Open source

Most of these started as a production incident on our clusters. When the root cause is in someone else's code, the fix goes upstream. 5 merged so far, thanks to the maintainers who reviewed and landed them.

• google/gvisor#15182in review

  systrap: keep waiting on a stuck context instead of killing it

  1 Oct 2026Follow-up to #14201 after @ayushr2 reported false kills on slow host page faultsThe story: One lost signal, five days stuck, 45,000 frozen threads: fixing a gVisor hang upstream

• google/gvisor#14549merged

  shim: bound runsc calls with a 30s deadline

  24 Sept 2026merged by Copybara (Google)The story: One lost signal, five days stuck, 45,000 frozen threads: fixing a gVisor hang upstream

• google/gvisor#14201merged

  systrap: fail-stop on a stuck context

  31 Aug 2026merged by Copybara (Google)The story: One lost signal, five days stuck, 45,000 frozen threads: fixing a gVisor hang upstream

• containerd/containerd#13799reverted

  metadata: bound snapshotter Remove during garbage collection

  24 Aug 2026merged by @mikebrowReverted before release in favour of a proxy-level timeoutThe story: containerd part 2: 17 lines, 40 days, 30 reviews

• containerd/containerd#14187in review

  snapshots/proxy: optional default_timeout for proxy snapshotter calls

  17 Sept 2026The story: containerd part 3: the fix got reverted

• awslabs/soci-snapshotter#2043merged

  fs/reader: fix spancache fd leak in file Verify

  20 Jul 2026merged by @sondavidbThe story: A node that reported Ready and started nothing: four parts, one containerd fix

• google/gvisor#11563merged

  docs: inotify behaviour with shared volumes

  24 Mar 2025merged by Copybara (Google)

• kubernetes-sigs/security-profiles-operator#1994merged

  Handle AppArmorProfile owners in node status

  4 Dec 2023merged by k8s-ci-robotThe story: My first open source PR was 3 lines

Everything else is on GitHub.