containerd 1.1.8 → 2.3.0
172 releases · 220 breaking changes · 247 security fixes · 16 advisories fixed
247security220breaking168deprecated1210feature506fix
Vulnerabilities fixed by this upgrade
- medium CVE-2025-64329 Host memory exhaustion through goroutine leaks of Attach functionality in CRI server
- medium CVE-2024-25621 Local privilege escalation via wide permissions on several directories
- 4.6 CVE-2024-40635 Integer overflow in User ID handling
- medium GHSA-7ww5-4wqc-m92c RAPL accessible to a container
- medium CVE-2023-25173 Supplementary groups are not set up properly
- medium CVE-2023-25153 OCI image importer memory exhaustion
- medium CVE-2022-23471 containerd CRI stream server: Host memory exhaustion through Terminal resize goroutine leak
- medium CVE-2022-31030 containerd CRI plugin: Host memory exhaustion through ExecSync
- low CVE-2022-24769 Default inheritable capabilities for linux container should be empty
- medium CVE-2022-23648 containerd CRI plugin: Insecure handling of image volumes
- medium GHSA-5j5w-g665-5m35 Ambiguous OCI manifest parsing
- 5.9 CVE-2021-41103 Insufficiently restricted permissions on container root and plugin directories
- medium CVE-2021-32760 Archive package allows chmod of file outside of unpack target directory
- medium CVE-2021-21334 containerd CRI plugin: environment variables can leak between containers
- medium CVE-2020-15257 containerd-shim API exposed to host network containers
- medium CVE-2020-15157 containerd v1.2.x can be coerced into leaking credentials during image pull
Breaking changes
- breaking 1c0d72890 Makefile: remove go mod download from integration in 2.2.10
- breaking pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const () in 2.2.1
- breaking 58d23ab63 pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const in 2.2.1
- breaking 73a08aa00 go.mod: remove exclude rules in 2.2.1
- breaking core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor () in 2.2.1
- breaking ed19c5420 core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor in 2.2.1
- breaking 8c0c9f6 Implement removal of RDT in 2.2.1
- breaking 3aff986 pkg/runtime-tools/generate: remove embedded field "Generator" in 2.2.1
- breaking 4ed50edce fix: ST1019: removed the duplicate imports in 2.1.7
- breaking go.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) () in 2.1.6
- breaking core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor () in 2.1.6
- breaking a4454c49a core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor in 2.1.6
- breaking Remove additional fuzzers from instrumentation repo () in 2.1.5
- breaking Update FreeBSD defaults and re-organize platform defaults () in 2.1.0
- breaking 23c28d68c Makefile: remove go mod download from integration in 2.0.14
- breaking Remove additional fuzzers from instrumentation repo () in 2.0.7
- breaking Remove disable_cgroup from CRI config () in 2.0.0
- breaking Move client to subpackage () in 2.0.0
- breaking go.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) () in 1.7.30
- breaking remove sha256-simd () in 1.7.30
- breaking Remove additional fuzzers from instrumentation repo () in 1.7.28
- breaking Remove hashicorp/go-multierror dependency and fix CI () in 1.7.27
- breaking device-injector: remove unreachable code. (containerd/nri#115) in 1.7.26
- breaking 235aa11 chore: remove unreachable code and fmt files in 1.7.26
- breaking cmd/continuity/commands: MountCmd: remove macOS remnants (containerd/continuity#254) in 1.7.25
- breaking 327ebdd cmd/continuity/commands: MountCmd: remove macOS remnants in 1.7.25
- breaking go-fix: remove pre-go1.17 build-tags (containerd/continuity#252) in 1.7.25
- breaking 433b975 go-fix: remove pre-go1.17 build-tags in 1.7.25
- breaking 760935e52 runc-shim: remove misleading comment in 1.7.22
- breaking remove imports of errdefs package, and add depguard linter () in 1.7.19
- breaking a00a2d20a reference/docker: remove deprecated SplitHostname in 1.7.19
- breaking Remove hcsshim import from repo (containerd/platforms#10) in 1.7.19
- breaking Remove references to package io/ioutil (containerd/imgcrypt#100) in 1.7.17
- breaking a8004007a copy: remove max number of ErrResets in 1.7.14
- breaking 2a25c085b copy: remove wrapping io.NopCloser from push writer pipe in 1.7.14
- breaking socketpair_windows: remove implementation for now (containerd/nri#69) in 1.7.14
- breaking e47f09b socketpair_windows: remove implementation for now in 1.7.14
- breaking gha: remove GOPATH and workingdir, update actions/setup-go@v4, actions/checkout@v4 (containerd/nri#53) in 1.7.14
- breaking e33ac3e gha: remove working-dir and GOPATH in 1.7.14
- breaking remove containerd as dependency (containerd/nri#51) in 1.7.14
- breaking Remove runc import () in 1.7.12
- breaking Fix otel version incompatibility () in 1.7.11
- breaking [release/1.7] Fix otel version incompatibility () in 1.7.11
- breaking 6982a0df5 containerd-shim-runc-v2: remove unnecessary s.getContainer() in 1.7.8
- breaking 7aa4f8fdc log: WithLogger: remove redundant intermediate var in 1.7.5
- breaking 6621e0888 log: remove testify dependency in 1.7.5
- breaking df76aaede removes/docker: remove unnecessary conversion (unconvert) in 1.7.5
- breaking Remove CNI conf_template deprecation () in 1.7.3
- breaking [release/1.7 backport] ci: remove libseccomp-dev installation for nightly () in 1.7.3
- breaking 15d65709e ci: remove libseccomp-dev installation for nightly in 1.7.3
- breaking Remove references to io/ioutil package () in 1.7.3
- breaking [release/1.7 backport] snapshots/testsuite: Rename: fix fuse-overlayfs incompatibility () in 1.7.2
- breaking 9e60300ea snapshots/testsuite: Rename: fix fuse-overlayfs incompatibility in 1.7.2
- breaking Remove references to io/ioutil package () in 1.7.2
- breaking Remove entry for container from container store on error () in 1.7.1
- breaking [release/1.7] go.mod: remove redundant replace, and some cleaning-up () in 1.7.1
- breaking 1ece0cb50 go.mod: remove replace for github.com/opencontainers/runtime-tools in 1.7.1
- breaking Remove gogoproto.customtype () in 1.7.0
- breaking Remove enumvalue_customname, goproto_enum_prefix and enum_customname () in 1.7.0
- breaking Remove all gogoproto extensions () in 1.7.0
- breaking CRI: remove duplicated snapshotters code () in 1.7.0
- breaking contrib/apparmor: remove code related to apparmor_parser version () in 1.7.0
- breaking contrib/apparmor: remove version-dependent rules () in 1.7.0
- breaking Vagrantfile: install-rootless-podman: remove setenforce 0 () in 1.7.0
- breaking oci: appendOSMounts(): remove unused error, and move () in 1.7.0
- breaking add kube v1.26: remove v1alph2 cri support () in 1.7.0
- breaking Remove github.com/gogo/protobuf again () in 1.7.0
- breaking remove some (aliases for) deprecated functions () in 1.7.0
- breaking go.mod: golang_protobuf_extensions v1.0.4 - prevent incompatible versions () in 1.7.0
- breaking overlayfs: remove duplicated tx rollback () in 1.7.0
- breaking overlay: Remove unused method param () in 1.7.0
- breaking Remove OpenTelementry imports from remotes/docker package () in 1.7.0
- breaking Remove uses of deprecated go-digest.NewDigestFromHex, go-digest.Digest.Hex () in 1.7.0
- breaking maintenance: Remove WithWindowsNetworkNamespace from pkg/cri () in 1.7.0
- breaking sys: remove unused IsAbs() (windows) () in 1.7.0
- breaking archive: windows: chtimes(): remove redundant conversion () in 1.7.0
- breaking remove stray .zuul.yaml () in 1.7.0
- breaking Remove unused variable from images action () in 1.7.0
- breaking integration: TestUpdateContainerResources_MemoryLimit: remove TODO comment () in 1.7.0
- breaking metrics/cgroups/v1: Remove unused event parameter () in 1.7.0
- breaking zuul: remove the zuul because it is offline () in 1.7.0
- breaking mount: remove unused ErrNotImplementOnWindows () in 1.7.0
- breaking Remove hacks around contrib/fuzz () in 1.7.0
- breaking Reverts removal of parallel run from critest () in 1.7.0
- breaking oci: WithDefaultUnixDevices(): remove tun/tap from the default devices () in 1.7.0
- breaking Remove github.com/gogo/protobuf and github.com/golang/protobuf from containerd's direct dependencies () in 1.7.0
- breaking Remove hashicorp/go-multierror dependency and fix CI () in 1.6.38
- breaking 7e6a18c24 runc-shim: remove misleading comment in 1.6.36
- breaking Remove references to package io/ioutil (containerd/imgcrypt#100) in 1.6.32
- breaking Remove runc import () in 1.6.27
- breaking 65e908ee1 containerd-shim-runc-v2: remove unnecessary s.getContainer() in 1.6.25
- breaking 6e8f4555b log: WithLogger: remove redundant intermediate var in 1.6.24
- breaking c3c22f8cb log: remove gotest.tools dependency in 1.6.24
- breaking 70dc11a6c lint: remove //nolint:dupword that are no longer needed in 1.6.24
- breaking [release/1.6 backport] ci: remove libseccomp-dev installation for nightly () in 1.6.22
- breaking 6e2bcb6dd ci: remove libseccomp-dev installation for nightly in 1.6.22
- breaking Remove references to io/ioutil package () in 1.6.22
- breaking 627f563e6 chore: remove duplicate word in comments in 1.6.20
- breaking c23945c5f test: remove redundant mountPoint in 1.6.20
- breaking Revert removal of /sbin/apparmor_parser check () in 1.6.18
- breaking 550424f92 Vagrantfile: install-rootless-podman: remove setenforce 0 in 1.6.16
- breaking [release/1.6] go.mod: use golang_protobuf_extensions v1.0.4 to prevent incompatible versions () in 1.6.11
- breaking Update oci.WithDefaultUnixDevices(): remove tun/tap from the default devices () in 1.6.9
- breaking 7b8d679ad [release/1.6] integration: remove use of deprecated io/ioutil in 1.6.9
- breaking [release/1.6] .zuul: remove the zull because it is offline () in 1.6.9
- breaking 6b30bc4b4 .zuul: remove the zuul because it is offline in 1.6.9
- breaking [release/1.6] ci: remove GOPROXY environment variable due to https://github.com/go-… () in 1.6.9
- breaking 1efd8b947 ci: remove GOPROXY environment variable due to https://github.com/go-yaml/yaml/issues/887 in 1.6.9
- breaking [release/1.6 backport] oci: WithDefaultUnixDevices(): remove tun/tap from the default devices () in 1.6.9
- breaking ed9d3dc37 oci: WithDefaultUnixDevices(): remove tun/tap from the default devices in 1.6.9
- breaking 5df4731 cmd/continuity: remove FUSE for macOS in 1.6.9
- breaking de7fd6b sysx: remove unused sysx/generate.sh script in 1.6.9
- breaking 390920429 release workflow: remove Go setup action in 1.6.8
- breaking [release/1.6] Reverts removal of parallel run from critest () in 1.6.5
- breaking 82a77be2d reverts removal of parallel run from critest in 1.6.5
- breaking Remove submodule go mod () in 1.6.0
- breaking Remove api go submodule in 1.6.0
- breaking remove io/ioutil () in 1.6.0
- breaking remove io/ioutil in 1.6.0
- breaking Remove Windows integration testing for 2004. () in 1.6.0
- breaking Remove Windows integration testing for 2004. in 1.6.0
- breaking images/converter: remove deprecated types in 1.6.0
- breaking Integration: Remove explicit version passing to azure/CLI. () in 1.6.0
- breaking Integration: Remove explicit version passing to azure/CLI. in 1.6.0
- breaking Remove extra test_teardown in 1.6.0
- breaking pkg/cap: remove an outdated comment () in 1.6.0
- breaking pkg/cap: remove an outdated comment in 1.6.0
- breaking BUILDING.md: remove some bits about building runc () in 1.6.0
- breaking BUILDING.md: remove some bits about building runc in 1.6.0
- breaking Remove redundant build tags () in 1.6.0
- breaking Remove redundant build tags in 1.6.0
- breaking remove go 1.13 from containerd in 1.6.0
- breaking scripts: linting fixes, and remove support for Debian Jessie (as it's EOL) () in 1.6.0
- breaking test/build-utils.sh: remove support for Debian Jessie in 1.6.0
- breaking Fuzzing: Remove panics of container_fuzzer () in 1.6.0
- breaking Fuzzing: Remove panics of container_fuzzer in 1.6.0
- breaking runtime: runc v2: remove redundant validation () in 1.6.0
- breaking runtime: runc v2: remove redundant validation in 1.6.0
- breaking remove pkg/cri/platforms package () in 1.6.0
- breaking remove pkg/cri/platforms package in 1.6.0
- breaking sys: remove StatAtime(), StatCtime(), StatMtime() and StatATimeAsTime() utils () in 1.6.0
- breaking sys: remove StatAtime(), StatCtime(), StatMtime() and StatATimeAsTime() utils in 1.6.0
- breaking Remove mountpoints not commonly mounted on FreeBSD in 1.6.0
- breaking Remove useless lines () in 1.6.0
- breaking Remove useless lines in 1.6.0
- breaking v2: remove unimplemented errors and ErrorHandler, IgnoreNotExist () in 1.6.0
- breaking v2: remove ErrorHandler and IgnoreNotExist as they are not implemented in 1.6.0
- breaking v2: remove errors that are never returned in 1.6.0
- breaking Remove direct dependency on github.com/pkg/errors () in 1.6.0
- breaking remove direct dependency on github.com/pkg/errors in 1.6.0
- breaking remove: Continue on "not found" errors () in 1.6.0
- breaking [release/1.5] go.mod: use golang_protobuf_extensions v1.0.4 to prevent incompatible versions () in 1.5.15
- breaking cmd/continuity: remove FUSE for macOS in 1.5.15
- breaking sysx: remove unused sysx/generate.sh script in 1.5.15
- breaking remove version package in 1.5.15
- breaking Remove deprecated io/ioutil (except ioutil.ReadDir) in 1.5.15
- breaking Remove direct dependency on github.com/pkg/errors () in 1.5.15
- breaking remove direct dependency on github.com/pkg/errors in 1.5.15
- breaking Update oci.WithDefaultUnixDevices(): remove tun/tap from the default devices () in 1.5.14
- breaking [release/1.5] .zuul: remove the zuul because it is offline () in 1.5.14
- breaking 83ea10446 .zuul: remove the zuul because it is offline in 1.5.14
- breaking [release/1.5] ci: remove GOPROXY environment variable due to https://github.com/go-… () in 1.5.14
- breaking d3d97cce3 ci: remove GOPROXY environment variable due to https://github.com/go-yaml/yaml/issues/887 in 1.5.14
- breaking [release/1.5 backport] oci: WithDefaultUnixDevices(): remove tun/tap from the default devices () in 1.5.14
- breaking 9bdd52b3a oci: WithDefaultUnixDevices(): remove tun/tap from the default devices in 1.5.14
- breaking v2: remove unimplemented errors and ErrorHandler, IgnoreNotExist () in 1.5.12
- breaking db173a8 v2: remove ErrorHandler and IgnoreNotExist as they are not implemented in 1.5.12
- breaking b19a60d v2: remove errors that are never returned in 1.5.12
- breaking Remove "Very new" and checked TODO items () in 1.5.8
- breaking remove travis, add codecov badge () in 1.5.8
- breaking 6773702 CI: remove travis in 1.5.8
- breaking 7bb73da6b runtime/v2/shim: remove unused SetScore() and remove sys.OOMScoreMaxKillable in 1.5.0
- breaking 61c749036 integration/util: remove dependency on k8s.io/klog/v2 in 1.5.0
- breaking 757291920 mount: remove remaining uses of mount.Self() in 1.5.0
- breaking 474abe572 mount: remove unused mount.PID() in 1.5.0
- breaking 1cc3c7f4a docs: Remove appveyor badge in 1.5.0
- breaking eba94a15c pkg/cri/server: remove dependency on libcontainer/apparmor, libcontainer/utils in 1.5.0
- breaking 1edeea766 install-runc: remove unused USESUDO variable in 1.5.0
- breaking 5b13dcc73 mount.isFUSE(): remove unused error return in 1.5.0
- breaking fad87288f switching to windows-2016 latest is breaking due to wsl conflict with bash in 1.5.0
- breaking c96373f6d newTransport(): remove deprecated DualStack option in 1.5.0
- breaking 7fcef89b7 add removal of old go in 1.5.0
- breaking fda30c3ad Do not teardown when network namespace is removed already. in 1.5.0
- breaking 2cbde20 cmd/btrfs-test: remove duplicate copyright header in 1.5.0
- breaking 95a317e CI: remove travis in 1.5.0
- breaking 4029019 memory: remove wrong memory.kmem.limit_in_bytes check in 1.5.0
- breaking a348cec go.mod: remove github.com/stretchr/testify "indirect" in 1.5.0
- breaking df04ad1 mkfifo: remove solaris code in 1.5.0
- breaking 6f2eab6 Travis: Remove Travis testing in 1.5.0
- breaking 5a63297 Drop support for 1.12.x in 1.5.0
- breaking Fix unknown state preventing removal of containers containerd/containerd#4656 in 1.4.2
- breaking Remove libseccomp requirement, seccomp support is now always built-in in 1.4.0
- breaking Remove socat for port forwarding cri#1470 in 1.4.0
- breaking c4418bb3 CI: remove an unreferenced variable in 1.4.0
- breaking 03755821 seccomp: remove the unused query_module(2) in 1.4.0
- breaking 1b964049 ConfigureHosts: remove deprecated DualStack option in 1.4.0
- breaking 37c839e5 sys/proc: remove GetSystemCPUUsage as it is unused in 1.4.0
- breaking 295e7400 sys: remove custom setChildSubreaper const in 1.4.0
- breaking 4756258f service_windows.go: remove unused "service" variable in 1.4.0
- breaking 382444c v2: remove unneeded import in 1.4.0
- breaking fad87288 switching to windows-2016 latest is breaking due to wsl conflict with bash in 1.4.0
- breaking c96373f6 newTransport(): remove deprecated DualStack option in 1.4.0
- breaking 7fcef89b add removal of old go in 1.4.0
- breaking 0025117 blockcipher: Remove an unused field from the 'state' of the AES CTR cryptor in 1.4.0
- breaking a3a385c9d seccomp: remove the unused query_module(2) in 1.3.8
- breaking 229bfe2562 service_windows.go: remove unused "service" variable in 1.3.5
- breaking Fix garbage collection scheduling on reference removal. Ensures removal of leases or containers triggers the next scheduled garbage collection in 1.3.0
- breaking 282b19efd2 remotes: remove useless line in 1.3.0
- breaking 4b4ce4a26c remotes: remove unnecessary string formatting in 1.3.0
- breaking ec8d9d3d7a shimv2: remove the dead task from runtime task list in 1.3.0
- breaking 2d03791158 docs: remove shim_no_newns in ops.md in 1.3.0
- breaking 34672d483d metadata/gc: remove the noop-loop for snapshot reference in 1.3.0
- breaking 723797d320 docs: remove website leftovers in 1.3.0
- breaking 6ccb0d0629 fix: remove dead code in 1.3.0
- breaking 83f4ab8855 makefile: remove emoji on Linux in 1.3.0
- breaking 9b6a318a metadata/gc: remove the noop-loop for snapshot reference in 1.2.3
- breaking Remove auth config logs in 1.2.1
- breaking Remove host pid usage to work better with katacontainer in 1.2.1
- breaking Add Sync flag to Delete in leases API. Setting this option will ensure a garbage collection completes before the removal call is returned. This can be used to guarantee unreferenced objects are removed from disk after a lease. in 1.2.0
- breaking 2b69c16 sysx.Fchmodat(): remove in 1.2.0
Security changes
- security CVE-2026-95839 in 2.2.10
- security GHSA-5p7c-hggf-c748 in 2.2.10
- security GHSA-8647-2jxj-p2rc in 2.2.10
- security GHSA-hc94-p972-ch66 in 2.2.10
- security CVE-2026-53493 in 2.2.9
- security CVE-2026-53495 in 2.2.8
- security GHSA-rp3h-jf77-q9p4 in 2.2.8
- security Fixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context in 2.2.7
- security CVE-2026-50195 in 2.2.5
- security CVE-2026-53488 in 2.2.5
- security CVE-2026-53492 in 2.2.5
- security CVE-2026-53489 in 2.2.5
- security CVE-2026-47262 in 2.2.5
- security CVE-2026-46680 in 2.2.4
- security CVE-2026-34986 in 2.2.4
- security Bump go-jose/go-jose to v4.1.4 to fix GHSA-78h2-9frx-2jm8 () in 2.2.4
- security 80311db63 chore: update go-jose for CVE-2026-34986 in 2.2.4
- security CVE-2026-35469 in 2.2.3
- security c22cf5d49 cri,nri: pass any linux security profile to plugins. in 2.2.1
- security Fixes CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion in 2.2.0
- security Fixes CVE-2025-64329: Host memory exhaustion through goroutine leaks of Attach functionality in CRI server in 2.2.0
- security Fixes CVE-2024-25621: Local privilege escalation via wide permissions on several directories in 2.2.0
- security CVE-2026-50195 in 2.1.9
- security CVE-2026-53488 in 2.1.9
- security CVE-2026-53492 in 2.1.9
- security CVE-2026-53489 in 2.1.9
- security CVE-2026-47262 in 2.1.9
- security CVE-2026-46680 in 2.1.8
- security CVE-2026-35469 in 2.1.7
- security GHSA-pwhc-rpq9-4c8w in 2.1.5
- security GHSA-m6hq-p25p-ffr2 in 2.1.5
- security GHSA-qw9x-cqr3-wc7r in 2.1.5
- security GHSA-cgrx-mc8f-2prm in 2.1.5
- security GHSA-9493-h29p-rfm2 in 2.1.5
- security The first patch release for containerd 2.1 fixes a critical vulnernability (CVE-2025-47290) which was first introduced in 2.1.0. See the Github Advisory for more details. This release also contains a few smaller updates and bux fixes. in 2.1.1
- security Fixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. in 2.1.0
- security GHSA-hc94-p972-ch66 in 2.0.14
- security CVE-2026-53493 in 2.0.13
- security CVE-2026-53495 in 2.0.12
- security GHSA-rp3h-jf77-q9p4 in 2.0.12
- security CVE-2026-53488 in 2.0.10
- security CVE-2026-47262 in 2.0.10
- security CVE-2026-46680 in 2.0.9
- security CVE-2026-35469 in 2.0.8
- security GHSA-pwhc-rpq9-4c8w in 2.0.7
- security GHSA-m6hq-p25p-ffr2 in 2.0.7
- security GHSA-qw9x-cqr3-wc7r in 2.0.7
- security GHSA-cgrx-mc8f-2prm in 2.0.7
- security GHSA-9493-h29p-rfm2 in 2.0.7
- security Fixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. in 2.0.5
- security Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg) in 2.0.4
- security Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 () in 2.0.3
- security [medium] RAPL accessible to a container GHSA-7ww5-4wqc-m92c in 2.0.0
- security CVE-2026-53493 in 1.7.36
- security CVE-2026-53495 in 1.7.35
- security GHSA-rp3h-jf77-q9p4 in 1.7.35
- security CVE-2026-53488 in 1.7.33
- security CVE-2026-47262 in 1.7.33
- security CVE-2026-34986 in 1.7.33
- security Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 () in 1.7.33
- security 4dfc1844e Bump go-jose to v3.0.5 to address CVE-2026-34986 in 1.7.33
- security CVE-2026-46680 in 1.7.32
- security CVE-2026-35469 in 1.7.31
- security GHSA-pwhc-rpq9-4c8w in 1.7.29
- security GHSA-m6hq-p25p-ffr2 in 1.7.29
- security GHSA-qw9x-cqr3-wc7r in 1.7.29
- security GHSA-cgrx-mc8f-2prm in 1.7.29
- security GHSA-9493-h29p-rfm2 in 1.7.29
- security Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg) in 1.7.27
- security Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 () in 1.7.26
- security The thirteenth patch release for containerd 1.7 updates the runc binary in the release builds to address CVE-2024-21626 in 1.7.13
- security Update runc binary to v1.1.12 (GHSA-xr7r-f8xq-vfvv) in 1.7.13
- security Mask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c) in 1.7.11
- security Github Security Advisory GHSA-7ww5-4wqc-m92c in 1.7.11
- security ab28e71 docs: add a chapter about security considerations. in 1.7.7
- security Add CodeQL security scan workflow () in 1.7.2
- security c8de034 Add CodeQL security scan workflow in 1.7.2
- security Update README with location of security audits () in 1.7.0
- security Github Security Advisory GHSA-hmfx-3pcx-653p in 1.7.0
- security Github Security Advisory GHSA-259w-8hf6-59c2 in 1.7.0
- security Github Security Advisory GHSA-2qjp-425j-52j9 in 1.7.0
- security Update to go 1.19.2 to address CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 () in 1.7.0
- security Update to go 1.19.1, 1.18.6 to address CVE-2022-27664, CVE-2022-32190 () in 1.7.0
- security Github Security Advisory GHSA-5ffw-gxpp-mxpf in 1.7.0
- security Github Security Advisory GHSA-c9cp-9c75-9v8c in 1.7.0
- security update to go 1.16.15, 1.17.8 to address CVE-2022-24921 () in 1.7.0
- security Github Security Advisory GHSA-crp2-qrr5-8pq7 in 1.7.0
- security Add CodeQL Security scan workflow () in 1.7.0
- security Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg) in 1.6.38
- security The twenty-eighth patch release for containerd 1.6 updates the runc binary in the release builds to address CVE-2024-21626 in 1.6.28
- security Update runc binary to v1.1.12 (GHSA-xr7r-f8xq-vfvv) in 1.6.28
- security [release/1.6] upgrade OpenTelemetry to v1.21.0 / v0.46.0 (CVE-2023-47108) etc. () in 1.6.28
- security Mask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c) in 1.6.26
- security Github Security Advisory GHSA-7ww5-4wqc-m92c in 1.6.26
- security [Release/1.6] CVE-2022-1996 fix for go-restful () in 1.6.25
- security 62d402275 Remove CVE-2022-1996 from containerd binary upgrading go-restful to 2.16.0 in 1.6.25
- security The eighteenth patch release for containerd 1.6 includes fixes for CVE-2023-25153 and CVE-2023-25173 along with a security update for Go. in 1.6.18
- security Fix OCI image importer memory exhaustion (GHSA-259w-8hf6-59c2) in 1.6.18
- security Fix supplementary groups not being set up properly (GHSA-hmfx-3pcx-653p) in 1.6.18
- security Github Security Advisory GHSA-hmfx-3pcx-653p in 1.6.18
- security Github Security Advisory GHSA-259w-8hf6-59c2 in 1.6.18
- security The twelfth patch release for containerd 1.6 contains a fix for CVE-2022-23471. in 1.6.12
- security Fix goroutine leak during Exec in CRI plugin (GHSA-2qjp-425j-52j9) in 1.6.12
- security Github Security Advisory GHSA-2qjp-425j-52j9 in 1.6.12
- security Bump Go version to 1.18.8 to address CVE-2022-41716 () in 1.6.10
- security [release/1.6] update to Go 1.18.8 to address CVE-2022-41716 () in 1.6.10
- security [release/1.6] update to Go 1.18.8 to address CVE-2022-41716 in 1.6.10
- security [release/1.6] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 () in 1.6.9
- security 28324c529 [release/1.6] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 in 1.6.9
- security The sixth patch release for containerd 1.6 includes a fix for CVE-2022-31030. in 1.6.6
- security Fix ExecSync handler to cap console output size (GHSA-5ffw-gxpp-mxpf) in 1.6.6
- security Github Security Advisory GHSA-5ffw-gxpp-mxpf in 1.6.6
- security The second patch release for containerd 1.6 includes a fix for CVE-2022-24769. in 1.6.2
- security Fix the inheritable capability defaults (GHSA-c9cp-9c75-9v8c) in 1.6.2
- security Github Security Advisory GHSA-c9cp-9c75-9v8c in 1.6.2
- security [release/1.6] update to go 1.16.15, 1.17.8 to address CVE-2022-24921 () in 1.6.2
- security update to go 1.16.15, 1.17.8 to address CVE-2022-24921 in 1.6.2
- security The first patch release for containerd 1.6 includes a fix for CVE-2022-23648 and other issues. in 1.6.1
- security Use fs.RootPath when mounting volumes (GHSA-crp2-qrr5-8pq7) in 1.6.1
- security Github Security Advisory GHSA-crp2-qrr5-8pq7 in 1.6.1
- security Github Security Advisory GHSA-mvff-h3cj-wj9c in 1.6.0
- security Github Security Advisory GHSA-5j5w-g665-5m35 in 1.6.0
- security Github Security Advisory GHSA-c2h3-6mxw-7mvq in 1.6.0
- security Github Security Advisory GHSA-c72p-9xmj-rx3w in 1.6.0
- security The eighteenth patch release for containerd 1.5 includes fixes for CVE-2023-25153 and CVE-2023-25173 along with a security update for Go. in 1.5.18
- security Fix supplementary groups not being set up properly (GHSA-hmfx-3pcx-653p) in 1.5.18
- security Fix OCI image importer memory exhaustion (GHSA-259w-8hf6-59c2) in 1.5.18
- security Github Security Advisory GHSA-hmfx-3pcx-653p in 1.5.18
- security Github Security Advisory GHSA-259w-8hf6-59c2 in 1.5.18
- security The sixteenth patch release for containerd 1.5 contains a fix for CVE-2022-23471. in 1.5.16
- security Fix goroutine leak during Exec in CRI plugin (GHSA-2qjp-425j-52j9) in 1.5.16
- security Github Security Advisory GHSA-2qjp-425j-52j9 in 1.5.16
- security [release/1.5] update to Go 1.18.8 to address CVE-2022-41716 () in 1.5.15
- security [release/1.5] update to Go 1.18.8 to address CVE-2022-41716 in 1.5.15
- security [release/1.5] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 () in 1.5.14
- security a6672294a [release/1.5] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 in 1.5.14
- security The thirteenth patch release for containerd 1.5 includes a fix for CVE-2022-31030. in 1.5.13
- security Fix ExecSync handler to cap console output size (GHSA-5ffw-gxpp-mxpf) in 1.5.13
- security Github Security Advisory GHSA-5ffw-gxpp-mxpf in 1.5.13
- security The eleventh patch release for containerd 1.5 includes a fix for CVE-2022-24769. in 1.5.11
- security Fix the inheritable capability defaults (GHSA-c9cp-9c75-9v8c) in 1.5.11
- security Github Security Advisory GHSA-c9cp-9c75-9v8c in 1.5.11
- security [release/1.5] update to go 1.16.15 to address CVE-2022-24921 () in 1.5.11
- security [release/1.5] update to go 1.16.15 to address CVE-2022-24921 in 1.5.11
- security The tenth patch release for containerd 1.5 includes a fix for CVE-2022-23648 and other issues. in 1.5.10
- security Use fs.RootPath when mounting volumes (GHSA-crp2-qrr5-8pq7) in 1.5.10
- security Github Security Advisory GHSA-crp2-qrr5-8pq7 in 1.5.10
- security The ninth patch release for containerd 1.5 is a security release to fix CVE-2021-43816. in 1.5.9
- security Fix unprivileged pod using 'hostPath' bypassing SELinux labels (GHSA-mvff-h3cj-wj9c) in 1.5.9
- security Github Security Advisory GHSA-mvff-h3cj-wj9c in 1.5.9
- security The eighth patch release for containerd 1.5 contains a mitigation for CVE-2021-41190 as well as several fixes and updates. in 1.5.8
