gVisor virtualizes all syscalls which pass through a host userspace golang process that then maps onto the host's syscalls.