gVisor release 20261005.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20260928.0
Automated rollback of changelist 993737103 (d38ccf24a)
Support save and restore for /dev/net/tun devices. (8bf3dc484)
Update actions/setup-go to v7.0.0 (40ab07ee5)
Handle SECCOMP_RET_LOG in the sentry (176f861b0)
Honor DAC capabilities in mq_open (3fd8e2caf)
Update C++ dependencies for Bazel 9 (b90bda8cd)
Unify generic and concrete checkescape analysis (aa42986c0)
Materialize outputs consumed by Make (ea3dcb130)
Internal change. (0b0c579a7)
Exercise payloads in buffer benchmarks (52e384938)
Keep IPv6 subnet setup valid through its assertion (9453f33d7)
Retry each exhausted stress-test connection (5b2a159f2)
Cover imported private lock contracts (dd582df2f)
Share public syscall test selections (e2d25110c)
Inspect the Docker socket only when present (ef35352fb)
Run actionlint as a declared Bazel test (e89cc3985)
Remove unused builder Java and QEMU packages (3e7bad01a)
Add a shebang to the goimports launcher (fffb5e816)
Use the selected nm for sysmsg offsets (07a47811d)
Select test platforms by operating system and CPU (6e036a388)
checklocks: annotate memory and timer locking (0ce4df8dc)
Apply systemd cgroup I/O resources directly (4aec3baa5)
Expect short IPV6_CHECKSUM options to fail (8a71f041a)
Report valid FUSE attributes (b8dc99428)
Fail network tests at namespace setup errors (962441d4e)
Keep cgroup unit tests independent of the host (9ae038dec)
Match Linux message-queue unlink permissions (768231db3)
Lower loopback before testing rename events (3c528de66)
Fix iptables replacement counter counts (15e7abef0)
Wait for checkpointed containers to resume logging (91e15cbbc)
Clean up cgroups after failed container creation (eda1b757c)
Support passed descriptors in create and restore (490148c39)
Declare the ping runner's descriptor budget (9cfbe5fa8)
Use native ping bind errors with host networking (12b1959dd)
Checkpoint openat2 races after workers finish (1ea4a9f75)
Set explicit priorities in ioprio tests (ff8a597f6)
Use the configured parent in cgroup v2 tests (a6014c565)
arm64: disable PAC on systrap (6acbca000)
Add blog post announcing gVisor's donation to CNCF. (af982d4dd)
Fix two issues in the Buildkite benchmark pipeline: (42f3f28e7)
benchmarks: assume runc as default runtime in startup benchmarks (1b5fb29d1)
Internal change. (0e0839258)
fuse: Fix file size update on `fallocate(2)` (fc3ec9c05)
Add GitHub Actions workflows to cut, cherry-pick and stage releases. (7dc15fa3d)
Restore x0 to the first syscall argument on arm64 SECCOMP_RET_TRAP. (bbb7e9e15)
Internal change. (e68b1a05d)
control: Allow reconfiguring the save/restore exec binary (b21d96f99)
Remove the Podman smoke container before cleanup (8202d0dc4)
Internal change. (2353a35dc)
Use distinct benchmark suite names for OCI and shim lifecycle tests. (4e9e164ca)
Upgrade rules_go and adapt Go build rules (64d84bfb1)
sentry/arch: align ARM64 PIE load address and mmap randomization with Linux. (12aa4b4b6)
Preserve cloned buffers when growing with zeros (8b92e722d)
Keep devpts mount options off root and ptmx (b07ccec16)
Makefile: decouple benchmark upload from test exit status (f16fd344e)
Reset Go build modes for the Nogo tool (71a606a61)
Internal change. (040a288bd)
Syzkaller: Use gVisor release tarball. (78424a487)
checklocks: enforce lock and atomic contracts (2bf6f9791)
nogo: preserve configured analysis inputs (5a095390e)
Remove references to the Gitter chat room. (28d7fa83a)
Parse Docker test flags before checking the client (79cadb7e9)
