[staticassertion]

My understanding is that gvisor supports two modes of execution - one with virtualization and one without. AFAIK the official recommendation is to use the one with virtualization, but I've never dug into it.

[tptacek]

Yeah, the original mode uses ptrace to intercept system calls, and then just implements the system call itself.