Guides
Hands-on walkthroughs for building, running, and tuning ZViz. Start with the quickstart, then go deeper.
beginner·15 min
Build from source and run your first container
Compile ZViz with Zig 0.15+, extract an OCI rootfs, and run it under a selective-denial profile.
intermediate·12 min
Running an untrusted OCI image
Pick a strict profile, deny network by default, and constrain the filesystem when the workload is hostile.
intermediate·10 min
Understanding the selective-denial policy
What "132 allow / 24 deny / 1 filter" means, why ZViz denies instead of emulating, and how the socket filter works.
intermediate·8 min
Tuning cgroups v2 limits
Cap memory, PIDs, and CPU per container so a runaway or hostile workload stays contained.
beginner·7 min
Kernel and Landlock requirements
Why ZViz needs Linux 5.13+, cgroups v2, and (on Ubuntu 24.04+) an AppArmor profile — and what happens without them.