AFAICT previously the function was parsing the Docker *client* version, since
the output of `docker version` has the client version first, which gets picked
up by the `re.FindStringSubmatch()` since it finds the _first_ match:
```
$ docker version
Client: Docker Engine - Community
Version: 29.6.2
API version: 1.55
Go version: go1.26.5
Git commit: dfc4efb
Built: Thu Jul 16 16:12:34 2026
OS/Arch: linux/amd64
Context: default
Server: Docker Engine - Community
Engine:
Version: 29.6.2
API version: 1.55 (minimum version 1.40)
Go version: go1.26.5
Git commit: 3d80467
Built: Thu Jul 16 16:12:34 2026
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: v2.2.6
GitCommit: 11ce9d5f3c68c941867e82890e93e815c1304f1b
runc:
Version: 1.3.6
GitCommit: v1.3.6-0-g491b69ba
docker-init:
Version: 0.19.0
GitCommit: de40ad0
```
PiperOrigin-RevId: 966681719
Add e2e tests for systemd's event-driven activation mechanisms and the
sd_notify watchdog protocol:
- TestSystemdTimer: transient timer units fire repeatedly on both the
monotonic (OnActiveSec/OnUnitActiveSec) and the realtime (OnCalendar)
clocks.
- TestSystemdDBusActivation: a bus call to org.freedesktop.hostname1
starts systemd-hostnamed on demand.
- TestSystemdSocketActivation: with only ssh.socket started, the first
connection starts ssh.service, which serves it on the inherited
listening socket.
- TestSystemdWatchdog: a Type=notify service with WatchdogSec= stays up
while it pings the watchdog, and is killed with Result=watchdog once
the pings stop.
All TestSystemd* tests now run in parallel, each in its own container.
The systemd entry on the website's compatibility page is also updated.
PiperOrigin-RevId: 958778081
See issue #13764 for motivation and idea. This approach yields the
benefit without the security compromise of moving the fsgofer out of
a network-disabled netns, so it is a safe new default.
Benchmarks:
```
│ gofer-netns-new │ gofer-netns-null │
│ sec/op │ sec/op vs base │
OCIStartup/load=idle 118.6m ± 5% 119.3m ± 4% ~ (p=0.756 n=40)
OCIStartup/load=netns-churn 236.5m ± 13% 215.2m ± 7% -8.99% (p=0.033 n=20)
geomean 167.5m 160.2m -4.32%
```
`netns-churn` is simulated with this bash thingy in the background:
```
for j in $(seq 1 8); do
( while :; do unshare -n /bin/true; done ) &
done
```
The effect gets stronger at higher core counts on real servers.
The change introduces a deterministic test sharding and isolates host Docker
daemon operations across concurrent workers.
assisted-by:agy
PiperOrigin-RevId: 954858449
This verifies that a running Sentry (`runsc boot`) process's host kernel
state matches the state we expect it to be once it starts running untrusted
code.
Useful for defense-in-depth, and to assert that future startup
optimizations do not regress gVisor's security.
Updates issue #13718.
This change modifies the UTS namespace to track whether the hostname or
domainname has been explicitly changed by the application. During a restore
operation, the UTS namespace values are updated from the new sandbox
specification, but only if they were not previously modified by the application
inside the sandbox. This ensures that user-set values are preserved across
checkpoint/restore, while allowing spec-defined values to be applied if the UTS
namespace was in its default state.
Furthermore, made another bug fix: The initial UTS namespace creation was being
done with domainName=hostname. Now we correctly use domainname from the spec.
PiperOrigin-RevId: 934963603
For now, all sandbox controller methods are implemented to return unimplemented
errors (errdefs.ErrNotImplemented).
Add an integration test to verify that
containerd correctly routes sandbox API calls to our shim when configured
with "sandboxer = shim" (or "sandbox_mode = "shim" for containerd 1.7), and
that the shim returns the expected unimplemented error.
PiperOrigin-RevId: 923663790
Exclusive GPU tests(tests that are failed) now launch a dedicated container
instead of using one from the pre-warmed pool.
PiperOrigin-RevId: 915689394
This change moves the Server interface, DockerServer implementation, ResponseMetrics, APIResponse, and MakeAPIResponse functions from the individual LLM test packages (ollama, sglang, triton, vllm) into a new shared package llmutil. This reduces code duplication across the different LLM test clients.
PiperOrigin-RevId: 907987791
Wire shim Task.Update to runsc update with OCI LinuxResources JSON.
Extend runsc Container.Update for workload containers via compat cgroup
alongside the root sandbox cgroup. Consolidate runsc update CLI on the
shared merge path. Add criutil helper and crictl integration coverage.
- **checkescape: improve error output**
The output now includes stderr on failure e.g.:
```
checkescape: tools/checkescape/test2/test2.go:98:6: stack: possible split on function entry (2 omitted) → (possible, error running "external/rules_go++go_sdk+main___download_0/bin/go tool objdump bazel-out/k8-fastbuild-ST-04c87098fb12/bin/tools/checkescape/test2/test2.a": exit status 2 (go: no such tool "objdump")) (GOOARCH=amd64, GOOS=linux)
```
Simplify various bits of the implementation while I'm here:
- Use a set of strings rather than a list to avoid some O(n) operations.
- Use `CommandContext` to ensure proper cleanup.
- Remove stderr pipe and goroutine by setting `Stderr` to a
`bytes.Buffer`.
- Use `bufio.Scanner` instead of manually calling
`(*bufio.Reader).ReadString` and handling errors.
- Remove `NextLine` loop label.
