gVisor release 20261026.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20261019.0
tmpfs: allow Translate to allocate huge pages even when required is small (e8a2a2889)
Refactor callers of `runtime.GOMAXPROCS` to use `gomaxprocs` package. (354adc89e)
`runsc` state: Support lock-free read-only mode, match process by pidfd (bab1123c2)
tmpfs: support the huge mount option (c6d2391dc)
Align nested test cgroup namespace and mount (328b51265)
container_test: Verify OCI status after failed root start or restore. (558ce1dad)
`runsc`: Use a consistent OCI spec across sandbox setup. (bf5a48e89)
Ensure `runsc` commands are robust against still-booting sandboxes. (f76c600d6)
pkg/state: Defer type verification from `init` until actual use. (36555ddbd)
Register runsc metrics later but still before running untrusted code. (d804fcbc2)
`runsc`: Skip logs when they are not going to be used. (a390ada0c)
Only pass mount setup channel to Gofer when it may need it. (b7d3ad58e)
Resolve symlinks in device paths before mounting them in the gofer (88715ed9a)
Initialize `Loader.restoreDone` before `onRestoreFailed` needs it. (e7196c6dd)
Close `unet` RPC socket on `exec`. (0512915a0)
Build basic test images with rules_img (c3e0783a5)
Recognize GitHub codeload archives in license audits (e50192311)
nvproxy: Mark driver 620.51.03 as having no public ARM64 installer (c341af3e0)
Check existing task and signal locking contracts (2a057f2bb)
Add CPU limit knobs for sandbox lifecycle operations (a49825faf)
pgalloc: don't merge memAcct from UpdateUsage() during MemoryFile.SaveTo() (b6dff9b7e)
Run core tagging tests in unit CI (9da6f49c8)
Update Benchmark to 1.10.0 (adf6f31f9)
runsc: give each container its own rlimit set (b28cc9e57)
mark container init processes explicitly (29b97c66d)
Restore metric tests to routine CI (a52b53673)
Precompile platform-specific seccomp filters. (ace1e9186)
Support comment matches in nftables compatibility (a6df5d5df)
Propagate failures from source lint tools (b01f3baf4)
Reject noncanonical file descriptor names in procfs (d8c746bbf)
proc: Reject invalid task directory names (5dceaf054)
sysfs: restore DMI entries in CompleteRestore (9d981cb9d)
Validate FIB attributes by netlink ID (000154410)
Enable deprecation diagnostics for repository code (53203cabe)
Fix RACK packet-test assumptions (e7a0da69e)
Keep restore readers within the CPU budget (708536a75)
kernel: Implement setfsuid and setfsgid (cc78af96d)
Populate task counts and last TID in /proc/loadavg. (692e4268c)
Preserve moved TUN devices across restore (fdca42b68)
Make shim event publish failures non-fatal, as in the runc shim. (8e113d451)
seccomp: set GOMAXPROCS in test victim before installing filter (7244fd198)
Add `pkg/state` benchmark for kernel serialization. (8f26710e0)
Update checklocks for signalfd and adjacent files. (3e91facc5)
Refactor SpecEnviron so that its stored in the kernel. (3ddf938b7)
Fix `signalfd` read racing with `execve` in the creator process of `signalfd`. (a4cb9fbd5)
Add Bun spawning and seccomp fork benchmarks (84dc32126)
Declare syscall fixture headers directly (ac9a08b5c)
Reuse inherited seccomp syscall caches (6a4c5ad9d)
runsc: Add `--bitmask` flag to `runsc cpu-features` and `runsc statefile`. (3fdb673dc)
Use the BCR libbpf header target (2d1bbe301)
Record the sandbox's CPU features in checkpoint metadata. (09da2caef)
Build BPF with declared LLVM tools and headers (30ace3e2a)
pgalloc: throttle background page loading until the kernel and filesystems are restored (30cec7d69)
Check Go import groups with goimports (44d286a1d)
Spawn with explicit GOMAXPROCS to avoid 5ebae40be9 regression. (49e8aba56)
KVM: exclude the last page below 2^47 from physical regions. (8418a3739)
buildkite coordinator: give coordinator agents build-scoped artifact tokens (c5ab48fa9)
Write `runsc` state file atomically. (9fa3d71a6)
overlay: avoid ENOENT whiteout panic when renaming from a dead dir (6d278f8fc)
Wait for accepted connections in TCP restore tests (80eae6ef0)
Merge Go template declarations directly (473a5d133)
Update Go to 1.27.3 (34a65a944)
Bind SYN cookies to the client sequence number (d1e76f1cb)
Bound TUN and TAP interface MTUs (255953d4f)
Match Nogo sources to compiler order (a995e732e)
Drop privilege in the Landlock rejection test (d14afa764)
Run close_range CLOEXEC tests on supported kernels. (58cc8f3c1)
Remove unused benchmark address lookup (03c97723b)
Exercise IPv4 rejection of IPv6 traffic-class options. (d85672221)
Save and restore KCOV state (04556f955)
Wait for fork setup before freezing children (3c82fee9c)
runsc: Reject out-of-range exec user and group IDs (c6df8e6ac)
Reject out-of-range cgroup task IDs (53565c5c3)
Wait for FUSE before copying benchmark inputs (f19672241)
Include the terminator in the rewinddir path (c2d61fcd6)