- security Handle ambiguous OCI manifest parsing (GHSA-5j5w-g665-5m35) in 1.5.8
- security Merge Github Security Advisory GHSA-5j5w-g665-5m35 in 1.5.8
- security The seventh patch release for containerd 1.5 is a security release to fix CVE-2021-41103. in 1.5.7
- security Fix insufficiently restricted permissions on container root and plugin directories GHSA-c2h3-6mxw-7mvq in 1.5.7
- security 8686ededf Merge pull request from GHSA-c2h3-6mxw-7mvq in 1.5.7
- security The fourth patch release for containerd 1.5 is a security release to address CVE-2021-32760. in 1.5.4
- security 7ad08c69e Merge pull request from GHSA-c72p-9xmj-rx3w in 1.5.4
- security The second patch release for containerd 1.5 is a security release to update runc for CVE-2021-30465 in 1.5.2
- security 550b4949c Merge pull request from mikebrow/cri-security-profile-update in 1.5.0
- security d50de11ce ISSUE_TEMPLATE: remove redundant "report a security issue" button in 1.5.0
- security 3d358c9df [cri] don't clear base security settings in 1.5.0
- security 4a4bb851f Merge pull request from GHSA-36xw-fx78-c5r4 in 1.5.0
- security f673f0cf5 remove greetings due to security issue in 1.5.0
- security ef54a7839 vendor: bump golang.org/x/crypto bac4c82f6975 (CVE-2020-9283) in 1.5.0
- security 5f0bf0523 pick up fix for CVE-2019-19921 in opencontainers/selinux in 1.5.0
- security e1f74f00a Various security related fixes in 1.5.0
- security The thirteenth patch release for containerd 1.4 is a security release to address CVE-2022-23648. in 1.4.13
- security Use fs.RootPath when mounting volumes (GHSA-crp2-qrr5-8pq7) in 1.4.13
- security Github Security Advisory GHSA-crp2-qrr5-8pq7 in 1.4.13
- security The twelfth patch release for containerd 1.4 contains a few minor bug fixes and an update to mitigate CVE-2021-41190. in 1.4.12
- security Handle ambiguous OCI manifest parsing (GHSA-5j5w-g665-5m35) in 1.4.12
- security Merge Github Security Advisory GHSA-5j5w-g665-5m35 in 1.4.12
- security The eleventh patch release for containerd 1.4 is a security release to fix CVE-2021-41103. in 1.4.11
- security Fix insufficiently restricted permissions on container root and plugin directories GHSA-c2h3-6mxw-7mvq in 1.4.11
- security 5b46e404f Merge pull request from GHSA-c2h3-6mxw-7mvq in 1.4.11
- security The eighth patch release for containerd 1.4 is a security release to address CVE-2021-32760. in 1.4.8
- security 22e9a70c7 Merge pull request from GHSA-c72p-9xmj-rx3w in 1.4.8
- security The sixth patch release for containerd 1.4 is a security release to update runc for CVE-2021-30465 in 1.4.6
- security The fourth patch release for containerd 1.4 contains a fix for CVE-2021-21334 along with various other minor issues. See GHSA-6g2q-w5j3-fwh4 for more details related to CVE-2021-21334. in 1.4.4
- security 05f951a37 Merge pull request from GHSA-6g2q-w5j3-fwh4 in 1.4.4
- security The third patch release for containerd 1.4 is a security release to address CVE-2020-15257. See GHSA-36xw-fx78-c5r4 for more details. in 1.4.3
- security 269548fa2 Merge pull request from GHSA-36xw-fx78-c5r4 in 1.4.3
- security 32ba75f0 Update Golang 1.13.7 (CVE-2020-0601, CVE-2020-7919) in 1.4.0
- security faf03c3d Pick up fix for CVE-2019-16884 in opencontainers/selinux in 1.4.0
- security 6356e55b Update Golang 1.12.12 (CVE-2019-17596) in 1.4.0
- security f673f0cf remove greetings due to security issue in 1.4.0
- security ef54a783 vendor: bump golang.org/x/crypto bac4c82f6975 (CVE-2020-9283) in 1.4.0
- security 5f0bf052 pick up fix for CVE-2019-19921 in opencontainers/selinux in 1.4.0
- security The tenth patch release for containerd 1.3 contains a fix for CVE-2021-21334 along with various other minor issues. This is the final release for containerd 1.3. in 1.3.10
- security See GHSA-6g2q-w5j3-fwh4 for more details related to CVE-2021-21334. in 1.3.10
- security 1c5970efb Merge pull request from GHSA-6g2q-w5j3-fwh4 in 1.3.10
- security The ninth patch release for containerd 1.3 is a security release to address CVE-2020-15257. See GHSA-36xw-fx78-c5r4 for more details. in 1.3.9
- security ea765aba0 Merge pull request from GHSA-36xw-fx78-c5r4 in 1.3.9
- security b512c23a47 Update Golang 1.13.7 (CVE-2020-0601, CVE-2020-7919) in 1.3.4
- security dde0ab66c5 Revert "Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)" in 1.3.4
- security Update the runc vendor to v1.0.0-rc10 which includes a mitigation for CVE-2019-19921. in 1.3.3
- security Update the opencontainers/selinux which includes a mitigation for CVE-2019-16884. in 1.3.3
- security Update Golang runtime to 1.12.16, mitigating the CVE-2020-0601 certificate verification bypass on Windows, and CVE-2020-7919, which only affects 32-bit architectures. in 1.3.3
- security Update the gopkg.in/yaml.v2 vendor to v2.2.8 with a mitigation for CVE-2019-11253 in 1.3.3
- security d1e31f9f2d Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919) in 1.3.3
- security 9cf15235d0 Merge pull request from dims/bump-opencontainers/selinux-for-CVE-2019-16884-release-1.3 in 1.3.3
- security 3074db3a4b Pick up fix for CVE-2019-16884 in opencontainers/selinux in 1.3.3
- security Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for CVE-2019-16884. in 1.3.1
- security Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime, syscall and net packages (Go 1.12.12). in 1.3.1
- security 23b0ca70fe Update Golang 1.12.12 (CVE-2019-17596) in 1.3.1
- security Fixes CVE-2020-15157: containerd v1.2.x can be coerced into leaking credentials during image pull in 1.3.0
- security Update runc dependency Updated runc for CVE-2019-16884 in 1.3.0
- security 35d3bae1e1 AppVeyor: bump golang 1.12.10 (CVE-2019-16276) in 1.3.0
- security 95dbbdc8c1 Bump runc for CVE-2019-16884 in 1.3.0
- security 1b389b3628 AppVeyor: update to go 1.12.8 (CVE-2019-9512, CVE-2019-9514) in 1.3.0
- security aaca11c40d Merge pull request from dmcgowan/extended-security-releases in 1.3.0
- security 14eaad0cd9 Update runc to 6635b4f0c6af3810594d2770f662f34ddc15b40d (CVE-2019-5736) in 1.3.0
- security b5a794649a Merge pull request from estesp/security-audit in 1.3.0
- security a79879e9dd Add security audit report to README in 1.3.0
- security The fourteenth patch release for containerd 1.2 is a security release to fix CVE-2020-15157. in 1.2.14
- security Fix bug which allowed manifests to coerce containerd clients into leaking registry credentials GHSA-742w-89gc-8m9c in 1.2.14
- security abbb17959 Add comment clarifying fix for security issue in 1.2.14
- security 305703670 Update Golang 1.13.7 (CVE-2020-0601, CVE-2020-7919) in 1.2.14
- security c5843f944 Revert "Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)" in 1.2.14
- security The twelfth patch release for containerd 1.2 includes an updated runc with a fix for CVE-2019-19921, an updated version of the opencontainers/selinux dependency, which includes a fix for CVE-2019-16884, an updated version of the gopkg.in/yaml.v2 dependency to address CVE-2019-11253, and a Golang… in 1.2.12
- security Update the runc vendor to v1.0.0-rc10 which includes a mitigation for CVE-2019-19921. in 1.2.12
- security Update the opencontainers/selinux which includes a mitigation for CVE-2019-16884. in 1.2.12
- security Update Golang runtime to 1.12.16, mitigating the CVE-2020-0601 certificate verification bypass on Windows, and CVE-2020-7919, which only affects 32-bit architectures. in 1.2.12
- security Update the gopkg.in/yaml.v2 vendor to v2.2.8 with a mitigation for CVE-2019-11253 in 1.2.12
- security 44b5bac0c0 Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919) in 1.2.12
- security 7276974071 Merge pull request from dims/bump-opencontainers/selinux-for-CVE-2019-16884-release-1.2 in 1.2.12
- security 4c03d5dfb8 Pick up fix for CVE-2019-16884 in opencontainers/selinux in 1.2.12
- security ae6b4816 pick up fix for CVE-2019-19921 in opencontainers/selinux in 1.2.12
- security The eleventh patch release for containerd 1.2 includes an updated runc with an additional fix for CVE-2019-16884 and a Golang update. in 1.2.11
- security Update the runc vendor to v1.0.0-rc9 which includes an additional mitigation for CVE-2019-16884. in 1.2.11
- security Update Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime, syscall and net packages (Go 1.12.12). in 1.2.11
- security e319caedc4 Update Golang 1.12.12 (CVE-2019-17596) in 1.2.11
- security Update the runc vendor to capture the fix for CVE-2019-16884. Fixed by PR #3685 in 1.2.10
- security Update Golang runtime to 1.12.10 to handle CVE-2019-16276. More detail on the Golang CVE available in golang/go#34540 in 1.2.10
- security 8d33d03519 AppVeyor: bump golang 1.12.10 (CVE-2019-16276) in 1.2.10
- security 0c961b1867 Bump runc for CVE-2019-16884 in 1.2.10
- security Addresses CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood). in 1.2.9
- security Resolves CVE-2019-9512 and CVE-2019-9514 from the 1.12.8 security release. Originally fixed via PR #3531 which lists the details of the Golang CVEs, backported via PR #3532 to release/1.2. in 1.2.8
- security 4097217bbd AppVeyor: update to go 1.12.8 (CVE-2019-9512, CVE-2019-9514) in 1.2.8
- security It whitelists 2 new syscalls in the default seccomp profile, and also updates CNI to v0.7.5 to include the fix for CVE-2019-9946. in 1.2.6
- security cri: Update CNI plugins to v0.7.5 for CVE-2019-9946. in 1.2.6
- security The fifth patch release for containerd 1.2 contains fixes for image management, cgroup management and the CRI plugin. It also updates runc to include an improved fix for CVE-2019-5736 to reduce the increased memory-consumption introduced by the original patch. All these changes are noted below. in 1.2.5
- security runc updated to 2b18fe1d885ee5083ef9f0838fee39b62d653e30 to include the improved fix for CVE-2019-5736. in 1.2.5
- security The fourth patch release for containerd 1.2 re-vendors runc which includes the patch for the critical CVE-2019-5736 escape vulnerability. This release also includes a few fixes for the CRI plugin as well as a change for Windows; all these changes are noted below. in 1.2.4
- security runc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve CVE-2019-5736 in 1.2.4
- security b4bf3e340c Update runc to 6635b4f0c6af3810594d2770f662f34ddc15b40d (CVE-2019-5736) in 1.2.4
Deprecations
- deprecated Deprecate shim.Command () in 2.3.0
- deprecated cri: deprecate restore in CreateContainer () in 2.2.7
- deprecated c59d041d8 cri: deprecate restore in CreateContainer in 2.2.7
- deprecated Deprecate cgroup v1 () in 2.2.0
- deprecated Postpone v2.2 deprecation items to v2.3 () in 2.2.0
- deprecated Postpone v2.2 deprecation items to v2.3 () in 2.1.5
- deprecated 6374a8f9d Postpone v2.2 deprecation items to v2.3 in 2.1.5
- deprecated Update removal version for deprecated registry config fields () in 2.1.1
- deprecated 37d6c4236 Update removal version for deprecated registry config fields in 2.1.1
- deprecated Postpone cri config deprecations to v2.2 () in 2.1.0
- deprecated Remove deprecated dynamic library plugins () in 2.1.0
- deprecated Remove the support for Schema 1 images () in 2.1.0
- deprecated f58939c33 Remove deprecated WithCDIDevices in oci spec opts in 2.0.3
- deprecated Update warnings for deprecated CRI config fields () in 2.0.0
- deprecated Add type alias for event Envelope () in 2.0.0
- deprecated Postpone removal of deprecated CRI config properties () in 2.0.0
- deprecated Deprecate go-plugin configuration option () in 2.0.0
- deprecated CNI conf_template in CRI is no longer deprecated () in 2.0.0
- deprecated 3d7a50749 Replace use of deprecated api Envelope in 1.7.25
- deprecated 929e7bde6 Use api types over deprecated alias in 1.7.25
- deprecated 3ca0c62 gha: update CodeQL action to v3, as v2 is deprecated in 1.7.25
- deprecated Substitute deprecated rand.Seed() in Go 1.20 (containerd/continuity#231) in 1.7.25
- deprecated 242e29e Substitute deprecated rand.Seed() in Go 1.20 in 1.7.25
- deprecated 51939238f Revert "errdefs: denote deprecation as a godoc comment" in 1.7.23
- deprecated Update warnings for deprecated CRI config fields () in 1.7.21
- deprecated pkg/userns: deprecate and migrate to github.com/moby/sys/userns () in 1.7.21
- deprecated 65f7d0740 pkg/userns: deprecate and migrate to github.com/moby/sys/user/userns in 1.7.21
- deprecated 9afb8dcdf deprecation: update warnings for CRI config fields in 1.7.21
- deprecated errdefs: denote deprecation as a godoc comment () in 1.7.20
- deprecated c7d5e430a errdefs: denote deprecation as a godoc comment in 1.7.20
- deprecated reference: deprecate SplitObject () in 1.7.19
- deprecated dba53578c pkg/reference: deprecate SplitObject in 1.7.19
- deprecated 6ccdf6977 platforms: mark aliases as deprecated in 1.7.19
- deprecated Update GitHub Actions CI to resolve deprecation warnings (containerd/ttrpc#161) in 1.7.17
- deprecated 589a593 Update GitHub Actions CI to resolve deprecation warnings in 1.7.17
- deprecated 794b0c723 Add deprecated HTTPFallback for package compatibility in 1.7.16
- deprecated f2354894f Deprecate otel configs in 1.7.16
- deprecated cri: propagate deprecation list to runtime status () in 1.7.14
- deprecated c79ffa277 cri: propagate deprecation list to runtime status in 1.7.14
- deprecated ctr: print deprecation warnings on every invocation () in 1.7.14
- deprecated eaebe23de ctr: print deprecation warnings on every invocation in 1.7.14
- deprecated Emit deprecation warning for containerd.io/restart.logpath label usage () in 1.7.12
- deprecated Emit deprecation warning for AUFS snapshotter () in 1.7.11
- deprecated Emit deprecation warning for v1 runtime () in 1.7.11
- deprecated Emit deprecation warning for deprecated CRI configs () in 1.7.11
- deprecated Emit deprecation warning for CRI v1alpha1 usage () in 1.7.11
- deprecated Emit deprecation warning for CRIU config in CRI () in 1.7.11
- deprecated [release/1.7] cri: add deprecation warnings for deprecated CRI configs () in 1.7.11
- deprecated 9d1bad62e deprecation: fix missing spaces in warnings in 1.7.11
- deprecated 51a604c07 cri: add deprecation warning for runtime_root in 1.7.11
- deprecated 8040e74bf cri: add deprecation warning for rutnime_engine in 1.7.11
- deprecated 99adc40eb cri: add deprecation warning for default_runtime in 1.7.11
- deprecated [release/1.7] snapshots: emit deprecation warning for aufs () in 1.7.11
- deprecated 625b35e4b snapshots: emit deprecation warning for aufs in 1.7.11
- deprecated cri: add deprecation warnings for mirrors, auths, and configs () in 1.7.9
- deprecated Expose usage of deprecated features () in 1.7.9
- deprecated [release/1.7] cri: add deprecation warnings for mirrors, auths, and configs () in 1.7.9
- deprecated 152c57e91 cri: add deprecation warning for configs in 1.7.9
- deprecated 689a1036d cri: add deprecation warning for auths in 1.7.9
- deprecated 8c38975bf cri: add deprecation warning for mirrors in 1.7.9
- deprecated 1fbce40c4 cri: add ability to emit deprecation warnings in 1.7.9
- deprecated [release/1.7] Expose usage of deprecated features () in 1.7.9
- deprecated 60d48ffea ctr: new deprecations command in 1.7.9
- deprecated 74a06671a plugin: record deprecation for dynamic plugins in 1.7.9
- deprecated fa5f3c91a server: add ability to record config deprecations in 1.7.9
- deprecated f7880e7f0 pull: record deprecation warning for schema 1 in 1.7.9
- deprecated 1dd2f2c02 introspection: add support for deprecations in 1.7.9
- deprecated aaf000c18 api/introspection: deprecation warnings in server in 1.7.9
- deprecated 9b7ceee54 warning: new service for deprecations in 1.7.9
- deprecated b708f8bfa deprecation: new package for deprecations in 1.7.9
- deprecated 09633b539 deprecate logs package, but disable linter (for transitioning) in 1.7.7
- deprecated [release/1.7] Remove cni conf_template deprecation () in 1.7.3
- deprecated 0b2b96479 RELEASES.md: de-deprecation of CNI conf_template will be v1.7.3 in 1.7.3
- deprecated a24267b28 Remove cni conf_template deprecation in 1.7.3
- deprecated [release/1.7 backport] remotes/docker: ResolverOptions: fix deprecation comments () in 1.7.2
- deprecated eeda70fb0 remotes/docker: ResolverOptions: fix deprecation comments in 1.7.2
- deprecated Update warnings for deprecated CRI config fields () in 1.6.35
- deprecated ed87e4787 deprecation: update warnings for CRI config fields in 1.6.35
- deprecated errdefs: denote deprecation as a godoc comment () in 1.6.34
- deprecated ce685376f errdefs: denote deprecation as a godoc comment in 1.6.34
- deprecated b12c3b0c8 Add deprecated HTTPFallback for package compatibility in 1.6.32
- deprecated 2fda262a9 Deprecate otel configs in 1.6.32
- deprecated 3785deac4 cri: propagate deprecation list to runtime status in 1.6.30
- deprecated ctr: print deprecation warnings on every invocation () in 1.6.30
- deprecated b7a0b1b8e ctr: print deprecation warnings on every invocation in 1.6.30
- deprecated Emit deprecation warning for CRIU config usage () in 1.6.27
- deprecated Emit deprecation warning for some CRI configs () in 1.6.27
- deprecated Emit deprecation warning for containerd.io/restart.logpath label usage () in 1.6.27
- deprecated [release/1.6] cri: add deprecation warnings for deprecated CRI configs () in 1.6.27
- deprecated 713065793 deprecation: fix missing spaces in warnings in 1.6.27
- deprecated de0cc92a7 cri: add deprecation warning for runtime_root in 1.6.27
- deprecated 833b94149 cri: add deprecation warning for rutnime_engine in 1.6.27
- deprecated 47de3d63d cri: add deprecation warning for default_runtime in 1.6.27
- deprecated Emit deprecation warning for AUFS snapshotter usage () in 1.6.26
- deprecated Emit deprecation warning for v1 runtime usage () in 1.6.26
- deprecated Emit deprecation warning for CRI v1alpha1 usage () in 1.6.26
- deprecated [release/1.6] snapshots: emit deprecation warning for aufs () in 1.6.26
- deprecated 7cfe7052f snapshots: emit deprecation warning for aufs in 1.6.26
- deprecated Soft deprecate log package () in 1.6.25
- deprecated Expose usage of deprecated features () in 1.6.25
- deprecated [release/1.6] cri: add deprecation warnings for mirrors, auths, and configs () in 1.6.25
- deprecated b68204e53 cri: add deprecation warning for configs in 1.6.25
- deprecated ae8c58319 cri: add deprecation warning for auths in 1.6.25
- deprecated 455edcad2 cri: add deprecation warning for mirrors in 1.6.25
- deprecated 878823f4d cri: add ability to emit deprecation warnings in 1.6.25
- deprecated [release/1.6] deprecation: new package for deprecations () in 1.6.25
- deprecated 477b7d6a1 ctr: new deprecations command in 1.6.25
- deprecated 24068b813 dynamic: record deprecation for dynamic plugins in 1.6.25
- deprecated 218c7a1df server: add ability to record config deprecations in 1.6.25
- deprecated dfb9e1deb pull: record deprecation warning for schema 1 in 1.6.25
- deprecated 90b42da6f introspection: add support for deprecations in 1.6.25
- deprecated 0b6766b37 api/introspection: deprecation warnings in server in 1.6.25
- deprecated de3cb4c18 warning: new service for deprecations in 1.6.25
- deprecated da1b4419b deprecation: new package for deprecations in 1.6.25
- deprecated 81fa93784 Stop using math/rand.Read and rand.Seed (deprecated in Go 1.20) in 1.6.24
- deprecated fec784a06 lint: silence "SA1019: tar.TypeRegA has been deprecated... (staticheck)" in 1.6.24
- deprecated [release/1.6 backport] release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles () in 1.6.22
- deprecated 59a143670 release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles in 1.6.22
- deprecated [release/1.6 backport] remotes/docker: ResolverOptions: fix deprecation comments () in 1.6.22
- deprecated 56ff20839 remotes/docker: ResolverOptions: fix deprecation comments in 1.6.22
- deprecated e6179af1e remove unneeded nolint-comments (nolintlint), disable deprecated linters in 1.6.20
- deprecated Move up actions versions to prep for deprecation in 1.6.13
- deprecated 5bf078f Remove deprecated io/ioutil (except ioutil.ReadDir) in 1.6.9
- deprecated [release/1.6] config: improve config v1 deprecation message () in 1.6.5
- deprecated 3bb5a9d19 config: improve config v1 deprecation message in 1.6.5
- deprecated [release/1.5] config: improve config v1 deprecation message () in 1.5.12
- deprecated 4c98768bd config: improve config v1 deprecation message in 1.5.12
- deprecated go.mod: coreos/go-systemd/v22 v22.3.2 to prepare for deprecations () in 1.5.12
- deprecated f8918cf go.mod: coreos/go-systemd/v22 v22.3.2 to prepare for deprecations in 1.5.12
- deprecated 4dc758d0c Merge pull request from AkihiroSuda/deprecate-aufs in 1.5.0
- deprecated c19b7b64d RELEASES.md: recommend alternatives for deprecated features in 1.5.0
- deprecated 8a62aa1c3 Deprecate built-in aufs snapshotter in 1.5.0
- deprecated 6bf77c5eb Merge pull request from containerd/revert-5303-cri-remove-deprecated-default-untrusted in 1.5.0
- deprecated d4be6aa8f rm mirror defaults; doc registry deprecations in 1.5.0
- deprecated dc8af03ba Merge pull request from mikebrow/cri-remove-deprecated-default-untrusted in 1.5.0
- deprecated b5bf1fd5d Fix deprecated registry auth conversion. in 1.5.0
- deprecated befc70b44 Merge pull request from mikebrow/fix-deprecated-greeting in 1.5.0
- deprecated f9760af8d Merge pull request from Random-Liu/remove-no-pivot-deprecation in 1.5.0
- deprecated 871a8b89c Do not deprecate no_pivot yet. in 1.5.0
- deprecated fb5210e2a Merge pull request from Random-Liu/print-deprecated-notice in 1.5.0
- deprecated b74653b82 Print warning message for deprecated options. in 1.5.0
- deprecated db9080847 Update doc and add deprecation policy for CRI options. in 1.5.0
- deprecated 03c371a gha: replace uses of deprecated "set-env", "add-path" in 1.4.4
- deprecated 7efa54f0 Fix deprecated registry auth conversion. in 1.4.4
- deprecated 0a3488c71 Fix GH Actions CI deprecations in 1.4.2
- deprecated bb8b690f gha: replace uses of deprecated "set-env", "add-path" in 1.4.2
- deprecated Deprecate io.containerd.runtime.v1.* and io.containerd.runc.v1 in 1.4.0
- deprecated d4b17275 Merge pull request from AkihiroSuda/deprecate-legacy-shims in 1.4.0
- deprecated 04b98bb0 Deprecate legacy shims in 1.4.0
- deprecated b96f5f4b Fix deprecation warnings in CRI tests due to missing unix:// scheme in 1.4.0
- deprecated a30225b2 Merge pull request from thaJeztah/deprecate_sys_epoll in 1.4.0
- deprecated 0a7fd55f sys: deprecate EpollCreate1, EpollCtl, EpollWait in 1.4.0
- deprecated d616474 remove deprecated controller in 1.4.0
- deprecated befc70b4 Merge pull request from mikebrow/fix-deprecated-greeting in 1.4.0
- deprecated 03c371a gha: replace uses of deprecated "set-env", "add-path" in 1.3.10
- deprecated 651188ccf Fix GH Actions CI deprecations in 1.3.8
- deprecated ctr cri load command is deprecated, use ctr -n=k8s.io images import instead.(https://github.com/containerd/cri/issues/909) in 1.3.0
- deprecated The plugins.cri.containerd.default_runtime option is deprecated, use plugins."io.containerd.grpc.v1.cri".containerd.default_runtime_name instead. (https://github.com/containerd/cri/issues/1076) in 1.3.0
- deprecated Runtime options including systemd_cgroups, runtime_engine and runtime_root are deprecated, use runtime options instead. (https://github.com/containerd/cri/pull/1217) in 1.3.0
- deprecated runtimeHandler field is moved from the sandbox info into status. (https://github.com/containerd/cri/pull/1063) in 1.3.0
- deprecated plugins.cri.registry.auths is deprecated, use plugins.cri.registry.configs instead. (https://github.com/containerd/cri/pull/1227) in 1.3.0
- deprecated c1fc21e92e ctr: use NewDockerAuthorizer instead of deprecated NewAuthorizer in 1.3.0
- deprecated f9760af8 Merge pull request from Random-Liu/remove-no-pivot-deprecation in 1.3.0
- deprecated 871a8b89 Do not deprecate no_pivot yet. in 1.3.0
- deprecated fb5210e2 Merge pull request from Random-Liu/print-deprecated-notice in 1.3.0
- deprecated b74653b8 Print warning message for deprecated options. in 1.3.0
- deprecated db908084 Update doc and add deprecation policy for CRI options. in 1.3.0
- deprecated cluster/health-monitor.sh in the release tarball will be deprecated next release. Please use Kubernetes health-monitor.sh instead. in 1.2.0
Every release in between
featureAdd transfer types for container filesystem copy ()
featureAdd option to inject trace ID to logs ()
featurePropagate OpenTelemetry traces in outgoing RPCs from plugin clients ()
featureUpdate plugin config migration to run on load ()
featureUpdate sandbox API to include spec field ()
featureAllow containers to use user namespaces with host networking ()
featureWire UpdatePodSandboxResources to Sandbox API ()
featureUnpack images with per-layer labels for specific runtime ()
featurePopulate ImageId field in container status ()
featureSet annotations parameter in CreateSandbox request ()
featureAdd background stats collector to calculate UsageNanoCores for containers and pod sandboxes ()
featureSupport zstd-wrapped EROFS layers ()
featureAdd os.features support for EROFS native container images ()
featureAdd EROFS layer media type ()
featureAdd dmverity support to the erofs snapshotter ()
featureUse fsmount API to avoid PAGE_SIZE limit for erofs ()
featurePass container user (uid, gids) to plugins ()
featurePass seccomp policy to plugins ()
featurePass any POSIX rlimits to plugins ()
featurePass extended container status to NRI. ()
featurePass injected CDI devices to plugins ()
featurePass linux sysctl to plugins ()
featureUse dedicated RPC calls for all pod and container life-cycle events via the NRI wire protocol (containerd/nri#274)
featureAdd basic metrics collection for the NRI framework (containerd/nri#277)
featureExchange NRI versions between plugins and the runtime during registration (containerd/nri#271)
featureEnable adjusting Linux memory policy from NRI plugins (containerd/nri#166)
featureClose plugins if initial synchronization fails to prevent unregistered connections (containerd/nri#279)
featureAccumulate owners for OCI hook adjustments, disallowing commas in plugin names (containerd/nri#264)
featureAdd nri_no_wasm build tag to allow disabling WASM support at compile time (containerd/nri#253)
featureSupport direct adjustment of the intelRdt container configuration (containerd/nri#215)
featureAllow setting kernel scheduling policy attributes via NRI (containerd/nri#160)
featureAllow adjusting Linux network devices via NRI (containerd/nri#157)
featureAdd support for sysctl adjustment via NRI (containerd/nri#248)
featureExpose container user, group, and supplemental group IDs to plugins (containerd/nri#230)
featureAdd configured socket directory to shim bootstrap protocol ()
featureIntroduce shim bootstrap protocol ()
featureFix binary logging driver not blocking container start on failure ()
featureUse new filtered cgroups stats API ()
featureUpdate OOMKilled event handling ()
deprecatedDeprecate shim.Command ()
+76 more items in the release notessecurityCVE-2026-95839
securityGHSA-5p7c-hggf-c748
securityGHSA-8647-2jxj-p2rc
securityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureAvoid hang and data corruption during multipart image fetch ()
featureApply hardening to reject image references with ".." path components ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
otherPrepare release notes for v2.2.10 ()
other27d59fe59 Prepare release notes for v2.2.10
otherUpdate to go1.26.9 ()
othercb4648a80 Update to go1.26.9, remove go1.25.12
other6fe70e5cc Merge commit from fork
other70c8ae49e remotes/docker: bound parallel fetch readers
otheraff52a508 Merge commit from fork
other2455fec2f images: skip malformed digests when computing referrer labels
other32fc74497 Merge commit from fork
other5f8c507a2 content, remotes: bound reads to expected size
other14da554b2 Merge commit from fork
otherc3b7534ed cri: unmount checkpoint view on every CRImportCheckpoint return path
otherSkip critest OOMKilled testcase for systemd cgroup ()
othera47da7e9b script/critest.sh: always skip OOMKilled on systemd cgroup
other32c566557 *: skip critest OOMKilled testcase for systemd cgroup
othermultipart fetch stability fixes ()
other5dde40350 multipart fetch stability fixes
fixintegration/client: fix TestContainerExecLargeOutputWithTTY ()
fix7dff2d997 integration/client: fix TestContainerExecLargeOutputWithTTY
othercri: should not follow log file ()
othera5e41909a cri: should not follow log file
otherreference: reject .. path components that rewrite the host ()
other4f71fd9b0 reference: reject .. path components that rewrite the host
othercore/unpack: don't honor id-mapping labels from image annotations ()
other4b3494a8d core/unpack: tighten comments around id-mapping label filtering
other076598878 core/unpack: don't honor id-mapping labels from image annotations
featureseccomp: Use an allow-list for socket domains ()
feature5ba51c0f2 seccomp: Use an allow-list for socket domains
otherConditional actions ()
otherfa5e5452e [CI] Prevents triggering of an inactive issue/PR check for forked repository.
