gvisor - Container Runtime Sandbox

Age	Commit message (Collapse)	Author
2021-04-14	Automatically enforce limited netstack dependencies	Kevin Krakauer
	Netstack is supposed to be somewhat independent of the rest of gVisor, and others should be able to use it without pulling in excessive dependencies. Currently, there is no way to fight dependency creep besides careful code review. This change introduces a test rule `netstack_deps_check` that ensures the target only relies on gVisor targets and a short allowlist of external dependencies. Users who add a dependency will see an error and have to manually update the allowlist. The set of packages to test comes from //runsc, as it uses packages we would expect users to commonly rely on. It was generated via: $ find ./runsc -name BUILD \| xargs grep tcpip \| awk '{print $2}' \| sort \| uniq (Note: We considered giving //pkg/tcpip it's own go.mod, but this breaks go tooling.) PiperOrigin-RevId: 368456711
2020-10-07	Internal change.	gVisor bot
	PiperOrigin-RevId: 335960488
2020-08-06	Add bzl_library rules for .bzl files without one.	Adin Scannell
	PiperOrigin-RevId: 325280924
2020-04-20	Add internal nogo analysis & checkescape tool.	Adin Scannell
	See tools/nogo/README.md. The checkescape tool is able to perform recursive escape analysis, using the actual generated binary to confirm the results produced by the compiler itself. As an initial use case, this replaces the manual escape analysis tests used for go_marshal, and validates that the CopyIn and CopyOut paths will not require any allocation or stack splits. Updates #2243 PiperOrigin-RevId: 307532986
2020-03-25	nogo: enable sanitizers.	Adin Scannell
	This enables all relevant santizers (though most analyzers will not find much, it will prevent instances from creeping in), and codifies existing exceptions in tools/nogo.js to be fixed.
2020-01-27	Standardize on tools directory.	Adin Scannell
	PiperOrigin-RevId: 291745021