Add a set of formatting and spelling checks

.buildkite/pipeline.yaml

@@ -69,6 +69,14 @@ env:
   SYSCALL_TEST_FILTERS: ''
 
 steps:
+  # Source-level lint checks.
+  - <<: *common
+    <<: *source_test
+    label: ":lipstick: Lint"
+    command: make lint
+    agents:
+      queue: "default"
+
   # Run basic smoke tests before preceding to other tests.
   - <<: *common
     <<: *source_test

.clang-format

@@ -0,0 +1,16 @@
+# Copyright 2026 The gVisor Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# gVisor's C and C++ sources follow the Google C++ style guide.
+BasedOnStyle: Google

.github/workflows/lint.yml

@@ -0,0 +1,31 @@
+# Runs the source-level lint suite. See tools/lint.sh.
+name: Lint
+
+"on":
+  pull_request:
+    branches:
+      - master
+  push:
+    branches:
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+      with:
+        persist-credentials: false
+
+    - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      with:
+        go-version-file: 'go.mod'
+
+    - run: make lint

Makefile

@@ -906,6 +906,16 @@ tag: ## Creates and pushes a release tag.
 	@tools/tag_release.sh "$(RELEASE_COMMIT)" "$(RELEASE_NAME)" "$(RELEASE_NOTES)"
 .PHONY: tag
 
-codespell:
-	codespell
-.PHONY: codespell
+##
+## Lint targets.
+##
+##   These run the source-level linters that live outside the Bazel build.
+##   Deep Go analysis is owned by gVisor nogo.
+##
+lint: ## Runs the source linters.
+	@tools/lint.sh
+.PHONY: lint
+
+lint-fix: ## Reformats sources in place.
+	@tools/lint.sh --fix
+.PHONY: lint-fix

g3doc/user_guide/fuse.md

@@ -19,7 +19,7 @@ The external FUSE server feature allows a host-side process to serve a FUSE
 filesystem into a gVisor sandbox. The host process and the sandbox communicate
 over a Unix socketpair using the standard FUSE protocol. This approach avoids
 the performance penalty incurred by context switching through the I/O proxy
-mechansim that's otherwise used to expose host filesystems.
+mechanism that's otherwise used to expose host filesystems.
 
 ### How It Works
 

g3doc/user_guide/rootfs_snapshot.md

@@ -81,7 +81,7 @@ Enable the flag `allow-rootfs-tar-annotation` to runtimeArgs, e.g.
 
