SRAVNITEL'NYY ANALIZ DOCKER I GVISOR DLYA IZOLYATSII WORKLOADS. KONTEYNERIZATSIYA I VIRTUALIZATSIYA

This article compares the architectural approaches of Docker and gVisor, assessing the tradeoffs between security, performance, and compatibility. The methodology includes performance testing using standard benchmarks, attack surface analysis, and application compatibility assessment. It reveals gVisor's limited compatibility with applications that make intensive use of specific system calls. The practical significance of this work lies in developing criteria for selecting isolation technologies based on security and performance requirements.