Glossary

The terms behind ZViz and container isolation, in plain language.

OCI: Open Container Initiative — the standard that defines container image and runtime formats. ZViz is OCI-compatible: it runs a standard rootfs plus a config.json, the same bundle format runc uses.
Namespace: A Linux kernel feature that gives a process an isolated view of a system resource. ZViz creates five per container: user, pid, mount, ipc, and uts.
Linux capability: A fine-grained privilege carved out of the traditional all-or-nothing root. There are 41 of them (e.g. CAP_SYS_ADMIN, CAP_NET_RAW). ZViz drops all 41 before the workload runs.
Landlock: An unprivileged Linux Security Module (LSM), available since kernel 5.13, that lets a process sandbox its own filesystem access with a ruleset. ZViz applies a Landlock ruleset as one of its enforcement layers.
seccomp-BPF: Secure computing mode with a Berkeley Packet Filter program that classifies each syscall a process makes. ZViz uses it to allow, deny, or argument-filter syscalls — the mechanism behind selective denial.
cgroups v2: The Linux control-groups v2 hierarchy for limiting and accounting resource use. ZViz uses it to cap memory, PIDs, and CPU per container so a fork bomb stays contained.
Selective denial: ZViz's policy model: refuse the dangerous syscalls at the seccomp boundary (they return EPERM) and let the rest run on the host kernel at native speed. The opposite of emulating every syscall.
Syscall: A request from a userspace program to the kernel — read, write, mmap, socket, and so on. The set of syscalls a workload can reach is the practical measure of its kernel attack surface.
Userspace kernel: An isolation approach (used by gVisor's Sentry) that reimplements the syscall ABI in a userspace process so the host kernel runs fewer syscalls. ZViz does not do this — it denies rather than emulates.
MicroVM: A lightweight virtual machine (e.g. Firecracker) with a minimal guest kernel over KVM. It offers a hardware-virtualized boundary; ZViz offers container-shaped isolation on the host kernel with no guest kernel.
Static binary: A single self-contained executable with no external runtime dependencies. ZViz ships as one static Zig binary — no daemon, no supervisor process.