Configuring Raspberry Pi 5 Kernel to Run gVisor Container Security Sandbox

Regular containers (Docker, containerd, etc.) are fast and lightweight, but they share the host kernel. That means a compromised container could potentially attack the host OS, a real concern in multi-tenant environments.

gVisor is a container security sandbox that runs containers in a lightweight virtual machine-like environment. Instead of sharing the host kernel, gVisor provides a userspace kernel that intercepts and handles system calls from the container.

The root cause turns out to be a single kernel configuration option, one that most people have never heard of: CONFIG_ARM64_VA_BITS_48.

By default, the Raspberry Pi 5 kernel is configured with CONFIG_ARM64_VA_BITS_48=y, which means it uses 48-bit virtual addresses. gVisor, however, expects 39-bit virtual addresses (CONFIG_ARM64_VA_BITS_39).

The fix involves rebuilding the Raspberry Pi kernel with the correct configuration. You'll need to modify the kernel configuration to set CONFIG_ARM64_VA_BITS_39=y and CONFIG_ARM64_VA_BITS_48=n.