gVisor release 20261019.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20261012.0
Route ZIP imports through pkg/zip (760b80785)
Update entry_arm64.s WORD encodings with Go asm instructions. (c7b068949)
Implement TSC offset support for KVM platform. (0da978008)
netlink/route: report IFLA_OPERSTATE in RTM_GETLINK (83d1b4dba)
Mark subprocess dead when killing syscallThread on seccomp error (46ab0903f)
Correctly 0 out `ECX` for CPUID instructions that are `ECX` agnostic. (7bb7e84f3)
Internal change. (e7cf4ce66)
Return errors directly from CopyFiles (c971f5fc7)
Wait for reparenting before reaping a grandchild (0a0f0a63f)
Ignore unused arguments in fchdir trace events (27c9b0413)
Fix the UID map test's temporary mount (60a37a11a)
Advance the send cursor after retransmission (7c8d7811a)
Document internal socket-option test inputs (a3b167e62)
Update golang.org/x/net to v0.60.0 (a1a19130a)
checklocks: correct lock-state diagnostics (f21fe6e21)
Prepare for a runtime page size on arm64. (3f35bca89)
Run KCOV tests on systems with 64 KiB pages (126f2b747)
Skip syscall tracing in the process stress test (c5c61728e)
nvproxy: support nvidia-smi (95f5b5757)
Allow setting RLIMIT_MSGQUEUE (c4fc87231)
nvproxy: remove unused profiling control (c8bf830b3)
Update Ollama images to 0.40.6. (75aa7adbb)
Precompile seccomp filters for target arch, not the build machine's (078390601)
Support syscall-number variables in precompiled seccomp filters. (970913817)
Enable pinring for restored sandboxes. (ded27ddc5)
Don't write below the interrupted stack pointer on arm64 EL1 exception entry. (aa95814ad)
pgalloc: count bytes saved in synchronous MemoryFile.SaveTo (6eca749f3)
devpts: default ptmxmode to 0000 like Linux. (1a256dc06)
Stop panicking in createSysmsgThreadLocked (f56fca7ba)
netfilter: add iptables conntrack match extension with strict validation (42cb67604)
Optimize BPF instruction removal and return jump rewrites. (73eaa3854)
Support saving and restoring multiple filesystem checkpoint bundles. (b79256080)
Stop panicking on ptrace thread wait, attach, and syscall errors (423a3ccf6)
gofer: defer OnZeroWatches when HandleDeletion fires inside checkCachingLocked (47654520e)
Release packet views when checks abort (9e1d8226d)
Skip GetSockOptRequiresCapNetAdminTest if Linux lacks the table or target. (bf97a3bfc)
Use precompiled seccomp variables for self PID in ptrace and systrap. (e26feb3f7)
Fix devpts newinstance tests on Linux. (049c8afcb)
nvproxy: add missing ioctl used for NVIDIA EGL (bebda1d56)
Collect iperf metrics from the client (bfdd9b1f0)
runsc: cache OCI seccomp programs by profile hash (8e8cc9d9b)
Open release cherry-pick pull requests as gvisor-bot. (36d34f460)
Wait on Docker exec output before polling (0b31c2215)
tcpip: route post-DNAT OUTPUT packets by destination, not pre-DNAT source (0e24cb0b4)
Fix race condition in coretag.Enable (a3541b985)
runsc: support checkpoint/restore with --no-root-container (26f4302c3)
Fix /dev/vfio walking for device discovery. (b689fc55e)
Skip the signal stack overflow check in WalksOffBottom on arm64 Linux. (34ed99ebc)
Isolate and restore key-quota test state (e12658471)
Skip native overlayfs tests without CAP_DAC_OVERRIDE. (d42105233)
Map the top user page for KVM on ARM. (1fcea24a0)
benchmarks: isolate client and server CPU cores to eliminate scheduler thrashing (6a0439489)
Put overlayfs layers on a tmpfs in native mount tests. (664681582)
Fix privilege checks in cgroup2, proc and setns tests. (0761fe12e)
lisafs: fix uint32 overflow in PReadHandler response size check (85d922c54)
Carry the sources of runsc's sidecars in the go branch (0e12fb902)
tmpfs: copy small writes to disk-backed MemoryFiles through the mapping (ef69194f8)
Add FIB presence and register-storage tests (ccf74c570)
Measure pinring teardown after child setup (49ad4e7a2)
Group checksum trials by size and alignment (6540cf3e4)
runsc: Add a deps test that keeps the Sentry out of runsc. (6b3ee9cab)
control: Move control socket wire types into a Sentry-independent controlapi package. (817756385)
runsc: Forward `runsc metric-metadata` to the Sentry binary. (4dab1f475)
runsc: Forward `runsc nvproxy` to the Sentry binary. (68976aab7)