Check Linux filesystem reconfiguration effects (451728834)
Allow runsc to connect to an external proxy via UDS with `--network-proxy-path`. (4c47ec500)
directfs: Validate host file descriptor identity in openHandle. (cd968a36e)
Make setsockopt return ErrProtocolNotAvailable for SOL_TLS and TCP_ULP option (760962f47)
Add lifecycle benchmarks for containerd shim. (12c5ff6c1)
Keep test discovery out of XML results (1981947ab)
Use hackbench's short loop option (1ada6ae0d)
Bound checkpoint readiness with its context (840fdc5ae)
Preserve fio output when a benchmark fails (4c3863927)
Use private networks in checkpoint benchmarks (792cc8f9c)
Allow declared file copies to execute remotely (ff350d4dd)
Remove TLS pointer validation on ARM64. (dae79243c)
Add Snowflake to gvisor adopters. (303cf8815)
Include syscall test declarations directly (5f85d3f54)
directfs: Reduce revalidation from 3 to 1 syscall (dc25aa6d4)
netfilter: add iptables MASQUERADE target with strict hook validation and tests (45eec5982)
Update maintainers. (7b79c8948)
images/gpu/cuda-tests-12-8: set LD_LIBRARY_PATH for nvidia driver libraries (beea1699e)
Exclude Release from its own APT checksums (4be3f871c)
Clarify the two trace session setup methods in seccheck documentation. (911ffec99)
Wait for Docker exec completion (d229d4357)
Keep log-wait results safe after timeout (5eecc5ca5)
Avoid overmounting the gofer's process root (c7da74998)
Respect inherited limits in the rlimit test (17ac3a395)
tcp: Fix segment leak when TIME-WAIT reuse fails to enqueue. (470422245)
Add a publishing step for the Python release. (ecfe1cfac)
Load Bazel 9 rules explicitly (e4199cc99)
Internal change. (97ed0ffc7)
Fix BFQ cgroup weight access and detection (554716436)
Fix setup of the traced set-user-ID exec test (1e7bec989)
Check Linux packet mmap version support (1cd3f0592)
proc: never report TID 0 in /proc/<pid>/task/<tid>/children (72c8b8158)
Refuse iptables jump loops before parsing targets (07d493021)
fdbased, xdp: close dispatcher stop eventfds on endpoint Close (b11702b3c)
Skip the checksum check when REJECT resets a packet on OUTPUT (e86790f41)
gro: add missing test deps to gro_test (82c23e4f3)
buildkite coordinator: add scaffolding (505f7545d)
Fix compression cleanup and shared utility races (8807d41b2)
Avoid boxing errno during signal-frame setup (5ea6855c2)
Recognize additional BSD and CC0 license forms (19624c026)
nvproxy: support NV00FE memory mapper control commands (57884c289)
Use Linux UAPI headers in BPF programs (8c5ed4300)
Pack `Task.gostate{,Seq,Time}` into a single 64-bit atomic int. (c87495d12)
Fix imported file metadata updates (3cf8bfde6)
checklocks: annotate filesystem lock contracts (18acf5db9)
devpts: apply mode and gid to replicas, not the root directory (51a3d7233)
Add a reusable sentry CLI entry point (f351027dd)
Take the address family of a route lookup from rtm_family (c4efe7bd5)
netstack: drain all packets from GRO buckets on Flush (f5e3f6030)
nvproxy: support NV2080_CTRL_CMD_FLA_GET_FABRIC_MEM_STATS (1a3027f10)
Fix metric shutdown, state, and NaN bucketers (a30d5fc67)
stateio: limit concurrent page restore copies (b23d3c754)
lisafs: fix uint32 truncation in PReadResp.CheckedUnmarshal bounds check (bb4c4fc29)
Return ESPIPE on devpts positional read and write (3270e6530)
runsc/cgroup: discover and populate spec files for subcontainer compat dirs on systemd v2 (6bdc01afc)
Handle SECCOMP_RET_KILL_PROCESS in the sentry (99b466f31)
Full changelog: release-20260928.0...release-20261005.0