Merge 5b41ba5d (automated)

71 files changed, 91 insertions, 93 deletions

diff --git a/pkg/abi/linux/fcntl.go b/pkg/abi/linux/fcntl.go
index b30350193..30902a8ca 100644
--- a/pkg/abi/linux/fcntl.go
+++ b/pkg/abi/linux/fcntl.go
@@ -14,7 +14,7 @@
 
 package linux
 
-// Comands from linux/fcntl.h.
+// Commands from linux/fcntl.h.
 const (
 	F_DUPFD         = 0
 	F_GETFD         = 1
diff --git a/pkg/abi/linux/linux.go b/pkg/abi/linux/linux.go
index 8a8f831cd..281acdbde 100644
--- a/pkg/abi/linux/linux.go
+++ b/pkg/abi/linux/linux.go
@@ -12,7 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
-// Package linux contains the constants and types needed to inferface with a Linux kernel.
+// Package linux contains the constants and types needed to interface with a Linux kernel.
 package linux
 
 // NumSoftIRQ is the number of software IRQs, exposed via /proc/stat.
diff --git a/pkg/amutex/amutex.go b/pkg/amutex/amutex.go
index 4f7759b87..1c4fd1784 100644
--- a/pkg/amutex/amutex.go
+++ b/pkg/amutex/amutex.go
@@ -21,13 +21,13 @@ import (
 )
 
 // Sleeper must be implemented by users of the abortable mutex to allow for
-// cancelation of waits.
+// cancellation of waits.
 type Sleeper interface {
 	// SleepStart is called by the AbortableMutex.Lock() function when the
 	// mutex is contended and the goroutine is about to sleep.
 	//
 	// A channel can be returned that causes the sleep to be canceled if
-	// it's readable. If no cancelation is desired, nil can be returned.
+	// it's readable. If no cancellation is desired, nil can be returned.
 	SleepStart() <-chan struct{}
 
 	// SleepFinish is called by AbortableMutex.Lock() once a contended mutex
diff --git a/pkg/cpuid/cpuid.go b/pkg/cpuid/cpuid.go
index 18a10d389..3fabaf445 100644
--- a/pkg/cpuid/cpuid.go
+++ b/pkg/cpuid/cpuid.go
@@ -620,7 +620,7 @@ func vendorIDFromRegs(bx, cx, dx uint32) string {
 // state includes floating point registers, and other cpu state that's not
 // associated with the normal task context.
 //
-// Note: We can save some space here with an optimiazation where we use a
+// Note: We can save some space here with an optimization where we use a
 // smaller chunk of memory depending on features that are actually enabled.
 // Currently we just use the largest possible size for simplicity (which is
 // about 2.5K worst case, with avx512).
diff --git a/pkg/eventchannel/event.go b/pkg/eventchannel/event.go
index 8de0fb9b6..f6d26532b 100644
--- a/pkg/eventchannel/event.go
+++ b/pkg/eventchannel/event.go
@@ -144,7 +144,7 @@ type debugEmitter struct {
 	inner Emitter
 }
 
-// DebugEmitterFrom creates a new event channel emitter by wraping an existing
+// DebugEmitterFrom creates a new event channel emitter by wrapping an existing
 // raw emitter.
 func DebugEmitterFrom(inner Emitter) Emitter {
 	return &debugEmitter{
diff --git a/pkg/fd/fd.go b/pkg/fd/fd.go
index 2785243a2..83bcfe220 100644
--- a/pkg/fd/fd.go
+++ b/pkg/fd/fd.go
@@ -167,7 +167,7 @@ func NewFromFile(file *os.File) (*FD, error) {
 	return New(fd), nil
 }
 
-// Open is equivallent to open(2).
+// Open is equivalent to open(2).
 func Open(path string, openmode int, perm uint32) (*FD, error) {
 	f, err := syscall.Open(path, openmode|syscall.O_LARGEFILE, perm)
 	if err != nil {
@@ -176,7 +176,7 @@ func Open(path string, openmode int, perm uint32) (*FD, error) {
 	return New(f), nil
 }
 
-// OpenAt is equivallent to openat(2).
+// OpenAt is equivalent to openat(2).
 func OpenAt(dir *FD, path string, flags int, mode uint32) (*FD, error) {
 	f, err := syscall.Openat(dir.FD(), path, flags, mode)
 	if err != nil {
diff --git a/pkg/log/log.go b/pkg/log/log.go
index ab9ad01ef..9387586e6 100644
--- a/pkg/log/log.go
+++ b/pkg/log/log.go
@@ -222,7 +222,7 @@ var logMu sync.Mutex
 // log is the default logger.
 var log atomic.Value
 
-// Log retieves the global logger.
+// Log retrieves the global logger.
 func Log() *BasicLogger {
 	return log.Load().(*BasicLogger)
 }
diff --git a/pkg/p9/p9.go b/pkg/p9/p9.go
index 4039862e6..e12831dbd 100644
--- a/pkg/p9/p9.go
+++ b/pkg/p9/p9.go
@@ -92,7 +92,7 @@ func (o OpenFlags) String() string {
 	}
 }
 
-// Tag is a messsage tag.
+// Tag is a message tag.
 type Tag uint16
 
 // FID is a file identifier.
diff --git a/pkg/seccomp/seccomp.go b/pkg/seccomp/seccomp.go
index c298e9821..c7503f2cc 100644
--- a/pkg/seccomp/seccomp.go
+++ b/pkg/seccomp/seccomp.go
@@ -244,7 +244,7 @@ func addSyscallArgsCheck(p *bpf.ProgramBuilder, rules []Rule, action linux.BPFAc
 	return nil
 }
 
-// buildBSTProgram converts a binary tree started in 'root' into BPF code. The ouline of the code
+// buildBSTProgram converts a binary tree started in 'root' into BPF code. The outline of the code
 // is as follows:
 //
 // // SYS_PIPE(22), root
diff --git a/pkg/sentry/fs/ashmem/device.go b/pkg/sentry/fs/ashmem/device.go
index 594039367..776f54abe 100644
--- a/pkg/sentry/fs/ashmem/device.go
+++ b/pkg/sentry/fs/ashmem/device.go
@@ -44,7 +44,7 @@ type Device struct {
 
 var _ fs.InodeOperations = (*Device)(nil)
 
