gVisor release 20261109.0
Binaries are also available from the apt repository and the release bucket;
see Installation.
Changes since release-20261102.0
Support UDP in netgofer. (c58baea46)
Clear the interrupt shadow before delivering memory-fault signals. (abeb5cfca)
Refresh gvisor website to include sandboxing messaging. (70d4d07f0)
Add dedicated overlayfs syscall test suite (5aca3eeb3)
Update agents guidance. (39e515be5)
buildkite coordinator: delete instances that never got a timeout (eda4531ce)
nvproxy: don't copy non-parent dependencies in objDup (49e0b1ad5)
build(deps): bump actions/checkout from 5.1.0 to 7.0.1 (b3095be6a)
overlay: add lockdep subclasses for stacked overlays and directory copy-up (87f30ad81)
Round the minimum user address up to a page boundary. (e3550d8a2)
Mark nybidari as being on hiatus. (5999b18ff)
Release waiters and page references after a checkpoint read error (f054d1f11)
Export the netgofer command to the Go branch (bf7b1290b)
Preserve packet headers when consuming payloads (5053feec2)
Remove unused receive dispatcher GRO state (7321ca09d)
Preserve Bazel errors in the Gazelle check (c036b7338)
Start netgofer proxy in runsc. (451b92800)
Report retransmitted segments in TCP_INFO (7eda82e34)
Prepare more code for a runtime page size on arm64. (ed70698a7)
Build the Python HTTP image with rules_img (e62c22929)
Run the issue reviver without the Docker builder (3f9a9984a)
Build the resolver-symlink image with Bazel (a869d645a)
.github: let repo-guarded workflows run in gvisor/gvisor too (9f44ec755)
buildkite coordinator: apply idle timeouts to all agents (53788c741)
Recognize instantiated method receivers in stateify (1de5b54a9)
pgalloc: handle host faults when zeroing disk-backed pages (2b39184b6)
Serve the InfiniBand port P_Key table in the RDMA sysfs tree. (f5a077d07)
Require CAP_SYS_ADMIN for clone(CLONE_NEWNS) (bf8486ad1)
tcp: fix lost wakeups in two listen tests (3030bcb89)
Check the mutex protecting TCP keepalive options and probe counts (902bee917)
proc: add /proc/sys/fs/aio-max-nr and aio-nr (45a446ab1)
nvproxy: Use Syscall for host driver ioctls. (bbbd1d891)
runsc: introduce programmatic Go client with pause, resume, and state (77b464738)
Identify fdnotifier events by registration (9f4158394)
fix(tmpfs): read SourceTar to EOF after restoring a tar archive (0e2cd7793)
Declare vDSO disassembly tools (8f985c75c)
Run command lifecycle tests without /bin/sleep (b41ed9e0e)
Use the test binary for specutils child processes (18eea6dde)
Check the locks protecting kernfs directory children (199cf1558)
Remove the unused inotify Watch.OwnerID method (3cc383db9)
runsc: ignore tmpfs size= in mount options annotations on restore (94c03f66c)
netstack: fix bubblewrap: add if up/down, add lo address on if up, remove ipv6 on if down (80f80e7ae)
cpuid: make arm64 /proc/cpuinfo Features match AT_HWCAP (095ec5f25)
Check the instance lock when changing inotify watch indexes (738ede495)
buildkite: remove "Build runsc and pkg" step from First Pass pipeline (fd48fa491)
buildkite coordinator: implement idle timeouts for pinned agents (ca71e3bb6)
overlay: Rename on the upper layer with the filesystem's credentials. (06dda0dfe)
vfs: preserve empty mount tables across restore (4093ee5fe)
Use the timer helper for negative intervals (626ca2e77)
Preserve XML test suites during collation (1cbd8021a)
Check locking on pipe ring buffer operations (ef2403a1d)
Compare RACK timestamps across a clock wrap (33a1870df)
Check the mutexes required by the timekeeper updater (b40bb52d4)
overlay: check the file cache mutex (05eca6e0c)
Stage release binaries with a declared copy tool (83634be8c)
Report negotiated timestamps and SACK in TCP_INFO (70e7896ac)
Use the configured MTU for veth and loopback (679d20c1b)
Allow Bazel to sandbox Nogo filtering and facts rendering (021ba8c34)
Keep the x86 vDSO gettimeofday alias independent of libc headers (cf2264788)
Exclude AMX TILEDATA from XSAVE area sizes in CPUID and FPU state. (6dcadf4a8)
Declare the TLDK plugin build inputs (93993d354)
tmpfs: hold inode.mu across a regular file's tar header and contents (de703c042)
Report startup errors from the native syscall test runner (f3527b352)
Mark shailend-g as an ACTIVE maintainer (265bf676b)
tmpfs: handle host faults in small writes to disk-backed MemoryFiles (155fee684)
fuse: treat an ENOSYS reply to FLUSH as success (c2b473ed1)
