Frequently asked questions
Everything you need to know about ZViz — the OCI runtime that denies dangerous syscalls instead of emulating them.
General
General
What is ZViz?
ZViz is an OCI-compatible container runtime written in Zig. It runs standard OCI bundles but wraps the workload in a layered enforcement stack and a selective-denial syscall policy: 132 syscalls run on the host kernel at native speed, 24 dangerous ones are denied at seccomp, and one (socket) is argument-filtered inline. It is a single static binary with no daemon.
What does "selective denial" mean?
Instead of emulating syscalls in a userspace kernel, ZViz simply refuses the dangerous ones at the seccomp-BPF boundary — they return EPERM and never reach the kernel — while letting the rest run on the host kernel natively. Deny, do not emulate.
What license is ZViz under?
Apache License 2.0. ZViz is open source and developed by Skelf Research at github.com/Skelf-Research/zviz.
What language is ZViz written in?
Zig. ZViz ships as a single statically-linked binary with no daemon and no userspace kernel.
Technical
Technical
Which syscalls does ZViz block?
ZViz denies 24 dangerous syscalls at the seccomp filter — examples include ptrace, mount, unshare, init_module, and kexec_load — and argument-filters socket() so specific families can be permitted or refused. The remaining 132 syscalls are allowed to reach the host kernel.
What enforcement layers does ZViz apply?
Five, in order: namespaces (user, pid, mount, ipc, uts); all 41 Linux capabilities dropped; a Landlock LSM ruleset; a seccomp-BPF filter; and cgroups v2 limits. The order is load-bearing — capabilities drop before seccomp loads, and Landlock applies before seccomp so its setup syscalls are not self-blocked.
Is ZViz as strong as a VM?
No. A MicroVM like Firecracker adds a hardware-virtualized boundary and its own guest kernel. ZViz shares the host kernel for allowed syscalls. It is a smaller-footprint bet that a shrunk reachable surface is sufficient for the workload. See the threat-model page for the full picture.
What are the kernel requirements?
Linux kernel 5.13 or newer (for the Landlock LSM), cgroups v2 enabled, and Zig 0.15.0+ to build from source. On Ubuntu 24.04+ you should also load the bundled AppArmor profile.
Usage
Usage
Can ZViz run my existing Docker images?
Yes. ZViz is OCI-compatible and runs a rootfs produced by docker export together with a config.json. It changes the enforcement around the workload, not the image format.
When should I use gVisor instead of ZViz?
Use gVisor when the workload needs syscalls ZViz blocks — ptrace (strace, debuggers), mount, unshare, Docker-in-Docker, or Bazel/Nix internal sandboxing. gVisor emulates those safely; ZViz denies them.
What is ZViz good for?
Running untrusted code: AI agent runtimes executing LLM-generated code, code-execution platforms, CI sandboxers, and multi-tenant platforms where one tenant's workload runs next to another's.