gVisor release 20260831.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20260824.0
Report hangup in HostReadiness on closed FD and make beforeSave idempotent. (fd2f6b267)
Close exposed race window in stub ThreadID setting. (80bb74169)
cgroup2fs: fix cpu controller accounting (16f043af4)
cgroup2fs: charge existing tasks on pids controller enablement (727c8c389)
Add the `profile` command to `runsc`, with subcommands `cpu` and `heap`. (44c5c90e8)
internal change. (6138d37a6)
cgroup2fs: fix populated accounting when a mid-level cgroup drains (9f515f705)
Add building the Python SandboxExec wheel to our build pipeline (dc5be3956)
Deflake epoll_test (6ed83306f)
Fix ring0 compatibility with Go toolchain ABI wrappers. (11ad6bd3c)
Github assigner: replacing reviewer list with governance YAMLs (3791b35f8)
nvproxy: add support for driver 580.178.04 (a86f26d42)
runsc: allow killing a container in the Created state (c1083b751)
Fix setsid deadlock when orphaning a shared-sighand process group (c57f2c378)
buildkite: shard test images and decouple GPU/ML image testing (4a2953dcc)
Add `zstd` variant of gVisor release tarball. (284fbec98)
KVM: Enable PAC inside of the guest with zeroed keys. (d781f4401)
systrap: recover contexts stuck on an unresponsive stub (d119f5cfb)
Make the bwrap alias a wrapper around the sandboxexec Go bindings. (ab01a88bd)
Implement the copy_file_range(2) syscall. (0aa0d5b20)
Change default sidecar usage policy to disallow embedded fallback. (1ce5950e4)
Change default sidecar usage policy to disallow embedded fallback. (9fa0af4ab)
Use `//:release` rather than `//runsc` target for all gVisor test usage (eeff98ba9)
Implement /proc/sys/fs/mount-max. (1e97e1c40)
buildkite: pre-command: only cleanup containers after checking storage space (6f9c46baa)
vfs: fix partially-umounted mount refcounting (e4efb89c7)
Fix `//test/syscalls:tcp_socket_test_native` failing on newer kernels. (2e2e65ee6)
Set clone propagation to MS_PRIVATE upon BindAt failure. (6a24f67cc)
`CODEOWNERS`: Limit to a few security-sensitive areas. (8b43f099f)
buildkite: fetch repo key on all release agents (5df55c0ab)
Update GOVERNANCE.md. (a8d669e52)
vfs: remove nsfs/cgroup exemptions from umount check for bind mounting (90bc4fc36)
pidsCount: minimise the scope of lock. (d6d96478d)
Add cos and ubuntu-gpu release agents (bd30d19d8)
systrap: rate-limit the ptrace-with-patched-syscalls warning (b12d4113d)
Remove root-level wildcard ownership from CODEOWNERS. (2dec9c1e6)
nvproxy: include CapNGX in AllContainerDriverCaps (551ba1389)
seccheck: Add benchmark for seccheck overhead during syscall execution. (513676db3)
tcpip/ipv6: add support for NAT re-routing in IPv6. (b8c3f8fed)
Add ADOPTERS.md as single source of truth for gvisor users (e4850e96c)
Enforce sidecar version matching. (7c71cb14e)
timekeeper: Make the timer pausable. (2337c1f9f)
Remove individual binaries from gVisor release artifacts. (cd03d0179)
Fix crash and resource-leak bugs in the containerd shim (4b9e98bee)
Forbid the addition of new boolean flags. (73a7a0c67)
runsc: Use openat2 when creating self filestores (907c32d71)
state: reduce statistics clock overhead (8d0f6ad66)
Fix deadlock when restoring terminated TCP endpoints. (ce363a101)
checklocks: guard TCP send-queue snapshots (bf1a81fbb)
checklocks: guard UDP binding and error state (663d4c6e7)
checklocks: annotate network lock ownership (dd2c13655)
systrap: preserve latency medians across histogram reset (6172a4bf3)
Fix CI test flakes in trace_test's Execve trace validation (fd439eb27)
Update gVisor release documentation for GitHub Release workflow. (917062dc0)
sentry: Use raw exit fields for raw syscall exit events. (fed825eb9)
Replace the experimental --mount-cgroup-v2 flag with in-sandbox-cgroup (646783231)
fix SIGPIPE in the release mirror's latest-tag lookup (feb6ee115)
[mremap] Validate mapping offsets during in-place growth. (730f514c4)
`runsc`: Add flag to control policy of sidecar binaries. (869c68ef3)
gofer: reword perf warning to match perf warning regex (e2f9de455)
Mirror tagged releases to the GitHub Releases. (40e748b42)
Test RHEL UBI10, which runs systemd, on gVisor (390171a66)
Expand systemd e2e tests (33232b47e)
Add `CODEOWNERS` and auto-generation machinery. (3e490905e)
Show nodev in /proc/[pid]/{mounts,mountinfo} and fix noatime rendering. (d0e79a14d)
Add GKE Sandbox MicroVM runtime support to gke_tester and testcluster. (0b9499c9f)
Show NoNewPrivs in /proc/[pid]/status. (23c95e52d)
checklocks: synchronize proc network sysctls (d1bdf960a)
vendor neutral AI contribution policy. (f18718a13)
checklocks: express TUN state ownership (69883405b)
checklocks: synchronize FIFO test accounting (27c02db3d)
checklocks: express gonet deadline ownership (a3b4ddbf4)
checklocks: copy TCP probe flags atomically (4a5bb7b60)
checklocks: preserve concurrent TCP close updates (39fe4084a)
checklocks: initialize TCP IDs before publication (835ec556a)
checklocks: unlock fragment processing after release (07a2c7654)
checklocks: synchronize UDP receive state (a33d2ccea)
mm: restore file data after partial huge-page MADV_DONTNEED (cfd99fc87)
Implement openat2(2) in gVisor (2d42c2bdf)
checklocks: guard pending packet queues (6bce52856)
vfs: stop saving epollInterest.readySeq (55f41e06b)
vfs: rebuild the epoll ready list on restore instead of saving it (cc62901f6)
images/gpu: update test images for Blackwell (sm_100/sm_120) (bec8194cc)
`runsc gofer`: Precompile seccomp filters. (872055177)
Add AWS EFA support to rdmaproxy (d20f077d1)
nvproxy: support NV_EVENT_BUFFER (f48dedc9f)
erofs: add LRU dentry cache to bound memory usage (9bc89d325)
nvproxy: support MAXWELL_PROFILER_CONTEXT allocation class (ebbfad5ae)
Full changelog: release-20260824.0...release-20260831.0