diff --git a/go.mod b/go.mod
index 0ed16813..c2c6eb31 100644
--- a/go.mod
+++ b/go.mod
@@ -29,7 +29,7 @@ require (
 	golang.zx2c4.com/wireguard v0.0.0-20231211153847-12269c276173
 	google.golang.org/grpc v1.72.0
 	google.golang.org/protobuf v1.36.6
-	gvisor.dev/gvisor v0.0.0-20240320123526-dc6abceb7ff0
+	gvisor.dev/gvisor v0.0.0-20250428193742-2d800c3129d5
 	h12.io/socks v1.0.3
 	lukechampine.com/blake3 v1.4.0
 )
diff --git a/go.sum b/go.sum
index b19c7dbd..ccc00031 100644
--- a/go.sum
+++ b/go.sum
@@ -156,8 +156,8 @@ gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C
 gopkg.in/yaml.v3 v3.0.0-20200605160147-a5ece683394c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gvisor.dev/gvisor v0.0.0-20240320123526-dc6abceb7ff0 h1:P+U/06iIKPQ3DLcg+zBfSCia1luZ2msPZrJ8jYDFPs0=
-gvisor.dev/gvisor v0.0.0-20240320123526-dc6abceb7ff0/go.mod h1:NQHVAzMwvZ+Qe3ElSiHmq9RUm1MdNHpUZ52fiEqvn+0=
+gvisor.dev/gvisor v0.0.0-20250428193742-2d800c3129d5 h1:sfK5nHuG7lRFZ2FdTT3RimOqWBg8IrVm+/Vko1FVOsk=
+gvisor.dev/gvisor v0.0.0-20250428193742-2d800c3129d5/go.mod h1:3r5CMtNQMKIvBlrmM9xWUNamjKBYPOWyXOjmg5Kts3g=
 h12.io/socks v1.0.3 h1:Ka3qaQewws4j4/eDQnOdpr4wXsC//dXtWvftlIcCQUo=
 h12.io/socks v1.0.3/go.mod h1:AIhxy1jOId/XCz9BO+EIgNL2rQiPTBNnOfnVnQ+3Eck=
 lukechampine.com/blake3 v1.4.0 h1:xDbKOZCVbnZsfzM6mHSYcGRHZ3YrLDzqz8XnV4uaD5w=
diff --git a/transport/internet/sockopt_linux.go b/transport/internet/sockopt_linux.go
index aa24cceb..be2a0e46 100644
--- a/transport/internet/sockopt_linux.go
+++ b/transport/internet/sockopt_linux.go
@@ -112,7 +112,7 @@ func applyOutboundSocketOptions(network string, address string, fd uintptr, conf
 
 	if len(config.CustomSockopt) > 0 {
 		for _, custom := range config.CustomSockopt {
-			if custom.System != "" && custom.System != runtime.GOOS{
+			if custom.System != "" && custom.System != runtime.GOOS {
 				errors.LogDebug(context.Background(), "CustomSockopt system not match: ", "want ", custom.System, " got ", runtime.GOOS)
 				continue
 			}
@@ -120,7 +120,7 @@ func applyOutboundSocketOptions(network string, address string, fd uintptr, conf
 			// network might be tcp4 or tcp6
 			// use HasPrefix so that "tcp" can match tcp4/6 with "tcp" if user want to control all tcp (udp is also the same)
 			// if it is empty, strings.HasPrefix will always return true to make it apply for all networks
-			if !strings.HasPrefix(network, custom.Network){
+			if !strings.HasPrefix(network, custom.Network) {
 				continue
 			}
 			var level = 0x6 // default TCP
@@ -218,7 +218,7 @@ func applyInboundSocketOptions(network string, fd uintptr, config *SocketConfig)
 		}
 		if len(config.CustomSockopt) > 0 {
 			for _, custom := range config.CustomSockopt {
-				if custom.System != "" && custom.System != runtime.GOOS{
+				if custom.System != "" && custom.System != runtime.GOOS {
 					errors.LogDebug(context.Background(), "CustomSockopt system not match: ", "want ", custom.System, " got ", runtime.GOOS)
 					continue
 				}
@@ -226,7 +226,7 @@ func applyInboundSocketOptions(network string, fd uintptr, config *SocketConfig)
 				// network might be tcp4 or tcp6
 				// use HasPrefix so that "tcp" can match tcp4/6 with "tcp" if user want to control all tcp (udp is also the same)
 				// if it is empty, strings.HasPrefix will always return true to make it apply for all networks
-				if !strings.HasPrefix(network, custom.Network){
+				if !strings.HasPrefix(network, custom.Network) {
 					continue
 				}
 				var level = 0x6 // default TCP