gVisor

An open-source container runtime that enhances security and isolation by intercepting system calls via a user-space kernel.