Choose an executor¶
The two quick-start examples use Host and VM respectively. When you need a different execution environment, choose by the kernel and userspace your command requires.
| Executor | Environment | Prerequisites | Guide |
|---|---|---|---|
host (default) |
Host kernel and installed tools | Platform filesystem-mount support for staged runs; macFUSE on macOS | host |
container |
OCI image userspace on the Linux host kernel | A native OCI runtime (crun or runc) and a matching Linux pVisor binary |
container |
vm |
Linux guest kernel provided by libkrun | Linux KVM or Apple Silicon HVF, plus a Linux rootfs matching the host architecture | VM |
The command must be installed in the chosen environment; for a container or VM, install the required agent in its image.
Choosing¶
- To review file changes using local tools, choose host with
--safe. - For a mandatory network boundary, choose VM (
--overlaynet auto), or host with--overlaynet-deny-all. - For fixed Linux userspace, choose container or VM with an OCI image.
- For an independent kernel, choose VM.
Select an executor with --executor. --safe requires file and network isolation and refuses to start if it cannot enforce them. The container executor does not support --safe; see the container executor guide for staging and network configuration.
Configuration and verification¶
After choosing an executor, follow its guide in the table to prepare the environment. See CLI filesystem parameters for mounts, path access, and staging; configure file policies to restrict specific files.
After execution, use pvisor status --review to check the controls actually installed and warnings in the Run Bundle. See Executor boundaries for isolation scope and platform limits.