Application Kernel for Containers
This report presents the forensic synthetic code analysis of google/gvisor, a Go project with 19,183 GitHub stars. SynthScan v2.0 examined 762,904 lines of code across 2811 source files, recording 4617 pattern matches distributed across 16 syntactic categories. The overall adjusted score of 8.6 places this repository in the Low AI signal band.
The scanner applied 160+ deterministic lexical heuristics, multi-line block detectors, abstract syntax tree depth profilers, and a cross-file Jaccard similarity matrix to construct a statistically normalised synthetic code estimate. All matches are individually weighted by severity coefficient and contextual multiplier before summation, and the resulting headline score is temporally discounted to account for the repository's development history relative to the commercial emergence of large language model coding tooling (November 2022 onward).
This chart maps the temporal evolution of the adjusted synthetic code score across successive scan runs. An upward trajectory indicates ongoing incorporation of AI-generated code or expanding LLM-assisted scaffolding; a stable or declining trajectory may reflect active human refactoring, code removal, or the adoption of stricter authorship policies. The dashed secondary line (right axis) independently tracks total raw pattern hit count, which can diverge from the normalised score when codebase size changes significantly between scans.
Classifies detected patterns by their diagnostic confidence and structural impact. CRITICAL patterns (coefficient 10) represent definitive synthetic signatures — hallucinated imports, explicit LLM attribution metadata — virtually never produced by human authors. HIGH (5) indicates strong structural tells such as cross-file repetition or cross-linguistic idioms. MEDIUM (2) covers recognisable conversational padding and AI-specific vocabulary. LOW (1) captures subtle indicators like tautological comments and generic boilerplate that require density to carry independent signal.
This horizontal bar chart decomposes the repository's raw synthetic code score by top-level directory, allowing you to pinpoint precisely which modules or components carry the highest AI authorship density. Directories with disproportionately high scores relative to their size warrant targeted manual review: concentrated AI signatures often trace back to mass-generated configuration layers, auto-ported test suites, LLM-scaffolded boilerplate classes, or entire subsystems authored under heavy copilot assistance. Use this view to prioritise your human code-review effort.
The scanner identified 4617 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a statistically significant AI authorship indicator. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the diagnostic confidence level (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — comment-context matches receive a ×1.5 weight because LLMs systematically over-annotate. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier as dense clusters constitute far stronger evidence of synthetic authorship than isolated hits.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | webhook/main.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | webhook/pkg/cli/cli.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | webhook/pkg/injector/webhook.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | webhook/pkg/injector/certs.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | g3doc/proposals/runtime_dedicate_os_thread.md | 101 | run, and the M that selects the G then needs to transfer its P to the locked M, | COMMENT |
| LOW | tools/install_containerd.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/workspace_status.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/builkite-check-paths.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/make_release.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/gen_compile_commands.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/go_branch.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/build_cover.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/build_cover.sh | 81 | # sync/atomic.AddInt32), which will not work. We may be able to re-enable | COMMENT |
