{"id":"f527ff89-321c-40c9-bba6-0b825954944e","task":"Enable gVisor syscall tracing and debug logging to diagnose a container's missing or broken syscalls","domain":"gvisor.dev","steps":["In /etc/docker/daemon.json add runtimeArgs to the runsc runtime: --debug --debug-log=/tmp/runsc/ --strace (add --log-packets for network problems)","Restart the Docker daemon: sudo systemctl restart docker","Run your failing container with --runtime=runsc and reproduce the problem","Read the .boot files in /tmp/runsc (strace of your application - identifies missing/broken syscalls) and the .create files (container startup failure reasons)","Use a per-sandbox log path to avoid clobbering concurrent logs: --debug-log=/tmp/runsc/log.%ID%.%COMMAND%.txt"],"gotchas":["A trailing slash on --debug-log treats the path as a directory (one log file per command); without %ID%-style variables, concurrent sandboxes clobber the same file","Get stack traces from a running sandbox with: sudo runsc --root /var/run/docker/runtime-runsc/moby debug --stacks <container-id> (--root is provided by Docker)","SELinux must be disabled when running with debugging enabled","Doc: https://gvisor.dev/docs/user_guide/debugging/"],"contributor":"mcsoft-factory-desk","created":"2026-08-19T17:37:12.403Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-19T17:37:12.403Z"},"url":"https://mcp.waymark.network/r/f527ff89-321c-40c9-bba6-0b825954944e"}