-// NewDevice creates and intializes a Device structure.
+// NewDevice creates and initializes a Device structure.
 func NewDevice(ctx context.Context, owner fs.FileOwner, fp fs.FilePermissions) *Device {
 	return &Device{
 		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fp, linux.ANON_INODE_FS_MAGIC),
diff --git a/pkg/sentry/fs/ashmem/uint64_set.go b/pkg/sentry/fs/ashmem/uint64_set.go
index 6e435325f..a4860175a 100755
--- a/pkg/sentry/fs/ashmem/uint64_set.go
+++ b/pkg/sentry/fs/ashmem/uint64_set.go
@@ -1185,7 +1185,7 @@ func (s *Set) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *node) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/fs/binder/binder.go b/pkg/sentry/fs/binder/binder.go
index 66f6d32df..acd5d7164 100644
--- a/pkg/sentry/fs/binder/binder.go
+++ b/pkg/sentry/fs/binder/binder.go
@@ -61,7 +61,7 @@ type Device struct {
 
 var _ fs.InodeOperations = (*Device)(nil)
 
-// NewDevice creates and intializes a Device structure.
+// NewDevice creates and initializes a Device structure.
 func NewDevice(ctx context.Context, owner fs.FileOwner, fp fs.FilePermissions) *Device {
 	return &Device{
 		InodeSimpleAttributes: fsutil.NewInodeSimpleAttributes(ctx, owner, fp, 0),
diff --git a/pkg/sentry/fs/dev/fs.go b/pkg/sentry/fs/dev/fs.go
index 6dbc8c382..cbc2c2f9b 100644
--- a/pkg/sentry/fs/dev/fs.go
+++ b/pkg/sentry/fs/dev/fs.go
@@ -39,7 +39,7 @@ func init() {
 	fs.RegisterFilesystem(&filesystem{})
 }
 
-// FilesystemName is the name underwhich the filesystem is registered.
+// FilesystemName is the name under which the filesystem is registered.
 // Name matches drivers/base/devtmpfs.c:dev_fs_type.name.
 const FilesystemName = "devtmpfs"
 
diff --git a/pkg/sentry/fs/dirent_cache.go b/pkg/sentry/fs/dirent_cache.go
index 71f2d11de..60a15a275 100644
--- a/pkg/sentry/fs/dirent_cache.go
+++ b/pkg/sentry/fs/dirent_cache.go
@@ -146,7 +146,7 @@ func (c *DirentCache) contains(d *Dirent) bool {
 	return c.list.Front() == d
 }
 
-// Invalidate removes all Dirents from the cache, caling DecRef on each.
+// Invalidate removes all Dirents from the cache, calling DecRef on each.
 func (c *DirentCache) Invalidate() {
 	if c == nil {
 		return
@@ -159,7 +159,7 @@ func (c *DirentCache) Invalidate() {
 }
 
 // setMaxSize sets cache max size. If current size is larger than max size, the
-// cache shrinks to acommodate the new max.
+// cache shrinks to accommodate the new max.
 func (c *DirentCache) setMaxSize(max uint64) {
 	c.mu.Lock()
 	c.maxSize = max
diff --git a/pkg/sentry/fs/fsutil/dirty_set_impl.go b/pkg/sentry/fs/fsutil/dirty_set_impl.go
index 588693f31..2510b81b3 100755
--- a/pkg/sentry/fs/fsutil/dirty_set_impl.go
+++ b/pkg/sentry/fs/fsutil/dirty_set_impl.go
@@ -1189,7 +1189,7 @@ func (s *DirtySet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *Dirtynode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/fs/fsutil/file_range_set_impl.go b/pkg/sentry/fs/fsutil/file_range_set_impl.go
index 228893348..0548bba08 100755
--- a/pkg/sentry/fs/fsutil/file_range_set_impl.go
+++ b/pkg/sentry/fs/fsutil/file_range_set_impl.go
@@ -1189,7 +1189,7 @@ func (s *FileRangeSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *FileRangenode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/fs/fsutil/frame_ref_set_impl.go b/pkg/sentry/fs/fsutil/frame_ref_set_impl.go
index 6bc3f00ea..d4601bffa 100755
--- a/pkg/sentry/fs/fsutil/frame_ref_set_impl.go
+++ b/pkg/sentry/fs/fsutil/frame_ref_set_impl.go
@@ -1189,7 +1189,7 @@ func (s *frameRefSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *frameRefnode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/fs/gofer/session.go b/pkg/sentry/fs/gofer/session.go
index e9a07175a..9f7660ed1 100644
--- a/pkg/sentry/fs/gofer/session.go
+++ b/pkg/sentry/fs/gofer/session.go
@@ -29,7 +29,7 @@ import (
 )
 
 // DefaultDirentCacheSize is the default dirent cache size for 9P mounts. It can
-// be adjusted independentely from the other dirent caches.
+// be adjusted independently from the other dirent caches.
 var DefaultDirentCacheSize uint64 = fs.DefaultDirentCacheSize
 
 // +stateify savable
diff --git a/pkg/sentry/fs/lock/lock.go b/pkg/sentry/fs/lock/lock.go
index a074ecab0..636484424 100644
--- a/pkg/sentry/fs/lock/lock.go
+++ b/pkg/sentry/fs/lock/lock.go
@@ -134,7 +134,7 @@ const (
 // LockRegion attempts to acquire a typed lock for the uid on a region
 // of a file. Returns true if successful in locking the region. If false
 // is returned, the caller should normally interpret this as "try again later" if
-// accquiring the lock in a non-blocking mode or "interrupted" if in a blocking mode.
+// acquiring the lock in a non-blocking mode or "interrupted" if in a blocking mode.
 // Blocker is the interface used to provide blocking behavior, passing a nil Blocker
 // will result in non-blocking behavior.
 func (l *Locks) LockRegion(uid UniqueID, t LockType, r LockRange, block Blocker) bool {
diff --git a/pkg/sentry/fs/lock/lock_set.go b/pkg/sentry/fs/lock/lock_set.go
index 127ca5012..2343ca0b4 100755
--- a/pkg/sentry/fs/lock/lock_set.go
+++ b/pkg/sentry/fs/lock/lock_set.go
@@ -1185,7 +1185,7 @@ func (s *LockSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *Locknode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/fs/proc/fs.go b/pkg/sentry/fs/proc/fs.go
index 715591ae5..f14833805 100644
--- a/pkg/sentry/fs/proc/fs.go
+++ b/pkg/sentry/fs/proc/fs.go
@@ -30,7 +30,7 @@ func init() {
 	fs.RegisterFilesystem(&filesystem{})
 }
 