| LOW | tools/gopackagesdriver.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/tag_release.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/devcontainer-init.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | tools/make_apt.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/go_fieldenum/main.go | 1 | // Copyright 2021 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/main.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/cmd/install/install.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/cluster/cluster.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/util/util.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/spec/spec.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | …ls/gvisor_k8s_tool/provider/clusterflag/clusterflag.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/provider/gke/gke.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gvisor_k8s_tool/provider/kubectl/kubectl.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/checklinkname/check_linkname.go | 1 | // Copyright 2021 The gVisor Authors. | COMMENT |
| LOW | tools/checklinkname/check_linkname.go | 141 | // function declared as “localname” in the source code. If the | COMMENT |
| LOW | tools/checklinkname/test/test_unsafe.go | 1 | // Copyright 2021 The gVisor Authors. | COMMENT |
| LOW | tools/parsers/version.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | tools/parsers/go_parser_test.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | tools/parsers/go_parser.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | tools/parsers/go_parser.go | 41 | suite.Benchmarks = append(suite.Benchmarks, bm) | COMMENT |
| LOW | tools/parsers/parser_main.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | tools/profiletool/profiletool.go | 1 | // Copyright 2024 The gVisor Authors. | COMMENT |
| LOW | tools/profiletool/profiletool.go | 301 | // If a key is not found in a profile, its frequency is assumed to be | COMMENT |
| LOW | tools/compat/realpath.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | tools/gpu/cos_drivers_test.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/gpu/all_drivers_test.sh | 1 | #!/bin/bash | COMMENT |
| LOW | tools/gpu/main.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gpu/drivers/install_driver.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/gpu/drivers/install_driver_test.go | 1 | // Copyright 2023 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/main.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/analysis/analysis_unsafe.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/analysis/analysis_unsafe.go | 41 | // Internally, we populate the type with random data by doing an unsafe cast to | COMMENT |
| LOW | tools/go_marshal/test/test.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/test/test.go | 141 | // | COMMENT |
| LOW | tools/go_marshal/test/test.go | 161 | // +marshal | COMMENT |
| LOW | tools/go_marshal/test/dynamic.go | 1 | // Copyright 2021 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/test/benchmark_test.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/test/marshal_test.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/test/marshal_test.go | 421 | } | COMMENT |
| LOW | tools/go_marshal/test/escape/escape.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/test/external/external.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | …al/gomarshal/generator_interfaces_primitive_newtype.go | 1 | // Copyright 2020 The gVisor Authors. | COMMENT |
| LOW | …s/go_marshal/gomarshal/generator_interfaces_dynamic.go | 1 | // Copyright 2021 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/gomarshal/util.go | 1 | // Copyright 2019 The gVisor Authors. | COMMENT |
| LOW | tools/go_marshal/gomarshal/util.go | 81 | primitive func(n, t *ast.Ident) | COMMENT |
| LOW | tools/go_marshal/gomarshal/util.go | 161 | COMMENT | |
| LOW | tools/go_marshal/gomarshal/util.go | 341 | COMMENT | |
| 4253 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | pkg/sentry/vfs/opath.go | 128 | stat, err := fd.vfsfd.vd.mount.fs.impl.StatAt(ctx, rp, opts) | CODE |
| CRITICAL | pkg/sentry/vfs/opath.go | 141 | statfs, err := fd.vfsfd.vd.mount.fs.impl.StatFSAt(ctx, rp) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 584 | stat, err = fd.vd.mount.fs.impl.StatAt(ctx, rp, opts) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 604 | err := fd.vd.mount.fs.impl.SetStatAt(ctx, rp, opts) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 626 | statfs, err := fd.vd.mount.fs.impl.StatFSAt(ctx, rp) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 783 | names, err := fd.vd.mount.fs.impl.ListXattrAt(ctx, rp, size) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 812 | val, err := fd.vd.mount.fs.impl.GetXattrAt(ctx, rp, *opts) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 828 | err := fd.vd.mount.fs.impl.SetXattrAt(ctx, rp, *opts) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 848 | err := fd.vd.mount.fs.impl.RemoveXattrAt(ctx, rp, name) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 867 | acl, err := fd.vd.mount.fs.impl.GetPosixACLAt(ctx, rp, t) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 883 | acl, mode, err := fd.vd.mount.fs.impl.SetPosixACLAt(ctx, rp, t, acl, clearSGID) | CODE |
