gVisor 20261012.0

gVisor release 20261012.0

Binaries are also available from the apt repository and the release bucket;
see Installation.

Changes since release-20261005.0

Find license notices in Go module archives (60faa657c)
Move ARM64-64k tests to `master`-only tests. (10e1efc8a)
Add a gVisor review style guide for Gemini Code Assist. (7207fc531)
Update `--fs-checkpoint-paths` and `--path` to accept bundle prefixes. (f4372fc0d)
shim: enforce size limits on memory-backed EmptyDir volumes (58251e7c0)
Accept per-platform device paths in --platform_device_path. (313af1306)
tmpfs: stream regular file contents to and from tar archives (0d478ad55)
fuse: abort host FD passthrough connections on save (342261967)
test: focus proc children stress on reaping (1feac14b6)
nvproxy: Support NVOS32_FUNCTION_ALLOC_OS_DESCRIPTOR on fixed drivers (da9088640)
fix(runsc): clear stale state when updating overlay2 (266870572)
Report the send MSS in TCP_INFO (696c4f0fa)
Route queued listener packets to their connection (71240ef19)
Add the gVisor release policy and process. (a93193290)
Respect the strict SACK loss threshold (52fc849e5)
runsc: return the lock error in Container.Update (4a8a3ac7f)
Add an on-demand Gemini Code Assist review configuration. (494ae2abf)
Precompile seccomp programs in parallel. (7486f3a24)
lisafs: explicitly track linked file nodes (04b138ba0)
seccomp: Remove fallback for when `RET_KILL_PROCESS` is not available. (9f646f232)
Propagate lock state through synchronous closures (950a6bc5d)
Automated rollback of changelist 996655289 (f2b8e4060)
Handle internal restart errors in syserr.FromError. (698fb3ab2)
systrap: Deliver SIGILL at reverted patch sites that were overwritten (3ccdb0391)
Honor the boolean save-mode environment flag (d4132a0c9)
Handle multiple Make build target patterns (5cb1aad84)
tcp: preserve CUBIC ACK growth credit (1a12268af)
tcp: consume Reno ACK credit before growing cwnd (2f1ecd8af)
Exercise CUBIC in SACK recovery tests (543fc51f7)
systrap: shift the spinning queue by the stub gap (c7f458aa3)
Inherit explicit TCP congestion control on accept (8d7493b5f)
Remove save/restore page-size guards blocking non-4K hosts (b27af97d3)
Gate FUSE clone errors by kernel version (f986152df)
Parse nogo language versions with modfile (6c6116257)
proc: report allocated files in /proc/sys/fs/file-nr (f9b7024e2)
Honor packet logging with network=none (4c9fc9af5)
Initialize mmap fixture files with ftruncate (2c12d3463)
Update Go to 1.27.2 (6af80fb1f)
gvisor/pgalloc: remove direct waste reclaim reintroduced by cl/995947533 (c5e9146e6)
buildkite: prevent hooks from dirtying the git working tree (a504c5e42)
Return ENOENT from unlink of a missing path with a trailing slash (a462ffdfe)
Encode map entries with their iterator (a0e316efd)
Update Abseil and its C++ dependencies (c8e00a8c4)
Don't cut EROFS reads short at the inline tail (636086525)
Automated rollback of changelist 993881815 (cd5fba542)
Inherit TCP_NODELAY on accepted TCP sockets (6915fb680)
proc: report PF_EXITING in /proc/[pid]/stat flags (fcfcc9148)
Save foreign structs through binary codecs (9c1aeb068)
Wait for Yama tracer cleanup (9fbf12f24)
Align ptrace test capability sets (5f62039a6)
Respect send limits in oversized receive tests (8f032f4e1)
Isolate proc dumpability changes (8f7a051d6)
Enable IPv6 on the nftables masquerade test veth (a4fdb9d9f)
systrap: retry seccomp notify RECV on ENOENT (38ad1072a)
Automated rollback of changelist 994876694 (c66c2773d)
Update runsc profiles for PGO (profile-guided optimizations), 2026-10-08. (c6d07dc6b)
container_test: fix data race with ForEach read. (8fabc5baf)
Internal change. (68b996670)
Skip SetMarkNeedsNetAdminOrRaw if SO_MARK doesn't need capabilities. (5dd59c994)
netfilter: return ENOENT for nonexistent iptables tables. (67fcf4020)
moby-tests: Added dockerd/moby integration tests. (40eb31ef2)
Support save and restore after unpatching address spaces. (ef8f59f1b)
sentry: Support `ARCH_GET_GS` and `ARCH_SET_GS` arch_prctl options on AMD64 (0cda8a6e6)
Use defined attacker prerequisite categories in security policy examples. (0c875d328)
Internal change. (e797bdc7f)
Restore slices with standard reflection (09917ea64)
Generate marshal buffers with unsafe.Slice (4823d71dc)
Accept Linux unconnected FUSE clone errors (987306894)
Check decoded complex values in state tests (665142176)
Use Go attributes for static linking (a9025ef7f)
Correct the Docker user-defined bridge DNS FAQ entry (422559ef5)
Avoid Make during CodeQL Go extraction (6d761a9b9)
Accept single-bit ranges in bitmap lists (01d6bdfd1)
Update containerd harness CNI plugins (47a97dbfc)