breaking1c0d72890 Makefile: remove go mod download from integration
+2 more items in the release notessecurityCVE-2026-53493
featureFix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ()
featureEnable mount manager for image mounts in CRI ()
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other60acf78bc5 Prepare release notes for v2.2.9
other253f9cc140 Merge commit from fork
other053c0cc412 Bound Walk references
otherefd11fc9c2 Bound Dispatch concurrency and references
othercri: tolerate wrapped ENOTSUP during relabel ()
other39d0dd4b43 cri: tolerate wrapped ENOTSUP during relabel
otherpkg/oci: mask thermal interrupt info ()
otherbaffef9669 pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other9e1ae6a9e9 core/unpack: fetch layers of every config-sharing manifest
othercri: Backport image mount fixes 2.2 ()
other2cdf8d80cc cri: only unmount image volumes when mounting fails
other2e1dcc5da0 cri: enable mount manager for image mounts
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureFix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ()
featureFix EROFS snapshot creation failure caused by concurrent snapshot removal ()
other4864b1814 Prepare release notes for v2.2.8
other3458b7fd3 Merge commit from fork
other22ccf4314 cri: cancel ExecSync IO drain on context cancellation
other2bf01ce17 Merge commit from fork
other45166eb82 archive: skip redundant opaque whiteout walks
otherSet SystemTemp env var to config temp on Windows ()
other2c722ad04 Set SystemTemp env var to config temp on Windows
otherpkg/oci: resolve rootfs symlinks for user lookup ()
other196664bc0 pkg/oci: resolve rootfs symlinks for user lookup
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other6da9d9528 core/remotes/docker: normalize descriptor URL origins
other4f7851699 core/remotes/docker: strip sensitive headers on desc.urls fetch
othersnapshots/erofs: protect snapshot staging from cleanup ()
otherf7075a224 snapshots/erofs: protect snapshot staging from cleanup
securityFixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context
featureDisable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ()
featureDeprecate checkpoint restore in CreateContainer ()
featureSupport non-UTF-8 binary environment variable values in CRI ()
featureDisable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ()
featureEnable OCI runtime feature introspection for non-runc runtimes in CRI ()
featureEnable log scrubbing by default on Windows ()
featureFix mount manager activation error when activation already exists ()
other43f299db6 Prepare release notes for v2.2.7
othercri: disable restore in CreateContainer by default ()
other5c3a47036 cri: disable restore in CreateContainer by default
otherUse ScrubLogs by default on Windows ()
feature4c93ae6d5 ctr: add --scrub-logs flag for Windows
othera124c7e35 cri/config: use ScrubLogs by default on Windows
deprecatedcri: deprecate restore in CreateContainer ()
deprecatedc59d041d8 cri: deprecate restore in CreateContainer
otherHandle []byte envvar value for CRI ()
other6cdc2ddce Handle []byte envvar value
othera60898833 update to v0.34.x kubernetes dependencies
fixFix mount manager activation error when already exists ()
fix54ecff6ca core/mount: Fix mount manager activation error when already exists
otherDisable checkpoint restore codepath when CRIU is not installed ()
otherfd966ba29 github/workflows: install criu in node-e2e
feature7d41b25c9 cri: add enable_criu configuration option
other48116fa59 cri: validate CRIU availability and version early
fixfix(cri): introspect OCI runtime features for non-runc runtimes ()
other6a3d14e8a fix(cri): introspect OCI runtime features for non-runc runtimes
otherci: bound Go fuzzing by execution count ()
other424b714f0 ci: bound Go fuzzing by execution count
othergo.opentelemetry.io/otel v1.38.0 -> v1.41.0
othergo.opentelemetry.io/otel/metric v1.38.0 -> v1.41.0
othergo.opentelemetry.io/otel/trace v1.38.0 -> v1.41.0
othergoogle.golang.org/protobuf v1.36.10 -> f2248ac996af
otherk8s.io/api v0.34.1 -> v0.34.10
otherk8s.io/apimachinery v0.34.1 -> v0.34.10
otherk8s.io/client-go v0.34.1 -> v0.34.10
otherk8s.io/cri-api v0.34.1 -> v0.34.10
featureFix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ()
featureReject CreateContainer calls when the target sandbox is not running ()
featureEnsure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ()
featureLimit fallback to /blobs endpoint during ref resolution to prevent content store pollution ()
otherPrepare release notes for v2.2.6 ()
other701734d2f Prepare release notes for v2.2.6
otherCI: migrate Vagrant to Lima ()
other672ea355f CI: migrate Vagrant to Lima
otherUpdate go to 1.26.5/1.25.12 ()
otherd7eba3f42 Update go to 1.26.5/1.25.12
otherci: pin fog-json to resolve gem conflict ()
other8f123e4f7 ci: pin fog-json to resolve gem conflict
fixFix nil pointer dereference in NRI GetIPs ()
otherd3e1a2be9 Fix nil pointer dereference in NRI GetIPs
othercri: reject CreateContainer when sandbox is not running ()
other872a9502e cri: reject CreateContainer when sandbox is not running
featureAdd defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ()
featureba7605ee7 Add deferred call to ShutdownSandbox to avoid leaks
fixfix: avoid content storage pollution by limiting the fallback on ref resolution ()
other36c4275ee fix:avoid content storage pollution by limiting the fallback on ref resolution
securityCVE-2026-50195
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
otherPrepare release notes for v2.2.5 ()
other269031099 Prepare release notes for v2.2.5
otherad59aa564 Merge commit from fork
other0b4d23690 Merge commit from fork
otherbe8460656 cri: filter CDI annotations on checkpoint restore
other347240f72 Merge commit from fork
othercff578841 cri: do not re-tag restored checkpoints
other668cf2c2f Merge commit from fork
other357652293 cri: make checkpoint restore robust to unexpected archive content
otherd43da05af Merge commit from fork
other30708e8d1 Bound user-database file reads in openUserFile
other028647ea2 Merge commit from fork
otherb6072a49f Do not propagate reserved labels from image configs
othervendor: golang.org/x/crypto v0.53.0 ()
othercfea2c141 [release/2.2] vendor: golang.org/x/crypto v0.53.0
otherupdate runc binary to v1.3.6 ()
otherfc96ea6b3 update runc binary to v1.3.6
otherupdate go to 1.26.4/1.25.11 ()
other5a125fd66 update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
other2b7dfbd7f Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
other1500e586f Clean up disk space in node e2e workflow
othercontrib/checkpoint: increase timeouts to 30s ()
other9991e944e contrib/checkpoint: increase timeouts to 30s
otherrelease: don't mark 2.2 releases as latest ()
other55a1f85d5 release: don't mark 2.2 releases as latest
othergolang.org/x/crypto v0.45.0 -> v0.53.0
othergolang.org/x/mod v0.29.0 -> v0.36.0
othergolang.org/x/net v0.47.0 -> v0.55.0
othergolang.org/x/sync v0.18.0 -> v0.21.0
othergolang.org/x/sys v0.38.0 -> v0.46.0
othergolang.org/x/term v0.37.0 -> v0.44.0
othergolang.org/x/text v0.31.0 -> v0.38.0
securityCVE-2026-46680
securityCVE-2026-34986
otherUse mount manager during image volume processing to support snapshotters that require writable block volumes (e.g., EROFS) ()
fixFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
otherApply hardening to block AF_ALG in default socket policy ()
fixFix bugs in sandbox service affecting sandbox creation configuration and event publishing ()
otherSet AppArmor abi conditionally to support versions < 3.0 ()
otherDisable overlay "rebase" capability when running in a user namespace to fix layer extraction failures ()
otherSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
otherWei Fu
otherAkihiro Suda
otherChris Henzie
otherPaweł Gronowski
otherSamuel Karp
otherBrian Goff
otherChamp-Goblem
otherChris Chang
otherLEI WANG
otherPhil Estes
otherWilliam Myers
otheroci: return explicit error for out-of-range USER values ()
otherd20c6267b oci: return explicit error for out-of-range USER values
otherseccomp: Block AF_ALG in default socket policy ()
otherdb34dc4b4 seccomp: Block AF_ALG in default socket policy
other214b141ee seccomp: Document socket rule scope and socketcall limitation
otherupdate Go to 1.25.10, 1.26.3 ()
otherc2b1856fa update Go to 1.25.10, 1.26.3
otheroverlay: disable "rebase" capability when running in UserNS ()
other63874d262 overlay: disable "rebase" capability when running in UserNS
otherSupport both styles of volatile mount option ()
other2c7d48acf Support both styles of volatile mount option
securityBump go-jose/go-jose to v4.1.4 to fix GHSA-78h2-9frx-2jm8 ()
security80311db63 chore: update go-jose for CVE-2026-34986
othersandbox: forward Create fields, fix event topics ()
othercaa29a741 sandbox: forward Create fields, fix event topics
otherapparmor: Set abi conditionally ()
other5ab0a1206 apparmor: Set abi conditionally
otherParameterize K8s version in node-e2e workflow ()
otherf9c34f7b1 Parameterize K8s version in node-e2e workflow
othercri: use mount manager when image has volumes ()
+4 more items in the release notessecurityCVE-2026-35469
featurePreserve cgroup mount options for privileged containers ()
featureEnsure UpdatePodSandbox returns Unimplemented instead of a generic error ()
featureHandle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 ()
featureEnable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) ()
featureApply hardening to prevent TOCTOU race during tar extraction ()
featureRestore support for client-mounted roots in Windows containers using process isolation ()
featureUpdate runc to v1.3.5 ()
featureApply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems ()
featureFix bug that caused whiteouts to be ignored when parallel unpack was used ()
otherPrepare release notes for v2.2.3 ()
other8a0f4ed5d Prepare release notes for v2.2.3
otherupdate github.com/moby/spdystream v0.5.1 ()
other31bd34a06 update github.com/moby/spdystream v0.5.1
othervendor: github.com/klauspost/compress v1.18.5 ()
other1336f6c45 vendor: github.com/klauspost/compress v1.18.5
otherdiff/walking: enable mount manager ()
other409f75be8 diff/walking: enable mount manager
otherupdate runhcs to v0.14.1 ()
other3f33146c1 update runhcs to v0.14.1
othervendor: github.com/Microsoft/hcsshim v0.14.1 ()
other8bd1b74e5 vendor: github.com/Microsoft/hcsshim v0.14.1
otherc6b0be8e1 vendor: github.com/Microsoft/hcsshim v0.14.0
otherupdate to Go 1.25.9, 1.26.2 ()
other2ecde8cfe update to Go 1.25.9, 1.26.2
otherSkip TestExportAndImportMultiLayer on s390x ()
otherbe554f478 Skip TestExportAndImportMultiLayer on s390x
otherTweak mount info for overlayfs in case of parallel unpack ()
other660de195b Tweak mount info for overlayfs in case of parallel unpack
featurebc9274a4b Add integration test for issue 13030
featurec387890b5 Add integration test for privileged container cgroup mounts
other047a335a6 Forward RUNC_FLAVOR env var down to integration tests
other9b2d72ee0 Preserve host cgroup mount options for privileged containers
other5b66cd6a0 Move cgroup namespace placement higher in spec builder
otherupdate runc binary to v1.3.5 ()
fixFix vagrant on CI ()
fixFix TOCTOU race bug in tar extraction ()
fixfbed68b8f Fix TOCTOU race bug in tar extraction
fixfix(oci): apply absolute symlink resolution to /etc/group ()
fixfix(oci): handle absolute symlinks in rootfs user lookup ()
+12 more items in the release notesfeatureFix migrated CRI image config when using legacy registry mirrors ()
featureUnpack images with per-layer labels for runtime-specific snapshotters ()
featureFix CNI issue where DEL is never executed after a restart ()
featureHarden error handling to strip potentially-sensitive registry parameters ()
featureFix nil pointer dereference in container spec memory metrics when memory constraints are not fully configured ()
featureUse the specified runtime handler when pulling images ()
featureReduce noisy CDI logs ()
featureFix regression for pulling encrypted images ()
featureFix unintended dropping of mount flags for read-only bind-mounts in user namespaces ()
featureFix AppArmor bug disallowing unix domain sockets on newer kernels ()
featureFix ctr image mount failing with "no such device" ()
otherPrepare release notes for v2.2.2 ()
other7e6ecf434 Prepare release notes for v2.2.2
othera20dead7c set default config_path in plugin init
othera5f83d8c2 cri: unpack images with per-layer labels for runtime-specific snapshotters
otherci: modprobe xt_comment on almalinux ()
other68855cb0b ci: modprobe xt_comment on almalinux
featureef7a8beb3 core/mount: add test for getUnprivilegedMountFlags
fix07b2cc07e core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
feature54101116f add integration test for cni result nil
otherd44c4384e address comment
fixf1835270b fix issue where cni del is never executed
other6c05047b4 apparmor: explicitly set abi/3.0
otherci: add build/test go1.26.0, drop go1.24 ()
other5dbf1b915 update golangci-lint to v2.9.0 with go1.26 support
other8ec695ebe remove windows/arm from cross build
otherb9c22a6e3 ci: build/test go1.26.0
fixintegration: Fix TestImageLoad() failure on CI ()
fix09b876a81 integration: Fix TestImageLoad() failure on CI
fixcri: Fix image volumes with user namespaces ()
fix172ba65b6 cri: Fix image volumes with user namespaces
otherupdate to go1.24.13, go1.25.7 ()
otherb4240ef87 update to go1.24.13, go1.25.7
other94dbfaea7 ci: bump go 1.24.12, 1.25.6
otherci: set fetch-depth for containerd to 0 for version parsing ()
othere46a7a286 set fetch-depth for containerd to 0 for version parsing
fix1d7908273 core/mount/manager: fix bind mount missing rbind option
feature3d509bcd3 core/mount/manager: add tests for WithTemporary option
othercb3ae2119 fix: sanitize error before gRPC return to prevent credential leak in pod events
otherbump google.golang.org/grpc from 1.76.0 to 1.78.0 ()
+18 more items in the release notesfeatureRedact all query parameters in CRI error logs ()
featureFix image defaults on Darwin to usable configuration ()
featureFix possible panic from WithMediaTypeKeyPrefix ()
featureUpdate runc binary to v1.3.4 ()
featureFix parsing of hugetlb..events files (containerd/cgroups#379)
securityc22cf5d49 cri,nri: pass any linux security profile to plugins.
breakingpkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const ()
breaking58d23ab63 pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const
breaking73a08aa00 go.mod: remove exclude rules
breakingcore/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor ()
breakinged19c5420 core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor
featureRevert "Implement io.ReaderAt on docker fetch reader" ()
feature678f944dd Revert "Implement io.ReaderAt on docker fetch reader"
featureadaptation: allow compiling out WASM support altogether. (containerd/nri#253)
featureab88fe6 adaptation: allow compiling out WASM support altogether.
breaking8c0c9f6 Implement removal of RDT
featuredfbae8a plugins: add sample rdt plugin
featured05dd81 pkg/adaptation: support new RDT fields
feature725289b pkg/runtime-tools/generate: support new RDT fields
featurea7832a2 api: add rdt
featurepkg/api: add OptionalRepeatedString type (containerd/nri#212)
feature687c1a6 pkg/api: add OptionalRepeatedString type
featureapi,adaptation,generate: allow setting kernel scheduling policy attributes. (containerd/nri#160)
feature6a371ac device-injector: add scheduling policy adjustment.
featuree06369e api,adaptation,generate: allow setting scheduler attributes.
featureapi,adaptation,generate: allow adjusting linux net devices (containerd/nri#157)
feature5145c92 device-injector: add network device injection.
feature8a03823 api,adaptation,generate: allow adjusting linux net devices.
featureAdd support for sysctl adjustment (containerd/nri#248)
feature8705f9b api: add sysctl container adjustment
featurefeat: Make logger a configurable struct member for stub (containerd/nri#239)
feature71b0335 api,adaptation: add container uid/gid info.
featurecontrib: add example for enabling per-container RDT monitoring (containerd/nri#228)
feature91fbf06 contrib: add example for enabling per-container RDT monitoring
feature1a50ff5 Add nolint directives
feature00fa1a1 Add and fix comments for exported types
featureac21da7 pkg/api/seccomp: add comments for exported functions
breaking3aff986 pkg/runtime-tools/generate: remove embedded field "Generator"
featurec0c4bb6 pkg/api/validate: add comments for exported methods
featurec0ba9da adaptation/builtin: add comment for exported symbols
+133 more items in the release notessecurityFixes CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion
securityFixes CVE-2025-64329: Host memory exhaustion through goroutine leaks of Attach functionality in CRI server
securityFixes CVE-2024-25621: Local privilege escalation via wide permissions on several directories
featureAdd mount manager () The mount manager is a new service that provides lifecycle management for filesystem mounts to support more advanced use cases, such as:
featureDevice formatting to create formatted filesystems (xfs, ext4) on-demand
featureMount activation to prepare devices such as loopbacks or network fileystems
featureMount transformation to allow mount arguments to be filled in dynamically from previous mounts
featureGarbage collection of mounts to ensure temporary mounts are never leaked
featureAdd conf.d include in the default config ()
featureAdd support for back references in the garbage collector ()
featurePod Sandbox Metrics () Full implementation of Kubernetes CRI pod-level metrics API
featureListPodSandboxMetrics: Query metrics for running pods/sandboxes
featureListMetricsDescriptors: Discover available metrics and their descriptions
featureSupport image volume mount subpath ()
featureUpdate pkg/oci to use fs.FS interface and os.OpenRoot ()
featureParallel Unpack () Adds support for unpacking layers in parallel during pull operations. This feature is supported with overlayfs and EROFS snapshotters.
featureOCI Referrers Support () Adds new referrers fetcher to remote registry interface using the new referrers endpoint added in OCI distribution-spec 1.1
featureTar unpack progress through transfer service ()
featureEROFS enhancements using mount manager () Improvements to EROFS snapshotter using the new mount manager service
featureQuota Support: Support for sized block devices as the upper layer for overlayfs
featureMount Lifecycle: Loopback setup, block device creation, and overlayfs argument formatting is moved to the mount manager to be performed on-demand or within the runtime.
featureMount handler: To allow optimization of EROFS mount types based on the current system
featuremacOS Support: EROFS snapshotter can now be used on Darwin to natively allow image pulls
featureTar index mode: Efficiently generate EROFS metadata backed by original tar content ()
featureAdd snapshotter and differ for block CIMs ()
featureEnable otel traces in NRI ()
featureAdd WASM plugin support (containerd/nri#121)
featureImprove shim load time after restart by loading in parallel ()
featureFix pidfd leak in UnshareAfterEnterUserns ()
deprecatedDeprecate cgroup v1 ()
deprecatedPostpone v2.2 deprecation items to v2.3 ()
featuregithub.com/StackExchange/wmi cbe66965904d new
featuregithub.com/go-ole/go-ole v1.2.6 new
featuregithub.com/google/certtostore v1.0.6 new
featuregithub.com/google/deck 105ad94aa8ae new
featuregithub.com/hashicorp/errwrap v1.1.0 new
featuregithub.com/knqyf263/go-plugin v0.9.0 new
featuregithub.com/moby/sys/capability v0.4.0 new
featuregithub.com/tetratelabs/wazero v1.9.0 new
featurego.uber.org/goleak v1.3.0 new
+59 more items in the release notessecurityCVE-2026-50195
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
otherPrepare release notes for v2.1.9 ()
otherb8b3a86e9 Prepare release notes for v2.1.9
otheree965da63 Merge commit from fork
otherb5e0c4733 Merge commit from fork
other02045fd46 cri: filter CDI annotations on checkpoint restore
othere9c26cf3c Merge commit from fork
other2e4583a9f cri: do not re-tag restored checkpoints
other6e4ec908a Merge commit from fork
other570e69884 cri: make checkpoint restore robust to unexpected archive content
other3788b4b9e Merge commit from fork
other290420fa7 Bound user-database file reads in openBoundedUserFile
otherbc5014f45 Merge commit from fork
other429bcb924 Do not propagate reserved labels from image configs
otherupdate runc binary to v1.3.6 ()
other698f2fd66 update runc binary to v1.3.6
otherupdate go to 1.26.4/1.25.11 ()
otherb8b75a90e update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
other22515b56f Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
otheraf88d4f60 Clean up disk space in node e2e workflow
other[github-action] release - Empty allowedSignersFile ()
other06df49576 release - Empty allowedSignersFile
securityCVE-2026-46680
featureFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
featureFix bugs in sandbox service affecting sandbox creation configuration and event publishing ()
featureSet AppArmor abi conditionally to support versions < 3.0 ()
featureSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
otherPrepare release notes for v2.1.8 ()
other07f2265d4 Prepare release notes for v2.1.8
otheroci: return explicit error for out-of-range USER values ()
other2054cc54c oci: return explicit error for out-of-range USER values
otherSupport both styles of volatile mount option ()
other677e8f08a Support both styles of volatile mount option
otherbackport: sandbox: forward Create fields, fix event topics ()
otherf3b4b35c9 sandbox: forward Create fields, fix event topics
otherapparmor: Set abi conditionally ()
othereba90da61 apparmor: Set abi conditionally
featureAdd GitHub Action for k8s node e2e tests ()
featureb8b110584 Add GitHub Action for k8s node e2e tests
securityCVE-2026-35469
featurePreserve host cgroup mount options for privileged containers ()
featureFix image volumes when using user namespaces in CRI ()
featureFix issue where CNI DEL was never executed after a restart ()
featureHardening: sanitize errors before returning via gRPC to prevent possible credential leaks in pod events ()
featureEnable options for pulling encrypted images in CRI ()
featureFix possible panic from WithMediaTypeKeyPrefix ()
featureUpdate runc binary to v1.3.5 ()
featureHardening: fix possible TOCTOU race bug in tar extraction ()
featureFix unintended dropping of mount flags for read-only bind-mounts in user namespaces ()
featureExplicitly set AppArmor ABI to 3.0 ()
otherPrepare release notes for v2.1.7 ()
other3a06b6847 Prepare release notes for v2.1.7
otherupdate github.com/moby/spdystream v0.5.1 ()
other82910b8c1 update github.com/moby/spdystream v0.5.1
otherupdate to Go 1.25.9, 1.26.2 ()
other295bdbbff update to Go 1.25.9, 1.26.2
otherSkip TestExportAndImportMultiLayer on s390x ()
other8d0c87494 Skip TestExportAndImportMultiLayer on s390x
fixfe316cc1f remotes: fix possible panic from WithMediaTypeKeyPrefix
otherPreserve cgroup mount options for privileged containers ()
featurec5ee417ab Add integration test for privileged container cgroup mounts
othera5d5a70ed Forward RUNC_FLAVOR env var down to integration tests
other515c7f98d Preserve host cgroup mount options for privileged containers
otherffd9b61c9 Move cgroup namespace placement higher in spec builder
fixFix vagrant on CI ()
fixFix TOCTOU race bug in tar extraction ()
fixaecfb3dc6 Fix TOCTOU race bug in tar extraction
breaking4ed50edce fix: ST1019: removed the duplicate imports
fixcri: Fix image volumes with user namespaces ()
fix8d5351929 cri: Fix image volumes with user namespaces
fixcore/mount: fix getUnprivilegedMountFlags iterating over indices instead of values ()
feature74e575ce8 core/mount: add test for getUnprivilegedMountFlags
fixc62466642 core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
fixFix CNI issue where CNI DEL is never executed ()
fix9710aed4a fix issue where cni del is never executed
fixintegration: Fix TestImageLoad() failure on CI ()
fix51a63212f integration: Fix TestImageLoad() failure on CI
fixfix: sanitize error before gRPC return to prevent credential leak in pod events ()
featureUncomment call to add options for pulling encrypted images ()
+49 more items in the release notesfeatureUpdate runc binary to v1.3.4 ()
otherPrepare release notes for v2.1.6 ()
other93f79087a Prepare release notes for v2.1.6
othergo.mod: containerd/zfs v2.0.0 ()
other7e75db3a9 build(deps): bump github.com/containerd/zfs/v2 from 2.0.0-rc.0 to 2.0.0
othercri/nri: short-circuit nil adjustment. ()
other2b8e11b12 cri/nri: short-circuit nil adjustment.
othergo.mod: github.com/containernetworking/plugins v1.9.0 ()
other69efd067c go.mod: github.com/containernetworking/plugins v1.9.0
breakinggo.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) ()
othere81678853 go.mod: golang.org/x/crypto v0.45.0
other55a2d8c8d CI: drop Go 1.23
otherfd8e3c39b Update Go requirements in BUILDING
breakingcore/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor ()
breakinga4454c49a core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor
other251f0a285 runc: Update runc binary to v1.3.4
otherci: bump Go 1.24.11, 1.25.5 ()
otherc07c29bca ci: bump Go 1.24.11, 1.25.5
othere52817652 ci: bump Go 1.24.10, 1.25.4
other04bbb66e4 ci(release): set GO_VERSION in Dockerfile
otherci: update CIFuzz actions to support Ubuntu 24.04 ()
other492987ccc ci: update CIFuzz actions to support Ubuntu 24.04
otherbuild(deps): bump github.com/opencontainers/selinux ()
other55a25ec6e build(deps): bump github.com/opencontainers/selinux
otherRedact all query parameters in CRI error logs ()
otherb72d0dfe0 fix: redact all query parameters in CRI error logs
otherUpdate 2.1 branch to no longer build as latest ()
otherecd58bd65 Update 2.1 branch to no longer build as latest
otheruse windowsMatchComparer for OSVersion match order (containerd/platforms#25)
other8c0d9f9 use windowsMatchComparer for OSVersion match order
featureAdd WS2025 to Windows matcher and code optimizations (containerd/platforms#24)
other8447b0a Update ci.yml
feature4549974 Add WS2025 to Windows matcher and code optimizations
othergithub.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
othergithub.com/containerd/zfs/v2 v2.0.0-rc.0 -> v2.0.0
othergithub.com/containernetworking/plugins v1.7.1 -> v1.9.0
othergithub.com/coreos/go-systemd/v22 v22.5.0 -> v22.6.0
featuregithub.com/cyphar/filepath-securejoin v0.5.1 new
othergithub.com/go-logr/logr v1.4.2 -> v1.4.3
othergithub.com/opencontainers/selinux v1.12.0 -> v1.13.1
+9 more items in the release notessecurityGHSA-pwhc-rpq9-4c8w
securityGHSA-m6hq-p25p-ffr2
securityGHSA-qw9x-cqr3-wc7r
securityGHSA-cgrx-mc8f-2prm
securityGHSA-9493-h29p-rfm2
featureDisable event subscriber during task cleanup ()
featureAdd SystemdCgroup to default runtime options ()
featureFix userns with container image VOLUME mounts that need copy ()
featureEnsure errContentRangeIgnored error when range-get request is ignored ()
featureUpdate runc binary to v1.3.3 ()
deprecatedPostpone v2.2 deprecation items to v2.3 ()
otherPrepare release notes for v2.1.5 ()
otherfc5bdfeac Prepare release notes for v2.1.5
otherc578c26bf Update mailmap
other46a4a03fb Merge commit from fork
other232786c90 Fix directory permissions
other239ab877d Merge commit from fork
other0766796e8 fix goroutine leak of container Attach
other3d713d3d0 runc: Update runc binary to v1.3.3
otherUpdate GHA runners to use latest images for basic binaries build ()
otherde4221cb7 Update GHA runners to use latest images for basic binaries build
otherci: bump Go 1.24.9, 1.25.3 ()
other2045b1920 ci: bump Go 1.24.9, 1.25.3
otherUpdate GHA runners to use latest image for most jobs ()
other21ec7cc7d Update GHA runners to use latest image for most jobs
deprecated6374a8f9d Postpone v2.2 deprecation items to v2.3
fixFix lost container logs from quickly closing io ()
fix7d9f09ba0 bugfix:fix container logs lost because io close too quickly
breakingRemove additional fuzzers from instrumentation repo ()
featureupdate release builds to 1.24.7 and add 1.25.1 to CI ()
featurec54585ba7 update release builds to 1.24.7 and add 1.25.1 to CI
featuref13f8c431 add SystemdCgroup to default runtime options
feature10944e19f integration: Add test for directives with userns
fix41d74aee2 cri: Fix userns with Dockerfile VOLUME mounts that need copy
fixFix overlayfs issues related to user namespace ()
featureAdd documentation for cgroup_writable field ()
feature4832b4d15 Add documentation for cgroup_writable field
fixfix: create bootstrap.json with 0644 permission ()
fixsys: fix pidfd leak in UnshareAfterEnterUserns ()
fix5ef6ea747 sys: fix pidfd leak in UnshareAfterEnterUserns
+23 more items in the release notesfeatureFix containerd panic when sandbox extension is missing ()
featureUpdate status response to return stable order for runtime handlers ()
featureFix lazy gRPC connection mode waiting for connect on client creation ()
featureFix resolve deadlock issue in docker fetcher open ()
featureUpdate erofs snapshotter to make immutable optional ()
featureFix erofs filesystem UUID for tar-converted layers ()
featureFix close container io not closed when runtime create failed ()
otherPrepare release notes for v2.1.4 ()
feature112e41363 Add release notes for v2.1.4
otheradd2dcf86 Ensure fetcher always closes body and properly calls release
other34a1cb1dd fix(dockerFetcher): resolve deadlock issue in dockerFetcher open
otherci: bump Go 1.23.11, 1.24.5 ()
other82c4d6875 ci: bump Go 1.23.11, 1.24.5
otherBackport windows test fixes ()
other6cc2a8d77 Fix intermittent test failures on Windows CIs
fix6adc69312 Remove WS2025 from CIs due to regression
other8d194c19f erofs-snapshotter: make IMMUTABLE_FL optional
feature2df7175d7 client/New: Don't unlazy the gRPC connection implicitly
otherbackport: update go-md2man binary to v2.0.7 ()
other4902adb92 update go-md2man binary to v2.0.7
other02298e1a0 cri:fix containerd panic when can't find sandbox extension
fix583133e71 erofs-differ: fix filesystem UUID for tar-converted layers
other57db13d50 Amend runtime handler test for stable order
otherd822c9048 CRI: Stable sort for RuntimeHandlers
othera2fd70639 Test showing RuntimeHandlers in Status() are unordered
fixb74268f86 bugfix:close container io when runtime create failed
featureFix multipart fetch issue when the server does not return content length ()
featureUpdate transfer service supported platforms logic ()
featureFix import for local transfer service ()
featureFix registry errors with transfer service ()
featureFix fetch always adding range to requests ()
featureUpdate fetcher errors to include full registry error ()
otherPrepare release notes for v2.1.3 ()
other627729341 Prepare release notes for v2.1.3
other7636bd5eb fix when multipart fetching and the server does not return content length
other3c5ede878 Update transfer supported platforms logic
otherfb752bc8e fix import for local transfer service
otherf6d926314 Register remote errors for clients to access registry errors
other7c1813345 Decode grpc errors in the transfer client proxy
otherbabacebad Fix fetch always adding range to requests
otherf30be44ad Update fetcher errors to include full registry error
featureFix check of wrapped errors in erofs snapshotter ()
featureImprove mount error message ()
featureFix transfer differ selection ()
featureEnable DuplicationSuppressor in transfer service ()
featureProperly shutdown non-groupable shims to prevent resource leaks ()
otherPrepare release notes for v2.1.2 ()
other63b9eae62 Prepare release notes for v2.1.2
othercff1feb28 *: properly shutdown non-groupable shims to prevent resource leaks
otherci: bump golang [1.23.10,1.24.4] in build and release ()
other2ce169aae ci: bump golang [1.23.10,1.24.4] in build and release
otherBackport Enable CIs to run on WS2022 and WS2025 ()
other70bcb9b55 Enable CIs to run on WS2022 and WS2025
othercri:use debug level when receive exec process exited events ()
other40575a15f cri:use debug level when receive exec process exited events
otherbuild(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.2 ()
otherc71f77170 build(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.2
other4bcea74de Update differ selection in transfer service to prefer default
feature0c3cd8a99 Add debug log when transfer returns not implemented
feature820e56765 Add more error details when unpack fails to extract
otherFetch image with default platform only in TestExportAndImportMultiLayer ()
other9b6c1949a Fetch image with default platform only in TestExportAndImportMultiLayer
fix480126f50 erofs-snapshotter: fix to work with wrapped errors
otherd82921ff5 Enable DuplicationSuppressor in transfer service
otherci: bump golang [1.23.9, 1.24.3] in build and release ()
other0bb25c3d6 ci: bump golang [1.23.9, 1.24.3] in build and release
otherac8e84efc client:improve mount error message
featureAdd symlink breakout test for overriden path ()
featuredd2ce49d0 Add symlink breakout test for overriden path
othergoogle.golang.org/grpc v1.72.0 -> v1.72.2
securityThe first patch release for containerd 2.1 fixes a critical vulnernability (CVE-2025-47290) which was first introduced in 2.1.0. See the Github Advisory for more details. This release also contains a few smaller updates and bux fixes.
