Repository navigation
Pin gVisor release for hosted scenario sandbox - #172
Merged
Merged
Conversation
The latest gVisor tarball and its checksum are replaced separately. After the 20261026 release, latest served the new tarball with the previous checksum, failing every hosted Install scenario sandbox step. Pin the last known-good release and commit its checksums.
Jake Bailey (jakebailey)
enabled auto-merge (squash)
October 28, 2026 00:33
The gVisor apt index is also inconsistent while a release is published, failing the GitHub scenario checks. Install the same pinned, checksummed release tarball in CI and both hosted benchmark paths.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hosted benchmark runs on main (e.g. 169647) fail in Install scenario sandbox with
gvisor.tar.bz2: FAILED, and the GitHub scenario checks fail withPackages.xz ... File has unexpected size. Mirror sync in progress?.gVisor is publishing the 20261026 release:
release/latest/gvisor.tar.bz2was replaced at 00:09 UTC, butrelease/latest/gvisor.tar.bz2.sha512still has the 20261019.0 checksum, and the apt index is inconsistent too.This adds
scripts/installGvisor.sh, which installs the 20261019.0 release tarball (the release main was using) and verifies it against checksums committed in the repo. GitHub CI and both hosted benchmark paths (Ubuntu and Azure Linux) now use it, so upstream publishing races can no longer break or weaken the install. Updating gVisor is now an explicit change to the version and checksums.