-// FilesystemName is the name underwhich the filesystem is registered.
+// FilesystemName is the name under which the filesystem is registered.
 // Name matches fs/proc/root.c:proc_fs_type.name.
 const FilesystemName = "proc"
 
diff --git a/pkg/sentry/fs/proc/rpcinet_proc.go b/pkg/sentry/fs/proc/rpcinet_proc.go
index c1405a746..01ac97530 100644
--- a/pkg/sentry/fs/proc/rpcinet_proc.go
+++ b/pkg/sentry/fs/proc/rpcinet_proc.go
@@ -29,7 +29,7 @@ import (
 	"gvisor.dev/gvisor/pkg/waiter"
 )
 
-// rpcInetInode implments fs.InodeOperations.
+// rpcInetInode implements fs.InodeOperations.
 type rpcInetInode struct {
 	fsutil.SimpleFileInode
 
diff --git a/pkg/sentry/fs/sys/fs.go b/pkg/sentry/fs/sys/fs.go
index b31c46bf9..e60b63e75 100644
--- a/pkg/sentry/fs/sys/fs.go
+++ b/pkg/sentry/fs/sys/fs.go
@@ -30,7 +30,7 @@ func init() {
 	fs.RegisterFilesystem(&filesystem{})
 }
 
-// FilesystemName is the name underwhich the filesystem is registered.
+// FilesystemName is the name under which the filesystem is registered.
 // Name matches fs/sysfs/mount.c:sysfs_fs_type.name.
 const FilesystemName = "sysfs"
 
diff --git a/pkg/sentry/fs/tmpfs/fs.go b/pkg/sentry/fs/tmpfs/fs.go
index 881dd89b0..be98ad751 100644
--- a/pkg/sentry/fs/tmpfs/fs.go
+++ b/pkg/sentry/fs/tmpfs/fs.go
@@ -65,7 +65,7 @@ func init() {
 	fs.RegisterFilesystem(&Filesystem{})
 }
 
-// FilesystemName is the name underwhich the filesystem is registered.
+// FilesystemName is the name under which the filesystem is registered.
 // Name matches mm/shmem.c:shmem_fs_type.name.
 const FilesystemName = "tmpfs"
 
diff --git a/pkg/sentry/kernel/auth/id_map_set.go b/pkg/sentry/kernel/auth/id_map_set.go
index f72c839c7..73a17f281 100755
--- a/pkg/sentry/kernel/auth/id_map_set.go
+++ b/pkg/sentry/kernel/auth/id_map_set.go
@@ -1185,7 +1185,7 @@ func (s *idMapSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *idMapnode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/kernel/fs_context.go b/pkg/sentry/kernel/fs_context.go
index a08917889..938239aeb 100644
--- a/pkg/sentry/kernel/fs_context.go
+++ b/pkg/sentry/kernel/fs_context.go
@@ -61,8 +61,8 @@ func newFSContext(root, cwd *fs.Dirent, umask uint) *FSContext {
 // destroy is the destructor for an FSContext.
 //
 // This will call DecRef on both root and cwd Dirents.  If either call to
-// DecRef returns an error, then it will be propigated.  If both calls to
-// DecRef return an error, then the one from root.DecRef will be propigated.
+// DecRef returns an error, then it will be propagated.  If both calls to
+// DecRef return an error, then the one from root.DecRef will be propagated.
 //
 // Note that there may still be calls to WorkingDirectory() or RootDirectory()
 // (that return nil).  This is because valid references may still be held via
diff --git a/pkg/sentry/kernel/ipc_namespace.go b/pkg/sentry/kernel/ipc_namespace.go
index f0db0838d..80a070d7e 100644
--- a/pkg/sentry/kernel/ipc_namespace.go
+++ b/pkg/sentry/kernel/ipc_namespace.go
@@ -40,7 +40,7 @@ func NewIPCNamespace(userNS *auth.UserNamespace) *IPCNamespace {
 	}
 }
 
-// SemaphoreRegistry returns the semanphore set registry for this namespace.
+// SemaphoreRegistry returns the semaphore set registry for this namespace.
 func (i *IPCNamespace) SemaphoreRegistry() *semaphore.Registry {
 	return i.semaphores
 }
diff --git a/pkg/sentry/kernel/kernel.go b/pkg/sentry/kernel/kernel.go
index 9fe9eb914..47dadc43a 100644
--- a/pkg/sentry/kernel/kernel.go
+++ b/pkg/sentry/kernel/kernel.go
@@ -679,7 +679,7 @@ func (ctx *createProcessContext) Value(key interface{}) interface{} {
 		return ctx.args.Credentials
 	case fs.CtxRoot:
 		if ctx.args.Root != nil {
-			// Take a refernce on the root dirent that will be
+			// Take a reference on the root dirent that will be
 			// given to the caller.
 			ctx.args.Root.IncRef()
 			return ctx.args.Root
diff --git a/pkg/sentry/kernel/semaphore/semaphore.go b/pkg/sentry/kernel/semaphore/semaphore.go
index fb4a0e1e0..93fe68a3e 100644
--- a/pkg/sentry/kernel/semaphore/semaphore.go
+++ b/pkg/sentry/kernel/semaphore/semaphore.go
@@ -86,7 +86,7 @@ type Set struct {
 	dead bool
 }
 
-// sem represents a single semanphore from a set.
+// sem represents a single semaphore from a set.
 //
 // +stateify savable
 type sem struct {
diff --git a/pkg/sentry/kernel/seqatomic_taskgoroutineschedinfo.go b/pkg/sentry/kernel/seqatomic_taskgoroutineschedinfo.go
index c284a1b11..be6b07629 100755
--- a/pkg/sentry/kernel/seqatomic_taskgoroutineschedinfo.go
+++ b/pkg/sentry/kernel/seqatomic_taskgoroutineschedinfo.go
@@ -1,12 +1,11 @@
 package kernel
 
 import (
+	"fmt"
+	"gvisor.dev/gvisor/third_party/gvsync"
 	"reflect"
 	"strings"
 	"unsafe"
-
-	"fmt"
-	"gvisor.dev/gvisor/third_party/gvsync"
 )
 