 Since the tar file path is provided via OCI spec's annotation, it is compatible
 with Docker client when the runtime is gVisor. You can pass the annotation via
-Docker commad and observe the file change as:
+Docker command and observe the file change as:
 
 ```
 $ docker run --rm --runtime=runsc --annotation "dev.gvisor.tar.rootfs.upper"="/tmp/rootfs.tar" alpine cat /dir/file

images/basic/integrationtest/link_test.c

@@ -65,7 +65,7 @@ int main(int argc, char** argv) {
          new_stat.st_nlink);
   }
 
-  // Check taht contents are the same.
+  // Check that contents are the same.
   fd = open(kNewPath, O_RDONLY);
   if (fd < 0) {
     errx(1, "open(%s) failed", kNewPath);

pkg/aio/aio.go

@@ -31,7 +31,7 @@ import (
 // Queues are not safe to use concurrently in multiple goroutines.
 type Queue interface {
 	// Destroy cancels all inflight operations and releases resources owned by
-	// the Queue. Destroy waits for cancelation, so the Queue will not access
+	// the Queue. Destroy waits for cancellation, so the Queue will not access
 	// memory corresponding to inflight operations after Destroy returns.
 	Destroy()
 

pkg/lisafs/client.go

@@ -140,7 +140,7 @@ func (c *Client) StartChannels() error {
 	}
 	channelsWg.Wait()
 
-	// Check that atleast 1 channel is created. This is not required by lisafs
+	// Check that at least 1 channel is created. This is not required by lisafs
 	// protocol. It exists to flag server side issues in channel creation.
 	c.channelsMu.Lock()
 	numChannels := len(c.channels)

pkg/sentry/devices/nvproxy/frontend.go

@@ -234,7 +234,7 @@ func (fd *frontendFD) Ioctl(ctx context.Context, uio usermem.IO, sysno uintptr,
 	}
 
 	// nr determines the argument type.
-	// Implementors:
+	// Implementers:
 	// - To map nr to a symbol, look in
 	// src/nvidia/arch/nvalloc/unix/include/nv_escape.h,
 	// kernel-open/common/inc/nv-ioctl-numbers.h, and
@@ -905,7 +905,7 @@ func rmControl(fi *frontendIoctlState) (uintptr, error) {
 		// Consequently, its parameters cannot reasonably contain pointers.
 		return rmControlSimple(fi, &ioctlParams)
 	}
-	// Implementors:
+	// Implementers:
 	// - Top two bytes of Cmd specifies class; third byte specifies category;
 	// fourth byte specifies "message ID" (command within class/category).
 	//   e.g. 0x800288:
@@ -1223,7 +1223,7 @@ func rmAlloc(fi *frontendIoctlState) (uintptr, error) {
 	if log.IsLogging(log.Debug) {
 		fi.ctx.Debugf("nvproxy: allocation class %v", ioctlParams.HClass)
 	}
-	// Implementors:
+	// Implementers:
 	// - To map hClass to a symbol, look in
 	// src/nvidia/generated/g_allclasses.h.
 	// - See src/nvidia/src/kernel/rmapi/resource_list.h for table mapping class

pkg/sentry/devices/nvproxy/nvconf/caps_test.go

@@ -21,7 +21,7 @@ import (
 
 // TestNVIDIAFlagsSkipsPrivilegedCaps is a regression test for the
 // container-startup bug seen when NVIDIA_DRIVER_CAPABILITIES=all is combined
-// with --nvproxy-allowed-driver-capabilities using priviledged capabilities.
+// with --nvproxy-allowed-driver-capabilities using privileged capabilities.
 //
 // In that configuration, NVProxyDriverCapsFromEnv returns the full allowed set,
 // which includes CapProfiling. nvproxySetup then calls NVIDIAFlags() on that set

pkg/sentry/devices/tundev/tundev.go

@@ -103,7 +103,7 @@ func (fd *tunFD) Ioctl(ctx context.Context, uio usermem.IO, sysno uintptr, args
 		flags, err := netstack.LinuxToTUNFlags(linuxFlags)
 		if err != nil {
 			if warnRateLimiter.Allow() {
-				ctx.Warningf("Unsuported tun flags: %x", linuxFlags)
+				ctx.Warningf("Unsupported tun flags: %x", linuxFlags)
 			}
 		}
 		return 0, fd.device.SetIff(ctx, stack.Stack, req.Name(), flags)

pkg/sentry/fdimport/fdimport.go