| CRITICAL | pkg/sentry/vfs/file_description.go | 893 | return fd.vd.mount.fs.impl.Sync(ctx) | CODE |
| CRITICAL | pkg/sentry/fsimpl/devpts/replica.go | 107 | rfd.inode.t.ld.replicaWaiter.EventRegister(e) | CODE |
| CRITICAL | pkg/sentry/fsimpl/devpts/replica.go | 113 | rfd.inode.t.ld.replicaWaiter.EventUnregister(e) | CODE |
| CRITICAL | pkg/sentry/fsimpl/gofer/socket.go | 106 | e.dentry.inode.fs.renameMu.RLock() | CODE |
| CRITICAL | pkg/sentry/fsimpl/gofer/socket.go | 108 | e.dentry.inode.fs.renameMu.RUnlock() | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1808 | d.inode.fs.dentryCache.mu.Lock() | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1811 | d.inode.fs.dentryCache.dentries.Remove(&d.cacheEntry) | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1812 | d.inode.fs.dentryCache.dentries.PushFront(&d.cacheEntry) | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1813 | d.inode.fs.dentryCache.mu.Unlock() | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1819 | d.inode.fs.dentryCache.dentries.PushFront(&d.cacheEntry) | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1823 | d.inode.fs.dentryCache.mu.Unlock() | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1840 | d.inode.fs.dentryCache.mu.Lock() | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1841 | d.inode.fs.dentryCache.dentries.Remove(&d.cacheEntry) | CODE |
| CRITICAL⚡ | pkg/sentry/fsimpl/gofer/gofer.go | 1843 | d.inode.fs.dentryCache.mu.Unlock() | CODE |
| CRITICAL | pkg/sentry/fsimpl/tmpfs/regular_file.go | 751 | ims, err := rw.file.inode.fs.mf.MapInternal(seg.FileRangeOf(seg.Range().Intersect(mr)), hostarch.Read) | CODE |
| CRITICAL | pkg/sentry/fsimpl/tmpfs/regular_file.go | 919 | if rw.file.inode.fs.mf.IsDiskBacked() { | CODE |
| CRITICAL | pkg/sentry/fsimpl/tmpfs/regular_file.go | 925 | fd, err := rw.file.inode.fs.mf.DataFD(fr) | CODE |
| CRITICAL | pkg/sentry/fsimpl/tmpfs/regular_file.go | 937 | ims, err := rw.file.inode.fs.mf.MapInternal(fr, hostarch.Write) | CODE |
| CRITICAL | pkg/sentry/fsimpl/cgroup2fs/memory.go | 138 | mc.m.c.fs.treeMu.RLock() | CODE |
| CRITICAL | pkg/sentry/fsimpl/cgroup2fs/memory.go | 140 | mc.m.c.fs.treeMu.RUnlock() | CODE |
| CRITICAL | pkg/sentry/kernel/task_acct.go | 215 | t.tg.pidns.owner.mu.RLock() | CODE |
| CRITICAL | pkg/sentry/kernel/task_acct.go | 216 | defer t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 303 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 304 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 314 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 315 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1085 | t.tg.pidns.owner.mu.RLock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1087 | t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1091 | t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1098 | t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1288 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1289 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1293 | t.tg.pidns.owner.mu.RLock() | CODE |
| CRITICAL⚡ | pkg/sentry/kernel/ptrace.go | 1294 | defer t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 127 | t.tg.pidns.owner.mu.RLock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 128 | defer t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 466 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 467 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 478 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 479 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 512 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 513 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 567 | t.tg.pidns.owner.mu.Lock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 568 | defer t.tg.pidns.owner.mu.Unlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 667 | t.tg.pidns.owner.mu.RLock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 668 | defer t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 690 | t.tg.pidns.owner.mu.RLock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 691 | defer t.tg.pidns.owner.mu.RUnlock() | CODE |
