# Linkerd with gvisor runtime class
**URL:** https://linkerd.buoyant.io/t/linkerd-with-gvisor-runtime-class/855
**Category:** Linkerd General Discussion
**Tags:** proxy
**Created:** [May 6, 2026, 3:51pm UTC](https://linkerd.buoyant.io/t/linkerd-with-gvisor-runtime-class/855 "2026-05-06T15:51:55Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@ryant](https://linkerd.buoyant.io/u/ryant)
#### Post date: [May 6, 2026, 3:51pm UTC](https://linkerd.buoyant.io/t/linkerd-with-gvisor-runtime-class/855/1 "2026-05-06T15:51:55Z")
Hoping someone can help here. I’m currently running agent-sandbox([https://agent-sandbox.sigs.k8s.io/](https://agent-sandbox.sigs.k8s.io/)) for a template pod with a gvisor runtime class.
Initially I tried just a normal linkerd-init, but because CAP\_NET\_ADMIN is not available under gvisor, the ip tables route couldn’t be reconfigured.
I tried using linkerd CNI hoping that will bypass CAP\_NET\_ADMIN permissions but now I get the following error from the network validator init container
```auto
{"timestamp":"2026-05-06T15:27:45.109272Z","level":"INFO","fields":{"message":"Listening for connections on 0.0.0.0:4140"},"target":"linkerd_network_validator"}
{"timestamp":"2026-05-06T15:27:45.109381Z","level":"DEBUG","fields":{"token":"\"PaBNKvGoEXM98AAkKczvEvWZdS5Xkb81jvh3wdXh20LSTdBvDf1u4b4QFqBNJA9\\n\""},"target":"linkerd_network_validator"}
{"timestamp":"2026-05-06T15:27:45.109410Z","level":"INFO","fields":{"message":"Connecting to 1.1.1.1:20001"},"target":"linkerd_network_validator"}
{"timestamp":"2026-05-06T15:27:55.110599Z","level":"ERROR","fields":{"message":"Failed to validate networking configuration. Please ensure traffic redirection rules are rewriting traffic as expected.","timeout":"10s"},"target":"linkerd_network_validator"}
```
Hoping I can get some help here
---
### Author:  [@ryant](https://linkerd.buoyant.io/u/ryant)
#### Post date: [May 6, 2026, 7:26pm UTC](https://linkerd.buoyant.io/t/linkerd-with-gvisor-runtime-class/855/2 "2026-05-06T19:26:13Z")
I’ve tried setting the CNI to iptable-legacy and installed the binary into my node but still no dice and got the same issue here.
---
### Author:  [@Flynn](https://linkerd.buoyant.io/u/Flynn)
#### Post date: [May 15, 2026, 2:49pm UTC](https://linkerd.buoyant.io/t/linkerd-with-gvisor-runtime-class/855/3 "2026-05-15T14:49:17Z")
Hey @ryant, sorry for the delay here! I’ll be trying to reproduce this in hopes of getting to some answers shortly.
---
### Author:  [@Flynn](https://linkerd.buoyant.io/u/Flynn)
#### Post date: [August 31, 2026, 3:55pm UTC](https://linkerd.buoyant.io/t/linkerd-with-gvisor-runtime-class/855/4 "2026-08-31T15:55:19Z")
Sorry for the delay getting back to you here! I was indeed able to reproduce it, and the Linkerd maintainers took a look at it, and… I’m honestly not sure there’s a great answer here. From what I see, gVisor’s main purpose is locking down the kind of network functionality that service meshes need (in fact, even Google’s Cloud Service Mesh doesn’t fully support gVisor). I’d like a happier answer here, but it doesn’t look like there is one. 😐