Skip to content
zviz
About

A runtime, not a platform

ZViz is a single static Zig binary that runs OCI bundles with a security policy you can read in an afternoon. It is a Skelf Research project, Apache 2.0 licensed.

What it is

  • An OCI-compatible container runtime written in Zig.
  • A selective-denial policy model: 132 syscalls reach the host kernel directly, 24 are blocked at seccomp, one (socket) is argument-filtered inline.
  • A layered enforcement stack: namespaces, capability drop (all 41), Landlock LSM, seccomp-BPF, cgroups v2.
  • A single static binary — no daemon, no supervisor, no userspace kernel.

What it is not

  • Not a userspace kernel. ZViz does not emulate syscalls the way gVisor's Sentry does. Allowed syscalls hit the host kernel at native speed.
  • Not a MicroVM. There is no KVM guest, no virtio devices, no boot path. ZViz runs on bare Linux kernel primitives.
  • Not a daemon. There is no long-running supervisor. zviz run exec-replaces into PID 1.
  • Not a drop-in for every workload. If you need ptrace, mount, or unshare inside the container, you want gVisor.

Who it's for

  • AI agent runtimes executing LLM-generated code.
  • Code-execution platforms running notebooks, REPLs, untrusted snippets.
  • CI sandboxers that want a smaller kernel attack surface than plain runc.
  • Multi-tenant platforms where one tenant's workload runs next to another's.

Threat model in one paragraph

The adversary is the code inside the container. It may hold arbitrary userspace capabilities within its namespace, may attempt any syscall, may try to load kernel modules, escalate capabilities, escape namespaces, or pivot via writeable filesystem paths. ZViz assumes the host kernel is trusted; if a CVE exists in an allowed syscall path, that risk is shared with the host. The selective-denial design is an explicit bet that you can shrink the reachable surface enough to make this trade-off favourable for most workloads — and gain native syscall throughput as a side effect. The full model is on the threat-model page.

Requirements

  • Linux kernel ≥ 5.13 (Landlock LSM).
  • cgroups v2 enabled.
  • Zig 0.15.0+ to build from source.
  • On Ubuntu 24.04+: the bundled AppArmor profile, or accept chdir-only filesystem isolation.

Project & license

ZViz is a Skelf Research project. Source on GitHub, Apache 2.0. Documentation at docs.skelfresearch.com/zviz.