diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index 052ffa30c..85dc833f6 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -224,6 +224,33 @@ steps:
     command: make python3.7.3-runtime-tests
     parallelism: 10
 
+  # Runtime tests (LISAFS).
+  - <<: *common
+    label: ":php: PHP runtime tests (LISAFS)"
+    command: make php7.3.6-runtime-tests_lisafs
+    parallelism: 10
+    if: build.message =~ /lisafs/ || build.branch == "master"
+  - <<: *common
+    label: ":java: Java runtime tests (LISAFS)"
+    command: make java11-runtime-tests_lisafs
+    parallelism: 40
+    if: build.message =~ /lisafs/ || build.branch == "master"
+  - <<: *common
+    label: ":golang: Go runtime tests (LISAFS)"
+    command: make go1.12-runtime-tests_lisafs
+    parallelism: 10
+    if: build.message =~ /lisafs/ || build.branch == "master"
+  - <<: *common
+    label: ":node: NodeJS runtime tests (LISAFS)"
+    command: make nodejs12.4.0-runtime-tests_lisafs
+    parallelism: 10
+    if: build.message =~ /lisafs/ || build.branch == "master"
+  - <<: *common
+    label: ":python: Python runtime tests (LISAFS)"
+    command: make python3.7.3-runtime-tests_lisafs
+    parallelism: 10
+    if: build.message =~ /lisafs/ || build.branch == "master"
+
   # ARM tests.
   - <<: *common
     label: ":mechanical_arm: ARM"
diff --git a/Makefile b/Makefile
index 35e1c508f..23f7cd20b 100644
--- a/Makefile
+++ b/Makefile
@@ -160,6 +160,7 @@ dev: $(RUNTIME_BIN) ## Installs a set of local runtimes. Requires sudo.
 	@$(call configure_noreload,$(RUNTIME)-p,--net-raw --profile)
 	@$(call configure_noreload,$(RUNTIME)-fuse-d,--net-raw --debug --strace --log-packets --fuse)
 	@$(call configure_noreload,$(RUNTIME)-cgroup-d,--net-raw --debug --strace --log-packets --cgroupfs)
+	@$(call configure_noreload,$(RUNTIME)-lisafs-d,--net-raw --debug --strace --log-packets --lisafs)
 	@$(call reload_docker)
 .PHONY: dev
 
@@ -234,6 +235,10 @@ packetimpact-tests:
 	@$(call install_runtime,$(RUNTIME),--watchdog-action=panic)
 	@$(call test_runtime,$(RUNTIME),--test_timeout=1800 //test/runtimes:$*)
 
+%-runtime-tests_lisafs: load-runtimes_% $(RUNTIME_BIN)
+	@$(call install_runtime,$(RUNTIME), --lisafs)
+	@$(call test_runtime,$(RUNTIME),--test_timeout=10800 //test/runtimes:$*)
+
 do-tests: $(RUNTIME_BIN)
 	@$(RUNTIME_BIN) --rootless do true
 	@$(RUNTIME_BIN) --rootless -network=none do true
@@ -257,6 +262,8 @@ INTEGRATION_TARGETS := //test/image:image_test //test/e2e:integration_test
 docker-tests: load-basic $(RUNTIME_BIN)
 	@$(call install_runtime,$(RUNTIME),) # Clear flags.
 	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
+	@$(call install_runtime,$(RUNTIME), --lisafs) # Run again with lisafs.
+	@$(call test_runtime,$(RUNTIME),$(INTEGRATION_TARGETS))
 .PHONY: docker-tests
 
 overlay-tests: load-basic $(RUNTIME_BIN)
diff --git a/test/runner/defs.bzl b/test/runner/defs.bzl
index 02d2e32a9..0061a4ddb 100644
--- a/test/runner/defs.bzl
+++ b/test/runner/defs.bzl
@@ -60,6 +60,7 @@ def _syscall_test(
         file_access = "exclusive",
         overlay = False,
         add_uds_tree = False,
+        lisafs = False,
         fuse = False,
         **kwargs):
     # Prepend "runsc" to non-native platform names.
@@ -73,6 +74,8 @@ def _syscall_test(
         name += "_overlay"
     if fuse:
         name += "_fuse"
+    if lisafs:
+        name += "_lisafs"
     if network != "none":
         name += "_" + network + "net"
 
@@ -110,6 +113,7 @@ def _syscall_test(
         "--file-access=" + file_access,
         "--overlay=" + str(overlay),
         "--add-uds-tree=" + str(add_uds_tree),
+        "--lisafs=" + str(lisafs),
         "--fuse=" + str(fuse),
         "--strace=" + str(debug),
         "--debug=" + str(debug),
@@ -131,6 +135,7 @@ def syscall_test(
         add_overlay = False,
         add_uds_tree = False,
         add_hostinet = False,
+        add_lisafs = True,
         fuse = False,
         allow_native = True,
         debug = True,
@@ -144,6 +149,7 @@ def syscall_test(
       add_overlay: add an overlay test.
       add_uds_tree: add a UDS test.
       add_hostinet: add a hostinet test.
+      add_lisafs: add a lisafs test.
       fuse: enable FUSE support.
       allow_native: generate a native test variant.
       debug: enable debug output.
@@ -177,6 +183,19 @@ def syscall_test(
             **kwargs
         )
 
