Tink vs gVisor
gVisor is a user-space kernel that sandboxes OCI containers. It also records runsc spec. That is not a mechanic. Tink installs in one command, watches the Linux host, explains what is wrong, and helps you fix it.
gVisor isolates the process. Tink answers “why is this VPS sick?”
Accidental sysadmins land on gVisor because Kubernetes RuntimeClass and runsc promise a safer container. Then the volume fills, host nginx dies, and runsc list still shows running — no sandbox matched host fill. A filling /var is a Tink warning; it is not a gVisor job unless you scraped the process and watched it.
Tink is the other job: detect the issue on the machine, say why it happened in plain English, propose the command, and run it only after you approve. Keep using gVisor if you already need a container sandbox. Use Tink if you run Linux servers and want a mechanic.
| Feature | Tink | gVisor |
|---|---|---|
| Setup time | 30 seconds (one curl | sh command) | Hours — RuntimeClass, runsc, platform, and a host that still has no mechanic after runsc list looks fine |
| What you get | Working monitoring, diagnosis, and approved fixes | A user-space kernel. Disk fill, host nginx, Postgres, and certs stay your problem until you SSH in |
| Pricing | Free (Scout) / $9 / $29 per machine per month | gVisor is free and open source. You still pay the engineer who owns the node after the sandbox started |
| Hidden costs | None — fully managed | A quiet node at 2am, overlay disk fill, and a second tool to tell you the VPS is sick while runsc list still shows running |
| Monitoring approach | Agent on the server — CPU, disk, services, logs, certs, ports | Syscall isolation. gVisor does not watch a quiet cert or host auth.log after the sandbox started |
| Configuration | None after install — heuristics and AI | runsc, RuntimeClass, platform (systrap/kvm), and which container death actually pages you |
| Plain-English diagnosis | Yes — AI explains root cause, impact, and fix | You read runsc events and sandbox logs, then SSH in to change the host gVisor already isolated |
| Fix execution | Proposes and executes approved commands with an audit trail | Sandbox only — gVisor cannot free host disk, rotate a cert, or stop SSH brute-force unless you wrote that runbook |
| Alerting | Built-in across 8 channels | Not a gVisor job — the shim, kubelet, and a separate monitoring tool have to fire |
| Predictive alerts | Yes — disk fills in ~6 days, memory and CPU trends | Not a gVisor job — a green runsc list does not forecast a quiet volume filling up |
| SSH brute-force detection | Built-in — parses auth.log every scan | Never — gVisor does not read host auth.log, journald, or firewall state after the sandbox started |
| Machine offline detection | Agent presence monitoring with multi-channel alerts | Silence if the box dies after the last runsc list — unless you built a separate uptime check |
| Public status page | Shareable URL with 90-day history | None — gVisor has no customer-facing status page |
| Weekly fleet digest | Automated Monday digest + daily brief when issues are open | None — a runsc list recap is not a plain-English fleet narrative |
| On-call tracking | Built-in /oncall command + incident acknowledgment | Not included — wire failed sandboxes into PagerDuty or another incident tool |
| Conversation interface | Telegram, WhatsApp, web dashboard, CLI | runsc spec and RuntimeClass. No mechanic you text when /var filled and the last sandbox still showed running |
| Learning curve | None — works after install | Steep — user-space kernel, syscall coverage, platforms, and which host failure is the sandbox vs the running box |
| Best for | Freelancers, small teams, accidental sysadmins (1-50 Linux servers) | Teams that already need a container sandbox and need isolation, not a sick-VPS mechanic |
When gVisor is the right choice
Keep using gVisor when you already want that exact job:
- Container sandbox — you need a user-space kernel and syscall isolation, not a mechanic.
- An existing gVisor host — RuntimeClass, runsc, and platform flags matter more than host nginx, certs, and SSH on a quiet VPS.
- An existing Kubernetes RuntimeClass — untrusted workloads already run in sandboxes, and someone owns the isolation policy.
- Hosts that only page on failed sandboxes — you already run exporters and PromQL, not a sick-box SSH loop.
The real cost of “just run runsc list”
gVisor is the sandbox under runsc. A working ops loop for five Linux boxes is not:
- A green runsc list still means you SSH in and change the box by hand when it gets sick later
- Host fill, nginx, certs, and SSH brute-force never appear unless a separate tool scraped those signals and a rule fired
- A filling /var is a Tink disk warning on every scan — gVisor will stay quiet until the next sandbox process dies
- A single VPS with a dead agent still needs a mechanic, not another runsc state line
For a 5-server team, Tink Mechanic at $45/month is cheaper than a gVisor host plus the engineer who keeps failed-sandbox notifications alive, and every scan includes a diagnosis a quiet runsc list will not type.
No sandbox homework. No silent host. One command install.
Start MechanicAlso compare: Tink vs runc · Tink vs containerd · Tink vs Docker