Re this item in the FAQ:

I can’t see a file copied with docker cp.

For performance reasons, gVisor caches directory contents, and therefore it may not realize a new file was copied to a given directory. To invalidate the cache and force a refresh, create a file under the directory in question and list the contents again.

DirentOperations (akin to dentry_operations in Linux; embedded in MountOperations, which are about to be renamed MountSourceOperations, and are akin to super_operations) currently have Revalidate and Keep methods.

In Linux, revalidation will stat the inode to see if anything has changed. If it has, it re-walks to that node.

In gVisor, revalidation always returns false for host files, so the sandbox will notice the new file either when it falls out of the Dirent cache or when you readdir the containing directory. For Gofer files, revalidation is controlled by whether Dirents are cached or not, which should also not be the case.

We should be following Linux more closely here, which would also resolve the above problem. For Gofers, we should provide a configuration option to say "don't revalidate" that one can use as a performance optimization if they know only gVisor has access to that mount and nothing else can add/change/remove files.