diff --git a/go.mod b/go.mod
index acfd2b7158..e5295a5372 100644
--- a/go.mod
+++ b/go.mod
@@ -18,6 +18,7 @@ require (
 	github.com/coredns/coredns v1.3.0
 	github.com/coreos/go-iptables v0.6.0
 	github.com/creack/pty v1.1.18
+	github.com/docker/go-units v0.5.0
 	github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96
 	github.com/eggsampler/acme/v3 v3.6.2
 	github.com/fernet/fernet-go v0.0.0-20180830025343-9eac43b88a5e
@@ -106,7 +107,7 @@ require (
 	k8s.io/klog/v2 v2.90.1
 	moul.io/http2curl/v2 v2.3.0
 	yunion.io/x/cloudmux v0.3.10-0-alpha.1.0.20260311083217-665f2742c60f
-	yunion.io/x/executor v0.0.0-20250518005516-5402e9e0bed0
+	yunion.io/x/executor v0.0.0-20260312022053-f538abd2b005
 	yunion.io/x/jsonutils v1.0.1-0.20250507052344-1abcf4f443b1
 	yunion.io/x/log v1.0.1-0.20240305175729-7cf2d6cd5a91
 	yunion.io/x/ovsdb v0.0.0-20230306173834-f164f413a900
@@ -212,7 +213,6 @@ require (
 	github.com/dimchansky/utfbom v1.1.0 // indirect
 	github.com/dnstap/golang-dnstap v0.0.0-20170829151710-2cf77a2b5e11 // indirect
 	github.com/docker/go-events v0.0.0-20250114142523-c867878c5e32 // indirect
-	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.0 // indirect
 	github.com/eapache/go-resiliency v1.1.0 // indirect
 	github.com/eapache/go-xerial-snappy v0.0.0-20180814174437-776d5712da21 // indirect
diff --git a/go.sum b/go.sum
index 2e426846da..286a48c737 100644
--- a/go.sum
+++ b/go.sum
@@ -1742,8 +1742,8 @@ sigs.k8s.io/yaml v1.3.0 h1:a2VclLzOGrwOHDiV8EfBGhvjHvP46CtW5j6POvhYGGo=
 sigs.k8s.io/yaml v1.3.0/go.mod h1:GeOyir5tyXNByN85N/dRIT9es5UQNerPYEKK56eTBm8=
 yunion.io/x/cloudmux v0.3.10-0-alpha.1.0.20260311083217-665f2742c60f h1:lT3OJ9LghFlaM9am3oRjMUJTvMSJCDk3jg4wIbGndi8=
 yunion.io/x/cloudmux v0.3.10-0-alpha.1.0.20260311083217-665f2742c60f/go.mod h1:aWRX5Phwz3nbHUNnIAm1oVogjguXPYDDgCOy/9Hnnvk=
-yunion.io/x/executor v0.0.0-20250518005516-5402e9e0bed0 h1:msG4SiDSVU7CrXH06WuHlNEZXIooTcmNbfrIGHuIHBU=
-yunion.io/x/executor v0.0.0-20250518005516-5402e9e0bed0/go.mod h1:Uxuou9WQIeJXNpy7t2fPLL0BYLvLiMvGQwY7Qc6aSws=
+yunion.io/x/executor v0.0.0-20260312022053-f538abd2b005 h1:3sWwcjGXGjG9mLBWa7AyLq+QSi0udTAx21pfVQRFMBE=
+yunion.io/x/executor v0.0.0-20260312022053-f538abd2b005/go.mod h1:Uxuou9WQIeJXNpy7t2fPLL0BYLvLiMvGQwY7Qc6aSws=
 yunion.io/x/jsonutils v0.0.0-20190625054549-a964e1e8a051/go.mod h1:4N0/RVzsYL3kH3WE/H1BjUQdFiWu50JGCFQuuy+Z634=
 yunion.io/x/jsonutils v1.0.1-0.20250507052344-1abcf4f443b1 h1:/+THlvf/MvgCW+7KeCDCr33e81KSRa5JmdZ1IIyLOXQ=
 yunion.io/x/jsonutils v1.0.1-0.20250507052344-1abcf4f443b1/go.mod h1:VK4Z93dgiKgAijcSqbMKmGaBMJuHulR16Hz4K015ZPo=
diff --git a/pkg/compute/tasks/container/container_delete_task.go b/pkg/compute/tasks/container/container_delete_task.go
index 83882ab50f..9776ee4e49 100644
--- a/pkg/compute/tasks/container/container_delete_task.go
+++ b/pkg/compute/tasks/container/container_delete_task.go
@@ -55,6 +55,11 @@ func (t *ContainerDeleteTask) OnStopped(ctx context.Context, container *models.S
 }
 
 func (t *ContainerDeleteTask) OnStoppedFailed(ctx context.Context, container *models.SContainer, reason jsonutils.JSONObject) {
+	if strings.Contains(reason.String(), "NotFoundError") {
+		// container not found, ignore the error
+		t.OnStopped(ctx, container, nil)
+		return
+	}
 	t.SetStageFailed(ctx, reason)
 }
 
