gVisor release 20261102.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20261026.0
proc: generate /proc/cpuinfo on read (7a675ac66)
proc, sys, kernfs: lazily populate /proc/sys and /sys/devices/system/cpu (8a719e832)
kernfs, proc, sys: Evict cached dentries in PrepareSave (918aefd5f)
Start the gofer with GOMAXPROCS bounded by its cgroup and capped at 8. (0cf7325e4)
pkg/state, runsc: switch default state engine to graph (6e6276344)
runsc/cmd, pkg/state: harden statefile output, HTML, and HMAC checks (85dbf4e65)
pkg/state: fix graph engine round-trip and pooled scratch bugs (0bbcbf9de)
Avoid holding shim locks across container creation and cache nil PodExtension. (7b2516a55)
Check SampledTimer EventRegister errors, and fix a stale comment (4f5ce20bd)
Don't let CLOCK_MONOTONIC go backwards when a restored kernel resumes (14313213c)
runsc/container: add active workload and cross-engine checkpoint E2E tests (3fb68e32c)
buildkite coordinator: fetch maintainers from governance/maintainers.yaml (dfeb3ce48)
buildkite: skip unnecessary clones (2116e5da2)
Rewrite vdsoClockGettime (085e111d7)
runsc: add --state-engine flag and per-checkpoint override (fc74469da)
Add runsc do and sandboxexec benchmarks. (558e98d97)
runsc/cmd, test/runner: forward statefile dumps to gvisor_sentry (1216e0f05)
governance: add maintainers' GitHub user IDs (8f15deb0c)
pkg/state/tests: run existing and callback tests with both engines (1398e3d66)
pkg/state: fix graph engine type info, type cache, and map hook edge cases (cabf43bcb)
pkg/state: add deferred decoding and PrintGraph unit tests (d12b0a39b)
pkg/state: add zero-sized value round-trip tests (8028e17d6)
Calibrate the clocks during restore, so the VDSO works on resume (eeb83261a)
Don't count time spent checkpointed in CLOCK_MONOTONIC (bd0e84e0f)
Measure relative CLOCK_REALTIME sleeps and timers with CLOCK_MONOTONIC (d87a01824)
Build the Bun spawn image with Bazel (a693e2364)
pkg/state: add round-trip tests for array aliasing and aliased maps (f8de95433)
tools/go_stateify: emit typed calls, registration, and callbacks (20/21) (cd90d7a74)
Add raw sandbox boot benchmarks. (a37bafc5d)
pkg/state: add typed Sink/Source methods and dual-engine dispatch (19/21) (aa5305e99)
Add seccomp-bpf filter rules for netgofer. (757d67e79)
pkg/state: add graph stream pretty-printer and typeInfo tests (18/21) (fbef70ac6)
pkg/state: add deferred object decoding and callback scheduler (17/21) (85d46891e)
pkg/state: add value and composite decoding to graph decoder (16/21) (3dd75fc57)
pkg/state: add graph decoder state and object/target table readers (15/21) (d8ff47859)
buildkite: rename the untrusted cluster's queue to `untrusted` (a7203afca)
pkg/state: add stream assembly to graph encoder (14/21) (6fb2e9fe2)
rdmaproxy: reject unsupported QP creation modes (98dae51e6)
gofer: restore the read-locked fast path in ensureSharedHandle (97d1256de)
pkg/state: add value, map, struct, and splice encoding to graph encoder (13/21) (8f9e31edd)
kernel: index unimplemented-syscall metric field values by a slice (ac2fe8a8e)
Keep FUSE device watches attached after connection abort (1e5a147a4)
pkg/state: add pointer and slice target resolution to graph encoder (12/21) (f4b41f15b)
pkg/state: add graph encoder state and object slabs (11/21) (9010b868a)
pkg/state: add per-stream type caches, type table, and graph stats (10/21) (0fa6803f2)
pkg/state: add reflection-free runtime typeInfo (9/21) (03e72471a)
Link host-run benchmarks and the container test app statically (b9193eed0)
