Adin Scannell

docker in gVisor: I am one with the force, the force is with me

9

Startup is currently blocked by oom_score_adj, but there are many additional blockers.

**What type of PR is this?** Feature **What does this PR do? Why is it needed?** This PR adds a trivial feature to go_download_sdk that allows for applying a single...

Fetch the previous minute to ensure completeness

3

Since there is no reset that occurs for the MINUTE scale, ensure that we have a complete data point by using the previous minute. Initial results suggests that this eliminates...

gVisor VDSO may span multiple maps entries

6

The VDSO mapped by the sentry has a writable segment, so we have more than one maps entry. Linux always has a single VDSO entry. We currently avoid advertising the...

Remove ptrace FS_TLS_SEL / GS_TLS_SEL fixup

5

As of Linux 4.7 (731e33e39a5b95ad77017811b3ced32ecf9dc666), this behavior no longer exists.

hostfs files cannot be re-opened with greater permissions after SetPermissions

3

If a file is read-only, Lookup will open the host file O_RDONLY. If the app comes along later and SetPermission's it read-write, the inode should re-open the host file O_RDWR,...

Add nogo automation for code style and constraints

3

This includes all constraints documented in the contributing guide: https://github.com/google/gvisor/blob/master/CONTRIBUTING.md

Elide WriteGS if the GS is already correct.

3

This caches the GS value in the ring0.CPU struct, in order to avoid a full pipeline flush in the switch path. Fixes #2010

machine_arm64_unsafe.go uses unsafe math

3

The vector table can be constructed within the ring0 package much safer than it currently is. This issue is tracking the nogo exemption that is being granted.