diff --git a/pkg/compute/tasks/container/container_stop_task.go b/pkg/compute/tasks/container/container_stop_task.go
index 27a22c3593..e9aa090da3 100644
--- a/pkg/compute/tasks/container/container_stop_task.go
+++ b/pkg/compute/tasks/container/container_stop_task.go
@@ -36,6 +36,7 @@ func init() {
 func (t *ContainerStopTask) OnInit(ctx context.Context, obj db.IStandaloneModel, body jsonutils.JSONObject) {
 	t.requestStop(ctx, obj.(*models.SContainer))
 }
+
 func (t *ContainerStopTask) requestStop(ctx context.Context, container *models.SContainer) {
 	t.SetStage("OnStopped", nil)
 	if err := t.GetPodDriver().RequestStopContainer(ctx, t.GetUserCred(), t); err != nil {
@@ -57,6 +58,7 @@ func (t *ContainerStopTask) OnStopped(ctx context.Context, container *models.SCo
 func (t *ContainerStopTask) OnSyncStatus(ctx context.Context, container *models.SContainer, data jsonutils.JSONObject) {
 	t.SetStageComplete(ctx, nil)
 }
+
 func (t *ContainerStopTask) OnSyncStatusFailed(ctx context.Context, container *models.SContainer, reason jsonutils.JSONObject) {
 	t.SetStageFailed(ctx, reason)
 }
diff --git a/pkg/hostman/guestman/portmapping.go b/pkg/hostman/guestman/portmapping.go
index d223f64075..5b61713d43 100644
--- a/pkg/hostman/guestman/portmapping.go
+++ b/pkg/hostman/guestman/portmapping.go
@@ -245,9 +245,9 @@ func (m *portMappingManager) allocateProtocolGroupWithRule(gst GuestRuntimeInsta
 		}
 	}
 
-	// 确定端口范围
-	start := compute.GUEST_PORT_MAPPING_RANGE_START
-	end := compute.GUEST_PORT_MAPPING_RANGE_END
+	// 确定端口范围（从 hostman options 读取）
+	start := options.HostOptions.PortMappingRangeStart
+	end := options.HostOptions.PortMappingRangeEnd
 
 	// 尝试不同的 basePort，直到找到满足所有规则要求的端口
 	success := false
@@ -295,8 +295,8 @@ func (m *portMappingManager) canAllocateWithBasePort(basePort int, input compute
 		offset := *pm.Rule.FirstPortOffset
 		targetPort := basePort + offset
 
-		// 检查目标端口是否在范围内
-		if targetPort > compute.GUEST_PORT_MAPPING_RANGE_END {
+		// 检查目标端口是否在配置的范围内
+		if targetPort > options.HostOptions.PortMappingRangeEnd {
 			return false
 		}
 
@@ -388,11 +388,15 @@ func (m *portMappingManager) allocatePortMapping(gst GuestRuntimeInstance, pm *c
 		}
 		return runtimePm, nil
 	} else {
-		start := compute.GUEST_PORT_MAPPING_RANGE_START
-		end := compute.GUEST_PORT_MAPPING_RANGE_END
+		start := options.HostOptions.PortMappingRangeStart
+		end := options.HostOptions.PortMappingRangeEnd
 		if pm.HostPortRange != nil {
-			start = pm.HostPortRange.Start
-			end = pm.HostPortRange.End
+			if pm.HostPortRange.Start > start {
+				start = pm.HostPortRange.Start
+			}
+			if pm.HostPortRange.End < end {
+				end = pm.HostPortRange.End
+			}
 		}
 		otherPodPorts, ok := otherPorts[pm.Protocol]
 		if !ok {
diff --git a/pkg/hostman/hostinfo/hostinfo.go b/pkg/hostman/hostinfo/hostinfo.go
index 4e48d7f812..ce05e18b1a 100644
--- a/pkg/hostman/hostinfo/hostinfo.go
+++ b/pkg/hostman/hostinfo/hostinfo.go
@@ -2279,15 +2279,17 @@ func (h *SHostInfo) getNicsInterfaces(nics []string) ([]isolated_device.HostNic,
 }
 
 func (h *SHostInfo) probeSyncIsolatedDevices() (*jsonutils.JSONArray, error) {
-	if !h.IsKvmSupport() {
+	if !h.IsKvmSupport() && !h.IsContainerHost() {
 		// skip probe isolated device on kvm not supported
 		log.Errorf("KVM is not supported, skip probe isolated devices")
 		return nil, nil
 	}
 