pkg/state: add encoding buffers and open-addressed address map (8/21) (f8cc8437f)
pkg/tcpip/network/ipv4: remove unused IP ID generation state (7/21) (ac7b4e0fd)
Automated rollback of changelist 1009271256 (f4c82a02f)
pkg/cpuid: save static CPUID function as packed bytes (6/21) (bcd924122)
nvproxy: Mark NVIDIA driver 580.95.05 as supported again (8ab9b43b6)
runsc: don't sample sentry heap allocations unless --profile is set (5f1b5b271)
Update rules_python to 2.4.5 (32bf29155)
Require a usable TCP timestamp echo for Eifel detection (450dd7775)
docs: add the gVisor channels on CNCF Slack (730cdb7e2)
runsc: don't sample gofer heap allocations unless --profile is set (862346bab)
tcpip/stack: don't presize neighbor caches for NeighborCacheSize entries (5683e4b9a)
Mark myself as being on hiatus. (1b7482678)
runsc: do not account memory of disk backed private MemoryFiles (0af51ca98)
Pass host inode numbers through the gofer client (8ead67b1c)
seccheck: validate point fields without allocating (54a7bf0f0)
Check locking of the pipe splice cursor (7022c2361)
pkg/sentry/vfs: allocate FileLocks lock sets on first use (5/21) (509ad5337)
test/benchmarks/checkpointfile: add statefile and GC benchmarks (4/21) (a9c4e2084)
pkg/state/tests: add randomized graph tests and benchmarks (3/21) (d939ff3ab)
Prime core scheduling cookie creation during runsc initialization. (017014153)
pkg/state/tests: add random object graph generator (2/21) (79c6a439f)
Internal change. (d42bae25a)
mm: get uncached internal mappings in the read-locked I/O fast path (7a8074c01)
pkg/state/tests: add graph isomorphism checker (1/21) (ec8390e5f)
profile-helper: Don't truncate containerd config after the target section. (13b1f0b23)
mm: don't wait for whole large pmas for internal mappings in bg restore (c63a70c94)
Move coretag cookie creation to prewarmer stage. (867d93e6a)
Sandbox security posture test: Verify core tags. (ae7d40064)
seccheck: add a benchmark for Initialize (fd0e19367)
systrap: Recognize host stalls and don't kill stubs in that case. (a5b7936e8)
tcp: remember the advertised receive window (89a4c4973)
Release the startup heap to the host once the sandbox is idle (6bb4d1893)
Add Kernel.WaitForIdle (258207547)
Cap startup benchmark iterations in Buildkite. (11b2f501c)
seccheck: make TestPointRegistrationFields test field validation (2896af932)
Use rules_qemu for cross-architecture generators (61088c907)
nvproxy: hugepage-align application memory mirrors (d05ab617a)
Check inotify locking contracts (f64a22fd6)
Declare the copy tool for architecture outputs (42a8333d1)
runsc/bwrap: Support --dev in bwrap personality (7f10cf978)
Roll back failed epoll registrations (9f6054c77)
Select Linux UAPI headers independently (b8420d7dc)
Check locking of file epoll registrations (eec6ed445)
pgalloc: skip decommitting zero pages when a checkpoint does not resume (418a5d441)
benchmarks: wait for an HTTP response from restored Nginx (5fc68d2b9)
Remove the unused basic Ruby image (c7cd9df3d)
Pin Alpine for the empty-container benchmarks (0a730fd58)
pgalloc: recycle hugepage-aligned ranges for huge allocations (25209dc53)
`runsc` state: Reload gofer fields, don't leak loaded state file on error (a6070d26b)
Compare UDP checksums as transmitted on the wire (beb37f745)
cuda-tests: Don't report timed-out samples as passing. (05e46bd5b)
seccheck: build trace point descriptions only when needed (43d42197e)
netlink: send a 4-byte payload in NLMSG_DONE (d2c63e2e1)
buildkite coordinator: expect to run on a VM instead of Cloud Run (acae2e0d5)
buildkite: stop setting BAZEL_REMOTE_CACHE in pre-command (8dbabb771)