| CRITICAL | pkg/sentry/kernel/ptrace.go | 706 | t.tg.pidns.owner.mu.RLock() | CODE |
| 133 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/packetimpact/dut/dut.go | 137 | // Scanning log lines is not the most robust way, we could pass a file | COMMENT |
| MEDIUM | test/root/crictl_test.go | 420 | // - Creates directories and a socket for containerd to utilize. | COMMENT |
| MEDIUM | runsc/fsgofer/lisafs_test.go | 26 | // Note that these are not supposed to be extensive or robust tests. These unit | COMMENT |
| MEDIUM | runsc/cgroup/systemd.go | 215 | // generating the path of slice. Essentially, test-a-b.slice becomes | COMMENT |
| MEDIUM | runsc/container/metric_server_test.go | 285 | // TestContainerMetricsRobustAgainstRestarts that exporting metrics is robust against metric server | COMMENT |
| MEDIUM | runsc/container/container.go | 655 | // CPU stats can utilize host cgroups for accuracy. | COMMENT |
| MEDIUM | pkg/shim/v1/utils/volumes.go | 150 | // - (Essentially we set it to what the admission controller said.) | COMMENT |
| MEDIUM | pkg/sentry/vfs/mount_unsafe.go | 123 | // Essentially every mountTable will contain at least /proc, /sys, and | COMMENT |
| MEDIUM | pkg/sentry/fsimpl/overlay/filesystem.go | 1290 | // Essentially no gVisor filesystem supports RENAME_WHITEOUT, so just do a | COMMENT |
| MEDIUM | pkg/sentry/platform/kvm/machine_amd64.go | 242 | // capability, but it means that this method should be robust to | COMMENT |
| MEDIUM | pkg/sentry/time/parameters.go | 46 | // TODO(b/68779214): make error correction more robust to delayed | COMMENT |
| MEDIUM | pkg/sentry/control/state_cuda.go | 131 | // Option 1 is more robust, however, support for --get-state was only added | COMMENT |
| MEDIUM⚡ | pkg/sentry/kernel/task_futex.go | 53 | // GetRobustList sets the robust futex list for the task. | COMMENT |
| MEDIUM⚡ | pkg/sentry/kernel/task_futex.go | 61 | // SetRobustList sets the robust futex list for the task. | COMMENT |
| MEDIUM⚡ | pkg/sentry/kernel/task_futex.go | 68 | // exitRobustList walks the robust futex list, marking locks dead and notifying | COMMENT |
| MEDIUM | pkg/sentry/kernel/task_futex.go | 130 | // wakeRobustListOne wakes a single futex from the robust list. | COMMENT |
| MEDIUM | pkg/sentry/kernel/task.go | 628 | // robustList is a pointer to the head of the tasks's robust futex | COMMENT |
| MEDIUM⚡ | pkg/sentry/kernel/task_exit.go | 282 | // Handle the robust futex list. | COMMENT |
| MEDIUM | pkg/sentry/kernel/task_exec.go | 357 | // Handle the robust futex list. | COMMENT |
| MEDIUM | pkg/sentry/kernel/futex/futex.go | 647 | // FUTEX_OWNER_DIED is only set by the Linux when robust lists are in use (see | COMMENT |
| MEDIUM | pkg/sentry/kernel/futex/futex.go | 648 | // exit_robust_list()). Given we don't support robust lists, although handled | COMMENT |
| MEDIUM | pkg/sentry/socket/netfilter/netfilter.go | 139 | // Read in the struct and table name. IPv4 and IPv6 utilize structs | COMMENT |
| MEDIUM | pkg/bpf/optimizer.go | 457 | // (Essentially, we create a common "jump to return" doormat that everyone in | COMMENT |
| MEDIUM | pkg/tcpip/transport/tcp/snd.go | 1311 | // can leverage the SACK information to determine when an incoming ACK is a | COMMENT |
| MEDIUM | …cpip/network/internal/ip/generic_multicast_protocol.go | 79 | // Robustness Variable may be increased. MLD is robust to [Robustness | COMMENT |
| MEDIUM | …cpip/network/internal/ip/generic_multicast_protocol.go | 87 | // Variable may be increased. IGMP is robust to (Robustness Variable - | COMMENT |
| MEDIUM | pkg/tcpip/stack/iptables_types.go | 100 | // don't utilize iptables. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tools/go_branch.sh | 29 | # Create a temporary working directory, and ensure that this directory and all | COMMENT |
| MEDIUM | tools/make_apt.sh | 60 | # Create a directory for the release. | COMMENT |
| MEDIUM | tools/make_apt.sh | 64 | # Create a temporary keyring, and ensure it is cleaned up. | COMMENT |
| MEDIUM | test/rtnetlink/linux/rtnetlink_test.sh | 70 | # Create a sync pipe that will be closed when TCP_SRV creates a listen socket. | COMMENT |
| MEDIUM | test/rtnetlink/linux/route_test.sh | 20 | # Create a new default route and a new route with a address. | COMMENT |
| MEDIUM | test/rtnetlink/linux/setlink_test.sh | 20 | # Create a new veth pair in the current namespace and change the MTU. | COMMENT |
| MEDIUM | test/rtnetlink/linux/setlink_test.sh | 31 | # Create a new veth pair in the current namespace and rename the link. | COMMENT |