Check the image cache only when loading (23f542cc7)
Enable leak checks in TUN syscall tests (3b3596833)
Wait for writable TCP benchmark sockets (587dd6592)
Use libc-compatible FUSE test headers (32e30154f)
Generate governance files with Bazel (865d0a1b0)
Internal change. (b48a3692b)
Precompile seccomp filters for target arch, not the build machine's (265226683)
Only signal a process group's stopped members when it becomes orphaned. (553528ee1)
Update Go to 1.27.1 (78a4931c5)
Seal the usertrap table against application modification. (c89b5d137)
Cover more flows in the UDP distribution test (ca7331879)
runsc: add a no-root-container boot mode (31cb23ece)
Add a gazelle presubmit for allowlisted packages (f999b3090)
Bump actions/upload-artifact from 4.6.2 to 7.0.1 (390d4461f)
Bump actions/checkout from 5.1.0 to 7.0.1 (d97e22dc8)
nvproxy: NVIDIA RTX PRO 6000 Missing ioctl 0x501 Implementation (1cfac5e1e)
Give netfilter test phases separate deadlines (0108067e4)
Eagerly copy the usertrap table on fork. (8907f2cea)
Update maintainers list (82de46d97)
Internal change. (5d905ac86)
Drop reassembled IPv4 packets exceeding maximum total length. (c5606b474)
runsc/sandbox: drop the netstack and plugin-stack imports (856c071c0)
Scope x86 syscall test constants to their users (99adc671d)
nvproxy: Reject OS descriptors without a handle (15d86e6e3)
Repair XDP network setup calls (f0b67041d)
Use documented unassigned syscall numbers in tests (6b486edc3)
Update Bazel to 8.8.1 (c4d5c2cf1)
Apply capability changes in the hostnet test (443832c6b)
Remove embedded binaries. (14ea68826)
Cull `--sidecar-usage-policy=LEGACY_DEPRECATED_SLOW_EMBEDDED_FALLBACK`. (dad1591fa)
nvproxy: move HostDriverVersion into nvconf; resolve latest in sentry (2b1d21294)
specutils: stop importing the OCI seccomp compiler (1b22783b1)
hostmm: move IMAWorkAroundForMemFile out of pgalloc (cdc12a9f1)
seccheck, auth: drop stale deps and the auth -> seccheck edge (c3f4e6a7a)
xdp: move the bpffs pin-path helpers into pkg/xdp (85544c371)
buildkite: respect $PRIORITY from pipeline upload step (bc1797689)
Pin GitHub Actions to commit SHAs and fix go.yml template injection. (e1c958717)
Simplify TCP benchmark argument registration (22c23f92b)
Check ping size before reading hostnet buffers (abf65a033)
netstack: remove only the first matching route on RTM_DELROUTE (7577af3c3)
Accept inherited session keyring descriptions (da9faf745)
Include syscall utility type and errno providers (4e7f86be2)
Use a valid cgroup v1 memory update (a75fe7b49)
Avoid pinning copied mount trees during sandbox startup. (04c849db9)
Run syscall tests on systrap platform(ARM64 64K) and fix 4K page-size assumptions. (e05c55f50)
Expect EPERM from SO_RCVBUFFORCE outside the initial user namespace. (ac1366bda)
proc: skip TID 0 when listing /proc (fd2e8452d)
Fix checkpoint waiter synchronization (bacd163af)
checklocks: guard AIO and logger state (47ac9acd4)
Remove the unused Docker network helper (05accd6ea)
Keep local test restrictions off compilation (6098e86dd)
Let canceled netfilter listeners finish (7540239d5)
buildkite coordinator: add github/buildkite agent API clients (586ae55fa)
Wait for restore before checkpointing in the test (e5c4013ef)
Keep syscall XML reports outside overlays (b04fae389)
Honor ENOSYS for FUSE access checks (e16cf7c28)
Replace deprecated `apt-key add` (aa51d9b3b)
Accept route requests with neither RTA_DST nor RTA_GATEWAY (e6448d633)
Take a gateway route's NIC from the route that reaches the gateway (3f608eb80)
tcp: update TS.Recent from a zero-window probe (8f6f546a4)
Keep metric field lookup nosplit (f5f027028)
Start Python tools with the declared interpreter (8130f5a58)
Include SDK headers in Go action inputs (a0979e57f)
Use an explicit /tmp mount for Bazel tests (b69abbaaa)
Bound IPv6 parsing by the declared payload (e2f202dd4)
Allow netfilter options on non-raw sockets (e34ecd989)
Enable atime for host-backed timestamp tests (dac54db33)
Allocate process_vm test buffers per case (e0f75c3ea)
tools/checklocks: make the inferred-annotation threshold configurable (4868950ce)
netfilter: add MARK target, RuleContinue verdict, and full mangle table hook support (12c5f1673)
proc: return ESRCH for /proc/<pid>/stat of a reaped task (b0db36650)
netstack: Don't locally deliver bridged transit frames (d4be3ed28)
syscall: Return E2BIG for oversized exec args (bd278996c)
rdmaproxy: support UCX-based data planes (epoll, comp channels, SRQ) (9537768b1)
systrap: return bare errno from stub syscalls (11bd95794)
Honor errnoRet in OCI seccomp profiles (7be4160a7)
Support meta mark load in nftables (b7d882b52)

Full changelog: release-20261005.0...release-20261012.0