tmpfs: let huge page fills recycle waste pages (540cd026e)
Restore basic image sources in the shared context archive (dc6c326b8)
runsc/bwrap: Support --as-pid-1 in bwrap personality (bcc22e169)
document sandboxes without a root container (11d4d7042)
Internal change. (dc0734572)
Build the syscall benchmark image with Bazel (67adaaa43)
Honor `--sandbox-creation-cpu-policy` until first non-root container (81e811f89)
Reject invalid IDs during user resolution (18ba8a82e)
Clear the parent-death signal under the task mutex (ff770a721)
state: benchmark late array parent discovery (d8c5f75da)
Preserve SACK on connections accepted with SYN cookies (0b06fce45)
Initialize CUBIC congestion-avoidance epochs (0ef892cc5)
buildkite: add first-pass.yaml (adf99ead2)
fix a sentry panic when containers share a no-root sandbox's PID namespace (ccc363493)
buildkite coordinator: remove stacktest=yes filter (962ecf27b)
Preserve procfs lookup errors during creation (b039155d0)
Reject unrepresentable TPU operation timeouts (72b4500d3)
`runsc create`: Boot the sandbox asynchronously. (947e20e7f)
Avoid relocking the signal mutex on a platform error (94cbcd44b)
Read the group exit status under the signal mutex (7a75a6400)
Allocate advisory file lock trees on first use (710b3f2e9)
Reuse BPF execution metrics in seccomp (61b42ce8e)
state: centralize wire payload loading (3c6804639)
Restore the RACK reordering test (792659c37)
Refactor gofer related packages. (d79912977)
pgalloc: reject inconsistent async page saves (29b76eaf1)
Wait for veth operational state in the netlink test (1be507cab)
runsc/bwrap: Support --dir in bwrap personality (7d6ec0b3d)
Share the Docker Hub mirror order across test images (248c3a910)
runsc: allow Process.OOMScoreAdj to change across checkpoint/restore (5dcc62069)
gofer: do not stat cached regular files during PrepareSave by default (fced9335d)
`runsc`: Perform state file modifications atomically. (94fc2579d)
Size readers in checkpoint/restore per sandbox lifecycle CPU limit (3298a461e)
Build the filesystem stress test on the official BusyBox image (97c071a74)
Default runsc restore to --background and --direct-io=auto (d0f7ca889)
overlay: Skip copy-up for chown that does not change the owner (06ea590f4)
Restrict /proc/gvisor/spec_environ to the container's user (d9d108d2e)
Load xtables matches before testing INET rules (f13051312)
Export Benchmark's public umbrella headers (b5a38f67b)
Read EOF before probing closing TCP states (ca4f51e3a)
Reject out-of-range ports in TCP samples (ee83f5be2)
Disable glibc rseq in the systrap test process (7cf0ed804)
Stop port-forward readiness polling on timeout (be98bb4a7)
Use rules_go static linking for portable tools (76919b760)
Reject metric timestamp offsets that overflow time.Duration (dc9eb0f9a)
Clean up canceled HTTP readiness probes (70cebfe4b)
Build the Ollama image client with Bazel (1f8ed8232)
shim: bound runtime waits and recover explicit sandbox teardown (1fcccf3e3)
mm: hugepage-align hugepage-capable tmpfs mappings (aab0cb261)
cgroup2fs: add memory.oom.group (ddc10a2c6)
Report the host's ephemeral port range in hostinet (29eff9a55)
lisafs: validate Walk responses in the client (1759348ab)
netstack: Handle disabled state for hidden addresses. (c369bb309)
Check mount_too_revealing for new proc and sysfs mounts (87cd634ed)
Use regular files in execveat nofollow tests (77360cb73)
netlink: do not ack a successful dump (9241ad391)
futex: fix FUTEX_WAKE_OP (338210591)
Full changelog: release-20261026.0...release-20261102.0