A release tag was created before the release built, so a failed build left a
tag on GitHub with nothing behind it. release-20260824.0 is an example: the
build failed, but users still see a release that they cannot install.
Before
```
make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
│
tag_release.sh └─ pushes the annotated tag as release-20260831.0 ← published immediately
│
┌────────────┴────────────┐
│ │
Buildkite GitHub Actions
(triggered by the tag) release_mirror.yml
├─ make artifacts ├─ poll GCS for artifacts (240 min timeout)
├─ make release ├─ verify sha512
└─ gcloud storage cp └─ create the GitHub Release
→ gs://gvisor/releases/
```
After
```
make tag RELEASE_COMMIT=<sha> RELEASE_NAME=20260831.0 RELEASE_NOTES=<file>
│
tag_release.sh └─ pushes the annotated tag as staging-release-20260831.0
│
Buildkite ├─ tag.sh stage restore release-20260831.0 locally (version stamping)
(triggered by ├─ make artifacts x86_64 + aarch64
the staging tag) ├─ make release sign, lay out repo/
├─ gcloud storage cp → gs://gvisor/releases/
└─ tag.sh publish push release-20260831.0, delete staging tag
│
GitHub Actions └─ release_mirror.yml verify sha512, create the GitHub Release
```
bwrap previously built its own specs.Spec, wrote an OCI bundle and drove
runsc/container directly. It now only parses the bubblewrap command line
and translates it into sandbox.Options; //sandboxexec/sandbox owns the
bundle, the runsc invocation and the container lifecycle.
- runsc/debug.go: the SIGUSR2 stack dumper never exited its loop, so one
signal pinned a core for the life of the shim.
- proc/init_state.go: the start-failure path closed p.io unconditionally,
but Init.Create leaves it nil for terminal containers. The nil deref
killed the shim, and with it the pod.
- proc/utils.go: getLastRuntimeError leaked the log file it opened, on
every failed runsc command.
- utils/volumes.go: configureShm wrote into a nil annotation map, which
IsSandbox permits.
- runsc/epoll.go: the cgroups v1 OOM watcher panicked on the first
publish failure, which is normal under CRI-O. Reuse forward's leniency
check; the panic under containerd is kept.
- runsccmd/runsc.go: cmdOutput returned slices aliasing sync.Pool buffers
that putBuf immediately recycled.
The Buildkite release pipeline uploads artifacts to gs://gvisor/releases,
but nothing publishes them as a GitHub Release, so the tags pushed by
tools/tag_release.sh carry no notes and no binaries.
Add a github action that triggers on release-* tags, waits for every release
object to appear in GCS, verifies each raw artifact against its published
sha512, creates or updates the release with a changelog.
It only mirrors what Buildkite already built; apt and the GCS bucket remain
canonical.
Provides a structured workflow for adding new syscalls or extending
partially-supported ones, with test-driven verification against both
native Linux and gvisor runsc.
Usage:
/add-syscall <syscall-name-or-flag>
Examples:
/add-syscall prctl PR_SET_CHILD_SUBREAPER
Generated-with: Claude Code (https://claude.com/claude-code)
The helper function is deprecated. The package gvisor.dev/gvisor/pkg/rand
depends on crypto/rand which performs worse thatn math/rand, the changes
are fine since they are not at any gVisor's hot path.
The ultimate goal is to migrate math/rand to math/rand/v2.
Jing Chen