gVisor release 20260928.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20260921.0
Treat missing host DMI data as optional (04f086c98)
Honor field ignores when inferring guards (62a88a44e)
netfilter: add iptables comment match extension (2950de401)
Add integration and unit tests for splitting fs snapshot. (43c7d2a65)
strace: include TID on enter/exit events (2962c6ba9)
Remove unused machineControl.isEnabled and fix checkFileExistsOnWrite. (80162d174)
Preserve config file permissions when backing it up in `runsc install`. (7967b38c4)
hostfd: Report partial progress from chunked vectored I/O. (aab280d45)
cuda-tests-12-8: Don't report timed-out or failing samples as passing. (1ecd1e9b0)
Fix plugin socket readiness caching (7357cd7b5)
Fail closed on statefile hash mismatches. (28878b9b2)
Target Linux in the Go package driver (7c9156c95)
Ship race runsc and Sentry in //:release under --config=race (6e97c9a36)
Test inner docker pause in TestSystemdDocker (3e148c432)
Github assigner: Delay PR auto-assignment (5dfeed28d)
Fix table rendering in the bwrap personality docs (aa6fdd4d1)
Add containerized harness for containerd tests. (e2603552c)
Fix PacketBuffer leak in UDP forwarder. (d6348acfd)
Internal change. (5d1560f19)
Refuse iptables targets on hooks and tables they do not support (ab048a0db)
Show signal masks in /proc/[pid]/status (0ac45dc25)
Reuse object-path indexing when exporting facts (63a6d5e30)
Add documentation for the runsc bwrap personality. (c989f7bb8)
Add a lockdep build config and syscall-test recipes (27e9df2bc)
nftables: validate csumOffset bounds in payloadSet evaluate (79d77b79d)
nftables: Enable ipv6 tests. (5b986d1c4)
buildkite: add continuous syscall tests against Linux release candidates (2561a298f)
ipv6: Support net.ipv6.conf.[all|default].forwarding sysctl (9655670bb)
Automated rollback of changelist 986324907 (ca64eb633)
Make `interrupt.Forwarder` lock-free. (a345ed50d)
Automated rollback of changelist 985597183 (7e57d20df)
cgroupfs: drop registry entries on filesystem release (b8d03ce77)
Account for packet memory overhead in UDP receive buffer limits. (14dfded19)
Implement cgroup.freeze for cgroup v2. (f62a6f5f8)
auth: Honor file capabilities under no_new_privs (aa481ade4)
nvproxy: restore version.go changes clobbered by 0662a64ef591 (346de8ca1)
Support 64K pages on the arm64 KVM platform and set page size dynamically (678a4ef20)
Add GitHub security advisories as a security reporting channel. (a9bf95d13)
don't leave staging tags behind for published releases. (e8a36c1c5)
mremap_test: gate Fixed_ShrinkingAcrossVMAs post-failure unmap test (12f5352cf)
test/syscalls: skip NonCanonicalTLS on native Linux for ARM64 and RISC-V. (7a8ec1873)
Move save/restore tests to dedicated test files. (cd70ec1fe)
Accept both kPageSize/4 and EPERM in SealGrowPartialWriteTruncated on Linux. (7aed62b0c)
test: align clone stack to 16 bytes in NonConsumingWaitPrefersGroupExitStatus. (faf41cce1)
overlay: Enforce Linux's stacking limits (73523ee01)
test/syscalls: accept ENOTTY for FIOASYNC on pidfd on native Linux. (613b243e3)
runsc/bwrap: Support --perms in bwrap personality (3cbc9bed6)
socket_netlink_netfilter_test: fixes for modern kernels (7ea66d902)
landlock_v6_test: create sun_path in /tmp rather than TEST_TMPDIR (5910b7fdc)
pread/pwrite tests: use a larger "invalid" flag (13cd8bfa2)
Read annotations on every declaration (b4f379e5d)
Cover read modes through lock aliases (a8651ab62)
Keep metric sampling helpers nosplit (babc833e7)
shim: bound runsc kill, Stats and Status with a 30s deadline (9d1aa3e70)
runsc/bwrap: Support -argv0 -die-with-parent -new-session in bwrap personality (d50f8512f)
Timekeeper: Read pausableClock before reading monotonic time. (4842a71e1)
Internal change. (ec1f1f3d5)
Add Go example for gVisor SandboxExec demonstrating safe document processing. (65a2381c5)
Add Python SDK documentation and API coverage test (9d48b83c5)
vfs: enforce mount noexec and readonly on the access path (758b9d44e)
safecopy: avoid writeback addressing in arm64 memcpy for KVM MMIO (0398da8e2)
rdmaproxy: handle legacy write-ABI commands explicitly (31cae96c3)
kvm: rerun vCPU after injecting ext_dabt for _KVM_EXIT_ARM_NISV (79dec3ec4)
nvproxy: support AMPERE_B and GET_HS_CREDITS_MAPPING (0662a64ef)
cpuid: Disable `FSGSBASE` feature for guest workloads (f518f5318)
seccheck: Move the control socket wire types out of the sentry. (a3969da89)
Add container lifecycle benchmarks. (573807c43)
checklocks: annotate service and metric locking (9da485e25)
Implement TCSETSF for master/replica tty (a87f8011a)
overlay, gofer: defer dentry drop when Notify removes the last watch (83ecfd353)
Check all checklocks fixture diagnostics (d5918bd3d)
checklocks: annotate kernel and IPC ownership (076838d0a)
Pick a free name for links created without one (22d8314e9)
Close the veth pair when the first NIC cannot be created (3ac2f8cee)
Pin and harden auto-assign workflow (e84a3415d)
fuse: advertise FUSE_BIG_WRITES in INIT (392210bd0)
fix: preserve TMPDIR for sandbox chroot setup (31190b0c2)
fuse: advertise FUSE_ATOMIC_O_TRUNC in INIT (a90a882ff)
fuse: fall back to FUSE_MKNOD when the server lacks FUSE_CREATE (bbd86c276)
boot: track PID namespaces on execProcess instead of ThreadGroup (1f9cec32e)
chore: trigger signature verification (a48fad62e)
boot: don't dereference a nil ThreadGroup when joining a PID namespace (660192acf)
Implement /proc/sys/user/max_user_namespaces (d54b5dac8)
Full changelog: release-20260921.0...release-20260928.0