 // SeqAtomicLoad returns a copy of *ptr, ensuring that the read does not race
diff --git a/pkg/sentry/kernel/task_futex.go b/pkg/sentry/kernel/task_futex.go
index d77dabc05..c211b5b74 100644
--- a/pkg/sentry/kernel/task_futex.go
+++ b/pkg/sentry/kernel/task_futex.go
@@ -34,14 +34,14 @@ func (t *Task) SwapUint32(addr usermem.Addr, new uint32) (uint32, error) {
 	})
 }
 
-// CompareAndSwapUint32 implemets futex.Target.CompareAndSwapUint32.
+// CompareAndSwapUint32 implements futex.Target.CompareAndSwapUint32.
 func (t *Task) CompareAndSwapUint32(addr usermem.Addr, old, new uint32) (uint32, error) {
 	return t.MemoryManager().CompareAndSwapUint32(t, addr, old, new, usermem.IOOpts{
 		AddressSpaceActive: true,
 	})
 }
 
-// LoadUint32 implemets futex.Target.LoadUint32.
+// LoadUint32 implements futex.Target.LoadUint32.
 func (t *Task) LoadUint32(addr usermem.Addr) (uint32, error) {
 	return t.MemoryManager().LoadUint32(t, addr, usermem.IOOpts{
 		AddressSpaceActive: true,
diff --git a/pkg/sentry/kernel/task_stop.go b/pkg/sentry/kernel/task_stop.go
index e735a5dd0..10c6e455c 100644
--- a/pkg/sentry/kernel/task_stop.go
+++ b/pkg/sentry/kernel/task_stop.go
@@ -172,7 +172,7 @@ func (t *Task) beginStopLocked() {
 	}
 }
 
-// endStopLocked decerements t.stopCount to indicate that an existing internal
+// endStopLocked decrements t.stopCount to indicate that an existing internal
 // or external stop no longer applies to t.
 //
 // Preconditions: The signal mutex must be locked.
diff --git a/pkg/sentry/kernel/thread_group.go b/pkg/sentry/kernel/thread_group.go
index 3562ef179..2a97e3e8e 100644
--- a/pkg/sentry/kernel/thread_group.go
+++ b/pkg/sentry/kernel/thread_group.go
@@ -268,7 +268,7 @@ func (k *Kernel) newThreadGroup(mounts *fs.MountNamespace, ns *PIDNamespace, sh
 	return tg
 }
 
-// saveRscr is invopked by stateify.
+// saveRscr is invoked by stateify.
 func (tg *ThreadGroup) saveRscr() *RSEQCriticalRegion {
 	return tg.rscr.Load().(*RSEQCriticalRegion)
 }
diff --git a/pkg/sentry/kernel/timekeeper.go b/pkg/sentry/kernel/timekeeper.go
index eadacfea2..76417342a 100644
--- a/pkg/sentry/kernel/timekeeper.go
+++ b/pkg/sentry/kernel/timekeeper.go
@@ -122,7 +122,7 @@ func (t *Timekeeper) SetClocks(c sentrytime.Clocks) {
 	//
 	// In a restored sentry, monotonic time jumps forward by approximately
 	// the same amount as real time. There are no guarantees here, we are
-	// just making a best-effort attempt to to make it appear that the app
+	// just making a best-effort attempt to make it appear that the app
 	// was simply not scheduled for a long period, rather than that the
 	// real time clock was changed.
 	//
diff --git a/pkg/sentry/memmap/mapping_set.go b/pkg/sentry/memmap/mapping_set.go
index c87d4687a..0a5b7ce45 100644
--- a/pkg/sentry/memmap/mapping_set.go
+++ b/pkg/sentry/memmap/mapping_set.go
@@ -85,7 +85,7 @@ func (mappingSetFunctions) Merge(r1 MappableRange, val1 MappingsOfRange, r2 Mapp
 	// Each MappingOfRange in val1 must have a matching region in val2, forming
 	// one contiguous region.
 	for k1 := range val1 {
-		// We expect val2 to to contain a key that forms a contiguous
+		// We expect val2 to contain a key that forms a contiguous
 		// region with k1.
 		k2 := MappingOfRange{
 			MappingSpace: k1.MappingSpace,
diff --git a/pkg/sentry/memmap/mapping_set_impl.go b/pkg/sentry/memmap/mapping_set_impl.go
index eb3071e89..e632f28a5 100755
--- a/pkg/sentry/memmap/mapping_set_impl.go
+++ b/pkg/sentry/memmap/mapping_set_impl.go
@@ -1185,7 +1185,7 @@ func (s *MappingSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *Mappingnode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/mm/file_refcount_set.go b/pkg/sentry/mm/file_refcount_set.go
index 84a7fd759..6b3081009 100755
--- a/pkg/sentry/mm/file_refcount_set.go
+++ b/pkg/sentry/mm/file_refcount_set.go
@@ -1189,7 +1189,7 @@ func (s *fileRefcountSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *fileRefcountnode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go
index 7bb96b159..f350e0109 100644
--- a/pkg/sentry/mm/mm.go
+++ b/pkg/sentry/mm/mm.go
@@ -74,7 +74,7 @@ type MemoryManager struct {
 	// privateRefs is immutable.
 	privateRefs *privateRefs
 
-	// users is the number of dependences on the mappings in the MemoryManager.
+	// users is the number of dependencies on the mappings in the MemoryManager.
 	// When the number of references in users reaches zero, all mappings are
 	// unmapped.
 	//
diff --git a/pkg/sentry/mm/pma_set.go b/pkg/sentry/mm/pma_set.go
index a048a299c..52e66468c 100755
--- a/pkg/sentry/mm/pma_set.go
+++ b/pkg/sentry/mm/pma_set.go
@@ -1189,7 +1189,7 @@ func (s *pmaSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *pmanode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/mm/vma.go b/pkg/sentry/mm/vma.go
index 074e2b141..f2fd70799 100644
--- a/pkg/sentry/mm/vma.go
+++ b/pkg/sentry/mm/vma.go
@@ -34,7 +34,7 @@ func (mm *MemoryManager) createVMALocked(ctx context.Context, opts memmap.MMapOp
 		panic(fmt.Sprintf("Non-effective MaxPerms %s cannot be enforced", opts.MaxPerms))
 	}
 