featureFix erofs media type handling ()
featureReduce shim cleanup log level and add more context ()
deprecatedUpdate removal version for deprecated registry config fields ()
othercb1076646 Merge commit from fork
other216667ba0 Prepare release notes for 2.1.1
otherac00b8e61 Revert "perf(applyNaive): avoid walking the tree for each file in the same directory"
otherbuild(deps): bump github.com/Microsoft/hcsshim ()
other444ca17cd update runhcs version to v0.13.0
other0684f1c44 build(deps): bump github.com/Microsoft/hcsshim
othere1817a401 docs/snapshotters/erofs.md: a tip for improved performance
fix2168cb92c erofs-differ: fix EROFS native image support
other7fcbc3c46 core/runtime/v2: cleanup shim-cleanup logs
deprecated37d6c4236 Update removal version for deprecated registry config fields
otherctr:make sure containerd socket exist before create client ()
othere7be076d4 ctr:make sure containerd socket exist before create client
othergithub: mark 2.1 releases as latest ()
otherc90524d5f .github: mark 2.1 releases as latest
othergithub.com/Microsoft/hcsshim v0.13.0-rc.3 -> v0.13.0
securityFixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
featureAdd no_sync option to boost boltDB performance on ephemeral environments ()
featureAdd content create event ()
featureErofs snapshotter and differ ()
featureUpdate CRI to use transfer service for image pull by default ()
featureSupport multiple cni plugin bin dirs ()
featureSupport container restore through CRI/Kubernetes ()
featureAdd OCI/Image Volume Source support ()
featureEnable Writable cgroups for unprivileged containers ()
featureFix recursive RLock() mutex acquisition (containerd/go-cni#126)
featureSupport CNI STATUS Verb (containerd/go-cni#123)
featureRetry last registry host on 50x responses ()
featureMultipart layer fetch ()
featureEnable HTTP debug and trace for transfer based puller ()
featureAdd support for unpacking custom media types ()
featureAdd dial timeout field to hosts toml configuration ()
featureExpose Pod assigned IPs to NRI plugins ()
featureSupport multiple uid/gid mappings ()
featureFix race between serve and immediate shutdown on the server (containerd/ttrpc#175)
breakingUpdate FreeBSD defaults and re-organize platform defaults ()
deprecatedPostpone cri config deprecations to v2.2 ()
deprecatedRemove deprecated dynamic library plugins ()
deprecatedRemove the support for Schema 1 images ()
othergithub.com/Microsoft/hcsshim v0.12.9 -> v0.13.0-rc.3
othergithub.com/cilium/ebpf v0.11.0 -> v0.16.0
othergithub.com/containerd/cgroups/v3 v3.0.3 -> v3.0.5
othergithub.com/containerd/containerd/api v1.8.0 -> v1.9.0
othergithub.com/containerd/continuity v0.4.4 -> v0.4.5
othergithub.com/containerd/go-cni v1.1.10 -> v1.1.12
othergithub.com/containerd/imgcrypt/v2 v2.0.0-rc.1 -> v2.0.1
othergithub.com/containerd/otelttrpc ea5083fda723 -> v0.1.0
othergithub.com/containerd/platforms v1.0.0-rc.0 -> v1.0.0-rc.1
othergithub.com/containerd/ttrpc v1.2.6 -> v1.2.7
othergithub.com/containerd/typeurl/v2 v2.2.2 -> v2.2.3
othergithub.com/containernetworking/cni v1.2.3 -> v1.3.0
othergithub.com/containernetworking/plugins v1.5.1 -> v1.7.1
othergithub.com/containers/ocicrypt v1.2.0 -> v1.2.1
featuregithub.com/petermattis/goid 4fcff4a6cae7 new
featuregithub.com/sasha-s/go-deadlock v0.3.5 new
featuregithub.com/smallstep/pkcs7 v0.1.1 new
+58 more items in the release notessecurityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
other30145a48d Prepare release notes for v2.0.14
othereaae6434c Merge commit from fork
other21fd0a996 content, remotes: bound reads to expected size
otherSkip critest OOMKilled testcase for systemd cgroup ()
othereb878c296 script/critest.sh: always skip OOMKilled on systemd cgroup
other95be879a5 *: skip critest OOMKilled testcase for systemd cgroup
fixintegration/client: fix TestContainerExecLargeOutputWithTTY ()
fix9101dc4e3 integration/client: fix TestContainerExecLargeOutputWithTTY
other16e119c17 ci:fix ci TestContainerExecLargeOutputWithTTY panic
othercri: should not follow log file ()
other85b6459b2 cri: should not follow log file
othercore/unpack: don't honor id-mapping labels from image annotations ()
other1e0b4964e core/unpack: tighten comments around id-mapping label filtering
other6e9229820 core/unpack: don't honor id-mapping labels from image annotations
featureseccomp: Use an allow-list for socket domains ()
feature1183551f1 seccomp: Use an allow-list for socket domains
otherConditional actions ()
other29ab0dcca [CI] Prevents triggering of an inactive issue/PR check for forked repository.
breaking23c28d68c Makefile: remove go mod download from integration
other4b3976166 ci: skip linters steps in private repositories
otherdb335dfa0 workflows: skip non-CI jobs in private forks
securityCVE-2026-53493
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other87c035016f Prepare release notes for v2.0.13
other9bb64e7024 Merge commit from fork
other2dbcee240e Bound Walk references
othera2e7a37e0c Bound Dispatch concurrency and references
otherpkg/oci: mask thermal interrupt info ()
other16ba4910fe pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other6850f41724 core/unpack: fetch layers of every config-sharing manifest
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureSurface OCI error bodies in registry 403 responses by falling back to GET requests ()
featureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureEnable log scrubbing by default on Windows ()
otherd6a01e72a Prepare release notes for v2.0.12
other2e964db90 Merge commit from fork
othereebea8c4c cri: cancel ExecSync IO drain on context cancellation
otherd93c158a6 Merge commit from fork
other6c060c952 archive: skip redundant opaque whiteout walks
otherSet SystemTemp env var to config temp on Windows ()
other56058341c Set SystemTemp env var to config temp on Windows
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other88c95d56d core/remotes/docker: normalize descriptor URL origins
other7711c3d21 core/remotes/docker: strip sensitive headers on desc.urls fetch
otherUse ScrubLogs by default on Windows ()
feature84c6caa67 ctr: add --scrub-logs flag for Windows
other5fcdfaab2 cri/config: use ScrubLogs by default on Windows
otherci: bound Go fuzzing by execution count ()
otherb452f2856 ci: bound Go fuzzing by execution count
otherCI: migrate Vagrant to Lima ()
othera15448870 CI: migrate Vagrant to Lima
otherremotes: surface OCI error body on HEAD 403 via GET fallback ()
other71a73c8a0 remotes: surface OCI error body on HEAD 403 via GET fallback
featureLimit fallback to /blobs endpoint during ref resolution to prevent content store pollution ()
otherPrepare release notes for v2.0.11 ()
other24a2ac9db Prepare release notes for v2.0.11
otherUpdate go to 1.26.5/1.25.12 ()
other8f0774f1a Update go to 1.26.5/1.25.12
otherci: pin fog-json to resolve gem conflict ()
otherf89266ecb ci: pin fog-json to resolve gem conflict
fixfix: avoid content storage pollution by limiting the fallback on ref resolution ()
other179b642d6 fix:avoid content storage pollution by limiting the fallback on ref resolution
securityCVE-2026-53488
securityCVE-2026-47262
otherPrepare release notes for v2.0.10 ()
othercbbd21672 Prepare release notes for v2.0.10
other200a4005f Merge commit from fork
otherda4098647 Merge commit from fork
other03a19324f Bound user-database file reads in openBoundedUserFile
other126177ea4 Merge commit from fork
otherbbf4a2b8e Do not propagate reserved labels from image configs
otherupdate runc binary to v1.3.6 ()
othera15e98122 update runc binary to v1.3.6
otherba2ed2a5e [release/2.2] update runc binary to v1.3.5
other474184497 runc: Update runc binary to v1.3.4
otherupdate go to 1.26.4/1.25.11 ()
otherbecbb802e update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
other55bdc8bc5 Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
other6d81e8867 Clean up disk space in node e2e workflow
securityCVE-2026-46680
otherEnsure container exit events are not lost during containerd restart ()
otherApply hardening to avoid TOCTOU race in tar extraction ()
fixFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
otherApply hardening to block AF_ALG in default socket policy ()
otherSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
fixFix bugs in sandbox service affecting sandbox creation configuration and event publishing ()
otherSet AppArmor abi conditionally to support versions < 3.0 ()
otherSamuel Karp
otherChris Henzie
otherMaksym Pavlenko
otherPaweł Gronowski
otherWei Fu
otherBrian Goff
otherLEI WANG
otherShachar Tal
otherWilliam Myers
otherningmingxiao
other2da65b8bd Prepare release notes for v2.0.9
otheroci: return explicit error for out-of-range USER values ()
other1a3d1c85e oci: return explicit error for out-of-range USER values
otherseccomp: Block AF_ALG in default socket policy ()
otherfa2a97505 seccomp: Block AF_ALG in default socket policy
other4b2b07879 seccomp: Document socket rule scope and socketcall limitation
otherSupport both styles of volatile mount option ()
otherea56c9605 Support both styles of volatile mount option
otherbackport: sandbox: forward Create fields, fix event topics ()
other3d34dc820 sandbox: forward Create fields, fix event topics
otherapparmor: Set abi conditionally ()
other4b260843e apparmor: Set abi conditionally
featureAdd GitHub Action for k8s node e2e tests ()
feature3e9c4d1e0 Add GitHub Action for k8s node e2e tests
fixFix TOCTOU race bug in tar extraction ()
fixcf73e6873 Fix TOCTOU race bug in tar extraction
othercri:fix lost container exit events if they arrive before info is cached ()
other2320b319e cri:fix lost container exit events if they arrive before info is cached
othercontainerd---.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
othercontainerd-static---.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.
securityCVE-2026-35469
featureSanitize error before gRPC return to prevent possible credential leak in pod events ()
featureFix CNI issue where DEL is never executed after a restart ()
featureUpdate selinux to v1.13.1 ()
otherPrepare release notes for v2.0.8 (missed line) ()
otherc07b94f19 Prepare release notes for v2.0.8 (missed line)
otherPrepare release notes for v2.0.8 ()
otherc54b69f1a Prepare release notes for v2.0.8
otherupdate github.com/moby/spdystream v0.5.1 ()
otherfde1480df update github.com/moby/spdystream v0.5.1
otherupdate to Go 1.25.9, 1.26.2 ()
other5b2eee8a2 update to Go 1.25.9, 1.26.2
otherc579db16e update golangci-lint to v2.9.0 with go1.26 support
other185ddcfd0 remove windows/arm from cross build
other8538158df Ignore warnings for golangci-lint bump
other1cff32695 ci: bump golangci from 6.5.2 to 7.0.0
otherUpdating selinux to v1.13.1 ()
other2e02b8bb3 Skip github.com/cyphar/filepath-securejoin license checks
othere71fc560b Updating selinux to v1.13.1
fixfix: sanitize error before gRPC return to prevent credential leak in pod events ()
other868869eb9 fix: sanitize error before gRPC return to prevent credential leak in pod events
other40632e4f2 fix: redact all query parameters in CRI error logs
otherCODEOWNERS: mark Sam and Chris as owners for 2.0 ()
other85c3b2b02 CODEOWNERS: mark Sam and Chris as owners for 2.0
otherUpdate github.com/moby/spdystream v0.4.0->v0.5.0 ()
other902d804c9 Update github.com/moby/spdystream v0.4.0->v0.5.0
fixFix CNI issue where CNI DEL is never executed ()
othere92d7b131 make linter happy in release
feature12fc0e6ca add integration test for cni result nil
other8d912c6a2 address comment
fix742f8b8f6 fix issue where cni del is never executed
otherCherry-picks to fix CI ()
otherf24653597 Ignore NOCHANGE error
other9c656fab4 ci: update CIFuzz actions to support Ubuntu 24.04
fixc71c4a091 integration: Fix TestImageLoad() failure on CI
otherbfee29999 ci: modprobe xt_comment on almalinux
featuregithub.com/cyphar/filepath-securejoin v0.5.1 new
othergithub.com/moby/spdystream v0.4.0 -> v0.5.1
othergithub.com/opencontainers/selinux v1.11.1 -> v1.13.1
securityGHSA-pwhc-rpq9-4c8w
securityGHSA-m6hq-p25p-ffr2
securityGHSA-qw9x-cqr3-wc7r
securityGHSA-cgrx-mc8f-2prm
securityGHSA-9493-h29p-rfm2
featureDisable event subscriber during task cleanup ()
featureAdd SystemdCgroup to default runtime options ()
featureFix userns with container image VOLUME mounts that need copy ()
featureAdd dial timeout field to hosts toml configuration ()
featureUpdate runc binary to v1.3.3 ()
featureFix lost container logs from quickly closing io ()
featureCreate bootstrap.json with 0644 permission ()
featureFix pidfd leak in UnshareAfterEnterUserns ()
otherPrepare release notes for v2.0.7 ()
other4931e24f1 Prepare release notes for v2.0.7
other205bc4f2d Update mailmap
other5f708b76a Merge commit from fork
other8cd112d82 Fix directory permissions
other05290b5bc Merge commit from fork
other4d1edf4ad fix goroutine leak of container Attach
otherb46dc6a67 runc: Update runc binary to v1.3.3
otherci: bump Go 1.24.9; 1.25.3 ()
other5e9c82178 Update GHA runners to use latest images for basic binaries build
other7f59248dc Update GHA runners to use latest image for most jobs
othere1373e8a8 ci: bump Go 1.24.9, 1.25.3
othere1a910a6a ci: bump Go 1.24.8; 1.25.2
otherfd04b7f17 move exclude-dirs to issues.exclude-dirs
otherb49377975 update golangci-lint to v1.64.2
other6e45022a1 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
other09ce0f2a1 build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
fixf953ee8a3 bugfix:fix container logs lost because io close too quickly
breakingRemove additional fuzzers from instrumentation repo ()
feature427cdd06c add SystemdCgroup to default runtime options
feature3212afc2f integration: Add test for directives with userns
fixb855c6e10 cri: Fix userns with Dockerfile VOLUME mounts that need copy
fixFix overlayfs issues related to user namespace ()
fix5bec0a332 sys: fix pidfd leak in UnshareAfterEnterUserns
fixFix windows test failures ()
fix018470948 Remove WS2025 from CIs due to regression
featureb50cbbc98 Add dial timeout field to hosts toml configuration
+21 more items in the release notesfeatureUpdate containerd config dump to reflect plugin config migrations ()
featureFix containerd panic when sandbox extension is missing ()
featureFix the panic caused by the failure of RunPodSandbox ()
featureAdd extension to sandbox metadata store on create sandbox ()
featureFix issue where Prometheus metric names changed for CRI ()
featureFix issue preventing some v2 shims from shutting down properly ()
featureFix lazy gRPC connection mode waiting for connect on client creation ()
featureFix cross-repo mount fallback after authorization failure ()
featureFix container io to close after runtime create failure ()
featureFix incompatibility with some pre-v3 shims ()
featureUpdate runc binary to v1.3.0 ()
otherPrepare release notes for v2.0.6 ()
otherd94b0fee6 Prepare release notes for v2.0.6
otherci: bump Go 1.23.11, 1.24.5 ()
otherf901e3c81 ci: bump Go 1.23.11, 1.24.5
othergo.mod: golang.org/x/* latest ()
other7e4ac4761 go.mod: golang.org/x/* latest
featurebed6d1401 client/New: Don't unlazy the gRPC connection implicitly
other8094fa21a cri:fix containerd panic when can't find sandbox extension
fix552f717be bugfix:close container io when runtime create failed
fixc4394d05a Fix the panic caused by the failure of RunPodSandbox
otherci: bump golang [1.23.10, 1.24.4] in build and release ()
other54f923a30 ci: bump golang [1.23.10, 1.24.4] in build and release
other2de777dfe ci: bump golang [1.23.9, 1.24.3] in build and release
otherEnable CIs to run on WS2022 and WS2025 ()
other9724cd5ea Enable CIs to run on WS2022 and WS2025
other7fc3151fc *: properly shutdown non-groupable shims to prevent resource leaks
other4396336a1 core/runtime: should invoke shim binary
other10bcc6929 Revert "not set sandbox id when use podsandbox type"
featuref38eb62b6 integration: add testcase to recover ungroupable shim
other2358561d5 Update release upgrade tests to test 1.7 and 2.0
other8931b1464 Fix upgrade test runtime config
otherFetch image with default platform only in TestExportAndImportMultiLayer ()
otherfc9235910 Fetch image with default platform only in TestExportAndImportMultiLayer
otherf8679737e store extension when create sandbox in store
othercbfa66223 fix(docker pusher): if authorizing a cross-repo mount fails, fall back
othergithub: do not mark 2.0 releases as latest ()
other7bf4d0a40 .github: do not mark 2.0 releases as latest
otherfa5a08244 Update runc binary to v1.3.0
otherRevert "disable portmap test in ubuntu-22 to make CI happy" ()
+19 more items in the release notessecurityFixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
featureUpdate go to 1.23.8 ()
featureUpdate ImageService to delete images synchronously ()
featurePrevent panic on zero length push ()
featureSet default differ for the default unpack config of transfer service ()
featureRemove invalid error log when stopping container after containerd restart ()
featureUpdate taskOptions based on runtimeOptions when creating a task ()
other5bcf0a95e use go1.23.8 as the default go version
other4838f33f7 update to go 1.24.2, 1.23.8
otherPrepare release notes for v2.0.5 ()
othera8082cd60 Prepare release notes for v2.0.5
otherDisable criu test on arm64 ()
other58b715ad8 Disable arm64 criu testing in GH Actions
otherb4a53e826 disable portmap test in ubuntu-22 to make CI happy
feature4bcf472de add option to skip tests in critest
other8a638b71a Prevent panic in Docker pusher.
other84d9658c3 Set default differ for the default unpack config of transfer service
otherci: update GitHub Actions release runner to ubuntu-24.04 ()
otherb184a97d3 ci: update GitHub Actions release runner to ubuntu-24.04
othere04543db0 use shimCtx for fifo copy
feature9f46e7a44 integration/client: add tests for TaskOptions is not empty
other8a16a6a04 prefer task options for PluginInfo request
othera183b2d23 update taskOptions based on runtimeOptions when creating a task
other091143135 *: CRIImageService should delete image synchronously
otherUpdate runc binary to v1.2.6 ()
otherc2372c072 Update runc binary to v1.2.6
othergo.{mod,sum}: bump CDI deps to stable v1.0.0. ()
othere8506511b go.{mod,sum}: bump CDI deps to stable v1.0.0.
othersilence govulncheck false positives ()
other4cfb89430 go.mod: github.com/go-jose/go-jose/v4
other2b9e6a29d go.mod: golang.org/x/oauth2 v0.28.0
other6df1ea0d9 go.mod: golang.org/x/net v0.37.0
fixFix CI lint error (cherry-picked #11555) ()
other16f20abdf Fix CI lint error
othergithub.com/go-jose/go-jose/v4 v4.0.4 -> v4.0.5
othergolang.org/x/crypto v0.31.0 -> v0.36.0
othergolang.org/x/net v0.33.0 -> v0.37.0
othergolang.org/x/oauth2 v0.23.0 -> v0.28.0
othergolang.org/x/sync v0.10.0 -> v0.12.0
othergolang.org/x/sys v0.28.0 -> v0.31.0
+4 more items in the release notessecurityFix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
featureRespect client.WithTimeout option on connect ()
featureUpdate image type checks to avoid unnecessary logs for attestations ()
featureFix incorrect runtime name being passed to NRI ()
other1a43cb6a1 Merge commit from fork
other07a0b5419 (cherry picked from commit de1341c201ffb0effebbf51d00376181968c8779)
otherPrepare release notes for v2.0.4 ()
other06a886a8e Prepare release notes for v2.0.4
other6b5efba83 client: Respect client.WithTimeout option
other916d48722 core/remotes: Handle attestations in MakeRefKey
otherdf4d905a6 core/images: Ignore attestations when traversing children
feature4f037050c add name in package version
otherupdate build to go1.23.7, test go1.24.1 ()
othere5ad0d0a0 update build to go1.23.7, test go1.24.1
otherdocs: include note about unprivileged sysctls ()
othera39f1146b docs: include note about unprivileged sysctls
othere2e: use the shim bundled with containerd artifact ()
other81b3384a0 e2e: use the shim bundled with containerd artifact
otherbuild(deps): bump containerd/project-checks from 1.1.0 to 1.2.1 ()
other7215a7d2c build(deps): bump containerd/project-checks from 1.1.0 to 1.2.1
featureUpdate remote content to break up writes to avoid grpc message size limits ()
featureUpdate runc binary to v1.2.5 ()
featureFix privileged container sysfs can't be rw because pod is ro by default ()
featureFix recursive RLock() mutex acquisition (containerd/go-cni#126)
featureFix initial sync race when registering NRI plugins ()
otherPrepare release notes for v2.0.3 ()
otherb8dde9189 Prepare release notes for v2.0.3
othereaa7ca80d proxy: break up writes from the remote writer to avoid grpc limits
otherc7f64196f Fix privileged container sysfs can't be rw because pod is ro by default
othergo.{mod,sum}: bump CDI deps to v.0.8.1. ()
other92ae2951f Update CDI dependency to v0.8.1.
otherPrefer runtime options for PluginInfo request ()
other569af34cb Prefer runtime options for PluginInfo request
otherpkg: prevent oom watcher from depending on shim pkg ()
other0ce93e16a prevent oom watcher depend on shim pkg.
otherCI: arm64-8core-32gb -> ubuntu-24.04-arm ()
otherf3284aa68 CI: arm64-8core-32gb -> ubuntu-24.04-arm
featureRevert "Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG" ()
featureb5313993c Revert "Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG"
othermove the device after the options when using mkfs.ext4 ()
otherf95a426b8 move the device after the options when using mkfs.ext4
otherupdate build to go1.23.6, test go1.24.0 ()
other4d19a6adf update build to go1.23.6, test go1.24.0
otherbuild(deps): bump actions/cache from 4.1.2 to 4.2.0 ()
otherc738c3aab build(deps): bump actions/cache from 4.1.2 to 4.2.0
securityUpgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 ()
otherfcf64305c Update vendor files to fix build failure
otherd3437eb29 Upgrade x/net to 0.33.0
featureUpdate install-imgcrypt to allow change install repo ()
feature0785bd8cc Update install-imgcrypt to allow change install repo
other697c59c63 Update runc binary to v1.2.5
otherUpdate go-cni version to fix Race Condition issue ()
other06891f899 fix go-cni race condition
other79cdbf61b cri,nri: block NRI plugin sync. during event processing.
otherUpdate github.com/containerd/imgcrypt to v2.0.0 ()
other9d5cfce83 Update github.com/containerd/imgcrypt to v2.0.0
deprecatedf58939c33 Remove deprecated WithCDIDevices in oci spec opts
featuregithub.com/petermattis/goid 4fcff4a6cae7 new
featuregithub.com/sasha-s/go-deadlock v0.3.5 new
featuregithub.com/smallstep/pkcs7 v0.1.1 new
+20 more items in the release notesfeatureRemove confusing warning in cri runtime config migration ()
featureFix runtime platform loading in cri image plugin init ()
featureUpdate runc binary to v1.2.4 ()
otherPrepare release notes for v2.0.2 ()
othercdaf4dfb4 Prepare release notes for v2.0.2
otherUpdate platforms to latest rc ()
othereb125e1dd Update platforms to latest rc
other468079c5c Remove confusing warning in cri runtime config migration
othera2d9d4fd5 Fix runtime platform loading in cri image plugin init
othermake sure console master tty is closed on task exit ()
feature184ffad01 Add integ test to check tty leak
other17181ed33 fix master tty leak due to leaking init container object
otherBump up otelttrpc to 0.1.0 ()
other8666e7422 Bump up otelttrpc to 0.1.0
fixctr: ctr images import --all-platforms: fix unpack ()
fixc4270430d ctr: ctr images import --all-platforms: fix unpack
other7373ddd70 update runc binary to v1.2.4
otherdowngrade go-difflib and go-spew to tagged releases ()
otherf34147772 downgrade go-difflib and go-spew to tagged releases
featureAdd a build tag to disable std plugin import ()
featuredca769485 chore: add a build tag to disable containerd plugin import
otherUpdate golangci to 1.60.3 ()
other5942b3fcb Update golangci to 1.60.3
featureAdd dependabot and upgrade golang and dependency versions (containerd/otelttrpc#3)
other2d46141 upgrade golang, deps, CI versions
feature64922e7 Add dependabot CI
fixFix concurrent map panic on metadata (containerd/otelttrpc#2)
other2ba3be1 Fix concurrent map panic on inject metadata
otherf50a922 UT for concurrent inject/extract metadata
otherMove windows matcher logic so all platforms can use (containerd/platforms#22)
other7c58292 Move windows matcher logic so all platforms can use
otherreplace testify with stdlib in tests (containerd/platforms#21)
other86a86b7 replace testify with stdlib in tests
otherReplace arm64 minor variant logic with lookup table (containerd/platforms#18)
other364665a Replace arm64 minor variant logic with lookup table
featureAdd MD.Clone function (containerd/ttrpc#177)
feature430f734 Add MD.Clone
fixserver: fix a Serve() vs. (immediate) Shutdown() race (containerd/ttrpc#175)
fixc4d96d5 server: fix Serve() vs. immediate Shutdown() race.
featureed6c3ba server_test: add Serve()/Shutdown() race test.
+6 more items in the release notesfeatureFix apply IoOwner options when not in user namespace ()
featureFix cri grpc plugin config migration ()
featureSupport CNI STATUS Verb (containerd/go-cni#123)
featureUpdate differ to handle zstd media types ()
featureUpdate runc binary to v1.2.3 ()
featureFix panic due to nil dereference cgroups v2 ()
otherPrepare release notes for v2.0.1 ()
otherb0ece5dc5 Prepare release notes for v2.0.1
otherbuild(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0 ()
otherfe6957084 build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0
otherupdate xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+ ()
othereb2ce6882 update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+
otherctr pull should unpack for default platform when transfer service is used ()
other44cdca68b ctr pull unpack for default platform using transfer service
other018d83650 internal/cri: should not apply IoOwner options
otherUpdate go-cni for CNI STATUS ()
other5eb7995a9 feat: update go-cni version for CNI STATUS
featurea2302ea89 Add integration test for custom configuration
otherbe5eda069 complete cri grpc config migration
othera53eff53d update runc binary to v1.2.3
other73f57acb0 Update differ to handle zstd media types
otherupdate to go1.23.4 / go1.22.10 ()
other290e8bc70 update to go1.23.4 / go1.22.10
otherCI: update Fedora to 41 ()
other62b790bfa CI: update Fedora to 41
other3ba2df924 fix panic due to nil dereference cgroups v2
otherPublish attestation as release artifact ()
other34a45cab2 Publish attestation as release artifact
otherMove rockylinux 9.4 to almalinux/9 in CI ()
other7dec6b460 move rocky 9.4 to almalinux/9 in CI
other*: should align pipe's owner with init process ()
othercf07f28ee *: should align pipe's owner with init process
fixfix: set the credentials even if not provided ()
other986088866 fix: set the credentials even if not provided
fixfsverity_test.go: fix nil pointer derefence, fix test fail, fix minor/major device numbers resolving ()
fix30b929ece fsverity_test.go: fix major/minor device number resolving
fix10996a334 fsverity_test.go: fix nil pointer dereference, fix test fail
otherupdate runc binary to 1.2.2 ()
fixfsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems ()
fixa7f2b562f fsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems
+19 more items in the release notesfeatureAllow sections of Plugins to be merged, and not overwritten as entire sections. ()
featureAdd Update API for sandbox controller ()
featureConfigure otel from env instead of config.toml ()
featureEnable NRI by default ()
featureAdd PluginInfo to introspection API ()
featureRemove overlayfs volatile option on temp mounts ()
featureExpose usage of deprecated features ()
featureUse Intel ISA-L's igzip if available ()
featureIntroduce top level config migration ()
featureAdd image delete target ()
featureRemove LimitNOFILE from containerd.service ()
featureAdd support for image expiration during garbage collection ()
featureReduce the contention between ref lock and boltdb lock in content store ()
featureRemove "containerd.io/restart.logpath" label ()
featureRemove aufs snapshotter ()
featureFix deadlock during NRI plugin registration (containerd/nri#79)
featureSupport arm64/v9 and minor variants (containerd/platforms#8)
featureFix deadlock when writing to pipe blocks (containerd/ttrpc#168)
featureGenerate attestation for artifacts during release ()
featureRemove cri-containerd-*.tar.gz release bundles ()
featureUse 'UserSpecifiedImage' from CRI to set the image-name annotation ()
featureFine-grained SupplementalGroups control ()
featureAdd support to set loopback to up ()
featureKEP-3857: Recursive Read-only (RRO) mounts ()
featureAdd support for multiple subscribers to CRI container events ()
featureEnable CDI by default ()
featureRemove non-sandboxed CRI implementation ()
featureAdd support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ()
featureUse sandboxed CRI by default ()
featureImplement RuntimeConfig CRI call ()
featureAdd support for user namespaces (KEP-127) ()
featureRemove CRI v1alpha2 ()
security[medium] RAPL accessible to a container GHSA-7ww5-4wqc-m92c
breakingRemove disable_cgroup from CRI config ()
breakingMove client to subpackage ()
deprecatedUpdate warnings for deprecated CRI config fields ()
deprecatedAdd type alias for event Envelope ()
deprecatedPostpone removal of deprecated CRI config properties ()
deprecatedDeprecate go-plugin configuration option ()
deprecatedCNI conf_template in CRI is no longer deprecated ()
+146 more items in the release notessecurityCVE-2026-53493
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
otherb0ab39c205 Prepare release notes for v1.7.36
other670a5de22f Merge commit from fork
othera3a39e5873 Bound Walk references
otherffc673f859 Bound Dispatch concurrency and references
otherpkg/oci: mask thermal interrupt info ()
other19334a4d7e pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other4684c683c2 core/unpack: fetch layers of every config-sharing manifest
feature7fba9f7c3c Create new imagetest package
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureEnable log scrubbing by default on Windows ()
other05aa78da3 Prepare release notes for v1.7.35
other3bd79bb36 Merge commit from fork
other5a2a3a759 cri: cancel ExecSync IO drain on context cancellation
other323e148f2 Merge commit from fork
other9205b1903 archive: skip redundant opaque whiteout walks
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
otherb01d66349 core/remotes/docker: normalize descriptor URL origins
otherb5d936dca core/remotes/docker: strip sensitive headers on desc.urls fetch
otherUse ScrubLogs by default on Windows ()
featurecff94ea40 ctr: add --scrub-logs flag for Windows
other544e4657d cri/config: use ScrubLogs by default on Windows
otherci: bound Go fuzzing by execution count ()
other71e00ba9c ci: bound Go fuzzing by execution count
featureFix lost container exit events when events arrive before container info is cached ()
otherPrepare release notes for v1.7.34 ()
other7db112471 Prepare release notes for v1.7.34
otherUpdate go to 1.26.5/1.25.12 ()
otherc06144c85 Update go to 1.26.5/1.25.12
otherci: pin fog-json to resolve gem conflict ()
otherb84460e50 ci: pin fog-json to resolve gem conflict
othercri:fix lost container exit events if they arrive before info is cached ()
other2fe076ea7 cri:fix lost container exit events if they arrive before info is cached
otherbuild(deps): bump golang.org/x/* dependencies ()
other862057716 bump golang.org/x/* dependencies
othergolang.org/x/crypto v0.45.0 -> v0.52.0
othergolang.org/x/mod v0.29.0 -> v0.35.0
othergolang.org/x/net v0.47.0 -> v0.55.0
othergolang.org/x/sync v0.18.0 -> v0.20.0
othergolang.org/x/sys v0.38.0 -> v0.45.0
othergolang.org/x/term v0.37.0 -> v0.43.0
othergolang.org/x/text v0.31.0 -> v0.37.0
securityCVE-2026-53488
securityCVE-2026-47262
securityCVE-2026-34986
otherPrepare release notes for v1.7.33 ()
other7517e6737 Prepare release notes for v1.7.33
otherab306518a Merge commit from fork
otherd34cdafda Merge commit from fork
other9ab2b7a89 Bound user-database file reads in openBoundedUserFile
other1e9806f90 Merge commit from fork
other4d8ba4d23 Do not propagate reserved labels from image configs
otherupdate runc binary to v1.3.6 ()
other74c728c13 update runc binary to v1.3.6
otherupdate go to 1.26.4/1.25.11 ()
other947caa4b7 update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
othere884e964e Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
otherb9e756888 Clean up disk space in node e2e workflow
securityBump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 ()
security4dfc1844e Bump go-jose to v3.0.5 to address CVE-2026-34986
othergithub.com/go-jose/go-jose/v3 v3.0.4 -> v3.0.5
securityCVE-2026-46680
featureAllow hosts.toml to contain only root-level fields without an explicit [host] section ()
fixFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
otherApply hardening to block AF_ALG in default socket policy ()
otherSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
otherSet AppArmor abi conditionally to support versions < 3.0 ()
otherMaksym Pavlenko
otherChris Henzie
otherDerek McGowan
otherPaweł Gronowski
otherSamuel Karp
otherWei Fu
otherBrad Davidson
otherBrian Goff
otherLEI WANG
otherPhil Estes
otherbc87d865c Prepare release notes for v1.7.32
otheroci: return explicit error for out-of-range USER values ()
other503f47946 oci: return explicit error for out-of-range USER values
otherseccomp: Block AF_ALG in default socket policy ()
othere55b747d3 seccomp: Block AF_ALG in default socket policy
other4627a65f8 seccomp: Document socket rule scope and socketcall limitation
fixFix issue with empty host tree in hosts.toml ()
other24007441d Fix error parsing hosts.toml without any host tree
otherSupport both styles of volatile mount option ()
other940733149 Support both styles of volatile mount option
otherapparmor: Set abi conditionally ()
other2b732c892 apparmor: Set abi conditionally
featureAdd GitHub Action for k8s node e2e tests ()
feature0db1e143a Add GitHub Action for k8s node e2e tests
otherUpdate release process after 1.7 ()
other3223a75c2 Update for latest updates to release tool
other1b30082eb Update release process after 1.7
securityCVE-2026-35469
featureFix CNI issue where DEL is never executed after a restart ()
featureSanitize error before gRPC return to prevent possible credential leak in pod events ()
featureImprove error message and add warning when concurrent container creation is detected ()
otherPrepare release notes for v1.7.31 ()
other7d2662653 Prepare release notes for v1.7.31
otherupdate github.com/moby/spdystream v0.5.1 ()
other3f795c02a update github.com/moby/spdystream v0.5.1
otherupdate to Go 1.25.9, 1.26.2 ()
other7b1e1b17b update to Go 1.25.9, 1.26.2
otherb673f2d42 update golangci-lint to v2.9.0 with go1.26 support
otherd88d8513a remove windows/arm from cross build
othera763407b5 Ignore warnings for golangci-lint bump
other03dcd8360 ci: bump golangci from 6.5.2 to 7.0.0
otherUpdate github.com/moby/spdystream v0.2.0->v0.5.0 ()
otherc08711218 Update github.com/moby/spdystream v0.2.0->v0.5.0
otherSkip TestExportAndImportMultiLayer on s390x ()
other043548f6d Skip TestExportAndImportMultiLayer on s390x
otherupdate runc binary to v1.3.5 ()
othere99bd6050 [release/1.7] update runc binary to v1.3.5
otherCODEOWNERS: mark Sam and Chris as owners for 1.7 ()
other3a3103aaf CODEOWNERS: mark Sam and Chris as owners for 1.7
fixFix vagrant on CI ()
other9b4cfa271 Ignore NOCHANGE error
otherci: modprobe xt_comment on almalinux ()
other53e9e73f0 ci: modprobe xt_comment on almalinux
fixFix TOCTOU race bug in tar extraction ()
fix61c2733fd Fix TOCTOU race bug in tar extraction
fixFix CNI issue where CNI DEL is never executed ()
fixf854c1890 fix issue where cni del is never executed
otherapparmor: explicitly set abi/3.0 ()
other5c091d92e apparmor: explicitly set abi/3.0
fixbackport: integration: Fix TestImageLoad() failure on CI ()
fix177ac10fe integration: Fix TestImageLoad() failure on CI
otherupdate to go1.24.13, go1.25.7 ()
other56da43d0f update to go1.24.13, go1.25.7
other5cb3cb9ba ci: bump go 1.24.12, 1.25.6
fixfix: sanitize error before gRPC return to prevent credential leak in pod events ()
otherb1fa03843 fix: sanitize error before gRPC return to prevent credential leak in pod events
othercri: emit warning for concurrent CreateContainer ()
+2 more items in the release notesfeatureFix NRI dropping requested CDI devices silently ()
featureRedact all query parameters in CRI error logs ()
featureUpdate runc binary to v1.3.4 ()
otherPrepare release notes for v1.7.30 ()
other3d0ca6d2e Prepare release notes for v1.7.30
other0bc74f47e cri,nri: don't drop requested CDI devices silently.
