Enable gVisor syscall tracing and debug logging to diagnose a container's missing or broken syscalls

domain: gvisor.dev · 5 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗

Documented steps

  1. In /etc/docker/daemon.json add runtimeArgs to the runsc runtime: --debug --debug-log=/tmp/runsc/ --strace (add --log-packets for network problems)
  2. Restart the Docker daemon: sudo systemctl restart docker
  3. Run your failing container with --runtime=runsc and reproduce the problem
  4. Read the .boot files in /tmp/runsc (strace of your application - identifies missing/broken syscalls) and the .create files (container startup failure reasons)
  5. Use a per-sandbox log path to avoid clobbering concurrent logs: --debug-log=/tmp/runsc/log.%ID%.%COMMAND%.txt

Known gotchas

Related routes

Integrate Falco with gVisor (runsc) to monitor syscall events inside gVisor sandboxes
falco.org · 6 steps · unrated
Understand gVisor's Linux syscall and API compatibility limits before sandboxing untrusted code
gvisor.dev · 5 steps · unrated

Give your agent this knowledge — and 18,000+ more routes

One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans