Modal says it is joining the maintainers of gVisor, the container runtime it uses to isolate customer code, as Google donates the project to the Cloud Native Computing Foundation. The practical point is not just new stewardship: Modal describes a collection of upstream changes that make gVisor more useful for AI and GPU computing.
Modal Labs Watch analysis
What happened
In a post published on 11 November, Modal says it launches more than 40 million gVisor containers a day, including for GPU inference, multi-node training and AI coding agents. It explains that gVisor puts a separate application kernel, called the Sentry, between a container and the host. That gives the workload a more restricted route to the host system than an ordinary container sharing its kernel.
Modal says it is one of three companies joining gVisor’s maintainers, alongside Ant Group and Tines; OpenAI, Tencent and NVIDIA are continuing their contributions. Its post describes work on NVIDIA GPU support, multi-GPU workloads, RDMA networking, snapshots and faster file and memory operations.
Some of the concrete results are striking. Modal reports that an optimised PyTorch DataLoader benchmark rose from 2.9 to 22 GB/s, SQLite ran 2.7 times faster after tmpfs changes, and its RDMA work reached about 99% of native bus bandwidth in NCCL all-reduce benchmarks. The company also says gVisor can start a sandbox in about 25 milliseconds with 12 MB of memory overhead, and that roughly 670,000 containers are restored from snapshots each day.
Why it matters
AI services increasingly run code that is generated, supplied or steered by other people. Isolation matters when that code shares machines with other workloads, and GPU support matters if adding a security boundary means leaving expensive accelerators idle. Modal’s account shows how those goals can be pursued together, including for multi-node training rather than just small, single-machine tasks.
The performance figures are Modal’s own measurements, not a comparison independently tested here. Even so, they give operators useful numbers to judge against their own workloads, instead of asking them to admire the phrase “secure by design” and hope for the best.
Our read
This is a substantial piece of infrastructure work, not a fresh AI model launch. The most useful signal is the combination of isolation, GPU and RDMA support, and concrete performance figures. Teams running untrusted workloads should look closely at the trade-offs and test results against their own requirements; the benchmark is a starting point, not a universal guarantee.
What to watch
- How gVisor’s maintainer-led governance develops after the CNCF donation.
- Whether the GPU and RDMA improvements become broadly available across providers and hardware.
- How Modal’s planned multi-GPU snapshots and GPUDirect Storage work perform when released.
Discussion spark: Would you accept a small performance cost for stronger isolation when running AI workloads on shared GPU infrastructure, or should near-native speed be the minimum bar?
Sources and evidence
- Source update (11 November 2026, 12:00 UTC)
Independent WittyWires tracker for public updates about Modal Labs. Not affiliated with or endorsed by Modal Labs; this is not an official account.