otherscript/setup/install-cni: install CNI plugins v1.9.0 ()
other7db16b562 script/setup/install-cni: install CNI plugins v1.9.0
breakinggo.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) ()
otherbca897b47 go.mod: golang.org/x/crypto v0.45.0
other37cbd2224 CI: drop Go 1.23
otheree49d1747 Update Go requirements in BUILDING
otherci: bump Go 1.24.11, 1.25.5 ()
other145978224 ci: bump Go 1.24.11, 1.25.5
other3dbadfaa1 ci: bump Go 1.24.10, 1.25.4
other2bac971f0 ci(release): set GO_VERSION in Dockerfile
other34b89a574 runc: Update runc binary to v1.3.4
otherci: update CIFuzz actions to support Ubuntu 24.04 ()
other6e0dd8956 ci: update CIFuzz actions to support Ubuntu 24.04
otherbuild(deps): bump github.com/opencontainers/selinux ()
other3eea2a4af build(deps): bump github.com/opencontainers/selinux
breakingremove sha256-simd ()
other1194f5128 remove sha256-simd
othergithub: skip 5 critest cases for window-2022 ()
otherce2d3a67f .github: skip 5 critest cases in window CI pipeline
other65271ea89 fix: redact all query parameters in CRI error logs
featuregithub.com/cyphar/filepath-securejoin v0.5.1 new
othergithub.com/opencontainers/selinux v1.11.0 -> v1.13.1
othergolang.org/x/crypto v0.40.0 -> v0.45.0
othergolang.org/x/mod v0.26.0 -> v0.29.0
othergolang.org/x/net v0.42.0 -> v0.47.0
othergolang.org/x/sync v0.16.0 -> v0.18.0
othergolang.org/x/sys v0.34.0 -> v0.38.0
othergolang.org/x/term v0.33.0 -> v0.37.0
othergolang.org/x/text v0.27.0 -> v0.31.0
securityGHSA-pwhc-rpq9-4c8w
securityGHSA-m6hq-p25p-ffr2
securityGHSA-qw9x-cqr3-wc7r
securityGHSA-cgrx-mc8f-2prm
securityGHSA-9493-h29p-rfm2
featureUpdate differ to handle zstd media types ()
featureUpdate runc binary to v1.3.3 ()
featureFix lost container logs from quickly closing io ()
other442cb34bd Merge commit from fork
other0450f046e Fix directory permissions
othere5cb6ddb7 Merge commit from fork
otherc575d1b5f fix goroutine leak of container Attach
otherPrepare release notes for v1.7.29 ()
other1fc2daaf3 Prepare release notes for v1.7.29
other3f5f9f872 runc: Update runc binary to v1.3.3
otherUpdate GHA images and bump Go 1.24.9; 1.25.3 ()
other667409fb6 ci: bump Go 1.24.9, 1.25.3
other294f8c027 Update GHA runners to use latest images for basic binaries build
othercf66b4141 Update GHA runners to use latest image for most jobs
otherfa3e6fa18 pkg/epoch: extract parsing SOURCE_DATE_EPOCH to a function
fixac334bffc pkg/epoch: fix tests on macOS
otherd04b8721f pkg/epoch: replace some fmt.Sprintfs with strconv
otherCI: update Fedora to 43 ()
other5cfedbf52 CI: update Fedora to 43
otherCI: skip ubuntu-24.04-arm on private repos ()
othercf99a012d CI: skip ubuntu-24.04-arm on private repos
otherrunc:Update runc binary to v1.3.1 ()
other4c77b8d07 runc:Update runc binary to v1.3.1
fixd30024db2 bugfix:fix container logs lost because io close too quickly
otherci: bump Go 1.24.8 ()
otherf4b3d96f3 ci: bump Go 1.24.8
other334fd8e4b update golangci-lint to v1.64.2
other8a67abc4c Drop inactivated linter exportloopref
othere4dbf08f0 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
otherd7db2ba06 build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
otherd7182888f build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
other4be6c7e3b build(deps): bump actions/cache from 4.1.2 to 4.2.0
othera2e097e86 build(deps): bump actions/checkout from 4.2.1 to 4.2.2
other6de404d11 build(deps): bump actions/cache from 4.1.1 to 4.1.2
other038a25584 [StepSecurity] ci: Harden GitHub Actions
+3 more items in the release notesfeatureRefresh OAuth tokens when they expire during registry operations ()
featureSet default differ for the default unpack config of transfer service ()
featureUpdate runc binary to v1.3.0 ()
featureRemove invalid error log when stopping container after containerd restart ()
otherPrepare release notes for v1.7.28 ()
otherb01b809f8 Prepare release notes for v1.7.28
otherci: bump Go 1.23.11, 1.24.5 ()
otherce2373176 ci: bump Go 1.23.11, 1.24.5
otherBackport windows test fixes ()
other3c06bcc4d Fix intermittent test failures on Windows CIs
fixc6c0c6854 Remove WS2025 from CIs due to regression
otherci: use fedora 39 archive ()
other6d7e021cf ci: use fedora/39-cloud-base image from archive
otherupdate runners to ubuntu 24.04 ()
otherc362e18cc CI: install OVMF for Vagrant
fix1d99bec21 CI: fix "Unable to find a source package for vagrant" error
featuredafa3c48d add debian sources for ubuntu-24
otherb03301d85 partial: enable ubuntu 24 runners
other13fbc5f97 update release runners to ubuntu 24.04
othergo.mod: golang.org/x/* latest ()
otherda5d1a371 go.mod: golang.org/x/* latest
breakingRemove additional fuzzers from instrumentation repo ()
other5fef123ba Remove additional fuzzers from CI
otherbackport windows runner and golang toolchain updates ()
othera35978f5a ci: bump golang [1.23.10, 1.24.4] in build and release
otherdf035aa3e ci: bump golang [1.23.9, 1.24.3] in build and release
other2a6d9fc71 use go1.23.8 as the default go version
other15d4d6eba update to go 1.24.2, 1.23.8
other1613a3b1a Enable CIs to run on WS2022 and WS2025
othertest: added runc v1 tests using vagrant ()
feature60e73122c test: added runc v1 tests using vagrant
otherRevert "disable portmap test in ubuntu-22 to make CI happy" ()
other10e1b515e Revert "Disable port mapping tests in CRI-in-UserNS"
other7a680e884 fix unbound SKIP_TEST variable error
othere5f8cc995 Revert "disable portmap test in ubuntu-22 to make CI happy"
otherb001469c7 Update runc binary to v1.3.0
othera6421da84 remotes/docker/authorizer.go: invalidate auth tokens when they expire.
other[CI] Fix vagrant ()
fixFix CI ()
featureb300fd37b add option to skip tests in critest
+27 more items in the release notessecurityFix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
featureUpdate image type checks to avoid unnecessary logs for attestations ()
other05044ec0a Merge commit from fork
other11504c3fc validate uid/gid
otherPrepare release notes for v1.7.27 ()
other1be04be6c Prepare release notes for v1.7.27
other82b5c43fe core/remotes: Handle attestations in MakeRefKey
other2c670e79b core/images: Ignore attestations when traversing children
otherupdate build to go1.23.7, test go1.24.1 ()
othera39863c9f update build to go1.23.7, test go1.24.1
breakingRemove hashicorp/go-multierror dependency and fix CI ()
other49537b3a7 e2e: use the shim bundled with containerd artifact
otherfe490b76f Bump up github.com/intel/goresctrl to 0.5.0
other13fc9d313 update containerd/project-checks to 1.2.1
other585699c94 Remove unnecessary joinError unwrap
other4b9df59be Remove hashicorp/go-multierror
othergo.{mod,sum}: bump CDI deps to v0.8.1. ()
other5ba28f8dc go.{mod,sum}: bump CDI deps to v0.8.1, re-vendor.
otherCI: arm64-8core-32gb -> ubuntu-24.04-arm ()
other85f10bd92 CI: arm64-8core-32gb -> ubuntu-24.04-arm
other561ed520e increase xfs base image size to 300Mb
othergithub.com/intel/goresctrl v0.3.0 -> v0.5.0
othergithub.com/prometheus/client_golang v1.14.0 -> v1.16.0
othergithub.com/prometheus/common v0.37.0 -> v0.42.0
othergithub.com/prometheus/procfs v0.8.0 -> v0.10.1
otherk8s.io/apimachinery v0.26.2 -> v0.27.4
othersigs.k8s.io/json f223a00ba0e2 -> bc3834ca7abd
othertags.cncf.io/container-device-interface v0.7.2 -> v0.8.1
othertags.cncf.io/container-device-interface/specs-go v0.7.0 -> v0.8.0
featureAdd support for syncfs after unpack ()
featureUpdate runc binary to v1.2.5 ()
featureFix race between serve and immediate shutdown on the server (containerd/ttrpc#175)
featureReject oversized messages from the sender (containerd/ttrpc#171)
featureFix fatal concurrency error in port forwarding ()
featureFix initial sync race when registering NRI plugins ()
featureAdd API support for reading Pod IPs (containerd/nri#119)
featureFix plugin sync to use multiple messages if ttrpc max message limit is hit (containerd/nri#111)
featureUpdate API to pass configured timeouts to plugins. (containerd/nri#109)
featureFix mount removal in adjustments (containerd/nri#107)
featureClose plugin if initial synchronization fails (containerd/nri#103)
featureAdd support for adjusting OOM score (containerd/nri#94)
featureAdd API support for NRI-native CDI injection (containerd/nri#98)
featureAdd support for pids cgroup (containerd/nri#76)
featureFix console TTY leak in runc shim ()
securityUpgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 ()
featureUpdate install-imgcrypt to allow change install repo ()
feature83eaab482 Update install-imgcrypt to allow change install repo
featurec3e24e024 Add integ test to check tty leak
feature07bfc18 wip: generate: add test for oom score adj
breakingdevice-injector: remove unreachable code. (containerd/nri#115)
breaking235aa11 chore: remove unreachable code and fmt files
feature6fd59d6 api: add support for multiple sync messages.
fix5fe9b06 mux: fix maximum allowed message size.
fixcfcd2af Makefile: fix ginkgo-tests target.
feature966ac92 adaptation: implement plugin synchronization blocks.
feature3880f1d adaptation: add test case for mount removal.
fix0d3b376 adaptation: fix mount removal in adjustments.
featurecodespell: add codespell config, workflow, fix spelling errors. (containerd/nri#105)
featuredf84c47 .github: add codespell workflow.
featurea03dc93 pkg,plugins,.codespellrc: add codespellrc, fix spelling.
feature4bd8da8 device-injector: add support for CDI injection.
feature44773bd runtime-tools/generate: add support CDI injection.
feature65282fe adaptation: add CDI device injection unit test.
feature01f3b7a adaptation: add support for native CDI injection.
featuref1aa58f api: add support for native CDI device injection.
featureAdd MD.Clone function (containerd/ttrpc#177)
feature430f734 Add MD.Clone
featureed6c3ba server_test: add Serve()/Shutdown() race test.
featureb5cd6e4 channel: allow discovery of overflown message size.
+76 more items in the release notesfeatureUpdate runc binary to v1.2.4 ()
featureFix proto conflicts and update to 1.8 API ()
featureFix ip_pref configuration option ()
featureFix panic due to nil dereference cgroups v2 ()
otherPrepare release notes for v1.7.25 ()
otherbda53fc60 Prepare release notes for v1.7.25
otherd4a649130 update runc binary to v1.2.4
otherReduce shim plugin log level ()
other99c973791 runtime/v2: reduce shim plugin log
other0cfc1edf3 Fix "even if IPv4 comes first" test to have IPv4 first
other53d1fd0d9 Don't use To16() != nil to detect IPv6 addresses
featureAdd a build tag to disable std plugin import (#11202) ()
feature2b12ef2f4 chore: add a build tag to disable containerd plugin import
otherbump github.com/containerd/continuity from 0.4.2 to 0.4.4 ()
otherb99091838 build(deps): bump github.com/containerd/continuity from 0.4.3 to 0.4.4
other9f48f7af0 build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.35.2
other79172ba16 go.mod: github.com/containerd/continuity v0.4.3
otherdeps: update golang.org/x/ ()
other2dfbe2c7c vendor: update golang.org/x/crypto dependencies
deprecated3d7a50749 Replace use of deprecated api Envelope
deprecated929e7bde6 Use api types over deprecated alias
other5a42503d1 Remove end of life api directory
otherc4069878e Update runtime/v2/runc/options to alias api type
other4d955223a Update to containerd api 1.8
breakingcmd/continuity/commands: MountCmd: remove macOS remnants (containerd/continuity#254)
breaking327ebdd cmd/continuity/commands: MountCmd: remove macOS remnants
fixkind.String(): fix missing case statements for iota consts in switch (containerd/continuity#256)
fix7d074e7 kind.String(): fix missing case statements for iota consts in switch
breakinggo-fix: remove pre-go1.17 build-tags (containerd/continuity#252)
breaking433b975 go-fix: remove pre-go1.17 build-tags
deprecated3ca0c62 gha: update CodeQL action to v3, as v2 is deprecated
fixFix TestDiffDirChangeWithOverlayfs (also updates the CI to use Ubuntu 24.04) (containerd/continuity#249)
featurefs: implement Atime for Windows (containerd/continuity#241)
feature3cbda8c fs: implement Atime for Windows
featurefs: add DiffDirChanges function to get changeset fast (containerd/continuity#145)
feature8b312bd fs: add DiffDirChanges function to get changeset fast
featureAdd type to iterate directory (containerd/continuity#229)
feature5c2d1b4 Add type to itterate directory
deprecatedSubstitute deprecated rand.Seed() in Go 1.20 (containerd/continuity#231)
deprecated242e29e Substitute deprecated rand.Seed() in Go 1.20
+43 more items in the release notesfeatureUpdate runc binary to 1.2.2 ()
featureFix "invalid metric type" error message for cgroup v1 ()
featureUpdate the container exit log to info level ()
featureFix retry logic and concurrency issue with http fallback ()
otherPrepare release notes for v1.7.24 ()
other936f8e2de Prepare release notes for v1.7.24
feature47ff8e2b6 add info of exited event
feature10af0d60f Adds a mutex to protect fallback host
othere426ec51b Use unix and windows specific connection error checks
feature49c9f303b Allow fallback across default ports
otherlocal: avoid writing to content root on readonly store ()
otherddf2b03ed local: avoid writing to content root on readonly store
other06e72da76 update runc binary to 1.2.2
otherRevert "Disable vagrant strict dependency checking" ()
other23a31ce63 Revert "Disable vagrant strict dependency checking"
othertestutil: avoid conflict with continuity/testutil ()
other4bd411f8c testutil: avoid conflict with continuity/testutil
otherupdate cri-tools to v1.29.0 ()
other216dc892e update cri-tools to v1.29.0
otherupdate build to go1.22.9, test go1.23.3 ()
other56a7d31cb update build to go1.22.9, test go1.23.3
otherci: disable marking 1.7 releases as latest ()
other205940716 ci: disable marking 1.7 releases as latest
otherAvoid arch info in the sed/replace when building cri-cni-containerd.tar.gz ()
otherb7bb8d515 Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz
otherbackport: Disable vagrant strict dependency checking ()
other860a51384 Disable vagrant strict dependency checking
otherUpdate runc binary to 1.2.1 ()
other710cd3716 update runc binary to 1.2.1
otherservices/snapshots: include name of snapshotter in debug logs ()
other5bd0834ce services/snapshots: include name of snapshotter in debug logs
otherMake TestContainerPids more resilient ()
other455787bf8 Make TestContainerPids more resilient
featureAdd After=dbus.service to containerd.service ()
featurecb82e52a4 Add After=dbus.service to containerd.service
otherd6f577843 metrics: Use UnmarshalTo instead of UnmarshalAny
featureAdd errdefs aliases ()
featureAllow proxy plugins to have capabilities ()
featureRevert errdefs package migration ()
featureAdd check for CNI plugins before tearing down pod network ()
featureFix the race condition during GC of snapshots when client retries ()
otherPrepare release notes for v1.7.23 ()
other921f554af Prepare release notes for v1.7.23
otherRevert "update runc binary to 1.1.15" ()
other8f16d6588 Revert "update runc binary to 1.1.15"
otherSwitch from actuated.dev to GH Action runners for arm64 ()
other41e8f24cd Switch from actuated.dev to GH Action runners for arm64
otherdd811f224 Update github actions ci to run on forks
otherbump golangci/golangci-lint-action from 4 to 6 ()
other284484af4 bump golangci/golangci-lint-action from 4 to 6
otherupdate to go1.23.2,go1.22.8 ()
featureprow: allow ENABLE_CRI_SANDBOXES to be configured ()
featureae11176fa prow: allow ENABLE_CRI_SANDBOXES to be configured
fixTestNewBinaryIOCleanup: fix a comment, minor rewrite ()
fix7fd794a7c TestNewBinaryIOCleanup: fix a comment, minor rewrite
feature0714a2952 Add errdefs aliases
feature950740390 Allow proxy plugins to have capabilities
fixcb5e6a01a Fix the race condition during GC of snapshots when client retries
feature278bd0f72 [release/1.7] Add check for CNI plugins before tearing down pod network
deprecated51939238f Revert "errdefs: denote deprecation as a godoc comment"
featureAdd errdefs/pkg package (containerd/errdefs#19)
feature46a6522 Add errdefs/pkg package
featureAdd support for grpc error details and multiple errors (containerd/errdefs#7)
featureb9dce4d Add support for grpc error details
featureAdd support for custom error messages (containerd/errdefs#10)
featuredc9b20e Add support for custom error messages
featureAdd a resolve error function to return first error (containerd/errdefs#9)
feature9f87502 Add a resolve error function to return first error
featureAdd stack support (containerd/errdefs#8)
featuref96dfda Add stack package for managing error stack traces
feature70fd2d7 Add collapsible error type
feature6022faf Add typeurl to go mod
fixFix Cancelled interface typo (containerd/errdefs#6)
featureAdd more grpc types (containerd/errdefs#3)
featuref727cdb Add HTTP status code and error type conversion
feature9854dc7 Add more grpc error types
+27 more items in the release notesfeatureUpdate to go1.22.7, go1.23.1 ()
featureCumulative stats can't decrease ()
featureFix bug where init exits were being dropped ()
featureUpdate runc binary to 1.1.14 ()
otherPrepare release notes for v1.7.22 ()
other43174ee6a Prepare release notes for v1.7.22
fixintegration: regression test for issue 10589 ()
fix0c4ba21d8 integration: regression test for issue 10589
other1cc2cfa4b fifosync: cross-process synchronization
otherf338717ed runc-shim: handle pending execs as running
other686c69490 runc-shim: refuse to start execs after init exits
breaking760935e52 runc-shim: remove misleading comment
other19d678f73 update to go1.22.7, go1.23.1
other3658d5b40 Include change in cri server
other88d001c74 Cumulative stats can't decrease
other33e8a2005 update runc binary to 1.1.14
featureRegenerate introspection UUID if state is empty ()
featureSet stderr to empty string when using terminal on Windows ()
featureMove builds to Go 1.22 and add support for testing with 1.23 ()
featureBorrow latest wsstream from k8s v1.31.x to 1.7 ()
featureEnsure the CRIAPIV1Alpha2 warning's lastOccurrence is accurate ()
featureMake StopContainer idempotent ()
featureMake StopPodSandbox idempotent ()
featureFix failed force deletion for tasks with PID 0 ()
featureFix packaged runc reporting incorrect version ()
featureEnsure /run/containerd gets created with correct perms ()
deprecatedUpdate warnings for deprecated CRI config fields ()
otherPrepare release notes for v1.7.21 ()
other975f279ee Prepare release notes for v1.7.21
othergo.mod: keep minimum go version at go1.21 ()
otherd63bd8464 go.mod: keep minimum go version at go1.21
otherc76028088 update golangci-lint to 1.60.1
feature3b263d082 add go1.23.0, drop go1.21.x
fixFix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4 ()
other09ca004de Fix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4
other9269d97b1 hide wsstream under internal/ to prevent external use
feature59815fa44 golangci-lint should only look for problems in new code
other1c431dc6f Run go mod tidy
feature226f93d92 Add copyright headers
feature6f3252733 switch over references to the new package
other0a85d476a Fix up some constant references
other82bfa44d0 Copy over wsstream from k8s v1.31.0-rc.1 release
other52b79f337 Update CRIAPIV1Alpha2 warning lastOccurrence every call
deprecatedpkg/userns: deprecate and migrate to github.com/moby/sys/userns ()
otherdce0b5a6d migrate to github.com/moby/sys/userns
deprecated65f7d0740 pkg/userns: deprecate and migrate to github.com/moby/sys/user/userns
otherf21675c27 vendor: github.com/moby/sys/user v0.2.0
otherupdate to go1.21.13 / go1.22.6 ()
other228914a5e update to go1.21.13 / go1.22.6
fixFix TestNewBinaryIOCleanup failing with gotip ()
other3ff82ba0f Fix TestNewBinaryIOCleanup failing with gotip
fixd51143f6f script/setup/install-runc: fix runc using incorrect version
otherupdate auths code comment ()
fix0db46f664 client: fix tasks with PID 0 cannot be forced to delete
deprecated9afb8dcdf deprecation: update warnings for CRI config fields
featuregithub.com/moby/sys/userns v0.1.0 new
+6 more items in the release notesfeatureSupport for dropping inheritable capabilities ()
featureMake PodSandboxStatus friendlier to shim crashes ()
featureHandle empty DNSConfig differently than unspecified ()
featureFix for [cri] ttrpc: closed during ListPodSandboxStats ()
otherPrepare release notes for v1.7.20 ()
other7f2d4cd97 Prepare release notes for v1.7.20
otherdeps: Update otelgrpc ()
other3a02c523d deps: Update otelgrpc
fixdf86bdd5d CRI Sbserver: Make PodSandboxStatus friendlier to shim crashes
other209ee4f10 CRI: An empty DNSConfig != unspecified
featurece65228af Support for dropping inheritable capabilities
fix610498df7 Fix for [cri] ttrpc: closed during ListPodSandboxStats
otherupdate to go1.21.12 / go1.22.5 ()
othere61c7932e update to go1.21.12 / go1.22.5
deprecatederrdefs: denote deprecation as a godoc comment ()
deprecatedc7d5e430a errdefs: denote deprecation as a godoc comment
othergithub.com/go-logr/logr v1.2.4 -> v1.3.0
othergithub.com/google/go-cmp v0.5.9 -> v0.6.0
othergithub.com/google/uuid v1.3.1 -> v1.4.0
othergo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.45.0 -> v0.46.1
othergo.opentelemetry.io/otel v1.19.0 -> v1.21.0
othergo.opentelemetry.io/otel/metric v1.19.0 -> v1.21.0
othergo.opentelemetry.io/otel/sdk v1.19.0 -> v1.21.0
othergo.opentelemetry.io/otel/trace v1.19.0 -> v1.21.0
othergoogle.golang.org/genproto e6e6cdab5c13 -> 989df2bf70f3
othergoogle.golang.org/genproto/googleapis/api 007df8e322eb -> 83a465c0220f
othergoogle.golang.org/genproto/googleapis/rpc d307bd883b97 -> 995d672761c0
featureFix support for OTLP config ()
featureAdd API go module ()
featureRemove overlayfs volatile option on temp mounts ()
featureUpdate runc binary to v1.1.13 ()
featureMigrate platforms package to github.com/containerd/platforms ()
featureMigrate reference/docker package to github.com/distribution/reference ()
featureFix panic in NRI from nil CRI reference ()
featureFix Windows HPC working directory ()
otherPrepare release notes for v1.7.19 ()
other74a3d2901 Prepare release notes for v1.7.19
other7f5d3c5f4 cri: ensure NRI API never has nil CRI
otherWindows: Supply windows shim version via file ()
other6efc5bb89 update runhcs binary to v0.11.7
other945ae09fd Windows: Supply windows shim version via file
deprecatedreference: deprecate SplitObject ()
deprecateddba53578c pkg/reference: deprecate SplitObject
feature57ce09b42 pkg/reference: SplitObject: add proper GoDoc
feature83822d144 Add api release action
feature1ce1c8f3e 1.7: Add back support for OTLP config from toml
breakingremove imports of errdefs package, and add depguard linter ()
feature3be919f3c Add support for 1.8 interfaces
feature5b87eb502 Add go mod replace when proto changes happen
featurea3a7431bc Add api go submodule
feature61b3e2261 Alias protobuf plugin to new api types package
deprecated6ccdf6977 platforms: mark aliases as deprecated
breakinga00a2d20a reference/docker: remove deprecated SplitHostname
breakingRemove hcsshim import from repo (containerd/platforms#10)
fixFix windows matching when os version is empty (containerd/platforms#11)
feature17c859f Add tests for osversion matching with no version
featureAdd format for platform string (containerd/platforms#6)
feature38a74d2 Add grammar for platform string
fixfix grammar and highlights in README (containerd/platforms#3)
fixFix link in README (containerd/platforms#1)
feature18e3da6 Add Github actions CI
featureb3f80ee Add go module
feature8ff004c Add license and readme
fixFix CI build status badge in readme (containerd/ttrpc#162)
featuregithub.com/containerd/containerd/api v1.7.19 new
featuregithub.com/containerd/platforms v0.2.1 new
featuregithub.com/distribution/reference v0.6.0 new
+63 more items in the release notesfeatureUpdate Go version to 1.21.11 ()
featureRemove uses of platforms.Platform alias ()
featureMigrate log imports to github.com/containerd/log ()
featureMigrate errdefs package to github.com/containerd/errdefs ()
featureFix usage of "unknown" platform ()
otherPrepare release notes for v1.7.18 ()
other9426aab62 Prepare release notes for v1.7.18
othercdd3ea913 Update Go version to 1.21.11
other1e3c662d6 [release/1.7] remove uses of platforms.Platform alias
other0af6825b1 migrate logs imports to github.com/containerd/log module
other308341a44 replace uses of github.com/containerd/containerd/errdefs
other47ff8cfce migrate errdefs package to github.com/containerd/errdefs module
fixf4d11912a core/image: fix usage of "unknown" platform
otherExplicitly set release latest to true ()
other5b0480009 Explicitly set release latest to true
otherd669b100d build(deps): bump softprops/action-gh-release from 1 to 2
featureAdd common files (containerd/errdefs#1)
feature78f3494 Add Github actions configuration
feature46f1770 Add go.mod configuration
feature959121a Add README.md
featureAdd LICENSE (containerd/errdefs#2)
feature33a2275 Add LICENSE
featuregithub.com/containerd/errdefs v0.1.0 new
othergoogle.golang.org/genproto b8732ec3820d -> e6e6cdab5c13
othergoogle.golang.org/genproto/googleapis/api b8732ec3820d -> 007df8e322eb
othergoogle.golang.org/genproto/googleapis/rpc b8732ec3820d -> d307bd883b97
featureUse LOOP_CONFIGURE when creating loop devices ()
featureUpdate unpacker to fetch all provided content ()
featurePreserve CL_UNPRIVILEGED locked flags during remount of bind mounts ()
featureUpdate metadata snapshotter to lease on already exists ()
featureHandle unsupported config versions ()
featureFix deadlock when writing to pipe blocks (containerd/ttrpc#168)
otherPrepare release notes for v1.7.17 ()
other114b07b97 Prepare release notes for v1.7.17
other803aaa680 Remove internal LoopConfig struct
feature7bd3be948 Swap internal ioctl implementation with golang.org/x/sys
othera0739dc0e Use LOOP_CONFIGURE when creating loop devices
other1573ea598 Update ctr image pull all platforms
other32b594f1b Update unpacker to always fetch all
otherUpdate hcsshim tag to v0.11.5 ()
other5a03a3aee Update hcsshim tag to v0.11.5
otherUpdate ttrpc tag to 1.2.4 ()
other9a1eda40f update ttrpc tag to 1.2.4
otherad85652fa Preserve CL_UNPRIVILEGED locked flags during remount of bind mounts
featureUpdate instrumentation fuzzer with new flag ()
feature582f3f43d Update instrumentation fuzzer with new flag
othervendor: github.com/containerd/[email protected] ()
othera5d13689b vendor: github.com/containerd/[email protected]
othervendor: golang.org/x/[email protected] ()
otherf853bc129 vendor: golang.org/x/[email protected]
fixUpdate tooling to Go 1.21.10, 1.22.3 for net/http bug fixes ()
featureeb930375c Add lease test for metadata snapshotter
feature00347b7fa Add check for unsupported config versions
fixFix some issues in the test script (containerd/imgcrypt#115)
fixaa517cc test: Fix order of parameters and remove unnecessary key parameter
featureec72311 test: Add comments to test case
feature2959ec0 test: To be able to run testLocalKeys alone add missing env variable
fixREADME: Fix a typo (containerd/imgcrypt#105)
fix12e84f5 README: Fix a typo
breakingRemove references to package io/ioutil (containerd/imgcrypt#100)
fix1b4f6f8 client: Fix deadlock when writing to pipe blocks
deprecatedUpdate GitHub Actions CI to resolve deprecation warnings (containerd/ttrpc#161)
deprecated589a593 Update GitHub Actions CI to resolve deprecation warnings
fixFix proto3 generation error (containerd/ttrpc#158)
feature73b6a91 Add optional feature in protobuf compiler
featuregithub.com/go-jose/go-jose/v3 v3.0.3 new
+86 more items in the release notesfeatureUpdate AppArmor template to allow confined runc to kill containers ()
featureFix config import relative path glob ()
featureUpdate AppArmor template to better support rootlesskit ()
featureUpdate HTTP fallback to better account for TLS timeout and previous attempts ()
featureAdd support for HPC port forwarding ()
featurePrevent GC from schedule itself with 0 period. ()
featureFix issue with using invalid token to retry fetching layer ()
featureAutomatically decompress archives for transfer service import ()
featureFix HTTPFallback fails when pushing manifest ()
featureAdd support for configuring otel from env and config deprecation notice ()
featureFix deadlock during NRI plugin registration (containerd/nri#79)
featureUpdate Go to 1.21.9 and 1.22.2 with net/http security fix ()
featureFix CRI snapshotter root path when not under containerd root ()
featureFix network creation failure from CreatedAt time as 269 years ago ()
featureInclude userns info in PodSandboxStatus ()
featureFix default working directory Windows HostProcess containers ()
featureFix ListPodSandboxStats to skip sandboxes with missing tasks ()
featureAdd release notes for v1.7.16 ()
feature1c623084f Add release notes for v1.7.16
feature18a2c36fa apparmor: Allow confined runc to kill containers
other62e9535f2 Fix config import relative path glob
othera8ebceb97 CRI: "Fix" imageFSPath behavior
otherbd423bf84 Snapshotters: Export the root path
feature8fb6bfa71 Add exports to proxy plugin config
feature8916e2cf9 Add platform config to proxy plugins
other293f5151d pod: CreatedAt time will be 269 years ago while creating cri network failed.