-	// Find a useable range.
+	// Find a usable range.
 	addr, err := mm.findAvailableLocked(opts.Length, findAvailableOpts{
 		Addr:     opts.Addr,
 		Fixed:    opts.Fixed,
diff --git a/pkg/sentry/mm/vma_set.go b/pkg/sentry/mm/vma_set.go
index 0211e2fce..c3ef24f34 100755
--- a/pkg/sentry/mm/vma_set.go
+++ b/pkg/sentry/mm/vma_set.go
@@ -1189,7 +1189,7 @@ func (s *vmaSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *vmanode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/pgalloc/evictable_range_set.go b/pkg/sentry/pgalloc/evictable_range_set.go
index a4dcb1663..6fbd02434 100755
--- a/pkg/sentry/pgalloc/evictable_range_set.go
+++ b/pkg/sentry/pgalloc/evictable_range_set.go
@@ -1185,7 +1185,7 @@ func (s *evictableRangeSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *evictableRangenode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/pgalloc/usage_set.go b/pkg/sentry/pgalloc/usage_set.go
index 612807caf..37b9235ca 100755
--- a/pkg/sentry/pgalloc/usage_set.go
+++ b/pkg/sentry/pgalloc/usage_set.go
@@ -1189,7 +1189,7 @@ func (s *usageSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *usagenode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go b/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
index 0effd33ac..9d8af143e 100644
--- a/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/bluepill_amd64_unsafe.go
@@ -30,7 +30,7 @@ func bluepillArchContext(context unsafe.Pointer) *arch.SignalContext64 {
 	return &((*arch.UContext64)(context).MContext)
 }
 
-// dieArchSetup initialies the state for dieTrampoline.
+// dieArchSetup initializes the state for dieTrampoline.
 //
 // The amd64 dieTrampoline requires the vCPU to be set in BX, and the last RIP
 // to be in AX. The trampoline then simulates a call to dieHandler from the
diff --git a/pkg/sentry/platform/kvm/machine.go b/pkg/sentry/platform/kvm/machine.go
index 69b2f92a7..7d92e16cc 100644
--- a/pkg/sentry/platform/kvm/machine.go
+++ b/pkg/sentry/platform/kvm/machine.go
@@ -135,7 +135,7 @@ type dieState struct {
 
 // newVCPU creates a returns a new vCPU.
 //
-// Precondtion: mu must be held.
+// Precondition: mu must be held.
 func (m *machine) newVCPU() *vCPU {
 	id := len(m.vCPUs)
 
diff --git a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
index c87fa7b7c..506ec9af1 100644
--- a/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
+++ b/pkg/sentry/platform/kvm/machine_amd64_unsafe.go
@@ -87,7 +87,7 @@ func (c *vCPU) setCPUID() error {
 
 // setSystemTime sets the TSC for the vCPU.
 //
-// This has to make the call many times in order to minimize the intrinstic
+// This has to make the call many times in order to minimize the intrinsic
 // error in the offset. Unfortunately KVM does not expose a relative offset via
 // the API, so this is an approximation. We do this via an iterative algorithm.
 // This has the advantage that it can generally deal with highly variable
diff --git a/pkg/sentry/platform/platform.go b/pkg/sentry/platform/platform.go
index 5ad98a329..eccbe2336 100644
--- a/pkg/sentry/platform/platform.go
+++ b/pkg/sentry/platform/platform.go
@@ -256,7 +256,7 @@ type AddressSpaceIO interface {
 	LoadUint32(addr usermem.Addr) (uint32, error)
 }
 
-// NoAddressSpaceIO implements AddressSpaceIO methods by panicing.
+// NoAddressSpaceIO implements AddressSpaceIO methods by panicking.
 type NoAddressSpaceIO struct{}
 
 // CopyOut implements AddressSpaceIO.CopyOut.
diff --git a/pkg/sentry/platform/ptrace/subprocess.go b/pkg/sentry/platform/ptrace/subprocess.go
index 46f9d3fb6..15e84735e 100644
--- a/pkg/sentry/platform/ptrace/subprocess.go
+++ b/pkg/sentry/platform/ptrace/subprocess.go
@@ -123,7 +123,7 @@ type subprocess struct {
 	contexts map[*context]struct{}
 }
 
-// newSubprocess returns a useable subprocess.
+// newSubprocess returns a usable subprocess.
 //
 // This will either be a newly created subprocess, or one from the global pool.
 // The create function will be called in the latter case, which is guaranteed
@@ -255,7 +255,7 @@ func (s *subprocess) newThread() *thread {
 	return t
 }
 
-// attach attachs to the thread.
+// attach attaches to the thread.
 func (t *thread) attach() {
 	if _, _, errno := syscall.RawSyscall(syscall.SYS_PTRACE, syscall.PTRACE_ATTACH, uintptr(t.tid), 0); errno != 0 {
 		panic(fmt.Sprintf("unable to attach: %v", errno))
@@ -285,9 +285,9 @@ func (t *thread) grabInitRegs() {
 	t.initRegs.Rip -= initRegsRipAdjustment
 }
 
-// detach detachs from the thread.
+// detach detaches from the thread.
 //
-// Because the SIGSTOP is not supressed, the thread will enter group-stop.
+// Because the SIGSTOP is not suppressed, the thread will enter group-stop.
 func (t *thread) detach() {
 	if _, _, errno := syscall.RawSyscall6(syscall.SYS_PTRACE, syscall.PTRACE_DETACH, uintptr(t.tid), 0, uintptr(syscall.SIGSTOP), 0, 0); errno != 0 {
 		panic(fmt.Sprintf("can't detach new clone: %v", errno))
@@ -374,7 +374,7 @@ func (t *thread) destroy() {
 
