[encryptluks2]

gVisor does more than filtering, they basically reimplemented the syscalls in an application kernel. At least with seccomp the performance overhead is minimal.

[remram]

How does gVisor fair against KVM and other hardware-accelerated VM solutions (firecracker)?