featureaf19e746e apparmor: add signal (receive) peer=/usr/local/bin/rootlesskit
other637d259dd update to go1.21.9, go1.22.2
deprecated794b0c723 Add deprecated HTTPFallback for package compatibility
other51c649d9d Update HTTPFallback to handle tls handshake timeout
otheraa14890ed Remove empty default tls configuration in ctr
feature3df5d4445 Add support for HPC port forwarding
other5c15bf406 Prevent GC from schedule itself with 0 period.
featureb57dc9fd3 cri/server: Add userns tests in PodSandboxStatus
fixf61de0864 fix bug that using invalid token to retry fetching layer
fixFix unexpected order of mounts since go 1.19 ()
fix9f774e438 fix(cri): fix unexpected order of mounts since go 1.19
fix18f4ad5ee remote: Fix HTTPFallback fails when pushing manifest
deprecatedf2354894f Deprecate otel configs
feature90c309fe2 Add IsNotFound case to ListPodSandboxStats
+18 more items in the release notesfeatureAdds mediatype to OCI index record on export ()
featureFix runc shim to only defer init process exits ()
otherPrepare for v1.7.15 release ()
other4d4759b54 Prep v1.7.15 release
other21df46766 runc-shim: only defer init process exits
fixFix compile from version control system (source) use case ()
other2a054213e Fix compile from version control system (source) use case
feature6605c47a4 adds mediatype to oci index record
othervendor: google.golang.org/protobuf 1.33.0, github.com/golang/protobuf v1.5.4 ()
othere6d91d843 vendor: github.com/golang/protobuf v1.5.4
other2d136c5f5 build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0
othera1a7af7a3 build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0
othergithub.com/golang/protobuf v1.5.3 -> v1.5.4
othergoogle.golang.org/protobuf v1.31.0 -> v1.33.0
featureUpdate builds to use go 1.21.8 ()
featureFix various timing issues with docker pusher ()
featureRegister imagePullThroughput and count with MiB ()
featureMove high volume event logs to Trace level ()
featureHandle pod transition states gracefully while listing pod stats ()
featureUpdate runc-shim to process exec exits before init ()
feature5b23a4127 seccomp, apparmor: add go:noinline
breakinga8004007a copy: remove max number of ErrResets
breaking2a25c085b copy: remove wrapping io.NopCloser from push writer pipe
featureAdd WithMetaStore to overlay snapshotter and missing unpacker.Wait for image import ()
feature8fe0b26f1 Add missing unpacker.Wait for image import
feature31ea2d7d9 Add WithMetaStore to overlay snapshotter to allow bringing your own
deprecatedcri: propagate deprecation list to runtime status ()
deprecatedc79ffa277 cri: propagate deprecation list to runtime status
deprecatedctr: print deprecation warnings on every invocation ()
deprecatedeaebe23de ctr: print deprecation warnings on every invocation
fixbug fix: make sure cri image is pinned when it is pulled outside cri ()
fix26c057423 bug fix: make sure cri image is pinned when it is pulled outside cri
featureAdd option to perform syncfs after pull ()
featureea0a92ec3 *: introduce image_pull_with_sync_fs in CRI
feature4caf44032 api: introduce sync_fs to diff.ApplyRequest
breakingsocketpair_windows: remove implementation for now (containerd/nri#69)
breakinge47f09b socketpair_windows: remove implementation for now
featureadaptation, stub: allow extra ttrpc client and server options. (containerd/nri#67)
feature13ee978 pkg/stub: add support for extra ttrpc options.
featurec4e2f81 pkg/adaptation: add support for extra ttrpc options.
fixTask: fix typo in godoc (containerd/nri#61)
fixae7840b Task: fix typo in godoc
breakinggha: remove GOPATH and workingdir, update actions/setup-go@v4, actions/checkout@v4 (containerd/nri#53)
breakinge33ac3e gha: remove working-dir and GOPATH
breakingremove containerd as dependency (containerd/nri#51)
fixscripts: fix protobuf URL on arm64 (containerd/nri#52)
fix9b43daa scripts: fix protobuf URL on arm64
fixFix streaming with empty payloads (containerd/ttrpc#157)
feature44ca009 Add comment
feature336fc1b Add integration test to reproduce issue with empty payloads
featureImplement support for unary interceptor chaining. (containerd/ttrpc#152)
feature40f227d server: implement UnaryServerInterceptor chaining.
featuref984c9b client: implement UnaryClientInterceptor chaining.
fixFix grammar in comment for UserOnCloseWait. (containerd/ttrpc#153)
+77 more items in the release notessecurityThe thirteenth patch release for containerd 1.7 updates the runc binary in the release builds to address CVE-2024-21626
securityUpdate runc binary to v1.1.12 (GHSA-xr7r-f8xq-vfvv)
featureUpdate seccomp profile for new syscalls added since Linux 5.16 ()
otherPrepare v1.7.13 and update runc to v1.1.12 ()
otherb97e611b9 Prepare release notes for v1.7.13
other2e7fa14db Update runc binary to v1.1.12
other[release/1.7] seccomp: kernel 6.7 ()
other1bed37871 seccomp: kernel 6.7
other[release/1.7] Update container-device-interface to v0.6.2 ()
other14628d4aa Update container-device-interface to v0.6.2
feature[release/1.7] content: Add InfoReaderProvider ()
feature836477930 content: Add InfoReaderProvider
featuretags.cncf.io/container-device-interface v0.6.2 new
featuretags.cncf.io/container-device-interface/specs-go v0.6.0 new
fixFix on dialer function for Windows ()
otherImprove /etc/group handling when appending groups ()
otherUpdate shim pidfile permissions to 0644 ()
otherUpdate runc binary to v1.1.11 ()
featureAllow import and export to reference missing content ()
breakingRemove runc import ()
otherUpdate Go version to 1.20.13 ()
deprecatedEmit deprecation warning for containerd.io/restart.logpath label usage ()
other[release/1.7] Prepare release notes for v1.7.12 ()
other775d544fe Prepare release notes for v1.7.12
other[release/1.7] update to go1.20.13, test go1.21.6 ()
othera5dc5b894 update to go1.20.13, test go1.21.6
other[release/1.7] shim: Create pid-file and address with 0644 permissions ()
other8d82242eb shim: Create address file with 0644 permissions
other260963a35 shim: Create pid-file with 0644 permissions
other[release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19) ()
other872af82f5 remove remaining uses of golang.org/x/sys/execabs
other2ad2a2e83 switch back from golang.org/x/sys/execabs to os/exec (go1.19)
other[release/1.7] update to CDI v0.6.1, and remove github.com/opencontainers/runc dependency ()
other9251072f7 remove github.com/opencontainers/runc dependency
other4e67213d4 vendor: github.com/cncf-tags/container-device-interface v0.6.1
othere0ee0be0d go.mod: github.com/opencontainers/runtime-spec v1.1.0
other02be2236a go.mod: github.com/.../container-device-interface v0.6.0
other91f953bb4 go.mod: github.com/opencontainers/runtime-spec v1.1.0-rc.2
other[release/1.7 backport] import/export: Support references to missing content ()
other6089b05d9 images/Export: Revert signature change
feature6b4b760c3 integration/import-export: Add WithSkipMissing tests
otherabb3c5ef9 export: Copy distribution source labels to manifest annotations
other9609f04f6 import/export: Support references to missing content
other42b60d865 images/archive: use mediatype helpers
other[release/1.7 backport] update runc binary to v1.1.11 ()
other23516a99c update runc binary to v1.1.11
other[release/1.7 backport] go.mod: dario.cat/mergo v1.0.0 ()
other428714e32 go.mod: dario.cat/mergo v1.0.0
other[release/1.7] restart: containerd.io/restart.logpath warning ()
other03fed557e restart: containerd.io/restart.logpath warning
fix[release 1.7] backport: fix on dialer function for windows ()
other68d237392 fix(pkg/dialer): minor fix on dialer function for windows
featuredario.cat/mergo v1.0.0 new
featuregithub.com/moby/sys/user v0.1.0 new
+6 more items in the release notesfixFix Windows default path overwrite issue ()
otherUpdate push to always inherit distribution sources from parent ()
otherUpdate shim to use net dial for gRPC shim sockets ()
breakingFix otel version incompatibility ()
fixFix Windows snapshotter blocking snapshot GC on remove failure ()
securityMask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)
deprecatedEmit deprecation warning for AUFS snapshotter ()
deprecatedEmit deprecation warning for v1 runtime ()
deprecatedEmit deprecation warning for deprecated CRI configs ()
deprecatedEmit deprecation warning for CRI v1alpha1 usage ()
deprecatedEmit deprecation warning for CRIU config in CRI ()
other[release/1.7] Prepare release notes for v1.7.11 ()
otherdfae68bc3 Prepare release notes for v1.7.11
other[release/1.7] update to go1.20.12, test go1.21.5 ()
other0d314401d update to go1.20.12, test go1.21.5
other1ec1ae2c6 update to go1.20.11, test go1.21.4
securityGithub Security Advisory GHSA-7ww5-4wqc-m92c
othercb804da21 contrib/apparmor: deny /sys/devices/virtual/powercap
other40162a576 oci/spec: deny /sys/devices/virtual/powercap
other[release/1.7] Don't block snapshot garbage collection on Remove failures ()
othered7c6895b Don't block snapshot garbage collection on Remove failures
feature[release/1.7] Add warning for CRIU config usage ()
feature1fdefdd22 Add warning for CRIU config usage
breaking[release/1.7] Fix otel version incompatibility ()
featuref8f659e66 Add HTTP client update function to tracing library
feature[release/1.7] Add cri-api v1alpha2 usage warning to all api calls ()
featuredc45bc838 Add cri-api v1alpha2 usage warning to all api calls
deprecated[release/1.7] cri: add deprecation warnings for deprecated CRI configs ()
deprecated9d1bad62e deprecation: fix missing spaces in warnings
deprecated51a604c07 cri: add deprecation warning for runtime_root
deprecated8040e74bf cri: add deprecation warning for rutnime_engine
deprecated99adc40eb cri: add deprecation warning for default_runtime
featureafef7ec64 cri: add warning for untrusted_workload_runtime
feature6220dc190 cri: add warning for old form of systemd_cgroup
feature[release/1.7] ctr: Add sandbox flag to ctr run ()
feature5fc0e4e61 ctr: Add sandbox flag to ctr run
deprecated[release/1.7] snapshots: emit deprecation warning for aufs ()
deprecated625b35e4b snapshots: emit deprecation warning for aufs
featuregithub.com/felixge/httpsnoop v1.0.3 new
featurego.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 new
+12 more items in the release notesotherEnhance container image unpack client logs ()
fixcri: fix using the pinned label to pin image ()
fixfix: ImagePull should close http connection if there is no available data to read. ()
featureAdd release notes for v1.7.10 ()
featurea995fe3a8 Add release notes for v1.7.10
other[release/1.7] fix: ImagePull should close http connection if there is no available data to read. ()
other206806128 remotes/docker: close connection if no more data
other328493962 integration: reproduce #9347
otherd1aab27cb fix: deflake TestCRIImagePullTimeout/HoldingContentOpenWriter
fix[release/1.7] cri: fix using the pinned label to pin image ()
fixa2b16d7f9 cri: fix update of pinned label for images
fix8dc861844 cri: fix using the pinned label to pin image
other[release/1.7] Enhance container image unpack client logs ()
other5930a3750 Enhance container image unpack client logs
otherupdate runc binary to v1.1.10:: ()
othervendor: upgrade OpenTelemetry to v1.19.0 / v0.45.0 ()
otherExpose usage of cri-api v1alpha2 ()
otherintegration: deflake TestIssue9103 ()
fixfix: shimv1 leak issue ()
deprecatedcri: add deprecation warnings for mirrors, auths, and configs ()
otherUpdate hcsshim tag to v0.11.4 ()
deprecatedExpose usage of deprecated features ()
feature[release/1.7] Add release notes for v1.7.9 ()
feature4b912af52 Add release notes for v1.7.9
other[release/1.7 backport] update runc binary to v1.1.10 ()
othereff291713 update runc binary to v1.1.10
other[release/1.7] vendor: upgrade OpenTelemetry to v1.19.0 / v0.45.0 ()
otherbd9428ff7 vendor: upgrade OpenTelemetry to v1.19.0 / v0.45.0
other[release/1.7] Expose usage of cri-api v1alpha2 ()
otherd62cba40c Expose usage of cri-api v1alpha2
other[release/1.7] integration: deflake TestIssue9103 ()
other5dbc258a8 integration: deflake TestIssue9103
other[release/1.7] fix: shimv1 leak issue ()
other449912857 fix: shimv1 leak issue
deprecated[release/1.7] cri: add deprecation warnings for mirrors, auths, and configs ()
deprecated152c57e91 cri: add deprecation warning for configs
deprecated689a1036d cri: add deprecation warning for auths
deprecated8c38975bf cri: add deprecation warning for mirrors
deprecated1fbce40c4 cri: add ability to emit deprecation warnings
other[release/1.7] Update hcsshim tag to v0.11.4 ()
other73f15bdb6 Update hcsshim tag to v0.11.4
deprecated[release/1.7] Expose usage of deprecated features ()
deprecated60d48ffea ctr: new deprecations command
deprecated74a06671a plugin: record deprecation for dynamic plugins
deprecatedfa5f3c91a server: add ability to record config deprecations
deprecatedf7880e7f0 pull: record deprecation warning for schema 1
deprecated1dd2f2c02 introspection: add support for deprecations
deprecatedaaf000c18 api/introspection: deprecation warnings in server
deprecated9b7ceee54 warning: new service for deprecations
deprecatedb708f8bfa deprecation: new package for deprecations
othergithub.com/Microsoft/hcsshim v0.11.1 -> v0.11.4
othergithub.com/cenkalti/backoff/v4 v4.2.0 -> v4.2.1
othergithub.com/go-logr/logr v1.2.3 -> v1.2.4
othergithub.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0 -> v2.16.0
+9 more items in the release notesfixFix ambiguous TLS fallback ()
otherUpdate Go to 1.20.10 ()
featureAdd a new image label on converted schema 1 images ()
fixFix handling for missing basic auth credentials ()
fixFix potential deadlock in create handler for containerd-shim-runc-v2 ()
other[release/1.7] Prepare release notes for v1.7.8 ()
other48dbdf871 Prepare release notes for v1.7.8
other[release/1.7] Fix ambiguous tls fallback ()
other68abc543b Check scheme and host of request on push redirect
other35c7634e3 Avoid TLS fallback when protocol is not ambiguous
other[release/1.7] vendor: google.golang.org/grpc v1.58.3 ()
otherf36948cad vendor: gRPC v1.58.3
other[release/1.7 backport] vendor: golang.org/x/net v0.17.0 ()
otherc67a53190 vendor: golang.org/x/net v0.17.0
other71f4b36ca vendor: golang.org/x/text v0.13.0
othera7b3b7090 vendor: golang.org/x/sys v0.13.0
other[release/1.7] vendor: google.golang.org/grpc v1.56.3 ()
other26736d6e1 vendor: google.golang.org/grpc v1.56.3
other54a69a6e4 vendor: golang.org/x/oauth2 v0.7.0
otherac15a7f5b vendor: google.golang.org/protobuf v1.30.0
other[release/1.7] update to go1.20.10, test go1.21.3 ()
other2479c3321 [release/1.7] update to go1.20.10, test go1.21.3
other11f40e9d8 [release/1.7] update to go1.20.9, test go1.21.2
feature[release/1.7] Add a new image label if it is docker schema 1 ()
featurecac1bab79 Add a new image label if it is docker schema 1
feature[release/1.7] remotes: add handling for missing basic auth credentials ()
feature6cd2cc4a8 remotes: add handling for missing basic auth credentials
other[release/1.7 backport] containerd-shim-runc-v2: avoid potential deadlock in create handler ()
featured0a1fedb5 *: add runc-fp as runc wrapper to inject failpoint
other04491240a containerd-shim-runc-v2: avoid potential deadlock in create handler
breaking6982a0df5 containerd-shim-runc-v2: remove unnecessary s.getContainer()
other0e2320398 Uncopypaste parsing of OCI Bundle spec file
othergolang.org/x/crypto v0.11.0 -> v0.14.0
othergolang.org/x/mod v0.9.0 -> v0.11.0
othergolang.org/x/net v0.13.0 -> v0.17.0
othergolang.org/x/oauth2 v0.4.0 -> v0.10.0
othergolang.org/x/sync v0.1.0 -> v0.3.0
othergolang.org/x/sys v0.10.0 -> v0.13.0
featuregoogle.golang.org/genproto/googleapis/api 782d3b101e98 new
featuregoogle.golang.org/genproto/googleapis/rpc 782d3b101e98 new
+6 more items in the release notesotherRequire plugins to succeed after registering readiness ()
otherHandle unexpected shim kill events ()
otherBuild binaries with Go 1.21.1 ()
othercri: Stop recommending disable_cgroup ()
fixremotes/docker: Fix MountedFrom prefixed with target repository ()
otherremotes: always try to establish tls connection when tls configured ()
featureNRI: Add support for rlimits ()
other[release/1.7] Prepare release notes for v1.7.7 ()
feature[release/1.7] Allow for images with artifacts to pull ()
feature6ca0aebf0 Allow for images with artifacts to pull
fix[release 1.7] remotes/docker: Fix MountedFrom prefixed with target repository ()
fix7df492a95 remotes/docker: Fix MountedFrom prefixed with target repository
deprecated09633b539 deprecate logs package, but disable linter (for transitioning)
feature[release/1.7] remotes/docker: Add MountedFrom and Exists push status ()
feature8cd2d33c2 [release/1.7] remotes/docker: Add MountedFrom and Exists push status
featuref9f250c Add project details
featurefb7fe3d Add github CI flow
feature7e13034 Add go module
feature698c398 Add README
feature87c83c4 Add license file
featureAdd support for rlimits ()
feature5ecea04 ulimit-adjuster: add validation for hard limits
featuref0deb59 ulimit-adjuster: new sample plugin
featured2dd708 Add support for rlimits
featureefaf36e api: add POSIXRlimit type
featuregithub: add test build to CI workflow. ()
feature3f092c2 .github: add test build to CI workflow.
feature01d5f14 Add a note about NRI API stability and release notes.
featureea9976d adaptation: add UpdateContainer tests.
fixd042d24 stub: fix plugin UpdateContainerInterface.
featurec783fc7 Resolves broken podman links and adds details to help better guide people in testing.
fixFix ParseEventMask to produce proper masks for 'pod' and 'container' shorthand event notations. ()
fixfix the NRI_PLUGIN_NAME env value when launching a pre-installed plugin ()
fix4a4cea6 fix the NRI_PLUGIN_NAME env value when launching a pre-installed plugin
featureAdd gitignore for build artifacts ()
feature8d9c64d Add gitignore for build artifacts
fixMakefile: fix 'install-*' targets. ()
fixc03d1be Makefile: fix 'install-*' targets.
securityab28e71 docs: add a chapter about security considerations.
featuregithub.com/containerd/log v0.1.0 new
+52 more items in the release notesfixFix log package for clients overwriting the global logger ()
fixFix blockfile snapshotter copy on Darwin ()
featureAdd support for Linux usernames on non-Linux platforms ()
otherUpdate Windows platform matcher to invoke stable ABI compability function ()
otherUpdate Golang to 1.20.8 ()
otherUpdate push to inherit distribution sources from parent ()
other[release/1.7] Prepare release notes for 1.7.6 ()
other3e09c65b2 Prepare release notes for v1.7.6
other[release/1.7] Invoke Stable ABI compatibility function in windows platform matcher ()
otherc7a35ccdc Fix transfer service dependencies:
other38d4e506d Invoke Stable ABI compatibility function in windows platform matcher
other[release/1.7] push: inherit distribution sources from parent ()
other5ebf05d97 push: inherit distribution sources from parent
featured206896dd content: add InfoProvider interface
other[release/1.7] update to go1.20.8 ()
other423693d7b [release/1.7] update to go1.20.8
other[release/1.7] Update hcsshim tag to v0.11.0 ()
otherddffc7c9a Update hcsshim tag to v0.11.0
other[release/1.7] CRI: Support Linux usernames for !linux platforms ()
otherb449440a4 CRI: Support Linux usernames for !linux platforms
other[release/1.7] Blockfile: Enlighten blockfile copy on Darwin ()
othered4bac11e Blockfile: Enlighten blockfile copy on Darwin
other[release/1.7 backport] Revert "log: define G() as a function instead of a variable" ()
other4d1cfbbdd Revert "log: define G() as a function instead of a variable"
other[release/1.7 backport] make repositories of install dependencies configurable ()
othera34e93241 make repositories of install dependencies configurable
othergithub.com/Microsoft/hcsshim v0.10.0-rc.8 -> v0.11.0
other[release/1.7] Prepare release notes for 1.7.5 ()
other93b23eb10 Prepare release notes for v1.7.5
otherfb1292c8d Bump version to v1.7.4
other[release/1.7 backport] go.mod: github.com/containerd/continuity v0.4.2 ()
other503ab21bf go.mod: github.com/containerd/continuity v0.4.2
other[release/1.7 backport] log: cleanups and improvements to decouple more from logrus ()
other2a9ae3c51 log: swap logrus functions with their equivalent on default logger
feature01445bb73 log: add package documentation and summary of package's purpose
other932795f45 log: make Fields type a generic map[string]any
feature707ca94d8 log: add log.Entry type
other0a79e67e4 log: define OutputFormat type
otherdbbe28b7d log: define G() as a function instead of a variable
feature93b6cb784 log: add all log-levels that are accepted
othere8e086e02 log: group "enum" consts and touch-up docs
breaking7aa4f8fdc log: WithLogger: remove redundant intermediate var
otherbfdce4ce4 log: SetFormat: include returns in switch
breaking6621e0888 log: remove testify dependency
breakingdf76aaede removes/docker: remove unnecessary conversion (unconvert)
featureAdd initial DragonFly BSD support ()
otherbcc6e25 dragonfly: Initial porting work
othergithub.com/containerd/continuity 1e0d26eb2381 -> v0.4.2
featureAdd blockfile snapshotter ()
featureAdd remote/proxy differ ()
otherUpdate runc binary to v1.1.9 ()
otherCri: Don't use rel path for image volumes ()
featureAllow attaching to any combination of stdin/out/err ()
fixFix ro mount option being passed ()
fixFix leaked shim caused by high IO pressure ()
featureAdd configurable mount options to overlay snapshotter ()
other[release/1.7] Prepare release notes for v1.7.4 ()
other7a0cae3ca [release/1.7] Prepare release notes for v1.7.4
fix[releases/1.7] *: fix leaked shim caused by high IO pressure ()
other537d7526e integration: issue7496 case should work for runc.v2 only
feature5add172be Vagrantfile: add strace tool
feature207e28f36 integration: add ShouldRetryShutdown case based on #7496
fixb4f480fb3 pkg/cri/sbserver: fix leaked shim issue for podsandbox mode
fix88ff575c5 pkg/cri/server: fix leaked shim issue
feature9f61dfb7c integration: add case to reproduce #7496
feature[release/1.7] Cherry-pick: [overlay] add configurable mount options to overlay snapshotter ()
feature0f4885c16 Add configurable mount options to overlay
other8804a27d7 feat: make overlay sync removal configurable
other[release/1.7] Remove temporary replace ()
other1c2dd5198 Remove temporary replace
feature[release/1.7] Add blockfile snapshotter ()
other2bf6bd143 vendor: update github.com/containerd/continuity
other30a163086 snapshots|pkg: umount without DETACH and nosync after umount
otherc9eebe3d1 mount: support direct-io for loopback device
other1c2977db0 Modify loopback size
fixcf9c78d2d snapshots/blockfile: fix lint issue
otherb823b4f54 snapshots/blockfile: deflaky the testsuite
featurefd39769ac Add mount options to blockfile snapshotter
feature8d732c6c2 Add sync before unmount on snapshotter layer test
feature8472a407e Add blockfile snapshotter to snapshotters doc
feature6740d77ca Add blockfile as a builtin
feature07cc24b32 Add blockfile snapshotter
feature32e3b76ee Add diffservice to contrib
feature661e505c8 Add proxy differ
fix[release/1.7] Port fix for Linux Integration test failure ()
feature[release/1.7] fix: allow attaching to any combination of stdin/stdout/stderr ()
feature34a5d0330 fix: allow attaching to any combination of stdin/stdout/stderr
fix[release/1.7] cherry-pick: Fix ro mount option being passed ()
+18 more items in the release notesotherRunC: Update runc binary to v1.1.8 ()
fixCRI: Fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty ()
otherCRI: write generated CNI config atomically ()
otherPort-Forward: Correctly handle known errors ()
otherResolve docker.NewResolver race condition ()
fixFix net.ipv4.ping_group_range with userns ()
otherRuntime/V2/RunC: handle early exits w/o big locks ()
featureSecComp: always allow name_to_handle_at ()
featureCRI: Windows Pod Stats: Add a check to skip stats for containers that are not running ()
breakingRemove CNI conf_template deprecation ()
fixFix issue for HPC pod metrics ()
feature4cb2f1515 [release/1.7] Add release notes for v1.7.3
feature64c3dcd8e atomicfile: new package for atomic file writes
fix[release/1.7 backport] bugfix(port-forward): Correctly handle known errors ()
fix6b6b0c828 bugfix(port-forward): Correctly handle known errors
fix801e8c806 pkg/cri/server: Fix net.ipv4.ping_group_range with userns
breaking[release/1.7 backport] ci: remove libseccomp-dev installation for nightly ()
breaking15d65709e ci: remove libseccomp-dev installation for nightly
feature[release/1.7 backport] integration/client: add timeout to TestShimOOMScore ()
feature3bf3996d9 integration/client: add timeout to TestShimOOMScore
feature[release/1.7 backport] seccomp: always allow name_to_handle_at ()
feature6281d46df seccomp: always allow name_to_handle_at
feature[release/1.7] [cri] Windows Pod Stats: Add a check to skip stats for containers that are not running ()
feature58b6b99cd Add a check to skip stats for containers that are not running
deprecated[release/1.7] Remove cni conf_template deprecation ()
deprecated0b2b96479 RELEASES.md: de-deprecation of CNI conf_template will be v1.7.3
deprecateda24267b28 Remove cni conf_template deprecation
fix[release/1.7] Fix issue for HPC pod metrics ()
fix89415fe36 Fix issue for HPC pod metrics
fixgha: fix golangci-lint, and upgrade to v1.52.2 ()
fix23c831a remove pre-go1.17 build-tags, and fix missing build-tags in plugin
fixe5acd95 gha: fix golangci-lint, upgrade to v1.52.2
featureAdd CodeQL analysis workflow ()
featurefee1db7 Add CodeQL analysis workflow
breakingRemove references to io/ioutil package ()
fixfollow-up-#52: fix the order of cause in fmt.Errorf ()
fixb3f193d follow-up-#52: fix the order of cause in fmt.Errorf
fixREADME.md: fix CI badge ()
fix0977d81 README.md: fix CI badge
featuregithub.com/mistifyio/go-zfs/v3 v3.0.1 new
+87 more items in the release notesotherPublish sandbox events ()
otherMake stats respect sandbox's platform ()
otherMount snapshots on Windows ()
otherNotify readiness when registered plugins are ready ()
fixFix cio.Cancel() should close pipes ()
otherCDI: Use CRI Config.CDIDevices field for CDI injection ()
other[release/1.7] Prepare release notes for v1.7.2 ()
other0e41daaea [release/1.7] Prepare release notes for v1.7.2
other[1.7 backport] Fix panic when remote differ returns empty result ()
othere134b6393 Fix panic when remote differ returns empty result
other[release/1.7 backport] Mount snapshots on Windows ()
other313c226b8 Update continuity to a tagged version
other8dd16285a UnmountAll is a no-op for missing mount points
otheracff3eefa Improve error messages and remove check
otherb4dd3bf4e Make ReadOnly() available on all platforms
other08d8baf3f Increase integration test tmieout to 20m
other1f0dbd011 Remove bind code path in mount()
other8f37b1c63 Remove "bind" code path from diff
other9139208b3 Properly mount base layers
featuree4307926f Add ReadOnly() function
feature375172604 Fix go.mod, simplify boolean logic, add logging
featuree1f999a18 Add paired 'mount' log for 'unmount'
featureb9a8aad45 Implement Windows mounting for bind and windows-layer mounts
feature1a64ee183 Implement WCOW parentless active snapshots and view snapshots
deprecated[release/1.7 backport] remotes/docker: ResolverOptions: fix deprecation comments ()
deprecatedeeda70fb0 remotes/docker: ResolverOptions: fix deprecation comments
feature4b77683b4 Add sandbox events protos
breaking[release/1.7 backport] snapshots/testsuite: Rename: fix fuse-overlayfs incompatibility ()
breaking9e60300ea snapshots/testsuite: Rename: fix fuse-overlayfs incompatibility
feature30cf84d Add support for Darwin clonefile
featureebdd069 Add copy benchmark
featureAdd more Windows metadata files ()
featurecdfbe61 Add more Windows metadata files
securityAdd CodeQL security scan workflow ()
securityc8de034 Add CodeQL security scan workflow
featureAdd Go 1.20 support to CI ()
featurebe62cc1 Add Go 1.20 support to CI
featureAdd paths to windows metadataFiles ()
feature68f7b34 Add paths to windows metadataFiles
breakingRemove references to io/ioutil package ()
+57 more items in the release notesotherThrow not supported error when UID or GID mappings provided ()
otherCleanup shim on start failure ()
fixFix premature close of CRI service when there are no CNI configuration monitors ()
otherAvoid UID lookup from mount on Darwin ()
otherKeep Linux mounts for Linux sandboxes on non-Linux hosts ()
featureAdd noexec,nodev,nosuid to /etc/resolv.conf bind mount ()
breakingRemove entry for container from container store on error ()
fixFix unmarshal in container metrics ()
otherUse readonly for temporary mounts ()
fixFix skip docker manifest option on image exporter ()
otherUpdate runc binary to v1.1.7 ()
fixFix runtime path task option ()
fixFix panic from nil checkpoint options ()
fixFix transfer service configuration options ()
fixFix server-side goroutine leak on receive message error (ttrpc#141)
fixFix panic caused by race to close send channel (ttrpc#140)
fixFix unmarshal to return non-nil object when nil value (ttrpc#140)
other[release/1.7] Prepare release notes for v1.7.1 ()
other27a0d957b Prepare release notes for v1.7.1
other[release/1.7] Update ttrpc v1.2.2 ()
other7b288e2d7 Update ttrpc to v1.2.2
fix[release/1.7] runtime/shim: fix the nil checkpoint options ()
fix3ef5b689a runtime/shim: fix the nil checkpoint options
fix[release/1.7] cri: Fix umarshal metrics ()
fix[release/1.7] fix the task setting the runtime path ()
featureaa3c63c15 integration: add container start test using abs runtime path
breaking[release/1.7] go.mod: remove redundant replace, and some cleaning-up ()
feature8f6e86fec go.mod: add comment explaining go-fuzz-headers replace rule
breaking1ece0cb50 go.mod: remove replace for github.com/opencontainers/runtime-tools
feature1d6641b7c export: add test for WithSkipDockerManifest
feature[release/1.7] Add noexec nodev and nosuid to sandbox /etc/resolv.conf mount bind. ()
feature9b4935d86 Update sbserver to add noexec nodev and nosuid to /etc/resolv.conf mount bind.
feature0aad93f08 Add noexec nodev and nosuid to sandbox /etc/resolv.conf mount bind.