 // init initializes trace options.
 func (t *thread) init() {
-	// Set our TRACESYSGOOD option to differeniate real SIGTRAP. We also
+	// Set the TRACESYSGOOD option to differentiate real SIGTRAP.
 	// set PTRACE_O_EXITKILL to ensure that the unexpected exit of the
 	// sentry will immediately kill the associated stubs.
 	const PTRACE_O_EXITKILL = 0x100000
@@ -558,7 +558,7 @@ func (s *subprocess) switchToApp(c *context, ac arch.Context) bool {
 		if c.signalInfo.Code > 0 {
 			// The signal was generated by the kernel. We inspect
 			// the signal information, and may patch it in order to
-			// faciliate vsyscall emulation. See patchSignalInfo.
+			// facilitate vsyscall emulation. See patchSignalInfo.
 			patchSignalInfo(regs, &c.signalInfo)
 			return false
 		} else if c.signalInfo.Code <= 0 && c.signalInfo.Pid() == int32(os.Getpid()) {
diff --git a/pkg/sentry/platform/ring0/defs_impl.go b/pkg/sentry/platform/ring0/defs_impl.go
index acae012dc..d4bfc5a4a 100755
--- a/pkg/sentry/platform/ring0/defs_impl.go
+++ b/pkg/sentry/platform/ring0/defs_impl.go
@@ -1,14 +1,14 @@
 package ring0
 
 import (
-	"fmt"
-	"gvisor.dev/gvisor/pkg/cpuid"
-	"io"
-	"reflect"
 	"syscall"
 
+	"fmt"
+	"gvisor.dev/gvisor/pkg/cpuid"
 	"gvisor.dev/gvisor/pkg/sentry/platform/ring0/pagetables"
 	"gvisor.dev/gvisor/pkg/sentry/usermem"
+	"io"
+	"reflect"
 )
 
 var (
diff --git a/pkg/sentry/platform/ring0/entry_impl_amd64.s b/pkg/sentry/platform/ring0/entry_impl_amd64.s
index d082d06a9..daba45f9d 100755
--- a/pkg/sentry/platform/ring0/entry_impl_amd64.s
+++ b/pkg/sentry/platform/ring0/entry_impl_amd64.s
@@ -79,7 +79,7 @@
 #include "funcdata.h"
 #include "textflag.h"
 
-// NB: Offsets are programatically generated (see BUILD).
+// NB: Offsets are programmatically generated (see BUILD).
 //
 // This file is concatenated with the definitions.
 
diff --git a/pkg/sentry/socket/unix/transport/connectionless.go b/pkg/sentry/socket/unix/transport/connectionless.go
index cb2b60339..e987519f0 100644
--- a/pkg/sentry/socket/unix/transport/connectionless.go
+++ b/pkg/sentry/socket/unix/transport/connectionless.go
@@ -23,7 +23,7 @@ import (
 )
 
 // connectionlessEndpoint is a unix endpoint for unix sockets that support operating in
-// a conectionless fashon.
+// a connectionless fashon.
 //
 // Specifically, this means datagram unix sockets not created with
 // socketpair(2).
diff --git a/pkg/sentry/socket/unix/transport/queue.go b/pkg/sentry/socket/unix/transport/queue.go
index f67f6fee0..0415fae9a 100644
--- a/pkg/sentry/socket/unix/transport/queue.go
+++ b/pkg/sentry/socket/unix/transport/queue.go
@@ -100,7 +100,7 @@ func (q *queue) IsWritable() bool {
 
 // Enqueue adds an entry to the data queue if room is available.
 //
-// If truncate is true, Enqueue may truncate the message beforing enqueuing it.
+// If truncate is true, Enqueue may truncate the message before enqueuing it.
 // Otherwise, the entire message must fit. If n < e.Length(), err indicates why.
 //
 // If notify is true, ReaderQueue.Notify must be called:
diff --git a/pkg/sentry/strace/capability.go b/pkg/sentry/strace/capability.go
index f4a8e6365..3255dc18d 100644
--- a/pkg/sentry/strace/capability.go
+++ b/pkg/sentry/strace/capability.go
@@ -19,7 +19,7 @@ import (
 	"gvisor.dev/gvisor/pkg/abi/linux"
 )
 
-// CapabilityBitset is the set of capabilties in a bitset.
+// CapabilityBitset is the set of capabilities in a bitset.
 var CapabilityBitset = abi.FlagSet{
 	{
 		Flag: 1 << uint32(linux.CAP_CHOWN),
diff --git a/pkg/sentry/time/seqatomic_parameters.go b/pkg/sentry/time/seqatomic_parameters.go
index 1ec221edd..b4fb0a7f0 100755
--- a/pkg/sentry/time/seqatomic_parameters.go
+++ b/pkg/sentry/time/seqatomic_parameters.go
@@ -1,12 +1,11 @@
 package time
 
 import (
+	"fmt"
+	"gvisor.dev/gvisor/third_party/gvsync"
 	"reflect"
 	"strings"
 	"unsafe"
-
-	"fmt"
-	"gvisor.dev/gvisor/third_party/gvsync"
 )
 
 // SeqAtomicLoad returns a copy of *ptr, ensuring that the read does not race
diff --git a/pkg/state/addr_set.go b/pkg/state/addr_set.go
index bce7da87d..5261aa488 100755
--- a/pkg/state/addr_set.go
+++ b/pkg/state/addr_set.go
@@ -1189,7 +1189,7 @@ func (s *addrSet) String() string {
 	return s.root.String()
 }
 
-// String stringifes a node (and all of its children) for debugging.
+// String stringifies a node (and all of its children) for debugging.
 func (n *addrnode) String() string {
 	var buf bytes.Buffer
 	n.writeDebugString(&buf, "")
diff --git a/pkg/state/encode.go b/pkg/state/encode.go
index 1cfdff643..5d9409a45 100644
--- a/pkg/state/encode.go
+++ b/pkg/state/encode.go
@@ -84,7 +84,7 @@ type encodeState struct {
 
 // register looks up an ID, registering if necessary.
 //
-// If the object was not previosly registered, it is enqueued to be serialized.
+// If the object was not previously registered, it is enqueued to be serialized.
 // See the documentation for idsByObject for more information.
 func (es *encodeState) register(obj reflect.Value) uint64 {
 	// It is not legal to call register for any non-pointer objects (see
diff --git a/pkg/tcpip/buffer/view.go b/pkg/tcpip/buffer/view.go
index 1a9d40778..150310c11 100644
--- a/pkg/tcpip/buffer/view.go
+++ b/pkg/tcpip/buffer/view.go
@@ -50,7 +50,7 @@ func (v View) ToVectorisedView() VectorisedView {
 	return NewVectorisedView(len(v), []View{v})
 }
 
