Original repository https://github.com/google/gvisor
In this project, we have undertaken the task of patching gVisor, an open-source container runtime sandbox, to integrate a JavaScript (JS) engine. The JS engine allows us to execute custom system call handlers written in JavaScript (which are called hooks). Hooks provide us with valuable information about the running processes, system calls, and their arguments. Additionally, we can use our custom functions called "accessors" to modify specific values within the system call handling process.
The motivation behind this project was to extend the capabilities of gVisor and enable more flexible and dynamic handling of system calls. With the JS engine integration, we sought to gain insights into the inner workings of processes, manipulate system call arguments, and control system call behavior, all using JavaScript code.
May be found in examples/gWisord/ or just click here
Run:
./init_script.sh your_config.json // this will build and run gVisor by using builtin command runsc domore about configuration file may be found here
If you have already built the gvisor, you may run:
./run_script your_config.jsonThe successful integration of a JavaScript engine into gVisor has significantly enhanced its capabilities by enabling the use of custom JavaScript-based system call handlers. These handlers empower us to extract vital information about processes, manipulate system call arguments, and control system call behavior. The flexibility offered by the accessors further allows for dynamic customization, making gVisor an even more powerful and versatile container runtime sandbox.
The potential applications of this patch range from debugging and monitoring to security analysis and testing, making it a valuable addition to gVisor's feature set. Further development and testing will continue to refine the system and explore additional use cases.