-	for _, driver := range []string{"vfio", "vfio_iommu_type1", "vfio-pci"} {
-		if out, err := procutils.NewRemoteCommandAsFarAsPossible("modprobe", driver).Output(); err != nil {
-			log.Errorf("failed probe driver %s: %s %s", driver, out, err)
+	if h.IsKvmSupport() {
+		for _, driver := range []string{"vfio", "vfio_iommu_type1", "vfio-pci"} {
+			if out, err := procutils.NewRemoteCommandAsFarAsPossible("modprobe", driver).Output(); err != nil {
+				log.Errorf("failed probe driver %s: %s %s", driver, out, err)
+			}
 		}
 	}
 
diff --git a/pkg/hostman/options/options.go b/pkg/hostman/options/options.go
index 17577b8291..da665f24c6 100644
--- a/pkg/hostman/options/options.go
+++ b/pkg/hostman/options/options.go
@@ -272,6 +272,9 @@ type SHostOptions struct {
 	// Container log rotation (Docker-style max-size and max-file)
 	ContainerLogMaxSize  string `help:"Max size of container log file before rotation (e.g. 10m, 100k). Disabled if empty or <= 0" default:"256m"`
 	ContainerLogMaxFiles int    `help:"Max number of container log files to keep (current + rotated). Disabled if <= 0" default:"1"`
+
+	PortMappingRangeStart int `default:"20000" help:"port mapping range start for guest port mapping allocation"`
+	PortMappingRangeEnd   int `default:"25000" help:"port mapping range end for guest port mapping allocation"`
 }
 
 func (o SHostOptions) HostLocalNetconfPath(br string) string {
diff --git a/pkg/hostman/storageman/remotefile/s3remotefile.go b/pkg/hostman/storageman/remotefile/s3remotefile.go
index c648689bac..9fc30de76b 100644
--- a/pkg/hostman/storageman/remotefile/s3remotefile.go
+++ b/pkg/hostman/storageman/remotefile/s3remotefile.go
@@ -55,7 +55,7 @@ func (info *S3RemoteFileInfo) download(ctx context.Context, localPath string, ca
 	}
 	defer fi.Close()
 
-	_, err = cloudprovider.DownloadObjectParallelWithProgress(ctx, bucket, info.Key, nil, fi, 0, 0, false, 10, callback)
+	_, err = cloudprovider.DownloadObjectParallelWithProgress(ctx, bucket, info.Key, nil, fi, 0, 0, true, 1, callback)
 	if err != nil {
 		return errors.Wrap(err, "download object")
 	}
diff --git a/vendor/github.com/anacrolix/torrent/Peer.go b/vendor/github.com/anacrolix/torrent/peer.go
similarity index 100%
rename from vendor/github.com/anacrolix/torrent/Peer.go
rename to vendor/github.com/anacrolix/torrent/peer.go
diff --git a/vendor/github.com/cilium/ebpf/readme.md b/vendor/github.com/cilium/ebpf/README.md
similarity index 100%
rename from vendor/github.com/cilium/ebpf/readme.md
rename to vendor/github.com/cilium/ebpf/README.md
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 440bf35b47..c986780cb5 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -2586,7 +2586,7 @@ yunion.io/x/cloudmux/pkg/multicloud/volcengine
 yunion.io/x/cloudmux/pkg/multicloud/volcengine/provider
 yunion.io/x/cloudmux/pkg/multicloud/zstack
 yunion.io/x/cloudmux/pkg/multicloud/zstack/provider
-# yunion.io/x/executor v0.0.0-20250518005516-5402e9e0bed0
+# yunion.io/x/executor v0.0.0-20260312022053-f538abd2b005
 ## explicit; go 1.12
 yunion.io/x/executor/apis
 yunion.io/x/executor/client
diff --git a/vendor/yunion.io/x/executor/server/server.go b/vendor/yunion.io/x/executor/server/server.go
index 336fcebccc..510eaeef18 100644
--- a/vendor/yunion.io/x/executor/server/server.go
+++ b/vendor/yunion.io/x/executor/server/server.go
@@ -139,12 +139,20 @@ func (e *Executor) Wait(ctx context.Context, in *apis.Sn) (*apis.WaitResponse, e
 	if !ok {
 		return nil, errors.Errorf("unknown sn %d", in.Sn)
 	}
-	var (
-		m   = icm.(*Commander)
-		err error
-	)
+	m := icm.(*Commander)
 
-	err = m.c.Wait()
+	// Must wait for stdout/stderr to be fully read BEFORE calling m.c.Wait().
+	// Once m.c.Wait() returns, exec.Cmd may close the pipe FDs; our reader
+	// goroutines would then get "read |0: file already closed" and miss data.
+	if m.stdout != nil {
+		<-m.stdoutCh
+	}
+	if m.stderr != nil {
+		<-m.stderrCh
+	}
+	m.wg.Wait()
+
+	err := m.c.Wait()
 	var (
 		exitStatus uint32
 		errContent string
@@ -164,14 +172,7 @@ func (e *Executor) Wait(ctx context.Context, in *apis.Sn) (*apis.WaitResponse, e
 	} else {
 		exitStatus = 0
 	}
-	if m.stdout != nil {
-		<-m.stdoutCh
-	}
-	if m.stderr != nil {
-		<-m.stderrCh
-	}
 
-	m.wg.Wait()
 	cmds.Delete(in.Sn)
 	return &apis.WaitResponse{
 		ExitStatus: exitStatus,