Skip to content

Enable runsc core tagging when supported by the kernel - #2887

Merged
Benjamin Elder (BenTheElder) merged 1 commit into
agent-substrate:mainfrom
fvoznika:runsc-enable-core-tags
Oct 29, 2026
Merged

Enable runsc core tagging when supported by the kernel#2887
Benjamin Elder (BenTheElder) merged 1 commit into
agent-substrate:mainfrom
fvoznika:runsc-enable-core-tags

Conversation

@fvoznika

@fvoznika Fabricio Voznika (fvoznika) commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Probe prctl(PR_SCHED_CORE_GET) once and pass --enable-core-tags to runsc when core scheduling is available on the host kernel to isolate gVisor sandboxes across SMT siblings.

Fixes #2136

AI disclosure: AI tooling assisted in writing and testing parts of this change.

  • Tests pass

Signed-off-by: Fabricio Voznika fvoznika@google.com

@fvoznika Fabricio Voznika (fvoznika) mentioned this pull request Oct 20, 2026
Closed
BenTheElder
Benjamin Elder (BenTheElder) reviewed Oct 21, 2026
View reviewed changes

@BenTheElder Benjamin Elder (BenTheElder) left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks, including some vetted review findings ... this crashes on my local dev environment

Comment thread cmd/ateworker-gvisor/runsc.go Outdated
Comment thread cmd/ateworker-gvisor/runsc.go Outdated
Comment thread cmd/ateworker-gvisor/runsc.go Outdated
@BenTheElder
Benjamin Elder (BenTheElder) added this pull request to the merge queue Oct 22, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 22, 2026
@BenTheElder
Benjamin Elder (BenTheElder) added this pull request to the merge queue Oct 22, 2026
@github-merge-queue
github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 22, 2026
@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

This is consistently causing e2e failures, looks like the little CI runners are having a timing issue with this in TestActorEgressMultiplexing

@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 23, 2026

Copy link
Copy Markdown
Collaborator

Tagging networking folks to see if someone has bandwidth to help out with that.

@zlammerts-svg

Zheng Lammerts (zlammerts-svg) commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

Fabricio Voznika (@fvoznika) Can you please make sure that the PR pass the DCO check? I can't move it back to the merge queue

@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 27, 2026

Copy link
Copy Markdown
Collaborator

DCO check needs fixing (sorry, we just completed that transition, git commit --amend --signoff --no-edit but we also have to do something about CI failing in the merge queue for this repeatedly due to the oversubscription trade. cc Yufan Su (@yufan-su) who looked into that.

@bowei Bowei Du (bowei) added area/gvisor area/security Security related issue/pr kind/feature An enhancement / feature request or implementation labels Oct 27, 2026
@zlammerts-svg Zheng Lammerts (zlammerts-svg) added this to the M3 milestone Oct 27, 2026
auto-merge was automatically disabled October 27, 2026 23:38

Head branch was pushed to by a user without write access

@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

DCO still failing, not sure why :/

@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

The test PR merged so this should be otherwise fine

@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator

I think you might need to rebase on upstream/main. It's confusing because github shows this PR as one commit, but the DCO check is seeing many commits

@fvoznika

Fabricio Voznika (fvoznika) commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Benjamin Elder (@BenTheElder) it should be good to go now.

@fvoznika

Fabricio Voznika (fvoznika) commented Oct 28, 2026

Copy link
Copy Markdown
Collaborator Author

Benjamin Elder (@BenTheElder) had to resolve a few conflicts...it's ready to go.

@fvoznika
Enable runsc core tagging when supported by the kernel
3399ba7 
Probe prctl(PR_SCHED_CORE_GET) once and pass --enable-core-tags to runsc
when core scheduling is available on the host kernel to isolate gVisor
sandboxes across SMT siblings.

Signed-off-by: Fabricio Voznika <fvoznika@google.com>
@BenTheElder
Benjamin Elder (BenTheElder) added this pull request to the merge queue Oct 29, 2026
@BenTheElder Benjamin Elder (BenTheElder) added the prio/P0 Highest priority / required for next milestone label Oct 29, 2026
@BenTheElder

Benjamin Elder (BenTheElder) commented Oct 29, 2026

Copy link
Copy Markdown
Collaborator

This is the top of the merge queue and should go in finally.

Merged via the queue into agent-substrate:main with commit f315318 Oct 29, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@BenTheElder Benjamin Elder (BenTheElder) BenTheElder approved these changes

Assignees

@BenTheElder Benjamin Elder (BenTheElder)

Labels

area/gvisor area/security Security related issue/pr kind/feature An enhancement / feature request or implementation milestone-ack prio/P0 Highest priority / required for next milestone

Projects

None yet

Milestone

M3

Development

Successfully merging this pull request may close these issues.

Hardening gVisor sandbox configuration against CPU side-channel risks and binary mismatches

4 participants

@fvoznika @BenTheElder @zlammerts-svg @bowei