> ## Documentation Index
> Fetch the complete documentation index at: https://bunny.net/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandboxing

> Learn how Magic Containers uses gVisor for application kernel isolation and enhanced container security.

Traditional containers use Linux namespaces to establish resource limits, but a malicious deployment could potentially breach container boundaries. Magic Containers addresses this by using [gVisor](https://gvisor.dev/) as the container runtime.

gVisor intercepts application system calls and handles them in a user-space kernel, creating strong isolation between the application and the host kernel without the overhead of full virtualization.

## Syscall Compatibility

gVisor implements a subset of Linux system calls. While most common applications work without modification, some workloads that rely on specialized or less common syscalls may experience compatibility issues. Applications using standard networking, file I/O, and process management typically work without issues.

For a complete list of supported syscalls, see the [gVisor compatibility documentation](https://gvisor.dev/docs/user_guide/compatibility/linux/amd64/).

## Ping and ICMP

Outbound ICMP is allowed, so `ping` works from your containers. The sandbox does not grant the `CAP_NET_RAW` capability, so applications cannot open raw sockets. Instead, `ping` uses an unprivileged ICMP socket. This works for root and non-root users.

On Debian and Ubuntu, the `iputils-ping` package installs `ping` with the file capability `cap_net_raw+ep`. The sandbox cannot grant this capability, so the binary does not start, even as root:

```
sh: 1: ping: Operation not permitted
```

Remove the file capability when you build the image:

```dockerfile theme={null}
FROM debian:bookworm-slim

RUN apt-get update \
 && apt-get install -y --no-install-recommends iputils-ping libcap2-bin \
 && setcap -r /bin/ping \
 && rm -rf /var/lib/apt/lists/*

USER 10001

CMD ["ping", "8.8.8.8"]
```

Keep `libcap2-bin` installed. `iputils-ping` depends on it, so removing it also removes `ping`.

Alpine images need no change. Alpine's `iputils-ping` and BusyBox `ping` both work without the capability.

## Network Isolation

Magic Containers uses Virtual Extensible LAN (VXLAN) to create virtual networks over the physical infrastructure. This provides scalable connectivity between containers across different hosts while maintaining isolation and segmentation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.