gVisor runsc install process is changing backwards-incompatibly

[Etienne Perot]

gVisor's install procedure is changing in a backwards-incompatible way.

tl;dr: gVisor has historically been released as a single, monolithic `runsc` binary which bundles any additional files into the binary itself. This is changing to a multi-file release. Existing gVisor setup automation must be updated by end of August 2026.

Updated instructions: gvisor.dev/docs/user_guide/install

Or point your agents to: https://raw.githubusercontent.com/google/gvisor/refs/heads/master/g3doc/user_guide/install.md

What you need to do, depending on how you install gVisor today:

• Debian APT repository:
  No need to do anything.

• Compiled from source:
  Follow updated instructions in README.md.

• Direct `runsc` download from `storage.googleapis.com`:
  Consider switching to the Debian package instead, as it is more future-proof.

If you cannot use the Debian package:

• If you call `runsc install` (as per the installation instructions), this subcommand has been updated to download any missing companion files from the Internet. We may drop this auto-download functionality at the end of September 2026. You are responsible for updating your gVisor setup procedure before then.
  This auto-download functionality requires:

• Network access to `storage.googleapis.com`.

• Write access to the parent directory of `runsc` at `runsc install` time.

• Either `curl` or `wget`, due to technical limitations preventing linkage of `net/http` within `runsc` (one of the things having separate binaries will fix).

• If you do not call `runsc install`, you need to act now to separately download the new files. We will stop bundling them into the `runsc` binary at the end of August 2026.

Background and rationale if curious: gvisor.dev/issues/13718

Cheers

[Etienne Perot]

As a reminder, this change is happening next week.

• `runsc` will not be able to start sandboxes if sidecar binaries are not present.
• `runsc` will no longer be downloadable from /gvisor/releases/release/latest

You should either use the Debian package, or the release tarball. See https://gvisor.dev/docs/user_guide/install

As a short-term migration option, `runsc install` can also be used to auto-download any missing binaries, and `runsc` has a soon-to-disappear flag `--sidecar-usage-policy=LEGACY_DEPRECATED_SLOW_EMBEDDED_FALLBACK` to continue using the legacy codepaths (and, like the name implies, has slower startup performance). This flag will stop working next month and is only intended as a quick fix.