engine, is something we may well want later. Until one actually ships, the docs should describe what runs today, since isolation strength is the kind of claim people make deployment decisions on. --- docs/docs/terminology.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/docs/terminology.md b/docs/docs/terminology.md index c7ac0191..97924bd3 100644 --- a/docs/docs/terminology.md +++ b/docs/docs/terminology.md @@ -118,7 +118,7 @@ Authentication at the routing layer using an [identity provider](#identity-provi ## Sandbox -An isolated execution environment where your app runs. Sandboxes use gvisor for security isolation and have their own network namespace. +An isolated execution environment where your app runs. Sandboxes are Linux containers managed by containerd, isolated using kernel namespaces and cgroups, and each has its own network namespace by default. ## Sandbox Pool