- **go_stateify: plumb go binary to goimports**
This avoids go_stateify relying on `go` being available outside of the
bazel sandbox.
- **Update Go to 1.25.5**
Reduce duplication of the version information in various places:
- Use `go_sdk.from_file` instead of repeating the version encoded in
`go.mod` in `MODULE.bazel`.
Add a workaround to allow `objdump` to be lazily compiled in the manner
introduced in https://go.dev/issue/71867 when invoked under bazel in
checkescape.
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/12452 from tamird:update-go 6c7f6400f5d3ea883096eef18d365c97f875bc68
PiperOrigin-RevId: 853572845
Docker's `restore` functionality is broken starting from v28 due to
https://github.com/moby/moby/issues/50750. This change adds a version check to
`dockerutil` and skips tests that rely on `docker restore` if the Docker
version is v28 or greater. TCP checkpoint/restore tests are also refactored to
centralize common setup and version checks.
PiperOrigin-RevId: 818827864
- Deletion of the WORKSPACE file. Dependencies are now managed in the MODULE.bazel file.
- Removal of --noenable_bzlmod and --enable_workspace from .bazelrc to enable bzlmod.
- Update paths in MODULE.bazel to be relative to the repository root.
There is already some support for privileged executables before this change:
file capabilities were taken into account when creating new processes inside
the sandbox from external instigation (but not during execve(2)). set-user-id
and set-group-id bits were never taken into account, and the Sentry behaved
as if NO_NEW_PRIVS is always true. After this change, execve(2) and the
external Exec entry point both take the set-user(group)-id bits and file
capabilities into account.
Because NO_NEW_PRIVS can no longer be assumed to be always set, a couple of
extra checks to prevent privilege elevation during execve(2) are needed:
the presence of a ptracer and the use of a shared fsContext. Moreover,
execve had to be serialized with seccomp(2) when it is syncing filters to
all threads in a group. Serializing execve with PTRACE_ATTACH and seccomp
required some Task runState gymnastics.
Task dumpability is reset when privilege elevation takes place and privilege
elevation is denied for binaries living on nosuid mounts. To fix an old bug
where some aux vectors were populated using data from the old pre-execve
creds, the computation of the (file-privilege-augmented) creds during execve
now takes place before the stack for the new program is set up.
gvisor users who thus far have exec'd into the sandbox with UID as (sandbox)
root will lose the caps an all-powerful namespace root'd have if: 1) the binary
is a suid/guid binary 2) the owner of the binary is host root and there is
no mapping for host root in the host user namespace of the sandbox. To avoid
this surprise, the suid/sgid bits are ignored by default. Users can opt-in
via the --allow-suid flag.
One result of this change is that sudo now works inside the sandbox.
PiperOrigin-RevId: 794414101
All these tests and benchmarks rely on networking between containers,
not on these ports being exposed on the host, so there is no need to
expose them on the host.
This avoids random errors like "Error starting userland proxy:
listen tcp4 0.0.0.0:12345: bind: address already in use".
#codehealth
PiperOrigin-RevId: 778272096
This can be used by all test users. Avoids duplicated code. We can handle all
known issues in one place.
There is a Docker bug which causes restore to fail sporadically. See
https://github.com/moby/moby/issues/42900. This has been broken at least since
Docker v19.03.12 (when the issue was reported) and was fixed in v25.0.4. Added
the handling for this issue.
Also got rid of the testutil.Poll() around restore. That can hide gVisor
restore flakiness issues. That was added in 1ec5baeb31 ("Make
checkpoint/restore e2e test less flaky"). The original sleep has been restored.
PiperOrigin-RevId: 734303878
Unlike Ubuntu VMs where we use Docker's `--gpus` flag, COS VMs do not use
this flag and instead mount the NVIDIA library directories automatically.
However, nothing guarantees that these directories are added to the LD
config. This change fixes that. It take advantage of the fact that all GPU
tests have the sniffer binary as entrypoint, which slightly overloads the
role of the sniffer within the GPU test infrastructure... but then again
the ioctl sniffer is already deeply intertwined with ld configuration
because it already overrides the `ioctl` libc function, so this doesn't
seem like too big of a stretch.
This change makes the ffmpeg test succeed with `runc` on COS, but they still
fail with gVisor (with `CUDA_ERROR_OUT_OF_MEMORY` errors). So there must be
some further gVisor-specific error.
Updates #11351
Updates #11321
PiperOrigin-RevId: 715222952
This includes the ability to force using local images only (do not check
for updated manifests), and to explicitly mount and specify external caches
for Go repositories via `rules_go`'s `GO_REPOSITORY_USE_HOST_MODCACHE`.
PiperOrigin-RevId: 713473497
This test was broken by 8e3b1bb7d4 ("Update CUDA test compatibility to keep
up with added gVisor support.") which requires all
images/gpu/cuda-tests/run_sample.go users to specify "all" driver capabilities.
PiperOrigin-RevId: 713170590
These CUDA tests were initially broken in gVisor but now appear to pass.
The test now also verifies that all capabilities are enabled when running.
PiperOrigin-RevId: 713094806
This CL restores the listening connections when netstack s/r is enabled.
The changes include:
- New method as a workaround to replace the new routes and nics to the loaded
stack after restore.
- New Restore() for transport layer protocols to restore the protocol level
background workers.
- Adds afterLoad() method for fdbased processors.
- Adds a test to verify listening connection is restored after checkpointing
with netstack s/r enabled.
- Few other changes to save restore fields to enable netstack s/r.
PiperOrigin-RevId: 698453124