+    if add_lisafs:
+        # Generate a *_lisafs variant with the default platform.
+        _syscall_test(
+            test = test,
+            platform = default_platform,
+            use_tmpfs = use_tmpfs,
+            add_uds_tree = add_uds_tree,
+            tags = platforms[default_platform] + tags + ["lisafs"],
+            debug = debug,
+            fuse = fuse,
+            lisafs = True,
+            **kwargs
+        )
     if add_overlay:
         _syscall_test(
             test = test,
diff --git a/test/runner/main.go b/test/runner/main.go
index b3801be4c..9c5755bf3 100644
--- a/test/runner/main.go
+++ b/test/runner/main.go
@@ -48,6 +48,7 @@ var (
 	fileAccess         = flag.String("file-access", "exclusive", "mounts root in exclusive or shared mode")
 	overlay            = flag.Bool("overlay", false, "wrap filesystem mounts with writable tmpfs overlay")
 	fuse               = flag.Bool("fuse", false, "enable FUSE")
+	lisafs             = flag.Bool("lisafs", false, "enable lisafs protocol if vfs2 is also enabled")
 	container          = flag.Bool("container", false, "run tests in their own namespaces (user ns, network ns, etc), pretending to be root")
 	setupContainerPath = flag.String("setup-container", "", "path to setup_container binary (for use with --container)")
 
@@ -181,6 +182,9 @@ func runRunsc(tc gtest.TestCase, spec *specs.Spec) error {
 	if *fuse {
 		args = append(args, "-fuse")
 	}
+	if *lisafs {
+		args = append(args, "-lisafs")
+	}
 	if *debug {
 		args = append(args, "-debug", "-log-packets=true")
 	}
@@ -388,15 +392,23 @@ func runTestCaseRunsc(testBin string, tc gtest.TestCase, t *testing.T) {
 
 	// Set environment variables that indicate we are running in gVisor with
 	// the given platform, network, and filesystem stack.
-	platformVar := "TEST_ON_GVISOR"
-	networkVar := "GVISOR_NETWORK"
+	const (
+		platformVar = "TEST_ON_GVISOR"
+		networkVar  = "GVISOR_NETWORK"
+		fuseVar     = "FUSE_ENABLED"
+		lisafsVar   = "LISAFS_ENABLED"
+	)
 	env := append(os.Environ(), platformVar+"="+*platform, networkVar+"="+*network)
-	fuseVar := "FUSE_ENABLED"
 	if *fuse {
 		env = append(env, fuseVar+"=TRUE")
 	} else {
 		env = append(env, fuseVar+"=FALSE")
 	}
+	if *lisafs {
+		env = append(env, lisafsVar+"=TRUE")
+	} else {
+		env = append(env, lisafsVar+"=FALSE")
+	}
 
 	// Remove shard env variables so that the gunit binary does not try to
 	// interpret them.
diff --git a/test/util/test_util.cc b/test/util/test_util.cc
index 181adfc1f..b0ab5de7d 100644
--- a/test/util/test_util.cc
+++ b/test/util/test_util.cc
@@ -42,6 +42,7 @@ namespace testing {
 
 constexpr char kGvisorNetwork[] = "GVISOR_NETWORK";
 constexpr char kFuseEnabled[] = "FUSE_ENABLED";
+constexpr char kLisafsEnabled[] = "LISAFS_ENABLED";
 
 bool IsRunningOnGvisor() { return GvisorPlatform() != Platform::kNative; }
 
@@ -64,6 +65,11 @@ bool IsFUSEEnabled() {
   return env && strcmp(env, "TRUE") == 0;
 }
 
+bool IsLisafsEnabled() {
+  const char* env = getenv(kLisafsEnabled);
+  return env && strncmp(env, "TRUE", 4) == 0;
+}
+
 // Inline cpuid instruction.  Preserve %ebx/%rbx register. In PIC compilations
 // %ebx contains the address of the global offset table. %rbx is occasionally
 // used to address stack variables in presence of dynamic allocas.
diff --git a/test/util/test_util.h b/test/util/test_util.h
index 9eec41904..f07eae6a5 100644
--- a/test/util/test_util.h
+++ b/test/util/test_util.h
@@ -225,6 +225,7 @@ bool IsRunningOnGvisor();
 const std::string GvisorPlatform();
 bool IsRunningWithHostinet();
 bool IsFUSEEnabled();
+bool IsLisafsEnabled();
 
 #ifdef __linux__
 void SetupGvisorDeathTest();