-// VectorisedView is a vectorised version of View using non contigous memory.
+// VectorisedView is a vectorised version of View using non contiguous memory.
 // It supports all the convenience methods supported by View.
 //
 // +stateify savable
diff --git a/pkg/tcpip/link/rawfile/errors.go b/pkg/tcpip/link/rawfile/errors.go
index 80e91bb34..a0a873c84 100644
--- a/pkg/tcpip/link/rawfile/errors.go
+++ b/pkg/tcpip/link/rawfile/errors.go
@@ -30,7 +30,7 @@ var translations [maxErrno]*tcpip.Error
 // TranslateErrno translate an errno from the syscall package into a
 // *tcpip.Error.
 //
-// Valid, but unreconigized errnos will be translated to
+// Valid, but unrecognized errnos will be translated to
 // tcpip.ErrInvalidEndpointState (EINVAL). Panics on invalid errnos.
 func TranslateErrno(e syscall.Errno) *tcpip.Error {
 	if err := translations[e]; err != nil {
diff --git a/pkg/tcpip/link/rawfile/rawfile_unsafe.go b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
index 08847f95f..e3fbb15c2 100644
--- a/pkg/tcpip/link/rawfile/rawfile_unsafe.go
+++ b/pkg/tcpip/link/rawfile/rawfile_unsafe.go
@@ -110,7 +110,7 @@ type PollEvent struct {
 
 // BlockingRead reads from a file descriptor that is set up as non-blocking. If
 // no data is available, it will block in a poll() syscall until the file
-// descirptor becomes readable.
+// descriptor becomes readable.
 func BlockingRead(fd int, b []byte) (int, *tcpip.Error) {
 	for {
 		n, _, e := syscall.RawSyscall(syscall.SYS_READ, uintptr(fd), uintptr(unsafe.Pointer(&b[0])), uintptr(len(b)))
diff --git a/pkg/tcpip/network/fragmentation/fragmentation.go b/pkg/tcpip/network/fragmentation/fragmentation.go
index 6822059d6..1628a82be 100644
--- a/pkg/tcpip/network/fragmentation/fragmentation.go
+++ b/pkg/tcpip/network/fragmentation/fragmentation.go
@@ -60,7 +60,7 @@ type Fragmentation struct {
 // lowMemoryLimit specifies the limit on which we will reach by dropping
 // fragments after reaching highMemoryLimit.
 //
-// reassemblingTimeout specifes the maximum time allowed to reassemble a packet.
+// reassemblingTimeout specifies the maximum time allowed to reassemble a packet.
 // Fragments are lazily evicted only when a new a packet with an
 // already existing fragmentation-id arrives after the timeout.
 func NewFragmentation(highMemoryLimit, lowMemoryLimit int, reassemblingTimeout time.Duration) *Fragmentation {
@@ -80,7 +80,7 @@ func NewFragmentation(highMemoryLimit, lowMemoryLimit int, reassemblingTimeout t
 	}
 }
 
-// Process processes an incoming fragment beloning to an ID
+// Process processes an incoming fragment belonging to an ID
 // and returns a complete packet when all the packets belonging to that ID have been received.
 func (f *Fragmentation) Process(id uint32, first, last uint16, more bool, vv buffer.VectorisedView) (buffer.VectorisedView, bool) {
 	f.mu.Lock()
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index 4aafb51ab..966b3acfd 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -534,7 +534,7 @@ type BroadcastOption int
 
 // Route is a row in the routing table. It specifies through which NIC (and
 // gateway) sets of packets should be routed. A row is considered viable if the
-// masked target address matches the destination adddress in the row.
+// masked target address matches the destination address in the row.
 type Route struct {
 	// Destination is the address that must be matched against the masked
 	// target address to check if this row is viable.
diff --git a/pkg/tcpip/transport/raw/endpoint.go b/pkg/tcpip/transport/raw/endpoint.go
index 03f495e48..73599dd9d 100644
--- a/pkg/tcpip/transport/raw/endpoint.go
+++ b/pkg/tcpip/transport/raw/endpoint.go
@@ -16,7 +16,7 @@
 // sockets allow applications to:
 //
 //   * manually write and inspect transport layer headers and payloads
-//   * receive all traffic of a given transport protcol (e.g. ICMP or UDP)
+//   * receive all traffic of a given transport protocol (e.g. ICMP or UDP)
 //   * optionally write and inspect network layer and link layer headers for
 //     packets
 //
diff --git a/pkg/urpc/urpc.go b/pkg/urpc/urpc.go
index be6b4f95b..df59ffab1 100644
--- a/pkg/urpc/urpc.go
+++ b/pkg/urpc/urpc.go
@@ -72,7 +72,7 @@ type FilePayload struct {
 	Files []*os.File `json:"-"`
 }
 
-// ReleaseFD releases the indexth FD.
+// ReleaseFD releases the FD at the specified index.
 func (f *FilePayload) ReleaseFD(index int) (*fd.FD, error) {
 	return fd.NewFromFile(f.Files[index])
 }
diff --git a/runsc/boot/filter/extra_filters.go b/runsc/boot/filter/extra_filters.go
index 1056cd314..e28d4b8d6 100644
--- a/runsc/boot/filter/extra_filters.go
+++ b/runsc/boot/filter/extra_filters.go
@@ -21,7 +21,7 @@ import (
 )
 
 // instrumentationFilters returns additional filters for syscalls used by
-// Go intrumentation tools, e.g. -race, -msan.
+// Go instrumentation tools, e.g. -race, -msan.
 // Returns empty when disabled.
 func instrumentationFilters() seccomp.SyscallRules {
 	return nil
diff --git a/runsc/cmd/syscalls.go b/runsc/cmd/syscalls.go
index df92c126a..fb6c1ab29 100644
--- a/runsc/cmd/syscalls.go
+++ b/runsc/cmd/syscalls.go
@@ -41,7 +41,7 @@ type Syscalls struct {
 // Maps operating system to architecture to ArchInfo.
 type CompatibilityInfo map[string]map[string]ArchInfo
 