@@ -97,7 +97,7 @@ func Import(ctx context.Context, fdTable *kernel.FDTable, fds map[int]*fd.FD, op
 				// FDs.
 				ttyFile = appFile
 			} else {
-				// Re-use the existing TTY file, as all three stdio FDs must point to
+				// Reuse the existing TTY file, as all three stdio FDs must point to
 				// the same fs.File in order to share TTY state, specifically the
 				// foreground process group id.
 				appFile = ttyFile

pkg/sentry/fsimpl/gofer/directfs_inode.go

@@ -138,7 +138,7 @@ func (fs *filesystem) newDirectfsDentry(controlFD int) (*dentry, error) {
 	// and its inode together in the heap. This will help reduce allocations and memory
 	// fragmentation. This is more cache friendly too.
 	// Obviously in case of hard link and if the inode already exists,
-	// we just re-use the inode and heap allocate just the dentry struct.
+	// we just reuse the inode and heap allocate just the dentry struct.
 	temp := struct {
 		d dentry
 		i directfsInode

pkg/sentry/fsimpl/gofer/lisafs_inode.go

@@ -120,7 +120,7 @@ func (fs *filesystem) newLisafsDentry(ctx context.Context, ino *lisafs.Inode) (*
 	// and its inode together in the heap. This will help reduce allocations and memory
 	// fragmentation. This is more cache friendly too.
 	// Obviously in case of hard link and if the inode already exists,
-	// we just re-use the inode and heap allocate just the dentry struct.
+	// we just reuse the inode and heap allocate just the dentry struct.
 	temp := struct {
 		d dentry
 		i lisafsInode

pkg/sentry/fsimpl/sys/rdma.go

@@ -338,7 +338,7 @@ func (fs *filesystem) addPorts(ib *rdmaDirTree, dev *rdma.Device) {
 // /sys/class/pci_bus symlink. NCCL resolves GPU and NIC positions via
 // "/sys/class/pci_bus/<bus>/../../<bdf>".
 //
-// Precondtion: rdma.IsBDF(path.Base(leaf)) == true
+// Precondition: rdma.IsBDF(path.Base(leaf)) == true
 func (fs *filesystem) addPCIBus(root *rdmaDirTree, leaf string, classPCIBus map[string]string) {
 	base := path.Base(leaf)
 	i := strings.LastIndex(base, ":")

pkg/sentry/kernel/task_start.go

@@ -321,7 +321,7 @@ func (ts *TaskSet) newTask(ctx context.Context, cfg *TaskConfig) (*Task, error)
 	// current->signal->tty, which differs from the parent's under
 	// CLONE_PARENT.
 	if srcT != nil {
-		inhTTY = srcT.tg.GetTTY() // Takes a ref, balanced in defer, or transfered to tg.tty.
+		inhTTY = srcT.tg.GetTTY() // Takes a ref, balanced in defer, or transferred to tg.tty.
 	}
 
 	// For the standard, non-cloneIntoCgroup fork case, we have to do this

pkg/sentry/memmap/memmap.go

@@ -264,7 +264,7 @@ type MappingIdentity interface {
 	// int64(mr.Start), int64(mr.End-1), fs.SyncData).
 	// (fs.FileOperations.Fsync() takes an inclusive end, but mr.End is
 	// exclusive, hence mr.End-1.) It is defined rather than Fsync so that
-	// implementors don't need to depend on the fs package for fs.SyncType.
+	// implementers don't need to depend on the fs package for fs.SyncType.
 	Msync(ctx context.Context, mr MappableRange) error
 }
 
@@ -454,7 +454,7 @@ type File interface {
 	//	* fr.Length() > 0.
 	//	* At least one reference must be held on all pages in fr. (The File
 	//		interface does not provide a way to acquire an initial reference;
-	//		implementors may define mechanisms for doing so.)
+	//		implementers may define mechanisms for doing so.)
 	IncRef(fr FileRange, memCgID uint32)
 
 	// DecRef decrements the reference count on all pages in fr.

pkg/sentry/platform/kvm/bluepill_amd64.go

@@ -122,7 +122,7 @@ func (c *vCPU) KernelSyscall() {
 	// 3. HLT does a VM-exit to bluepillHandler, which returns from the
 	// signal handler using vCPU.registers, directly to the SYSCALL
 	// instruction.
-	// 4. Later, when we want to re-use the vCPU (perhaps on a different