| MEDIUM | test/rtnetlink/linux/veth_test.sh | 20 | # Create a new veth pair in the current namespace. | COMMENT |
| MEDIUM | test/packetdrill/packetdrill_test.sh | 173 | # Create the DUT container and connect to network. | COMMENT |
| MEDIUM | test/packetdrill/packetdrill_test.sh | 191 | # Create the test runner container and connect to network. | COMMENT |
| MEDIUM | sandboxexec/sandbox/python/tests/sandbox_test.py | 62 | # Create the background sandbox (default network="none" works for | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | test/gpu/triton/triton.go | 0 | \n // ..the quick brown fox\n // ..jumps over\n // ....the lazy dog\n // . | STRING |
| HIGH | test/gpu/sglang/sglang.go | 0 | \n // ..the quick brown fox\n // ..jumps over\n // ....the lazy dog\n // . | STRING |
| HIGH | test/gpu/ollama/ollama.go | 0 | \n // ..the quick brown fox\n // ..jumps over\n // ....the lazy dog\n // . | STRING |
| HIGH | test/kubernetes/benchmarks/vllm.go | 0 | we assembled on the vast green lawn outside as the reactors began to slowly wind down. the workers were solemn; the acti | STRING |
| HIGH | test/kubernetes/benchmarks/sglang.go | 0 | we assembled on the vast green lawn outside as the reactors began to slowly wind down. the workers were solemn; the acti | STRING |
| HIGH | test/kubernetes/benchmarks/ollama.go | 0 | we assembled on the vast green lawn outside as the reactors began to slowly wind down. the workers were solemn; the acti | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | images/gpu/stable-diffusion-xl/generate_image.py | 187 | def get_optimal_terminal_width(): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 80 | def test_exec_invalid_command_or_args(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 101 | def test_non_root_networking_error(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 171 | def test_init_env_list_and_dict(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 199 | def test_init_env_overrides_path(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 213 | def test_init_env_malformed_raises_error(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 252 | def test_runtime_dir_ownership_and_cleanup(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 273 | def test_runtime_dir_creation_error(self, mock_mkdtemp): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 280 | def test_state_dir_creation_error(self, mock_makedirs): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 293 | def test_create_bundle_makedirs_error(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 307 | def test_sandbox_subprocess_timeout(self, mock_run): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 319 | def test_sandbox_subprocess_error(self, mock_run): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 330 | def test_invalid_networking_mode(self): # pylint: disable=unused-argument | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 339 | def test_invalid_networking_type(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 358 | def test_network_mode_enum_bundle( | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 374 | def test_network_sandbox_nonroot_raises_error( | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 383 | def test_network_mode_none_real_sandbox(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 395 | def test_network_mode_host_real_sandbox(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 407 | def test_find_runsc_not_found(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 421 | def test_custom_bind_mount_readonly(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 443 | def test_custom_bind_mount_readwrite(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 480 | def test_dict_mount_configuration(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 499 | def test_mount_validation_errors(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 545 | def test_container_default_working_dir(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 564 | def test_container_working_dir(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 576 | def test_container_working_dir_relative(self): | CODE |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 624 | def test_mount_factory_methods(self): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | sandboxexec/sandbox/python/gvisor/sandbox.py | 107 | Normalizes environment variables into a list of 'KEY=VALUE' strings. Args: env: A list of 'KEY=VALUE' strings or | STRING |