-// ArchInfo is compatbility doc for an architecture.
+// ArchInfo is compatibility doc for an architecture.
 type ArchInfo struct {
 	// Syscalls maps syscall number for the architecture to the doc.
 	Syscalls map[uintptr]SyscallDoc `json:"syscalls"`
diff --git a/runsc/container/container.go b/runsc/container/container.go
index bde46fb9b..8320bb2ca 100644
--- a/runsc/container/container.go
+++ b/runsc/container/container.go
@@ -206,7 +206,7 @@ func findContainerRoot(rootDir, partialID string) (string, error) {
 	}
 
 	// Now see whether id could be an abbreviation of exactly 1 of the
-	// container ids. If id is ambigious (it could match more than 1
+	// container ids. If id is ambiguous (it could match more than 1
 	// container), it is an error.
 	cRoot = ""
 	ids, err := List(rootDir)
@@ -273,7 +273,7 @@ type Args struct {
 	Attached bool
 }
 
-// Create creates the container in a new Sandbox process, unless the metadata
+// New creates the container in a new Sandbox process, unless the metadata
 // indicates that an existing Sandbox should be used. The caller must call
 // Destroy() on the container.
 func New(conf *boot.Config, args Args) (*Container, error) {
@@ -329,7 +329,7 @@ func New(conf *boot.Config, args Args) (*Container, error) {
 		log.Debugf("Creating new sandbox for container %q", args.ID)
 
 		// Create and join cgroup before processes are created to ensure they are
-		// part of the cgroup from the start (and all tneir children processes).
+		// part of the cgroup from the start (and all their children processes).
 		cg, err := cgroup.New(args.Spec)
 		if err != nil {
 			return nil, err
@@ -446,7 +446,7 @@ func (c *Container) Start(conf *boot.Config) error {
 		}
 	} else {
 		// Join cgroup to strt gofer process to ensure it's part of the cgroup from
-		// the start (and all tneir children processes).
+		// the start (and all their children processes).
 		if err := runInCgroup(c.Sandbox.Cgroup, func() error {
 			// Create the gofer process.
 			ioFiles, mountsFile, err := c.createGoferProcess(c.Spec, conf, c.BundleDir)
@@ -514,7 +514,7 @@ func Run(conf *boot.Config, args Args) (syscall.WaitStatus, error) {
 	if err != nil {
 		return 0, fmt.Errorf("creating container: %v", err)
 	}
-	// Clean up partially created container if an error ocurrs.
+	// Clean up partially created container if an error occurs.
 	// Any errors returned by Destroy() itself are ignored.
 	cu := specutils.MakeCleanup(func() {
 		c.Destroy()
diff --git a/runsc/fsgofer/filter/extra_filters.go b/runsc/fsgofer/filter/extra_filters.go
index 1056cd314..e28d4b8d6 100644
--- a/runsc/fsgofer/filter/extra_filters.go
+++ b/runsc/fsgofer/filter/extra_filters.go
@@ -21,7 +21,7 @@ import (
 )
 
 // instrumentationFilters returns additional filters for syscalls used by
-// Go intrumentation tools, e.g. -race, -msan.
+// Go instrumentation tools, e.g. -race, -msan.
 // Returns empty when disabled.
 func instrumentationFilters() seccomp.SyscallRules {
 	return nil
diff --git a/runsc/fsgofer/fsgofer.go b/runsc/fsgofer/fsgofer.go
index f970ce88d..fe450c64f 100644
--- a/runsc/fsgofer/fsgofer.go
+++ b/runsc/fsgofer/fsgofer.go
@@ -619,7 +619,7 @@ func (l *localFile) GetAttr(_ p9.AttrMask) (p9.QID, p9.AttrMask, p9.Attr, error)
 }
 
 // SetAttr implements p9.File. Due to mismatch in file API, options
-// cannot be changed atomicaly and user may see partial changes when
+// cannot be changed atomically and user may see partial changes when
 // an error happens.
 func (l *localFile) SetAttr(valid p9.SetAttrMask, attr p9.SetAttr) error {
 	conf := l.attachPoint.conf
diff --git a/runsc/specutils/fs.go b/runsc/specutils/fs.go
index 6e6902e9f..138aa4dd1 100644
--- a/runsc/specutils/fs.go
+++ b/runsc/specutils/fs.go
@@ -87,7 +87,7 @@ func OptionsToFlags(opts []string) uint32 {
 
 // PropOptionsToFlags converts propagation mount options to syscall flags.
 // Propagation options cannot be set other with other options and must be
-// handled separatedly.
+// handled separately.
 func PropOptionsToFlags(opts []string) uint32 {
 	return optionsToFlags(opts, propOptionsMap)
 }
diff --git a/runsc/specutils/namespace.go b/runsc/specutils/namespace.go
index c9ef606cb..d441419cb 100644
--- a/runsc/specutils/namespace.go
+++ b/runsc/specutils/namespace.go
@@ -204,7 +204,7 @@ func SetUIDGIDMappings(cmd *exec.Cmd, s *specs.Spec) {
 	}
 }
 
-// HasCapabilities returns true if the user has all capabilties in 'cs'.
+// HasCapabilities returns true if the user has all capabilities in 'cs'.
 func HasCapabilities(cs ...capability.Cap) bool {
 	caps, err := capability.NewPid2(os.Getpid())
 	if err != nil {
diff --git a/runsc/specutils/specutils.go b/runsc/specutils/specutils.go
index 215828120..0b40e38a3 100644
--- a/runsc/specutils/specutils.go
+++ b/runsc/specutils/specutils.go
@@ -394,7 +394,7 @@ func WaitForReady(pid int, timeout time.Duration, ready func() (bool, error)) er
 
 // DebugLogFile opens a log file using 'logPattern' as location. If 'logPattern'
 // ends with '/', it's used as a directory with default file name.
-// 'logPattern' can contain variables that are substitued:
+// 'logPattern' can contain variables that are substituted:
 //   - %TIMESTAMP%: is replaced with a timestamp using the following format:
 //			<yyyymmdd-hhmmss.uuuuuu>
 //	 - %COMMAND%: is replaced with 'command'