+	// 4. Later, when we want to reuse the vCPU (perhaps on a different
 	// host thread), we set the new thread's registers in vCPU.registers
 	// (as opposed to setting the KVM registers with KVM_SET_REGS).
 	// 5. KVM_RUN thus enters the guest with the old register state,

pkg/sentry/platform/kvm/physical_map_arm64.go

@@ -16,7 +16,7 @@ package kvm
 
 const (
 	reservedMemory = 0
-	// 5-level page tables are not implemeted on arm64.
+	// 5-level page tables are not implemented on arm64.
 	extendedAddressSpaceAllowed = false
 )
 

pkg/sentry/platform/platform.go

@@ -404,7 +404,7 @@ type AddressSpace interface {
 // AddressSpaceIO supports IO through the memory mappings installed in an
 // AddressSpace.
 //
-// AddressSpaceIO implementors are responsible for ensuring that address ranges
+// AddressSpaceIO implementers are responsible for ensuring that address ranges
 // are application-mappable.
 type AddressSpaceIO interface {
 	// CopyOut copies len(src) bytes from src to the memory mapped at addr. It

pkg/sentry/platform/slimvm/machine.go

@@ -150,7 +150,7 @@ type vCPU struct {
 // newVCPU creates and returns a new vCPU. It returns nil when the per-machine
 // vCPU limit (m.maxVCPUs) is exhausted.
 //
-// Precondtion: mu must be held.
+// Precondition: mu must be held.
 func (m *machine) newVCPU() *vCPU {
 	id, ok := m.allocateVCPUID()
 	if !ok {
@@ -443,7 +443,7 @@ func (c *vCPU) unlock() {
 		// when next time this vCPU enter guest ring3, bit of vCPUWaiter
 		// may not be cleard, this will cause the following BounceToKernel
 		// to this vCPU hang at waitUntilNot.
-		// Halt may workaroud this issue, because halt process will reset
+		// Halt may workaround this issue, because halt process will reset
 		// vCPU status into vCPUUser, and notify all waiter for vCPU state
 		// change, but if there is no exception or syscall in this period,
 		// BounceToKernel will hang at waitUntilNot.

pkg/sentry/platform/slimvm/machine_amd64.go

@@ -254,7 +254,7 @@ func (c *vCPU) SwitchToUser(switchOpts ring0.SwitchOpts, info *linux.SignalInfo)
 	// to produce vCPU bounce stalls.
 	switchOpts.PageTables.PrefaultRootTable()
 
-	// Enable CPUID Faulting featue if the CPU supported.
+	// Enable CPUID Faulting feature if the CPU supported.
 	if c.cpuidFaultingEnable == 0 {
 		ring0.SetCPUIDFaulting(true)
 		c.cpuidFaultingEnable = 1

pkg/sentry/platform/systrap/subprocess.go

@@ -338,7 +338,7 @@ func (s *subprocess) handlePtraceSyscallRequest(req any) {
 // The create function will be called in the latter case, which is guaranteed
 // to happen with the runtime thread locked.
 //
-// seccompNotify indicates a ways of comunications with syscall threads.
+// seccompNotify indicates a ways of communications with syscall threads.
 // If it is false, futex-s are used. Otherwise, seccomp-unotify is used.
 // seccomp-unotify can't be used for the source pool process, because it is a
 // parent of all other stub processes, but only one filter can be installed

pkg/sentry/platform/systrap/sysmsg/sighandler_arm64.c

@@ -51,7 +51,8 @@ long __syscall(long n, long a1, long a2, long a3, long a4, long a5, long a6) {
   register long x5 __asm__("x5") = a6;
   __asm__ __volatile__("svc #0"
                        : "=r"(x0)
-                       : "r"(x8), "0"(x0), "r"(x1), "r"(x2), "r"(x3), "r"(x4), "r"(x5)
+                       : "r"(x8), "0"(x0), "r"(x1), "r"(x2), "r"(x3), "r"(x4),
+                         "r"(x5)
                        : "memory", "cc");
   return x0;
 }
@@ -75,7 +76,7 @@ long sys_futex(uint32_t *addr, int op, int val, struct __kernel_timespec *tv,
 static void gregs_to_ptregs(ucontext_t *ucontext,
                             struct user_regs_struct *ptregs) {
   // Set all registers.
-  for (int i = 0; i < 31; i++ ) {