| HIGH | sandboxexec/sandbox/python/gvisor/sandbox.py | 148 | Normalizes and validates working directory into an absolute POSIX path. Relative paths are resolved and normalized re | STRING |
| HIGH | sandboxexec/sandbox/python/gvisor/sandbox.py | 181 | Normalizes and validates mount configurations into a list of Mount objects. Args: mounts: A sequence of Mount obj | STRING |
| HIGH | sandboxexec/sandbox/python/gvisor/sandbox.py | 566 | Runs the given command inside the running sandbox. Args: cmd: The command to run. *args: Arguments to t | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | runsc/fsgofer/lisafs.go | 599 | // Set the owners as requested by the client. | COMMENT |
| HIGH | pkg/sentry/mm/syscalls.go | 155 | // Get pmas and map as requested. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .claude/skills/add-syscall/SKILL.md | 140 | ### Step 1: Run the native test | COMMENT |
| LOW | .claude/skills/add-syscall/SKILL.md | 174 | ### Step 2: Build the gvisor implementation | COMMENT |
| LOW | .claude/skills/add-syscall/SKILL.md | 188 | ### Step 3: Run the gvisor (runsc) test | COMMENT |
| LOW | pkg/sentry/devices/nvproxy/README.md | 54 | ### Step 1: Place the New Version in the Tree | COMMENT |
| LOW | pkg/sentry/devices/nvproxy/README.md | 71 | ### Step 2: Calculate the Driver Checksum | COMMENT |
| LOW | pkg/sentry/devices/nvproxy/README.md | 81 | ### Step 3: Account for ABI Changes | COMMENT |
| LOW | pkg/sentry/devices/nvproxy/README.md | 137 | ### Step 4: Add Support for New or Modified Ioctls | COMMENT |
| LOW | pkg/tcpip/tcpip.go | 857 | // NOTE: This method is a no-op for sockets other than TCP. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/compatibility/wordpress/wordpress_test.go | 48 | adminEmail = "admin@example.com" | CODE |
| LOW | test/compatibility/gitea/gitea_test.go | 44 | adminEmail = "admin@example.com" | CODE |
| LOW | test/image/latin10k.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras ut placerat felis. Maecenas urna est, auctor a efficitur s | CODE |
| LOW | test/image/latin10k.txt | 1 | Lorem ipsum dolor sit amet, consectetur adipiscing elit. Cras ut placerat felis. Maecenas urna est, auctor a efficitur s | CODE |
| LOW | …e/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md | 407 | --env=OPENCLAW_GATEWAY_TOKEN="dummy-token-for-sandbox" \ | CODE |
| LOW | …e/blog/2026-04-15-magi-multi-agent-gvisor-isolation.md | 434 | You can now go to `http://127.0.0.1:18789/?token=dummy-token-for-sandbox` and | CODE |
| LOW | pkg/sentry/socket/netlink/netfilter/protocol.go | 1167 | m.PutAttrString(linux.NFTA_GEN_PROC_NAME, "placeholder") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/gen_compile_commands.py | 22 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/__init__.py | 17 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/__init__.py | 18 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/__init__.py | 19 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/__init__.py | 20 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/__init__.py | 21 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | pkg/tcpip/transport/tcp/sack_scoreboard.go | 233 | // We need to check if the immediate lower (if any) sacked | COMMENT |
| LOW | …/tcpip/network/internal/fragmentation/fragmentation.go | 241 | // Before releasing a fragment we need to check if r is already marked as done. | COMMENT |
| LOW | pkg/tcpip/stack/transport_demuxer.go | 439 | // If it was previously bound, we need to check if we can bind again. | COMMENT |
| LOW | pkg/tcpip/stack/transport_demuxer.go | 458 | // If it was previously bound, we need to check if we can bind again. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sandboxexec/sandbox/python/gvisor/sandbox.py | 103 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/sandbox.py | 178 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/sandbox.py | 289 | CODE | |
| LOW | sandboxexec/sandbox/python/gvisor/sandbox.py | 452 | CODE | |
| LOW | sandboxexec/sandbox/python/tests/sandbox_test.py | 118 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | sandboxexec/sandbox/python/gvisor/sandbox.py | 421 | except Exception: | CODE |
| MEDIUM | examples/sandboxexec/python/safe_runner.py | 159 | print(f"Error: {stderr}", file=sys.stderr) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tools/builkite-check-paths.sh | 17 | # Check if any changes are in specified paths. The script exits with 0 if no | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | examples/sandboxexec/python/safe_runner.py | 25 | CODE |