Report state dependency cycles without recursion (362335a95)
Exercise example network modes with a listener (30e04099a)
Consolidate GPU driver preparation (aa13d6a12)
Update actionlint to 1.7.12 (b40e6d53e)
test: Run the plugin network test only in its owning package (ba7660808)
Upload gofer logs for failed Buildkite tests (8f4774535)
Apply Java time limits during test discovery (9e496b6e7)
Update the nginx test image to 1.31.7 (8f0a165f2)
Build the GCS FUSE test image on Debian 13 (652a77068)
Wait for iptables test containers to exit (81c9463ba)
netstack: fix forwarded IPv6 checksums (f0d94d832)
Restore trace tests to routine CI (418508a78)
Allow libc thread creation in cgo filters (11218f20c)
Update TPU7xPFDeviceID to 0x75 and TPU7xDeviceID to 0x76 (f29613779)
buildkite: don't gate presubmits on the ARM64 smoke tests (7a659877c)
tmpfs: return ENOENT when creating a file in a deleted directory (814de4372)
runsc: Add test for VDSO time reading with adjusted TSC. (d5f2e7f30)
shim: Fix task deletion when the shim serves other containers. (5066e07d0)
update build files to enable save-restore on arch_prtcl (ab50ad6a6)
overlay: Copy file data for setattr copy-up without holding renameMu (ad2361b80)
overlay: Copy file data for open-time copy-up without holding renameMu (267690ee3)
Support --platform=auto in runsc (82aa7f55a)
keep TPIDR_EL0 when PTRACE_SETREGSET writes NT_PRSTATUS on arm64 (8c8c6be29)
Fix flakiness in native syscall test execution. (734b12546)
nvproxy: support GPU queries and FIFO events (6cb32c649)
Connect to host unix sockets with the application's supplementary groups (37bbffde6)
Refuse route types that netstack cannot install (35b79b350)
Apply three clone_private_mount checks to overlay layers (637d6897d)
Retain output when runtime test discovery fails (ddea238bb)
Assume only conditional jumps in `optimizeJumpsToSmallestSetOfReturns`. (64b17e6ea)
gofer: propagate sync errors from syncRemoteFileLocked (ce49537d1)
Modernize agent guidance. (1de93cd35)
Stop panicking in initSyscallThread (8a05f48c4)
Populate TSC metadata in save/restore checkpoints. (1921e111a)
Adds per-author rate-limiting to the Buildkite coordinator. (e2df13900)
Clarify that experimental features are out of scope for CVEs. (2d98b85a4)
Expose imported object facts to Nogo analyzers (41ca4bbf6)
Accept architecture-independent KCOV records (56f55fcbb)
Makefile: run every benchmark platform and report failures to Buildkite (79ed27312)
Add no-root-container test with split checkpoint/restore. (c7cb8e179)
Send full TCP segments without waiting for ACKs (b143d86cb)
overlay: Skip copying file data on copy-up for O_TRUNC opens (aeca713ee)
Speed up seccomp precompilation by 50% + another 25% for ARM cross-compile. (d5d791888)
tpuproxy: support non-zero PCI domains and guard nil pciInfos lookups in sysfs (82396309a)
Respect sandbox exit in FS checkpoint tests (6567a6c99)
kvm: Allow shadow VDSO stubs in the full [vdso] tail. (f45af8b75)
Run clang-format on the IPC_RMID ownership test (e67927203)
Enforce ownership check on shmctl(IPC_RMID) (f502e92ea)
Fix Gazelle check. Add it to BuildKite. (86797b5f4)
fsutil: use huge pages for the aligned middle of unaligned fills (372219903)
Match Linux KCOV buffer-size validation (254c5d70b)
Retry interrupted KVM creation in pinring tests (8d784afdc)
Avoid growing FD tables when clearing absent descriptors (0cd7d0778)
Validate netfilter query sizes and permissions (9661cdec7)
Restore original cgroup membership in tests (c9a33a02b)
Bound bitmap list parsing by its declared size (71a39f840)
Update PHP runtime tests to 8.5.11 (fa1d285ec)
Build gofer cgo filters only when needed (7941bdca9)
tcp: reject ambiguous loss-probe RTT samples (4d0adbc37)
Restore pending NDP jobs at their deadlines (f4190d878)
Return ENOENT for missing original destinations (bac3659cc)
Declare image contexts and CUDA helper builds (923b3b3e2)
Initialize RACK sequence markers from the ISN (776b86bce)
Reject out-of-range runsc do ID mappings (7ff604b88)
Probe core scheduling support before testing it (d838db565)
Restore tracereplay tests to routine CI (0068142bd)
Wait for native TCP timestamp activation (02e19cf28)
Separate trace metadata from stderr diagnostics (60399ad7b)
Ignore OOM score permission errors after exit (728f546af)
pgalloc: make MemoryFile.savable atomic (95423190e)
kernel: skip seccomp for restart_syscall after a checkpoint (e553a9457)
Limit EROFS block sizes to 64 KiB (8b584f080)
Add CVE-2026-95702 details. (8743876b9)
Remove duplicate network checkpoint variants (9e4c812a8)
netlink: notify RTNLGRP address and route groups (38c6bd2f3)
nvproxy: support /dev/nvidia-uvm-tools (9f745c6f3)
sandboxexec: document the gvisor Python package on PyPI (e2fc49d53)
runsc/specutils: reject host UTS namespaces (d7bcbddd5)
Full changelog: release-20261019.0...release-20261026.0