fix[release/1.7] ctr/tasks: fix unmarshal the task metrics for cgroups v1 ()
fix1a64f1b43 ctr/tasks: fix unmarshal the task metrics for cgroups v1
feature[release/1.7 backport] Add WithReadonlyTempMount to create readonly temporary mounts ()
featureb7d87b190 Add WithReadonlyTempMount to create readonly temporary mounts
featurecf2e454bf Sandbox: Correct/add some fields to Status()
featureAdd recvClose channel to stream ()
feature471297e Add recvClose channel to stream
+68 more items in the release notesbreakingRemove gogoproto.customtype ()
breakingRemove enumvalue_customname, goproto_enum_prefix and enum_customname ()
breakingRemove all gogoproto extensions ()
securityUpdate README with location of security audits ()
breakingCRI: remove duplicated snapshotters code ()
breakingcontrib/apparmor: remove code related to apparmor_parser version ()
securityGithub Security Advisory GHSA-hmfx-3pcx-653p
securityGithub Security Advisory GHSA-259w-8hf6-59c2
breakingcontrib/apparmor: remove version-dependent rules ()
breakingVagrantfile: install-rootless-podman: remove setenforce 0 ()
breakingoci: appendOSMounts(): remove unused error, and move ()
breakingadd kube v1.26: remove v1alph2 cri support ()
breakingRemove github.com/gogo/protobuf again ()
securityGithub Security Advisory GHSA-2qjp-425j-52j9
breakingremove some (aliases for) deprecated functions ()
breakinggo.mod: golang_protobuf_extensions v1.0.4 - prevent incompatible versions ()
breakingoverlayfs: remove duplicated tx rollback ()
breakingoverlay: Remove unused method param ()
breakingRemove OpenTelementry imports from remotes/docker package ()
breakingRemove uses of deprecated go-digest.NewDigestFromHex, go-digest.Digest.Hex ()
breakingmaintenance: Remove WithWindowsNetworkNamespace from pkg/cri ()
breakingsys: remove unused IsAbs() (windows) ()
breakingarchive: windows: chtimes(): remove redundant conversion ()
securityUpdate to go 1.19.2 to address CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 ()
breakingremove stray .zuul.yaml ()
securityUpdate to go 1.19.1, 1.18.6 to address CVE-2022-27664, CVE-2022-32190 ()
breakingRemove unused variable from images action ()
breakingintegration: TestUpdateContainerResources_MemoryLimit: remove TODO comment ()
breakingmetrics/cgroups/v1: Remove unused event parameter ()
breakingzuul: remove the zuul because it is offline ()
breakingmount: remove unused ErrNotImplementOnWindows ()
breakingRemove hacks around contrib/fuzz ()
securityGithub Security Advisory GHSA-5ffw-gxpp-mxpf
breakingReverts removal of parallel run from critest ()
breakingoci: WithDefaultUnixDevices(): remove tun/tap from the default devices ()
breakingRemove github.com/gogo/protobuf and github.com/golang/protobuf from containerd's direct dependencies ()
securityGithub Security Advisory GHSA-c9cp-9c75-9v8c
securityupdate to go 1.16.15, 1.17.8 to address CVE-2022-24921 ()
securityGithub Security Advisory GHSA-crp2-qrr5-8pq7
securityAdd CodeQL Security scan workflow ()
+907 more items in the release notesfeatureFix close container io not closed when runtime create failed ()
featureUpdate runc binary to v1.3.0 ()
otherPrepare release notes for v1.6.39 ()
other22134cbfe Prepare release notes for v1.6.39
otherci: bump Go 1.23.11, 1.24.5 ()
other067a639f6 ci: bump Go 1.23.11, 1.24.5
otherBackport windows test fixes ()
other9cc952fb0 Fix intermittent test failures on Windows CIs
fix555a34af0 Remove WS2025 from CIs due to regression
otherci: use fedora 39 archive ()
otherb58df07d6 ci: use fedora 39 archive
othergo.mod: github.com/containerd/btrfs v1.0.1 ()
otherfa4b325e0 go.mod: github.com/containerd/btrfs v1.0.1
othergo.mod: golang.org/x/* latest, github.com/go-jose/go-jose/v3 v3.0.4 ()
other2c9f5778f Fix lint failures
otherb2576bb82 go.mod: github.com/go-jose/go-jose/v3 v3.0.4
other262e98e90 go.mod: golang.org/x/* latest
fix22f669a7c bugfix:close container io when runtime create failed
otherbackport windows runner and golang toolchain updates ()
otherc165cc68b ci: bump Go 1.24.4 in CI
otherffacabc05 ci: bump golang [1.23.9, 1.24.3] in build and release
other3ec9965e8 use go1.23.8 as the default go version
othere62a059a2 update to go 1.24.2, 1.23.8
otherd430f3277 Enable CIs to run on WS2022 and WS2025
otherd00ccf523 Update runc binary to v1.3.0
othertest: added runc v1 support in vagrant ()
feature9e49725bf test: added runc v1 support in vagrant
fixFix CI ()
other57250c719 Skip criu on Arms
other9d350bbbd Address cgroup mountpoint does not exist
other78cbefc95 ci: update GitHub Actions release runner to ubuntu-24.04
otherUpdate runc binary to v1.2.6 ()
other2325157ed Update runc binary to v1.2.6
fixFix error: implicit declaration of function ‘memcpy’ (containerd/btrfs#44)
other3fb5c91 CI: update (Go 1.23, etc.)
othercab79ec CI: enable jobs for release/1.0
other12b3998 Fix error: implicit declaration of function ‘memcpy’
otherUpdate GitHub actions CI workflow (containerd/btrfs#38)
other5d1f727 Update GitHub actions CI workflow
otherUpgrade Go compiler from Go 1.16 to Go 1.19 (containerd/btrfs#39)
+16 more items in the release notessecurityFix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
featureFix fatal map concurrency error in httpstream ()
othercf158e884 Merge commit from fork
other9639b9625 validate uid/gid
otherPrepare release notes for v1.6.38 ()
othereee34bac2 Prepare release notes for v1.6.38
otherupdate build to go1.23.7, test go1.24.1 ()
otherb67a35baf move exclude-dirs to issues.exclude-dirs
other2104a41ef update golangci-lint to 1.60.1
other820e81adc update build to go1.23.7, test go1.24.1
breakingRemove hashicorp/go-multierror dependency and fix CI ()
other7cc3b3dce e2e: use the shim bundled with containerd artifact
other0733895f3 Remove unnecessary joinError unwrap
other054c4cc79 Remove hashicorp/go-multierror
otherff21be0ee Update go to 1.20 to use its multi error support
otherf63b5fd3f update containerd/project-checks to 1.2.1
otherabd1692cf fix fatal error: concurrent map iteration and map write
otherCI: arm64-8core-32gb -> ubuntu-24.04-arm ()
otherf5ab73c0a CI: arm64-8core-32gb -> ubuntu-24.04-arm
other2cc6b5b0a increase xfs base image size to 300Mb
featureUpdate runc binary to v1.2.5 ()
featureFix the race condition during GC of snapshots when client retries ()
featureUpdate the container exit log to info level ()
featureHandle teardown failure to avoid blocking cleanup ()
featureAdd check for CNI plugins before tearing down pod network ()
featureFix console TTY leak in runc shim ()
featureFix panic due to nil dereference cgroups v2 ()
otherPrepare release notes for v1.6.37 ()
other16ba72ad9 Prepare release notes for v1.6.37
feature3e6f219d7 Add integ test to check tty leak
otherbc20f7457 fix master tty leak due to leaking init container object
featureUpdate install-imgcrypt to allow change install repo ()
featurecbd44298c Update install-imgcrypt to allow change install repo
other9918dc4e3 Update runc binary to v1.2.5
otherUpdate vagrant host OS to fix Vagrant CI runs ()
otherd92457c71 Remove vagrant scp from the install list
otherupdate runc binary to v1.2.4 ()
other315a23dd9 update runc binary to v1.2.4
otherupdate runc binary to v1.2.3 ()
other79f6df6f4 update runc binary to v1.2.3
otherupdate build to go1.22.10, test go1.23.4 ()
otherbf89950f5 update build to go1.22.10, test go1.23.4
otherdb096794f fix panic due to nil dereference cgroups v2
featureAdd almalinux/9 in CI ()
feature3a0f138b0 add almalinux/9 in CI
featureaca1ca440 add info of exited event
otherupdate runc binary to 1.2.2 ()
other4eaef56a2 update runc binary to 1.2.2
otherRevert "Disable vagrant strict dependency checking" ()
otherf42035a21 Revert "Disable vagrant strict dependency checking"
otherupdate build to go1.22.9, test go1.23.3 ()
other20958cbb0 update build to go1.22.9, test go1.23.3
otherbackport: Disable vagrant strict dependency checking ()
otheredb3df5ab Disable vagrant strict dependency checking
otherUpdate critools-version to 1.29 ()
other9eca374a4 Update critools-version to 1.29 in release 1.6
featureAdd After=dbus.service to containerd.service ()
featuree6d8e5e9c Add After=dbus.service to containerd.service
fix74951d6cf Fix the race condition during GC of snapshots when client retries
featureca6516ee8 [release/1.6] Add check for CNI plugins before tearing down pod network
+19 more items in the release notesfeatureEnsure the CRIAPIV1Alpha2 warning's lastOccurrence is accurate ()
featureUpdate to go1.22.7, go1.23.1 ()
featureCumulative stats can't decrease ()
featureFix memory leak with kubectl exec >= 1.30.0 ()
featureFix bug where init exits were being dropped ()
featureUpdate runc binary to 1.1.14 ()
otherPrepare release notes for v1.6.36 ()
other7fee84514 Prepare release notes for v1.6.36
fixintegration: regression test for issue 10589 ()
fixab9fedde2 integration: regression test for issue 10589
otherd0989e952 fifosync: cross-process synchronization
otherc9617c321 runc-shim: handle pending execs as running
other15ad6ac67 runc-shim: refuse to start execs after init exits
breaking7e6a18c24 runc-shim: remove misleading comment
other951af274c update to go1.22.7, go1.23.1
otherc8e5b1eb6 Cumulative stats can't decrease
othermove builds to go1.22 and testing to go1.23 ()
other0bbc90aee use git clone to install gogo/protobuf
other383b2dcd1 move builds to go1.22 and testing to go1.23
otherfd70da38b update runc binary to 1.1.14
fixFix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4 ()
other4fd7d4eef Fix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4
other6f9efd3a9 hide wsstream under internal/ to prevent external use
feature4694b84e8 golangci-lint should only look for problems in new code
other05c2b1413 Run go mod tidy
featurea7b0c015d Add copyright headers
feature78f079926 switch over references to the new package
other64430d636 Fix up some constant references
othera37b08102 Copy over wsstream from k8s v1.31.0-rc.1 release
otherd727961d2 Update CRIAPIV1Alpha2 warning lastOccurrence every call
otherupdate to go1.21.13 / go1.22.6 ()
otherbe0f0db07 update to go1.21.13 / go1.22.6
featureRegenerate UUID if state is empty in introspection service ()
featureSet stderr to empty string when using terminal on Windows ()
featureRevert HPC working directory fix in pkg/cri/server code ()
featureMake StopPodSandbox RPC idempotent ()
featureFix packaged runc reporting incorrect version ()
featureEnsure /run/containerd gets created with correct perms ()
deprecatedUpdate warnings for deprecated CRI config fields ()
otherPrepare release notes for v1.6.35 ()
other849650ab7 Prepare release notes for v1.6.35
fixFix TestNewBinaryIOCleanup failing with gotip ()
other4ec5cd6bd Fix TestNewBinaryIOCleanup failing with gotip
fix9539b9b7b script/setup/install-runc: fix runc using incorrect version
otherc3c2b4eec Revert "[release/1.7]: HPC working directory fix in pkg/cri/server code"
otherupdate auths code comment ()
other65cf37bcb update auths code comment
otherb1ef73e76 Ensure /run/containerd is created with correct perms
otherMake StopContainer RPC idempotent ()
other7134b03ba Make StopContainer RPC idempotent
other18ea8f288 Make StopPodSandbox RPC idempotent
deprecateded87e4787 deprecation: update warnings for CRI config fields
fixclient: fix tasks with PID 0 cannot be forced to delete ()
fix5c8818782 client: fix tasks with PID 0 cannot be forced to delete
othera4846fc0d introspection: regenerate UUID if state is empty
other484705c62 Set stderr to empty string when using terminal on Windows.
featureRemove overlayfs volatile option on temp mounts ()
featureUpdate runc binary to v1.1.13 ()
featureHandle empty DNSConfig differently than unspecified ()
featureFix HPC working directory in pkg/cri/server code ()
featurePrepare release notes for v1.6.34 ()
featureSupport for dropping inheritable capabilities ()
otherb2863e9e7 Prepare release notes for v1.6.34
otherb7d06a619 CRI: An empty DNSConfig != unspecified
feature8d2739857 Support for dropping inheritable capabilities
deprecatederrdefs: denote deprecation as a godoc comment ()
deprecatedce685376f errdefs: denote deprecation as a godoc comment
otherupdate to go1.21.12 / go1.22.5 ()
other634ae543d update to go1.21.12 / go1.22.5
otherUpdating hcsshim vendoring to 0.9.12 to include an important backported fix ()
othera0adb2933 Updating hcsshim to 0.9.12
othergolangci-lint: enable depguard for packages that moved ()
other3ea0c4983 golangci-lint: enable depguard for packages that moved
other086e1f56e [release/1.7]: HPC working directory fix in pkg/cri/server code
other166283a34 integration: backport upgrade testsuite's utils
other990a05d0a *: export RemoveVolatileOption for CRI image volumes
othera894b5f81 strip-volatile-option-tmp-mounts
otherf6ef0071b update runc binary to v1.1.13
otherUpdate Fedora and EL linux version in vagrant ()
other89bb437f8 Remove rocklinux 9
other01fa3d0d7 Backport version from box string in Vagrantfile
other0be3788f5 Update Fedora and EL linux version
othergithub.com/Microsoft/hcsshim v0.9.11 -> v0.9.12
featureUpdate Go version to 1.21.11 ()
featureMigrate log imports to github.com/containerd/log ()
featureMigrate errdefs package to github.com/containerd/errdefs ()
featureFix usage of "unknown" platform ()
otherPrepare release notes for v1.6.33 ()
other97e059626 Prepare release notes for v1.6.33
fixda9a04e54 Includes fix for a symlink race on remove
othera389bb305 migrate logs imports to github.com/containerd/log module
other615fb03e4 replace uses of github.com/containerd/containerd/errdefs
otherc83be1b9e migrate errdefs package to github.com/containerd/errdefs module
fixd4d489496 core/image: fix usage of "unknown" platform
otherExplicitly set release latest to false ()
other5eaf5f881 Explicitly set release latest to false
otherb51f7445d build(deps): bump softprops/action-gh-release from 1 to 2
featureAdd common files (containerd/errdefs#1)
feature78f3494 Add Github actions configuration
feature46f1770 Add go.mod configuration
feature959121a Add README.md
featureAdd LICENSE (containerd/errdefs#2)
feature33a2275 Add LICENSE
featuregithub.com/containerd/errdefs v0.1.0 new
featureHandle unsupported config versions ()
featurePreserve CL_UNPRIVILEGED locked flags during remount of bind mounts ()
featureUpdate metadata snapshotter to lease on already exists ()
featureUpdate apparmor template to allow confined runc to kill containers ()
featurePrevent GC from schedule itself with 0 period. ()
featureConfigure otel from env instead of config.toml ()
featureFix snapshotter root path when not under containerd root ()
featureFix CreatedAt time set to 269 years ago if create network failed ()
featureFix unexpected order of mounts ()
featureUpdate HTTP fallback to better account for TLS timeout and previous attempts ()
featureFix use of invalid token on retry fetching layer ()
otherPrepare release notes for v1.6.32 ()
other085dc4c0d Prepare release notes for v1.6.32
otherBump hcsshim and go-winio for go1.22 compat ()
feature38607b59c Add check for unsupported config versions
fixUpdate tooling to Go 1.21.10, 1.22.3 for net/http bug fixes ()
feature57860c1b6 Add lease test for metadata snapshotter
featurecd9b74640 Add exports to proxy plugin config
feature83cf026b2 Add platform config to proxy plugins
feature63c41d003 apparmor: Allow confined runc to kill containers
deprecatedb12c3b0c8 Add deprecated HTTPFallback for package compatibility
deprecated2fda262a9 Deprecate otel configs
fixf1a14a12a fix bug that using invalid token to retry fetching layer
fix9701cf998 fix(cri): fix unexpected order of mounts since go 1.19
fixFix some issues in the test script (containerd/imgcrypt#115)
fixaa517cc test: Fix order of parameters and remove unnecessary key parameter
featureec72311 test: Add comments to test case
feature2959ec0 test: To be able to run testLocalKeys alone add missing env variable
fixREADME: Fix a typo (containerd/imgcrypt#105)
fix12e84f5 README: Fix a typo
breakingRemove references to package io/ioutil (containerd/imgcrypt#100)
featureUpdate to ocicrypt 1.1.6 and add support for zstd type of compressed layers (containerd/imgcrypt#96)
feature06da359 Add support for zstd type of compressed layers
feature44f4e18 ctr: Add support for --all-platforms to encrypt command
featured9fccdc ctr: Sync with upstream ctr and add --skip-digest-for-named opt to import
featureb8f807f ctr: Sync with upstream ctr and add --platform option to import
feature67b7b5d tests: Add -traditional to OpenSSL command line when OSSL v3 is used
fix98e43be chore: fix readme typo
feature6eaeb4a Add build tags to make gofmt happy
featuregithub.com/go-jose/go-jose/v3 v3.0.3 new
+113 more items in the release notesfeatureAdds mediatype to OCI index record on export ()
featureFix runc shim to only defer init process exits ()
otherPrepare for v1.6.31 release ()
other7f7012bad Prepare for v1.6.31 release
other5e53da4a1 runc-shim: only defer init process exits
fixFix compile from version control system (source) use case ()
other7592f87f0 Fix compile from version control system (source) use case
feature8d415fd0e adds mediatype to oci index record
othervendor: google.golang.org/protobuf 1.33.0, github.com/golang/protobuf v1.5.4 ()
other2dbb59b5a vendor: github.com/golang/protobuf v1.5.4
other069bb78c9 build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0
other68d395cad build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0
otherBackport test release on PR ()
otherb3713136d CI: test release.yml on every PR
othergithub.com/golang/protobuf v1.5.3 -> v1.5.4
othergoogle.golang.org/protobuf v1.31.0 -> v1.33.0
featureUpdate builds to go 1.21.8 ()
featureFix config import relative path glob ()
featureMove high volume event logs to Trace level ()
featureMove certain debug logs to trace logs ()
featureAdd timeout to drain exec io ()
featurePropagate deprecation list to runtime status ()
featureFix image pinning when image is not pulled through cri ()
featureUpdate runc-shim to process exec exits before init ()
otherPrepare v1.6.30 ()
other8268fc6e9 Prepare release notes for v1.6.30
other614ca2e12 Revert go version environment removal
otherPrepare release notes for v1.6.29 ()
feature9ef6d9d03 Add release notes for v1.6.29.toml
otheruse a composite action to install Go ()
othercfbbb510c Use the Go toolchain in CI matrix to build binaries
otherf015dbc5a use composite action in ci workflow
otherccf3eb6a2 update to go 1.21.8, 1.22.1
otherBackport easy go install and update go ()
otherf6475ea59 Drop go 1.20 and build against 1.22
other7c45ad092 Extract a composite action to install Go
other4f7305414 update to go1.21.6, go1.20.13
otherda5a36c37 Use testify
otherafe6efee3 Revert container_stats_test.go change which caused Windows CRI integration test failure
other370ef115f container_stats_test.go: avoid checking snapshot size
other935720b8c Move inline PS scripts into files
other74bae5af8 Uninstall mingw before attempting upgrade
other9b9500bb0 CI: Explicitly upgrade MinGW on Windows 2019 GitHub runners.
feature4814f9e48 seccomp, apparmor: add go:noinline
otherDisable OOM set score unpriv test temporarily ()
otherc7c8ce6bc Disable OOM set score unpriv test temporarily
fixaac488730 *: fix code style issue
feature2a38c7e2e cri: add config ut for invalid drain io timeout value
featurece213431f integration: add testcase to drain exec IO in time
feature0438e477c *: add DrainExecSyncIOTimeout config and disable as by default
fixfb262317c *: fix typo and skip exec-io-drain-testcase in win
featuref50c9922b pkg/cri/server: add timeout to drain exec io
deprecated3785deac4 cri: propagate deprecation list to runtime status
deprecatedctr: print deprecation warnings on every invocation ()
deprecatedb7a0b1b8e ctr: print deprecation warnings on every invocation
fix2d43994fb bug fix: make sure cri image is pinned when it is pulled outside cri
+19 more items in the release notessecurityThe twenty-eighth patch release for containerd 1.6 updates the runc binary in the release builds to address CVE-2024-21626
securityUpdate runc binary to v1.1.12 (GHSA-xr7r-f8xq-vfvv)
featureUpdate seccomp profile for new syscalls added since Linux 5.16 ()
otherPrepare v1.6.28 and update runc to v1.1.12 ()
other570c7c637 Prepare release notes for v1.6.28
otherb20b9f86b Update runc binary to v1.1.12
security[release/1.6] upgrade OpenTelemetry to v1.21.0 / v0.46.0 (CVE-2023-47108) etc. ()
other19500722a [release/1.6] vendor: golang.org/x/crypto v0.18.0
other919928f6b [release/1.6] vendor: golang.org/x/term v0.16.0
other7d6a4d23b [release/1.6] vendor: golang.org/x/sys v0.16.0
other16ac018ae [release/1.6] vendor: upgrade OpenTelemetry to v1.21.0 / v0.46.0
other[release/1.6] seccomp: kernel 6.7 ()
otherf44628305 seccomp: kernel 6.7
other[release/1.6] carry #9557 - enable ARM CI ()
fix65e1656f2 cri: fix integration test on cgroupsv2 system
other9cf1e1a39 *: enable ARM64 runner
othergithub.com/go-logr/logr v1.2.2 -> v1.3.0
othergithub.com/google/go-cmp v0.5.9 -> v0.6.0
othergithub.com/google/uuid v1.3.0 -> v1.3.1
othergo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.28.0 -> v0.46.0
othergo.opentelemetry.io/otel v1.3.0 -> v1.21.0
featurego.opentelemetry.io/otel/metric v1.21.0 new
othergo.opentelemetry.io/otel/sdk v1.3.0 -> v1.21.0
othergo.opentelemetry.io/otel/trace v1.3.0 -> v1.21.0
othergolang.org/x/crypto v0.14.0 -> v0.18.0
othergolang.org/x/net v0.17.0 -> v0.18.0
othergolang.org/x/oauth2 v0.10.0 -> v0.11.0
othergolang.org/x/sys v0.13.0 -> v0.16.0
othergolang.org/x/term v0.13.0 -> v0.16.0
othergolang.org/x/text v0.13.0 -> v0.14.0
othergoogle.golang.org/grpc v1.58.3 -> v1.59.0
otherImprove /etc/group handling when appending groups ()
otherUpdate runc binary to v1.1.11 ()
breakingRemove runc import ()
otherUpdate shim pidfile permissions to 0644 ()
otherUpdate Go version to 1.20.13 ()
deprecatedEmit deprecation warning for CRIU config usage ()
deprecatedEmit deprecation warning for some CRI configs ()
deprecatedEmit deprecation warning for containerd.io/restart.logpath label usage ()
other[release/1.6] Prepare release notes for v1.6.27 ()
otherd0edecf28 Prepare release notes for v1.6.27
other[release/1.6] update to go1.20.13, test go1.21.6 ()
other32a515211 update to go1.20.13, test go1.21.6
other[release/1.6 backport] shim: Create pid-file with 0644 permissions ()
other37de14d95 shim: Create pid-file with 0644 permissions
other[release/1.6 backport] remove github.com/opencontainers/runc dependency ()
other3938d63de remove github.com/opencontainers/runc dependency
other[release/1.6 backport] update runc binary to v1.1.11 ()
other9a9b11f73 update runc binary to v1.1.11
other[release/1.6 backport] go.mod: dario.cat/mergo v1.0.0 ()
other6cd8e17ab go.mod: dario.cat/mergo v1.0.0
other4f8ff5154 go.mod: github.com/imdario/mergo v0.3.13
other[release/1.6] restart: containerd.io/restart.logpath warning ()
otherd24d263a4 restart: containerd.io/restart.logpath warning
other[release/1.6 backport] WithAppendAdditionalGroups: better /etc/group handling ()
other9489c0eb0 WithAppendAdditionalGroups: better /etc/group handling
deprecated[release/1.6] cri: add deprecation warnings for deprecated CRI configs ()
deprecated713065793 deprecation: fix missing spaces in warnings
deprecatedde0cc92a7 cri: add deprecation warning for runtime_root
deprecated833b94149 cri: add deprecation warning for rutnime_engine
deprecated47de3d63d cri: add deprecation warning for default_runtime
featured421b8fda cri: add warning for untrusted_workload_runtime
feature802cb64b0 cri: add warning for old form of systemd_cgroup
feature[release/1.6] Add warning for CRIU config usage ()
featuref8447466c Add warning for CRIU config usage
featuredario.cat/mergo v1.0.0 new
featuregithub.com/moby/sys/user v0.1.0 new
fixFix windows default path overwrite issue ()
otherUpdate push to inherit distribution sources from parent ()
securityMask /sys/devices/virtual/powercap path in runtime spec and deny in default apparmor profile (GHSA-7ww5-4wqc-m92c)
deprecatedEmit deprecation warning for AUFS snapshotter usage ()
deprecatedEmit deprecation warning for v1 runtime usage ()
deprecatedEmit deprecation warning for CRI v1alpha1 usage ()
other[release/1.6] Prepare release notes for v1.6.26 ()
otherac5c5d3e0 Prepare release notes for v1.6.26
securityGithub Security Advisory GHSA-7ww5-4wqc-m92c
other02f07fe19 contrib/apparmor: deny /sys/devices/virtual/powercap
otherc94577e78 oci/spec: deny /sys/devices/virtual/powercap
other[release/1.6] update to go1.20.12, test go1.21.5 ()
other7cbdfc92e update to go1.20.12, test go1.21.5
other024b1cce6 update to go1.20.11, test go1.21.4
feature[release/1.6] Add cri-api v1alpha2 usage warning to all api calls ()
feature64e56bfde Add cri-api v1alpha2 usage warning to all api calls
other[release/1.6] tasks: emit warning for v1 runtime and runc v1 runtime ()
otherefefd3bf3 tasks: emit warning for runc v1 runtime
other7825689b4 tasks: emit warning for v1 runtime
deprecated[release/1.6] snapshots: emit deprecation warning for aufs ()
deprecated7cfe7052f snapshots: emit deprecation warning for aufs
other[release/1.6] cherry-pick/backport: Update golangci lint ()
othera1ae572a2 Fix linter error with updated linter
otherb638791d6 ci: bump up golangci-lint to v1.55.0
other2370a2842 Fix linter issues for golangci-lint 1.54.2
other8a65e2e31 Bump up golangci-lint to v1.54.2
other969f8feb2 Bump up golangci-lint to v1.52.2
other[release/1.6] push: inherit distribution sources from parent ()
other66959fdf5 push: inherit distribution sources from parent
featureb4dcffcfb content: add InfoProvider interface
otherbef4145c1 Change PushContent to require only Provider
other[release/1.6] Bump google.golang.org/grpc to v1.58.3 ()
othera5fc21060 vendor: google.golang.org/grpc v1.58.3
other4fa05b3d8 Upgrade github.com/klauspost/compress from v1.11.13 to v1.15.9
other[release/1.6] Windows default path overwrite fix ()
otherede0ad5e1 Fix windows default path overwrite issue
featurecloud.google.com/go/compute/metadata v0.2.3 new
othergithub.com/cespare/xxhash/v2 v2.1.2 -> v2.2.0
othergithub.com/golang/protobuf v1.5.2 -> v1.5.3
othergithub.com/klauspost/compress v1.11.13 -> v1.15.9
+5 more items in the release notesdeprecatedSoft deprecate log package ()
featureAllow for images with artifacts layers to pull ()
featureAdd handling for missing basic auth credentials ()
featureAdd a new image label if it is docker schema 1 ()
fixFix ambiguous tls fallback ()
deprecatedExpose usage of deprecated features ()
fixFix shimv1 leak issue ()
security[Release/1.6] CVE-2022-1996 fix for go-restful ()
security62d402275 Remove CVE-2022-1996 from containerd binary upgrading go-restful to 2.16.0
deprecated[release/1.6] cri: add deprecation warnings for mirrors, auths, and configs ()
deprecatedb68204e53 cri: add deprecation warning for configs
deprecatedae8c58319 cri: add deprecation warning for auths
deprecated455edcad2 cri: add deprecation warning for mirrors
deprecated878823f4d cri: add ability to emit deprecation warnings
deprecated[release/1.6] deprecation: new package for deprecations ()
deprecated477b7d6a1 ctr: new deprecations command
deprecated24068b813 dynamic: record deprecation for dynamic plugins
deprecated218c7a1df server: add ability to record config deprecations
deprecateddfb9e1deb pull: record deprecation warning for schema 1
deprecated90b42da6f introspection: add support for deprecations
deprecated0b6766b37 api/introspection: deprecation warnings in server
deprecatedde3cb4c18 warning: new service for deprecations
deprecatedda1b4419b deprecation: new package for deprecations
feature[release/1.6] Add a new image label if it is docker schema 1 ()
feature8108f0d03 Add a new image label if it is docker schema 1
feature[release/1.6] remotes: add handling for missing basic auth credentials ()
featuree529741d3 remotes: add handling for missing basic auth credentials
featureca45b92f4 Add ErrUnexpectedStatus to resolver
feature7b61862e7 *: add runc-fp as runc wrapper to inject failpoint
breaking65e908ee1 containerd-shim-runc-v2: remove unnecessary s.getContainer()
feature[release/1.6] Allow for images with artifacts to pull ()
feature8066dd81c Allow for images with artifacts to pull
feature[release/1.6] remotes/docker: Add MountedFrom and Exists push status ()
featureb66c818ba remotes/docker: Add MountedFrom and Exists push status
featuref9f250c Add project details
featurefb7fe3d Add github CI flow
feature7e13034 Add go module
feature698c398 Add README
feature87c83c4 Add license file
featuregithub.com/containerd/log v0.1.0 new
+79 more items in the release notesfixCRI: fix leaked shim caused by high IO pressure ()
otherUpdate to go1.20.8 ()
otherUpdate runc to v1.1.9 ()
featureBackport: add configurable mount options to overlay snapshotter ()
otherlog: cleanups and improvements to decouple more from logrus ()
other[release/1.6] Prepare release notes for v1.6.24 ()
othercdd59290d Prepare release notes for v1.6.24
other[release/1.6 backport] log: cleanups and improvements to decouple more from logrus ()
other33c2d88e7 Revert "log: define G() as a function instead of a variable"
other0a7f2975e log: swap logrus functions with their equivalent on default logger
feature9d175a19b log: add package documentation and summary of package's purpose
other96fb65529 log: make Fields type a generic map[string]any
featurebace17e2e log: add log.Entry type
otherdd127885f log: define OutputFormat type
other5b4cf2329 log: define G() as a function instead of a variable
featureee1b4a1e2 log: add all log-levels that are accepted
otherd563a411f log: group "enum" consts and touch-up docs
breaking6e8f4555b log: WithLogger: remove redundant intermediate var
otherc19325559 log: SetFormat: include returns in switch
breakingc3c22f8cb log: remove gotest.tools dependency
other[release/1.6] update to go1.20.8 ()
othera2c294800 [release/1.6] update to go1.20.8
other[release/1.6 backport] make repositories of install dependencies configurable ()
other0da8dcaa7 make repositories of install dependencies configurable
other[release/1.6 backport] update Golang to go1.20.7, minimum version go1.19 ()
other8e6a9de5b update to go1.20.7, go1.19.12
other8b2eb371f Update Go to 1.20.6,1.19.11
othercff669c7a update go to go1.20.5, go1.19.10
otherf34a22de9 update go to go1.20.4, go1.19.9
othere8e73065e update go to go1.20.3, go1.19.8
deprecated81fa93784 Stop using math/rand.Read and rand.Seed (deprecated in Go 1.20)
breaking70dc11a6c lint: remove //nolint:dupword that are no longer needed
deprecatedfec784a06 lint: silence "SA1019: tar.TypeRegA has been deprecated... (staticheck)"
fix[releases/1.6] *: fix leaked shim caused by high IO pressure ()
feature583696e4e Vagrantfile: add strace tool
featureab21d60d2 pkg/cri/server: add criService as argument when handle exit event
fixa229883cb pkg/cri/server: fix leaked shim issue
featured8f824200 integration: add case to reproduce #7496
feature[release/1.6] Cherry-pick: [overlay] add configurable mount options to overlay snapshotter ()
feature8cd40e1d0 Add configurable mount options to overlay
+11 more items in the release notesfeature**Add stable ABI support in windows platform matcher + update hcsshim tag ()
other**cri: Don't use rel path for image volumes ()
other**Upgrade GitHub actions packages in release workflow ()
other**update to go1.19.12 ()
fix**backport: ro option for userxattr mount check + cherry-pick: Fix ro mount option being passed ()
feature[release/1.6] Add release notes for v1.6.23 ()
featuree297a668f Add release notes for v1.6.23
feature[release/1.6] Add stable ABI support in windows platform matcher + update hcsshim tag ()
featuref51bf1960 Add support for stable ABI windows versions
other43a02c0b2 Update hcsshim tag to v0.9.10
other[release/1.6] cri: Don't use rel path for image volumes ()
othercc5b0a21b cri: Don't use rel path for image volumes
other[release/1.6 backport] Upgrade GitHub actions packages in release workflow ()
other4238cff1c Upgrade GitHub actions packages in release workflow
other[release/1.6] update to go1.19.12 ()
other00d1092b7 update to go1.19.12
fix[release/1.6] backport: ro option for userxattr mount check + cherry-pick: Fix ro mount option being passed ()
other47d73b2de Fix ro mount option being passed
othergithub.com/Microsoft/hcsshim v0.9.8 -> v0.9.10
otherRunC: Update runc binary to v1.1.8 ()
fixCRI: Fix additionalGids: it should fallback to imageConfig.User when securityContext.RunAsUser,RunAsUsername are empty ()
otherCRI: Write generated CNI config atomically ()
fixFix concurrent writes for UpdateContainerStats ()
otherMake checkContainerTimestamps less strict on Windows ()
otherPort-Forward: Correctly handle known errors ()
otherResolve docker.NewResolver race condition ()
featureSecComp: Always allow name_to_handle_at ()
otherAdding support to run hcsshim from local clone ()
fixFix cpu architecture detection issue on emulated ARM platform ()
fixFix panic when remote differ returns empty result ()
feature0770a4601 [release/1.6] Add release notes for v1.6.22
breaking[release/1.6 backport] ci: remove libseccomp-dev installation for nightly ()
breaking6e2bcb6dd ci: remove libseccomp-dev installation for nightly
featureb2d2d3829 atomicfile: new package for atomic file writes
deprecated[release/1.6 backport] release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles ()
deprecated59a143670 release: Add "cri-containerd.DEPRECATED.txt" in the deprecated cri-containerd-* bundles
fixb7cf26d8d docs: Fix sample config.toml syntax
fix[release/1.6 backport] bugfix(port-forward): Correctly handle known errors ()
fixfdb65f214 bugfix(port-forward): Correctly handle known errors
feature[release/1.6 backport] seccomp: always allow name_to_handle_at ()
feature07ea7b9e7 seccomp: always allow name_to_handle_at
feature[release/1.6 backport] integration/client: add timeout to TestShimOOMScore ()
featurebd76ab978 integration/client: add timeout to TestShimOOMScore
feature[1.6] Add Fields type alias to log package ()
feature9f2cdd589 Add Fields type alias to log package
feature2b16e4bfa Add unit test to function GetCPUVariantFromArch
deprecated[release/1.6 backport] remotes/docker: ResolverOptions: fix deprecation comments ()
deprecated56ff20839 remotes/docker: ResolverOptions: fix deprecation comments
fixgha: fix golangci-lint, and upgrade to v1.52.2 ()
fix23c831a remove pre-go1.17 build-tags, and fix missing build-tags in plugin
fixe5acd95 gha: fix golangci-lint, upgrade to v1.52.2
featureAdd CodeQL analysis workflow ()
featurefee1db7 Add CodeQL analysis workflow
breakingRemove references to io/ioutil package ()
fixfollow-up-#52: fix the order of cause in fmt.Errorf ()
fixb3f193d follow-up-#52: fix the order of cause in fmt.Errorf
fixREADME.md: fix CI badge ()
fix0977d81 README.md: fix CI badge
featuregithub.com/mistifyio/go-zfs/v3 v3.0.1 new
+140 more items in the release notesother**update runc binary to v1.1.7 ()
other**Remove entry for container from container store on error ()
other**oci: partially restore comment on read-only mounts for uid/gid uses ()
feature**windows: Add ArgsEscaped support for CRI ()
other**oci: Use WithReadonlyTempMount when adding users/groups ()
other**archive: consistently respect value of WithSkipDockerManifest ()
other[release/1.6] Prepare release notes for v1.6.21 ()
feature9226c362a Add release notes for v1.6.21
other[release/1.6] update go to go1.19.9 ()
other39566aade [release/1.6] update go to go1.19.9
fix[release/1.6] fix the task setting the runtime path ()
othere8840f688 skip TestContainerStartWithAbsRuntimePath if the runtime is v1
feature75ab094de integration: add container start test using abs runtime path
otherf49254f0b WithRuntimePath uses the TaskInfo.RuntimePath field
other[release/1.6 backport] update runc binary to v1.1.7 ()
otherccb51ff26 update runc binary to v1.1.7
other[release/1.6] Remove entry for container from container store on error ()
other95d31551d Remove entry for container from container store on error
other[release/1.6 backport] oci: partially restore comment on read-only mounts for uid/gid uses ()
otherc33eb574d oci: partially restore comment on read-only mounts for uid/gid uses
feature[release/1.6 ] Add ArgsEscaped support for CRI ()
otherbc2e01303 Fix argsEscaped tests
feature8b81d5acc Add ArgsEscaped support for CRI
other[release/1.6 backport] update runc binary to v1.1.6 ()
other57d953482 update runc binary to v1.1.6
other[release/1.6 backport] oci: Use WithReadonlyTempMount when adding users/groups ()
otherfb5e663d0 oci: Use WithReadonlyTempMount when adding users/groups
other[release/1.6] update go to go1.19.8 ()
other26efb8fd5 [release/1.6] update go to go1.19.8
other[release/1.6] archive: consistently respect value of WithSkipDockerManifest ()
featureec13b497e export: add test for WithSkipDockerManifest
otherd1f3771c4 archive: consistently respect value of WithSkipDockerManifest
otherDisable looking up usernames and groupnames on host ()
featureAdd support for Windows ArgsEscaped images ()
otherUpdate hcsshim to v0.9.8 ()
fixFix debug flag in shim ()
featureAdd WithReadonlyTempMount to support readonly temporary mounts ()
otherUpdate ttrpc to fix file descriptor leak ()
otherUpdate runc binary to v1.1.5 ()
otherUpdate image config to support ArgsEscaped ()
other[release/1.6] Prepare release notes for v1.6.20 ()
othera039a2b9c Prepare release notes for v1.6.20
other[release/1.6]Updates oci image config to support upstream ArgsEscaped ()
other5dd94a7e6 Updates oci image config to support upstream ArgsEscaped
other[release/1.6] update runc binary to v1.1.5 ()
other59fa6b191 update runc binary to v1.1.5
other0c0aad93e go.mod: github.com/opencontainers/runc v1.1.5
other[release/1.6] Update ttrpc to v1.1.1 ()
other50a6be0b4 Update ttrpc to v1.1.1
feature[release/1.6 backport] Add WithReadonlyTempMount to create readonly temporary mounts ()
feature8cead6594 Add WithReadonlyTempMount to create readonly temporary mounts
feature[release/1.6] Adds support for Windows ArgsEscaped images ()
featuref0dc0297d Adds support for Windows ArgsEscaped images
other[release/1.6]go.mod: Bump hcsshim tag to v0.9.8 ()
other5981a24e2 Update hcsshim tag to v0.9.8
fix[1.6] shim: fix debug flag not working ()
fix28f1e32e3 shim: fix debug flag not working
other[release/1.6] cherry-pick: Update go-restful to v3 ()
other5a8ea75df Update go-restful to v3
other59bdc1d5a go.mod: update to github.com/emicklei/go-restful/v3 v3.7.3
other[release/1.6] Go 1.19.7 ()
other86e0bd9e3 Go 1.19.7
other[release/1.6 backport] archive: disable looking up usernames and groupnames on the host ()
other063ad2f19 archive: disable looking up usernames and groupnames on the host
other[release/1.6 backport] assorted linting, and golang update-related changes ()
deprecatede6179af1e remove unneeded nolint-comments (nolintlint), disable deprecated linters
feature9f0617ecc pkg/cri/(server|sbserver): criService.getTLSConfig() add TODO to verify nolint
breaking627f563e6 chore: remove duplicate word in comments
breakingc23945c5f test: remove redundant mountPoint
fix[release/1.1] server: Fix connection leak when receiving ECONNRESET ()
fix8977f59 server: Fix connection leak when receiving ECONNRESET
featuregithub.com/emicklei/go-restful/v3 v3.7.3 new
+23 more items in the release notesfixUpdate hcsshim to v0.9.7 to include fix for graceful termination and pause containers ()
other[release/1.6] Prepare release notes for v1.6.19 ()
feature23e94075a Add release notes for v1.6.19
other[release/1.6] go.mod: Bump hcsshim to v0.9.7 ()
otherf488a6241 Update hcsshim tag to v0.9.7
othergithub.com/Microsoft/hcsshim v0.9.6 -> v0.9.7
securityThe eighteenth patch release for containerd 1.6 includes fixes for CVE-2023-25153 and CVE-2023-25173 along with a security update for Go.
