The True Cost of Containing - A gVisor Case Study.

We analyze many facets of the performance of gVisor, a new security-oriented container engine that integrates with Docker and backs Google's serverless platform. We explore the effect gVisor's in-Sentry network stack has on network throughput as well as the overheads of performing file opens via gVisor's Gofer service. We further analyze gVisor startup performance, memory efficiency, and system-call overheads. Our findings have implications for the future design of similar hypervisor-based container engines.