+  for (int i = 0; i < 31; i++) {
     ptregs->regs[i] = ucontext->uc_mcontext.regs[i];
   }
   ptregs->sp = ucontext->uc_mcontext.sp;
@@ -85,7 +86,7 @@ static void gregs_to_ptregs(ucontext_t *ucontext,
 
 static void ptregs_to_gregs(ucontext_t *ucontext,
                             struct user_regs_struct *ptregs) {
-  for (int i = 0; i < 31; i++ ) {
+  for (int i = 0; i < 31; i++) {
     ucontext->uc_mcontext.regs[i] = ptregs->regs[i];
   }
   ucontext->uc_mcontext.sp = ptregs->sp;

pkg/sentry/seccheck/sinks/remote/server/server.go

@@ -64,7 +64,7 @@ func (c client) close() {
 }
 
 // CommonServer provides common functionality to connect and process messages
-// from different clients. Implementors decide how clients and messages are
+// from different clients. Implementers decide how clients and messages are
 // handled, e.g. counting messages for testing.
 type CommonServer struct {
 	// Endpoint is the path to the socket that the server listens to.

pkg/sentry/state/stateio/stateio_impl_util.go

@@ -18,7 +18,7 @@ import (
 	"golang.org/x/sys/unix"
 )
 
-// This file contains utilities for implementors of AsyncReader and
+// This file contains utilities for implementers of AsyncReader and
 // AsyncWriter.
 
 // NoRegisterClientFD implements AsyncReader.NeedRegisterDestinationFD,

pkg/sentry/vfs/mount.go

@@ -1744,7 +1744,7 @@ func (vfs *VirtualFilesystem) GenerateProcMountInfo(ctx context.Context, taskRoo
 			continue
 		}
 		if mp := vfs.getMountPromise(mntRootVD); mp != nil && !mp.resolved.Load() {
-			// If the caller is reponsible for resolving the mount promise,
+			// If the caller is responsible for resolving the mount promise,
 			// blocking below in StatAt will result in deadlock. Some
 			// applications expect mount promises to appear in /proc/mountinfo
 			// (b/388102869), so generate fake information to avoid this.

pkg/tcpip/header/ipv4.go

@@ -170,7 +170,7 @@ var (
 	// https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml.
 	IPv4AllSystems = tcpip.AddrFrom4([4]byte{0xe0, 0x00, 0x00, 0x01})
 
-	// IPv4Broadcast is the broadcast address of the IPv4 procotol.
+	// IPv4Broadcast is the broadcast address of the IPv4 protocol.
 	IPv4Broadcast = tcpip.AddrFrom4([4]byte{0xff, 0xff, 0xff, 0xff})
 
 	// IPv4Any is the non-routable IPv4 "any" meta address.

pkg/tcpip/header/ndp_test.go

@@ -1630,7 +1630,7 @@ func TestNDPOptionsIterCheck(t *testing.T) {
 // TestNDPOptionsIter tests that we can iterator over a valid NDPOptions. Note,
 // this test does not actually check any of the option's getters, it simply
 // checks the option Type and Body. We have other tests that tests the option
-// field gettings given an option body and don't need to duplicate those tests
+// field getters given an option body and don't need to duplicate those tests
 // here.
 func TestNDPOptionsIter(t *testing.T) {
 	buf := []byte{

pkg/tcpip/link/sharedmem/pipe/tx.go

@@ -51,7 +51,7 @@ func (t *Tx) Capacity(recordSize uint64) uint64 {
 }
 
 // Push reserves "payloadSize" bytes for transmission in the pipe. The caller
-// populates the returned slice with the data to be transferred and enventually
+// populates the returned slice with the data to be transferred and eventually
 // calls Flush() to make the data visible to the reader, or Abort() to make the
 // pipe forget all Push() calls since the last Flush().
 //

pkg/tcpip/network/internal/fragmentation/reassembler.go

@@ -141,7 +141,7 @@ func (r *reassembler) process(first, last uint16, more bool, proto uint8, pkt *s
 				return nil, 0, false, 0, ErrFragmentOverlap
 			}
 			// Incoming fragment is a duplicate.
-			// Not dropping packet incase of duplicates.
+			// Not dropping packet in case of duplicates.
 			continue
 		}