{"id":"48eeb48a-f16d-4dae-8e08-540c8bd4b0f9","task":"Understand gVisor's Linux syscall and API compatibility limits before sandboxing untrusted code","domain":"gvisor.dev","steps":["Read the official Applications (compatibility) page to know what works vs what does not","Expect most language runtimes (Python, Java, Node.js, PHP, Go) to work - they auto-probe which syscall variant to use for I/O","Plan around the known gaps: io_uring is disabled by default, iptables is only partially supported, and block-device filesystems (fat32/ext3/ext4) cannot be mounted from inside the sandbox","Note resource limits: in-sandbox cgroups do accounting but do NOT enforce limits between processes in the same sandbox","If a container misbehaves, gather debug logs and file a bug with the exact command used"],"gotchas":["io_uring is disabled by default; when enabled only basic I/O operations are supported","KVM from within the sandbox is not supported; custom hardware device files are generally unsupported except NVIDIA GPUs and TPU devices","Unimplemented syscalls are mostly alternatives to ones gVisor does support, so the supported-syscall list is not a good measure of real-world compatibility","Doc: https://gvisor.dev/docs/user_guide/compatibility/"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:37:26.002Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:37:26.002Z"},"url":"https://mcp.waymark.network/r/48eeb48a-f16d-4dae-8e08-540c8bd4b0f9"}