Create ADOPTERS.md in the repository root documenting known production
users and adopters of gVisor. Connect ADOPTERS.md directly to the website
build system so the website is generated from this markdown document,
eliminating the need to maintain a separate HTML page.
PiperOrigin-RevId: 971782795
When opening the parent FD, ensures that none of the paths are symlinks.
This is done to prevent possile attacks that changes a path to a symlink
and makes the name resolution redirect to a different path.
This is a defense in depth measure.
PiperOrigin-RevId: 966826882
Add e2e tests for systemd's event-driven activation mechanisms and the
sd_notify watchdog protocol:
- TestSystemdTimer: transient timer units fire repeatedly on both the
monotonic (OnActiveSec/OnUnitActiveSec) and the realtime (OnCalendar)
clocks.
- TestSystemdDBusActivation: a bus call to org.freedesktop.hostname1
starts systemd-hostnamed on demand.
- TestSystemdSocketActivation: with only ssh.socket started, the first
connection starts ssh.service, which serves it on the inherited
listening socket.
- TestSystemdWatchdog: a Type=notify service with WatchdogSec= stays up
while it pings the watchdog, and is killed with Result=watchdog once
the pings stop.
All TestSystemd* tests now run in parallel, each in its own container.
The systemd entry on the website's compatibility page is also updated.
PiperOrigin-RevId: 958778081
Add an agents category to the compatibility dashboard, along with Ollama,
OpenClaw, PicoClaw, Hermes Agent, and Claude Code.
Ollama has a test included. The *claws and Hermes reference the MAGI blog post.
No test for claude code since they require an account, and testing claude code
with a local model would likely require a beefy GPU (since claude's system
prompt is pretty big).
PiperOrigin-RevId: 958632910
Document RDMA (InfiniBand/RoCE) support: what it does, how to enable it
(--rdmaproxy), GPUDirect via dma-buf, and the current limitations
(Mellanox-only, single-container sandboxes, device lifecycle, RoCE shared
namespace mode, no checkpoint).
Co-authored-by: Alessio Ricci Toniolo <[email protected]>
Add CVE-2026-43456 (network bonding type confusion) and CVE-2026-46300 (XFRM ESP-in-TCP logic flaw) to the list of vulnerabilities not exploitable under gVisor.
PiperOrigin-RevId: 951081670
website: register fuse user guide doc
The fuse.md doc() target was added to g3doc/user_guide/BUILD in
f29a17a550 but website/BUILD was never updated to list it, so
gvisor.dev/docs/user_guide/fuse/ was not being rendered on the site.
COPYBARA_INTEGRATE_REVIEW=https://github.com/google/gvisor/pull/13657 from ayushr2:fix-website-build-fuse-doc 514613e6075685959fcdcf710f6d48335cc482a2
PiperOrigin-RevId: 947338270
Includes:
- A JSON schema for the application compatibility database (an
application can either be compatible, partially compatible, not
compatible, coming-soon, or experimentally supported)
- A web page to render the compatibility database. Each row has the name
of the application, a link to the testing methodology script, the
version we last tested with, and a badge indicating its status
- A small database including the applications whose test scripts have
been reviewed so far.
The web page includes a search bar.
The CVE entries in `cve-track-record.yml` have been reordered alphabetically by CVE number within each month. Additionally, CVE-2026-43284 has been added to the list. Some CVSS scores were also updated to use explicit float notation.
PiperOrigin-RevId: 945215587
This change introduces a Go binary `update_cve_track_record` that can parse, update/insert, sort, and re-encode entries in the website's `_data/cve-track-record.yml`. The tool ensures proper formatting and sorting of CVE entries.
A new `SKILL.md` file is also added, providing a step-by-step guide on how to use this tool to manage CVE entries, including gathering necessary details and running validation tests after updating the YAML file.
PiperOrigin-RevId: 944802032
- Replace binary "Defended"/"Unmitigated" status with a richer `patched` field (tri-state: `PATCHED`, `EXTERNAL_MITIGATION_REQUIRED`, `UNPATCHED`). Required when `exploitable_under_gvisor` is true.
- Chart: distinct yellow/orange/red bar segments per status. Legend shows percentages.
- Chart: add a dashed "ghost" extrapolation on current-year bar projecting the expected year-end CVE count (suppressed when <2 months remain or projection within 15% of the actual count to avoid visual crowding).
- Display entries without a CVE ID so chart and table counts are complete.
- Add a CVSS chip, colored by score.
- Render markdown-style backticks in descriptions as monospace, and wrap code identifiers throughout the data file in backticks.
- Mobile: horizontally scrollable chart that starts scrolled to the most recent year; wrapped legend; fix stray divider border on stacked columns.
- Preserve highlighted year in URL anchor.
- Remove redundant "Vulnerability Overview & Impact" header and shorten "Target Ecosystem Scope" to "Scope".
The description now specifies that Anthropic uses gVisor for secure code execution within claude.ai and includes a quote from their blog post "How we contain Claude across products" as a testimonial.
PiperOrigin-RevId: 926266192
A blog post contributed by Tencent demonstrating their practice of running millions of gVisor sandboxes daily for Agentic-RL workloads in production, along with their AI-driven compatibility verification methodology.
Authors: Yifeng Tan, Hua Liu, Hui Chen
This PR is a fix-up by @EtiennePerot to make the Mermaid diagram render,
make tables formatted in a way that `mdformat` is OK with while
also rendering in Kramdown.
Slight wording changes on the blog post to make it clear that `runsc` is
gVisor, as that may not be obvious to all that come across this blog post.
Updates #12995
PiperOrigin-RevId: 905228160
A blog post contributed by Tencent demonstrating their practice of running
millions of gVisor sandboxes daily for Agentic-RL workloads in production,
along with their AI-driven compatibility verification methodology.
Signed-off-by: Yifeng Tan <[email protected]>
Signed-off-by: Hua Liu <[email protected]>
Signed-off-by: Hui Chen <[email protected]>
- `runsc fscheckpoint` saves a filesystem checkpoint, analogous to `runsc
checkpoint`. `-direct` and `-leave-running` flags are supported for
compatibility with `runsc checkpoint`. `-save-restore-exec*` is currently
not supported due to lack of a use case. `-compression` support is not
planned (specific files in filesystem checkpoint images may use compression
as appropriate, but this is an implementation detail).
`-exclude-committed-zero-pages` is inapplicable.
- `runsc create -fs-restore-image-path` restores a filesystem checkpoint. The
`-fs-restore-direct` flag has the same effect as `runsc restore -direct`.
The behavior of `runsc restore -background` is always in effect for
filesystem checkpoints.
PiperOrigin-RevId: 885914969