Add netgofer binary in runsc. (693353612)
Restrict mknodat seccomp rules to regular files and whiteouts. (4e97cb60e)
buildkite coordinator: publish the number of reserved jobs (b21a9d4ee)
Internal change. (95a716741)
Disable host PAC across all threads at KVM startup (dcae68e54)
Build gVisor with Bazel 9.3.1 (514a1ce4f)
Test that proc mounts share TCP SACK and the local port range (96a173628)
buildkite coordinator: remove `pure = true` from BUILD (2d41aa00d)
netstack: Support network protocol enable/disable. (bbe69510a)
Keep half-closed TCP sockets readable across restore (90ea6b3f8)
lisafs: Don't re-read FD IDs from the shared payload in WalkHandler cleanup. (14555f88a)
Report a refused TCP connection only once (b19a1ad2a)
proc: share the boot ID across a kernel's proc mounts (b76315862)
Reject mixed PI and ordinary futex wakeups (3737ff32e)
Use the collection time to age PGO profiles (1813a989c)
Check PIDFD task-set lock requirements (1bf9f3f36)
Guard SysV IPC registry operations with the registry mutex (6ff606c7e)
Release POSIX locks when duplicating over the same file (75a95f0a8)
Start the host FD notifier on the first registration (ff0622973)
Start packet capture and cooked socket delivery at the network header (42b379a95)
Read Bazel test logs without starting the Docker builder (096e5e98d)
Run the governance generator directly (08f421859)
Run statefile output permission tests as the invoking user (54b3b894b)
Checkpoint open filesystem configuration and mount descriptors (5c7696351)
tcp: release the port of a wildcard-bound endpoint when it is closed (48e209b56)
Pin the PostgreSQL compatibility image (a7a46825e)
sandbox: add exec options for uid/gid (a40dce503)
Move remaining FIB attribute checks into the netlink test (be530bf04)
Test FIB register and flag validation through netlink (632655077)
Remove a Unix socket waiter if host registration fails (ed3929b26)
Select the governance tool without a host uname (6e1caeba7)
tcp: add 2ms to TLP timeouts for multi-segment flights (f790ba3e6)
pgalloc: skip host holes in disk-backed MemoryFiles (05528123c)
Preserve live monotonic time when saving the TCP/IP clock (a38d73f8a)
Keep the first TCP zero-window probe on its deadline (51b6df1b5)
website: add CVE-2026-98432 to security track record (12095bd3f)
Reject invalid sudo IDs before setting up the sandbox (a51fb04e5)
Use RecvMsgTimeout instead of recvmsg in udp socket test (d9c4881b4)
Check the locks protecting TCP endpoint errors (2d6624b72)
Audit imported LLVM source archives (f8b7988ba)
Allow MSG_NOSIGNAL in hostinet receive calls (19a67add3)
Preserve the full counter when converting an eventfd to a host fd (d94cb4a55)
Restart the TCP retransmission timer after SACK repairs the oldest data (9df20cfc5)
Keep the congestion window when probing a closed receive window (3c02ab481)
Keep gofer namespace mounts out of Python sandbox state (ca87e0a2f)
docs: describe Wordfully in adopter list (3a2c74e86)
Discard failed O_ASYNC registrations (bb11bd99d)
Run the cgroup unit tests on remote workers (17ecf36e7)
Return EPERM from every epoll_ctl op on files without poll support (724580303)
netfilter: add iptables addrtype match with LOCAL via stack lookup (0e8c3e62d)
tcp: report duplicate data below the cumulative ACK (c451fa7d6)
Report per-interface multicast support (b584529cb)
netlink: Dump routes in Linux FIB order and honor the dump family (5f6df9665)
docs: add Wordfully to adopters (b13f0751f)
Interrupt RSEQ abort tests with a timer (3a7fe444c)
Honor bound devices for IPv6 multicast selection (29edee9cb)
hostinet: require CAP_NET_ADMIN for SO_RCVBUFFORCE (8fec75890)
gvisor2pcap: skip malformed log lines instead of panicking (df2fcbb6d)
overlay: support relative pathnames in mount options (e76dc9311)
Do not follow the final symlink for O_DIRECTORY|O_NOFOLLOW opens (f667de8e3)
Bump actions/upload-artifact from 7.0.1 to 7.0.2 (692293a6c)
semaphore: compare in int32 when waking waiters (0d8ae8a75)
semaphore: block instead of ERANGE for semop -32768 (5ea8c6aed)
Close host FDs that fdsToHostFiles doesn't import. (5b7fe075b)
tcp: Use SYN cookies after shrinking a listener's backlog. (2269c073a)
sentry/fuse: validate NodeID in LOOKUP responses (f4f483706)
netstack/ipv4: suppress ICMP echo replies to broadcast/multicast (2e798cb61)
runsc/cgroup: fix systemd cpuset byte order (a4f9ed000)
Full changelog: release-20261102.0...release-20261109.0