How ZViz compares
ZViz is one specific bet on isolation: deny the dangerous syscalls, run the rest at native speed. Here is how that trades off against the other credible answers to "runc is not a security boundary." Every row is architecture-level and honest — no invented benchmarks.
ZViz vs gVisor
ZViz vs gVisor: selective-denial at the seccomp boundary versus a userspace kernel that emulates the syscall ABI. Both are credible answers to "runc is not a security boundary".
Read comparison →
ZViz vs runc (plain Docker)
ZViz vs runc: runc gives you namespaces, cgroups, and a default seccomp profile. ZViz adds all 41 capabilities dropped, Landlock, and a much smaller default syscall allow-list.
Read comparison →
ZViz vs Firecracker
ZViz vs Firecracker: a selective-denial container runtime on bare kernel primitives versus a MicroVM with a KVM guest. Different isolation boundaries, different footprints.
Read comparison →