[tptacek]

gvisor doesn't require nested virtualization, right? If you're willing to take a tenable user-mode-Linux performance hit, you should be able to run it on anything?

[staticassertion]

My understanding is that gvisor supports two modes of execution - one with virtualization and one without. AFAIK the official recommendation is to use the one with virtualization, but I've never dug into it.

[tptacek]

Yeah, the original mode uses ptrace to intercept system calls, and then just implements the system call itself.