ZViz vs runc (plain Docker)
runc is the reference OCI runtime behind Docker and containerd; its default threat model assumes a friendly workload. ZViz assumes the workload is hostile: it drops every capability, applies a Landlock ruleset, and denies dangerous syscalls at seccomp rather than allowing most of them.
runc is the reference OCI runtime that powers Docker, containerd, and most production platforms. Its default posture assumes the workload is friendly. ZViz assumes the opposite and tightens every default.
Verdict: Use runc for general-purpose containers where you trust the workload. Use ZViz when the workload is untrusted and you want a smaller reachable syscall surface and stronger defaults.
ZViz strengths
- All 41 capabilities dropped by default (Docker keeps ~14)
- Landlock LSM ruleset enabled by default
- Selective-denial seccomp filter with a small allow-list
- Default-deny network posture per container
runc strengths
- → Ubiquitous — the default under Docker, containerd, Kubernetes
- → Broad workload compatibility with permissive defaults
- → No special kernel requirement beyond namespaces + cgroups
- → Huge ecosystem and operational familiarity
Feature comparison
| Feature | ZViz | runc |
|---|---|---|
| Default capability set | 0 capabilities (all 41 dropped) | ~14 default Docker capabilities |
| Seccomp posture | Small allow-list: 132 allow / 24 deny / 1 filter | Docker default profile (denies ~44, allows the rest) |
| Landlock LSM | Enabled by default | Not enabled (operator must add AppArmor/SELinux) |
| Reachable syscall surface | Roughly 132 syscalls | Substantially larger by default |
| Default network egress | Deny (explicit allow required) | Allowed via the network namespace |
| Runtime shape | Single static binary, no daemon | runc invoked by a daemon (dockerd/containerd) |
| Implementation language | Zig | Go |
| Kernel minimum | Linux 5.13 (Landlock) | Namespaces + cgroups (older kernels ok) |
| License | Apache 2.0 | Apache 2.0 |
Choose ZViz when
- → The workload is untrusted or multi-tenant
- → You want zero capabilities and Landlock on by default
- → You want a smaller reachable syscall surface than Docker default
- → You can run on Linux 5.13+ with cgroups v2
Choose runc when
- → You trust the workload and want maximum compatibility
- → You need the standard Docker/Kubernetes toolchain as-is
- → You must support older kernels without Landlock
- → You rely on default Docker capabilities or behaviours
Frequently Asked Questions
Is a plain Docker container not already isolated?
Docker via runc gives you namespaces, cgroups, a default seccomp profile, and ~14 capabilities. That is fine for trusted workloads, but the reachable syscall surface stays large and network egress is open by default. ZViz tightens all of those defaults for untrusted code.
Can ZViz run the same OCI images as Docker?
Yes. ZViz is OCI-compatible and can run a rootfs produced by docker export, plus a config.json. It changes the enforcement around the workload, not the image format.