runsc: Forward `runsc help syscalls` to the Sentry binary. (8e5b66d05)
runsc: Move Sentry RPC names and wire types into a Sentry-independent sentryapi package. (c6b77460b)
runsc: Make the procfs dump package contain only the dump types. (9974a900e)
platform: Move descriptions out to its own package (f29b69bb5)
runsc: Use literal filesystem type names rather than importing Sentry filesystems. (588276c3d)
runsc: Stop embedding the Sentry's `symbolize` command implementation in runsc. (a2c676851)
runsc: Unmount /proc with a freestanding C sidecar and remove the `umount` subcommand. (d4d3e2802)
Release received rights when recvmsg fails. (4a755d270)
vfs: allow open_tree(2) and move_mount(2) on non-directories (7b9b4d7fd)
nftables: Allow fib PRESENT flag only with RESULT_OIF. (cb15caa05)
buildkite: run smoke tests before other presubmit tests (85638ef5b)
Document how to identify syscall CI kernels (c4f2d7b2e)
fuse: implement FUSE interrupts (97e146315)
Run save/restore binary after cuda-checkpoint on resume and restore (7f6886541)
Internal change. (8c2116489)
Internal change. (a884b249d)
Run post-resume work asynchronously on checkpoint --leave-running (232543d3b)
Do not block when writing nothing to PTY master input queue (6b4e208e4)
Use CIDR masks in route-selection tests (6b1f66d11)
Fix shared-library linking in the C++ toolchain (928823b75)
Restore the IPv6 control test's source address (a5193ff58)
Support chunk-based regular files in EROFS (1b9e1446f)
Allow execve of execute-only (--x) binaries (3cd71284c)
kvm: Add VDSO counter-read matchers and stub writers. (16fce9626)
Fix sysfs mirroring to properly invalidate cached dentries on restore. (7d204a15a)
Internal change. (74790145a)
gofer/directfs: fix socket FD handling in chmod and BindAt (ab53add94)
nvproxy: support NV_MNCC_SESSION and mncc-mgmt capability in 620.51.03 (e1c79030f)
Internal change. (ceedd33bd)
shim: report OOM-killed containers as 137 under the systemd cgroup driver (01e1eb630)
Fix malformed markdown in release page. (fb8943abc)
runsc: join a restored container's namespaces by path (216913baa)
cpuid: expose AVX-VNNI and AVX512-BF16 (9e0cfe48e)
Avoid late checkpoint waits in tests (43eeb8be4)
cpuid: Hide AMX from applications (914b7c397)
Use the test directory for overlay storage (d711e04eb)
Reject malformed checkescape annotations (152315bed)
runsc: Remove the `boot` subcommand. (0d28165eb)
Run runsc from the //:release layout in docs and CI. (bf6270701)
fix(runsc): isolate xdp flag state (bb42934d1)
runsc: Disable cgroup-aware GOMAXPROCS in the sentry (5ebae40be)
kernel: implement SECBIT_NO_SETUID_FIXUP (8dae22eb4)
runsc: Hand checkpoint files to the sandbox through a read-only mount (3adbaeba6)
proc: keep /proc continuation on the PID, not the entry count (971b6ab62)
state: resolve zero-sized interior pointers (63317153e)
Isolate cgroup controller transfer tests (1371b429f)
Disable tracing in the page-table leak test (3e45c1519)
nvproxy: Add NV_COUNTER_COLLECTION_UNIT control commands (d517f8989)
Report clock readiness after rejected calibration (529ae96bd)
Copy netlink memberships in complete words (27c59aad4)
Return an error when an EROFS mapping extends past EOF (f1a2881c9)
Reuse temporary map decoding slots (912173d85)
Reuse scalar map iterator storage (3564cfff0)
bpf: Fix `Tax`/`Txa` flipped instructions, fix `removeRedundantLoads`. (109892937)
buildkite coordinator: implement core job scheduling + agent API (333ab1ceb)
Measure one state operation per benchmark iteration (54480518e)
nvproxy, tpuproxy: release FDs when device opens fail (5d14b1558)
Keep per-case XML test reports distinct (75f351eaf)
Make ARM64 page size a Bazel build setting (2f5afbc58)
examples/sandboxexec: add Go document processor example (6332ca527)
Preserve known Go module commit metadata (20a8b6c63)
Bump actions/stale from 10.4.0 to 11.0.0 (0bdd1abc0)
pgalloc: skip host holes during checkpoint (b48c20514)
nvproxy: handle Blackwell profiler control commands used by CUPTI (a559b7869)
Fix signal protection for a PID namespace's init (ad01feb5f)
nsfs: implement NS_GET_NSTYPE (860d3b9fc)
Full changelog: release-20261012.0...release-20261019.0