securityFix OCI image importer memory exhaustion (GHSA-259w-8hf6-59c2)
securityFix supplementary groups not being set up properly (GHSA-hmfx-3pcx-653p)
breakingRevert removal of /sbin/apparmor_parser check ()
otherUpdate Go to 1.19.6 ()
other[release/1.6] Prepare release notes for v1.6.18 ()
feature44e61d764 Add release notes for v1.6.18
securityGithub Security Advisory GHSA-hmfx-3pcx-653p
fix286a01f35 oci: fix additional GIDs
fix301823453 oci: fix loop iterator aliasing
other0070ab70f oci: skip checking gid for WithAppendAdditionalGroups
other16d52de64 refactor: reduce duplicate code
featureb45e30292 add WithAdditionalGIDs test
feature0a06c284a add WithAppendAdditionalGroups helper
securityGithub Security Advisory GHSA-259w-8hf6-59c2
other84936fd1f importer: stream oci-layout and manifest.json
feature[1.6] Add fallback for windows platforms without osversion ()
featureb327af6a4 Add fallback for windows platforms without osversion
other[release/1.6] Go 1.19.6 ()
other54ead5b7b Go 1.19.6
other[release/1.6] ctr/run: flags --detach and --rm cannot be specified together ()
other2b4b35ab4 ctr/run: flags --detach and --rm cannot be specified together
other[release/1.6] Fix retry logic within devmapper device deactivation ()
otherd5284157b Fix retry logic within devmapper device deactivation
fix[release/1.6 backport] Revert apparmor_parser regression ()
other624ff636b pkg/apparmor: clarify Godoc
other3a0a35b36 Revert "Don't check for apparmor_parser to be present"
other[release/1.6] CI: skip some jobs when repo != containerd/containerd ()
other664a938a3 CI: skip some jobs when repo != containerd/containerd
featureAdd network plugin metrics ()
otherUpdate mkdir permission on /etc/cni to 0755 instead of 0700 ()
otherExport remote snapshotter label handler ()
featureAdd support for default hosts.toml configuration ()
other[release/1.6] Prepare release notes for v1.6.17 ()
othera1aa9b900 Prepare release notes for v1.6.17
other[1.6] Backport default registry hosts config ()
other1436641b8 Support default hosts.toml configuration
other87acecd04 Update hosts doc
other[release/1.6 backport] Export remote snapshotter label handler ()
othera6544ed7d Export remote snapshotter label handler
other[release/1.6] cri: mkdir /etc/cni with 0755, not 0700 ()
otherae02a24a3 cri: mkdir /etc/cni with 0755, not 0700
feature[release/1.6] add network plugin metrics ()
feature6c6cc5ec1 add network plugin metrics
fixFix push error propagation ()
fixFix slice append error with HugepageLimits for Linux ()
otherUpdate default seccomp profile for PKU and CAP_SYS_NICE ()
fixFix overlayfs error when upperdirlabel option is set ()
other[release/1.6] Prepare v1.6.16 ()
otherd3c595aa3 Prepare release notes for v1.6.16
other[release/1.6 backport] Fix tx closed error when upperdirlabel specified ()
other8c704036a Fix tx closed error when upperdirlabel specified
other[release/1.6 backport] assorted test-fixes ()
fix91a68edd7 cri: Fix TestUpdateOCILinuxResource for host w/o swap controller
other5594f706e Fix TestUpdateContainerResources_Memory* on cgroup v2 hosts
other[release/1.6 backport] seccomp updates ()
feature7037f5313 seccomp: add get_mempolicy, mbind, set_mempolicy, with CAP_SYS_NICE
featured22919a1c seccomp: seccomp: add syscalls related to PKU in default policy
other[release/1.6 backport] Harden GITHUB_TOKEN permissions ()
other8b8a21fe4 Harden GITHUB_TOKEN permissions
other[release/1.6 backport] assorted updates to Vagrantfile ()
fix8009948bb Vagrantfile: fix comments about SELinux
breaking550424f92 Vagrantfile: install-rootless-podman: remove setenforce 0
other2c32f8559 CI: update Fedora to 37
other556bb0cc8 Vagrantfile: explicitly specify rsync as the shared folder driver
otheredfac1834 fix install cni script
other91d5e53fb Vagrantfile: dump containerd log after critest
other[release/1.6 backport] Fix slice append error ()
otherab193eb20 pkg/cri: optimize slice initialization
othere6cf5ec58 Fix slice append error
other[release/1.6] update to go1.18.10 ()
other6a8a6531f [release/1.6] update to go1.18.10
other[release/1.6 backport] release/Dockerfile: set DEBIAN_FRONTEND=noninteractive ()
otherd0dc7988a release/Dockerfile: set DEBIAN_FRONTEND=noninteractive
other[release/1.6 backport] pushWriter: correctly propagate errors ()
other1584c2581 pushWriter: correctly propagate errors
other[release/1.6] mod: update github.com/pelletier/[email protected] ()
other545f22091 mod: update github.com/pelletier/[email protected]
othergithub.com/pelletier/go-toml v1.9.3 -> v1.9.5
fixFix no CNI info for pod sandbox on restart in CRI plugin ()
other[release/1.6] Prepare release notes for v1.6.15 ()
other883899eae Prepare release notes for v1.6.15
other[release/1.6] CI: Pass GITHUB_TOKEN to containerd/project-checks ()
otherb57367020 CI: Pass GITHUB_TOKEN to containerd/project-checks
other[release/1.6] integration/images: switch away from Docker Hub to avoid rate limit ()
other0f4062c9b integration/images: switch away from Docker Hub to avoid rate limit
fix[release/1.6] CRI: Fix no CNI info for pod sandbox on restart ()
fixf16447e2d CRI: Fix no CNI info for pod sandbox on restart
fixFix memory.memsw.limit_in_bytes: no such file or directory error in CRI plugin ()
otherPrepare release notes for v1.6.14 ()
other1347d7c87 Prepare release notes for v1.6.14
fix[release/1.6] cri: fix memory.memsw.limit_in_bytes: no such file or directory ()
fix53c733e0b cri: fix memory.memsw.limit_in_bytes: no such file or directory
otherRevert "[release/1.6] support fetching containerd from non public GCS buckets" ()
othere8b22c100 Revert "[release/1.6] support fetching containerd from non public GCS buckets"
fixParseCgroupFile: fix wrong comment about unified hierarchy ; add ParseCgroupFileUnified to get the unified path ()
featuredd81920 add ParseCgroupFileUnified to get the unified path
fixdae6735 ParseCgroupFile: fix wrong comment about unified hierarchy
otherBump go version to 1.17 in go.mod ()
othere5baf6b Bump go version to 1.17 in go.mod
othermake cmd/ a separate module (as it's only for testing) ()
other66f3f56 make cmd/ a separate module (as it's only for testing)
featurefeat(v2): add Update method for v2.Manager ()
feature0592512 feat(v2): add Update method for v2.Manager
featurefeat: add memory.min param ()
feature8276db2 feat: add memory.min param
othermodified the dereference null pointer value. ()
othera76c4fb modified the dereference null pointer value.
otherupdate readme for cpu cgroup demo ()
otherf39d7da update readme for cpu cgroup demo
fixFix systemd full path ()
otheraa8003c Fix systemd full path
otherUpdate Go version and fedora base ()
otherd7918f2 Update Go version and fedora base
fixFix panic in NewSystemd on nil values ()
other65478b8 Fix panic in NewSystemd on nil values
othergithub.com/containerd/cgroups v1.0.3 -> v1.0.4
otherUpdate overlay snapshotter to check for tmpfs when evaluating usage of userxattr ()
otherUpdate hcsschim to v0.9.6 to fix resource leak on exec ()
otherMake swapping disabled with memory limit in CRI plugin ()
featureAllow clients to remove created tasks with PID 0 ()
fixFix concurrent map iteration and map write in CRI port forwarding ()
otherCheck for nil HugepageLimits to avoid panic in CRI plugin ()
other[release/1.6] Prepare release notes for v1.6.13 ()
otherPrepare release notes for v1.6.13
other[release/1.6] support fetching containerd from non public GCS buckets ()
otherdisable tracing while handling token
othersupport fetching containerd from non public GCS buckets
other[release/1.6] nil check to avoid panic on upgrade ()
othernil check to avoid panic on upgrade
other[release/1.6] concurrent map iteration and map write ()
otherfatal error: concurrent map iteration and map write
feature[release/1.6] allow client to remove created tasks with PID 0 ()
featureallow client to remove created tasks with PID 0
other[release/1.6] cri: make swapping disabled with memory limit ()
othercri: make swapping disabled with memory limit
other[release/1.6] go.mod: Bump hcsshim to v0.9.6 ()
otherBump hcsshim to v0.9.6
other[release/1.6] Cherry pick GitHub actions workflow updates 1.6 ()
otherupdate codeql-action to v2
otherUpgrade actions/upload-artifact from v2 to v3
deprecatedMove up actions versions to prep for deprecation
otherCI: update GHA instances from Ubuntu 18.04 to 20.04
otherUse global env variable to specify Go version on CI
otherRework permission handling in scripts
fixfix pool_device_test.go
other[release/1.6] fix: check for tmpfs when evaluating if userxattr should be used ()
fixfix: check for tmpfs when evaluating if userxattr should be used
othergithub.com/Microsoft/hcsshim v0.9.5 -> v0.9.6
securityThe twelfth patch release for containerd 1.6 contains a fix for CVE-2022-23471.
securityFix goroutine leak during Exec in CRI plugin (GHSA-2qjp-425j-52j9)
securityGithub Security Advisory GHSA-2qjp-425j-52j9
otherPrepare release notes for v1.6.12
fixCRI stream server: Fix goroutine leak in Exec
other[release/1.6] update to go1.18.9 ()
other[release/1.6] update to go1.18.9
featureAdd pod UID annotation in CRI plugin ()
fixFix nil pointer deference for Windows containers in CRI plugin ()
fixFix lease labels unexpectedly overwriting expiration ()
fixFix for simultaneous diff creation using the same parent snapshot ()
otherPrepare release notes for v1.6.11 ()
otherPrepare release notes for v1.6.11
other[release/1.6] fix: support simultaneous create diff for same parent snapshot ()
fixfix: support simultaneous create diff for same parent snapshot
fix[release/1.6] cherry-pick: Fix order of operations when setting lease labels ()
fixFix order of operations when setting lease labels
feature[release/1.6] Added nullptr checks to pkg/cri/server and sbserver ()
featureAdded nullptr checks to pkg/cri/server and sbserver
feature[release/1.6] cri: add pod uid annotation ()
featurecri: add pod uid annotation
breaking[release/1.6] go.mod: use golang_protobuf_extensions v1.0.4 to prevent incompatible versions ()
other[release/1.6] go.mod: use golang_protobuf_extensions v1.0.4
otherAlways check userxattr for overlay on kernels >= 5.11 ()
fixBump hcsshim to 0.9.5 to fix container shutdown bug on Windows (
securityBump Go version to 1.18.8 to address CVE-2022-41716 ()
other[release/1.6] Prepare release notes for v1.6.10 ()
otherPrepare release notes for v1.6.10
feature[release/1.6] overlayutils: Add fastpath for userxattr check ()
featureoverlayutils: Add fastpath for userxattr check
security[release/1.6] update to Go 1.18.8 to address CVE-2022-41716 ()
security[release/1.6] update to Go 1.18.8 to address CVE-2022-41716
other[release/1.6] ctr export strictly match default platform ()
otherctr export strictly match default platform
other[release/1.6] go.mod: Bump hcsshim to v0.9.5 ()
other[release/1.6] go.mod: Bump hcsshim to v0.9.5
other[release/1.6] ctr import: strictly match platform ()
otherctr import: strictly match platform
other[release/1.6] cherry-pick: Migrate away from GitHub actions set-output ()
otherMigrate away from GitHub actions set-output
othergithub.com/Microsoft/hcsshim v0.9.4 -> v0.9.5
breakingUpdate oci.WithDefaultUnixDevices(): remove tun/tap from the default devices ()
fixFix CRI: Do not append []string{""} to command to preserve Docker compatibility ()
otherEnhance CRI: ContainerStatus to return container resources ()
fixFix OCI resolver to skip TLS verification for localhost (
fixFix createTarFile: make xattr EPERM non-fatal ()
fixFix CRI plugin to setup pod network after creating the sandbox container ()
fixFix OCI pusher to retry request on writer reset ()
fixFix archive to validate digests before use ()
otherMigrate from k8s.gcr.io to registry.k8s.io ()
fixFix CRI: PodSandboxStatus should tolerate missing task ()
fixFix io.containerd.runc.v1: Stats() shouldn't assume s.container is non-nil ()
featureEnhance CRI plugin to add logging volume metrics ()
featureAdd support for CAP_BPF and CAP_PERFMON ()
other[release/1.6] Prepare release notes for v1.6.9 ()
otherf1493f665 Prepare release notes for v1.6.9
other99578d1fc Update mailmap
feature[release/1.6] Add logging volume metrics to Containerd CRI plugin ()
featurea956d8415 Add logging volume metrics to Containerd CRI plugin
security[release/1.6] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 ()
security28324c529 [release/1.6] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
breaking7b8d679ad [release/1.6] integration: remove use of deprecated io/ioutil
featureb9a35c6af Add integration tests with failpoint
feature[release/1.6] test: introduce failpoint control to runc-shimv2 and cni ()
featurea85709c6c integration: simplify CNI-fp and add README.md
featured89a8d223 pkg/failpoint: add FreeBSD link and update pkg doc
featureb0ce2965a integration: Add injected failpoint testing for RunPodSandbox
feature07c479471 pkg/failpoint: add DelegatedEval API
feature71ee7de24 bin/ctr,integration: new runc-shim with failpoint
breaking[release/1.6] .zuul: remove the zull because it is offline ()
breaking6b30bc4b4 .zuul: remove the zuul because it is offline
breaking[release/1.6] ci: remove GOPROXY environment variable due to https://github.com/go-… ()
breaking1efd8b947 ci: remove GOPROXY environment variable due to https://github.com/go-yaml/yaml/issues/887
breaking[release/1.6 backport] oci: WithDefaultUnixDevices(): remove tun/tap from the default devices ()
breakinged9d3dc37 oci: WithDefaultUnixDevices(): remove tun/tap from the default devices
breaking5df4731 cmd/continuity: remove FUSE for macOS
breakingde7fd6b sysx: remove unused sysx/generate.sh script
fixe9ca807 fs: fix minor linting and gofmt issue
deprecated5bf078f Remove deprecated io/ioutil (except ioutil.ReadDir)
fixFix wrapping errors ()
fixdef6729 fs: fix wrapping nil err
+79 more items in the release notesother[release/1.6] Prepare release notes for v1.6.8 ()
other3364f411e Prepare release notes for v1.6.8
other[release/1.6] release workflow: increase timeout to 30 minutes & remove Go setup action ()
breaking390920429 release workflow: remove Go setup action
othercf48ba6e8 release workflow: increase timeout to 30 minutes
other[release/1.6] release: rollback Ubuntu to 18.04 (except for riscv64) ()
other57873e652 release: rollback Ubuntu to 18.04 (except for riscv64)
otherUpdate runc to v1.1.3 ()
featureSeccomp: Allow clock_settime64 with CAP_SYS_TIME ()
fixFix WWW-Authenticate parsing ()
otherSupport RISC-V 64 and ppc64le builds ()
fixWindows: Update hcsshim to v0.9.4 to fix regression with HostProcess stats ()
fixWindows: Fix shim logs going to panic.log file ()
featureAllow ptrace(2) by default for kernels >= 4.8 ()
other[release/1.6] Update release build timeout ()
othereccb82f6d Update release build timeout to 20 minutes
otherPrepare releases notes for 1.6.7 ()
other6a854d4b5 Update mailmap
other61612e1a2 Prepare release notes for 1.6.7
other[release/1.6] Update golang to 1.17.13 ()
otherd199ee462 Update golang to 1.17.13
other[release/1.6] Backport: Change os.Stderr reassign for Windows service ()
other0578d20c5 Change os.Stderr reassign for Windows service
other[release/1.6] Backport: bump macos runner version ()
other12cae4961 Update Vagrant CI to macos-12
otherbc4091aae chore: bump macos runner version
other[release/1.6] Backport Windows HostProcess test improvements ()
othercb73bd050 Windows HostProcess container CRI stats test
featureac388525a Add validations for Windows HostProcess CRI configs
other[release/1.6] go.mod: Bump hcsshim to v0.9.4 ()
other0007f40fe [release/1.6] go.mod: Bump hcsshim to v0.9.4
other[release/1.6] Update Fedora version to 36 ()
otherc9607e78c Update Fedora version to 36
other[release/1.6] Support RISC-V 64 ()
feature2952b66c0 CI: add riscv64 builds
other6b2dc9a37 release/Dockerfile: update Ubuntu to 22.04 for supporting riscv64
other745dc07c4 seccomp: support riscv64
otherc2f841f21 Create ppc64le release
feature[release/1.6] allow ptrace(2) by default for kernel >= 4.8 ()
featuref3da3e51f allow ptrace(2) by default for kernel >= 4.8
feature[release/1.6] seccomp: allow clock_settime64 when CAP_SYS_TIME is added ()
feature86b55bd8d seccomp: allow clock_settime64 when CAP_SYS_TIME is added
other[release/1.6] update golang to 1.17.12 ()
otheraa1101068 [release/1.6] update golang to 1.17.12
other[release/1.6] Fix WWW-Authenticate parsing ()
fix[release/1.6] ctr: fix label args used in NewContainer ()
fix99c56d217 ctr: fix label args used in NewContainer
+8 more items in the release notessecurityThe sixth patch release for containerd 1.6 includes a fix for CVE-2022-31030.
securityFix ExecSync handler to cap console output size (GHSA-5ffw-gxpp-mxpf)
securityGithub Security Advisory GHSA-5ffw-gxpp-mxpf
other61213742a Prepare release notes for v1.6.6
otherf92068350 Implicitly discard the input to drain the reader
other2eb67213b [release/1.6] Limit the response size of ExecSync
fixFix for older CNI plugins not reporting version ()
fixFix mount path handling for CRI plugin on Windows ()
otherPrepare release notes for v1.6.5 ()
other185e87275 Prepare release notes for v1.6.5
other[release/1.6] update golang to 1.17.11 ()
other5c9c83d3e [release/1.6] update golang to 1.17.11
other[release/1.6] update go-cni/for cni update fixing plugins that don't respond with version ()
otherfdcdc27bc update go-cni/for cni update fixing plugins that don't respond with version
feature[release/1.6] archive: add human-readable hint to Lchown error ()
featuree33b9e709 archive: add human-readable hint to Lchown error
other[release/1.6] go.mod: Bump hcsshim to 0.9.3 ()
other6eff5b6c0 [release/1.6] go.mod: Bump hcsshim to 0.9.3
deprecated[release/1.6] config: improve config v1 deprecation message ()
deprecated3bb5a9d19 config: improve config v1 deprecation message
other[release/1.6] update golang to 1.17.10, golang.org/x/sys v0.0.0-20220412211240-33da011f77ad ()
otherf1d2d9260 [release/1.6] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
other9f99be51b [release/1.6] update golang to 1.17.10
fix[release/1.6] Bug fix for mount path handling ()
fix70839a344 Bug fix for mount path handling
breaking[release/1.6] Reverts removal of parallel run from critest ()
breaking82a77be2d reverts removal of parallel run from critest
other[release/1.6 backport] update runc binary and vendor to v1.1.2 ()
other246a1b42e vendor: github.com/opencontainers/runc v1.1.2
other43717e03a update runc binary to v1.1.2
feature[release/1.6] Allow git commands in Vagrantfile ()
feature06bdfeb67 Allow git commands in Vagrantfile
other[release/1.6] Update critools to v1.24 ()
other1520bae0f update critools to v1.24
othergo.mod: update libcni to v1.1.1 ()
othercb645ef go.mod: update libcni to v1.1.1
featureadd in some serial setup tests; a little make cleanup ()
feature42cfe0f add in some serial setup tests; a little make cleanup
featureRe-introduce serial network setup ()
featureee1a707 Re-introduce serial network setup
othergithub.com/Microsoft/hcsshim v0.9.2 -> v0.9.3
othergithub.com/containerd/go-cni v1.1.5 -> v1.1.6
othergithub.com/containernetworking/cni v1.1.0 -> v1.1.1
othergithub.com/opencontainers/runc v1.1.1 -> v1.1.2
othergolang.org/x/sys 1d35b9e2eb4e -> 33da011f77ad
fixUpdate go-cni to fix teardown regression ()
fixFix broken SELinux relabeling for Kubernetes volume mounts ()
otherPrepare release notes for 1.6.4 ()
other0d1d2953b Prepare release notes for 1.6.4
other[release/1.6 backport] Bump opencontainers/selinux from 1.10.0 to 1.10.1 ()
other42d691fe6 Bump opencontainers/selinux from 1.10.0 to 1.10.1
other[release/1.6] Update go-cni to v1.1.5 backported due to conflict in go.mod ()
othere9f22e008 Update go-cni to v1.1.5
other[release/1.6] cri: close fifos when container is deleted ()
otherbe4909e95 cri: close fifos when container is deleted
otherbump github.com/containernetworking/cni v1.1.0 ()
othere24193e bump github.com/containernetworking/cni v1.1.0
otherRevert "Update loopback version to support check" ()
other186662c Revert "Update loopback version to support check"
otherUse revive instead of golint ()
other322e8bf Use revive instead of golint
otherBump go verion to 1.17 ()
other9b78de4 Bump go verion to 1.17
othergithub.com/containerd/go-cni v1.1.4 -> v1.1.5
othergithub.com/containernetworking/cni v1.0.1 -> v1.1.0
othergithub.com/opencontainers/selinux v1.10.0 -> v1.10.1
fixFix panic when configuring tracing plugin ()
otherImprove image pull performance in CRI plugin ()
otherCheck for duplicate nspath ()
fixFix deadlock in cgroup metrics collector ()
otherMount devmapper xfs file system with "nouuid" option ()
otherMake the temp mount as ready only in container WithVolumes ()
fixFix deadlock from leaving transaction open in native snapshotter ()
otherMonitor OOMKill events to prevent missing container events ()
otherPrepare release notes for v1.6.3 ()
otherbaa386dc0 Prepare release notes for v1.6.3
fix[release/1.6] tracing: fix panic on startup when configured ()
fixe8da82adc tracing: fix panic on startup when configured
other[release/1.6] CRI: improve image pulling performance ()
other1764ea9a2 CRI: improve image pulling performance
other[release/1.6] update golang to 1.17.9 ()
other9cd76d465 [release/1.6] update golang to 1.17.9
other[release/1.6] check for duplicate nspath possibilities ()
otherc09cc1242 check for duplicate nspath possibilities
fix[release/1.6] metrics/cgroups: fix deadlock issue in Add during Collect ()
fixfe6ba62ce metrics/cgroups: fix deadlock issue in Add during Collect
other[release/1.6] go.mod: update image-spec to merge-commit of v1 into main ()
other8b81a7843 [release/1.6] go.mod: update image-spec to merge-commit of v1 into main
other[release/1.6 backport] update runc to 1.1.1 ()
otherf2ba2041b update runc binary to v1.1.1
otherb736b4dab go.mod: github.com/opencontainers/runc v1.1.1
feature[release/1.6] CI: add Rocky Linux 8 ()
feature72f1e58c7 CI: add Rocky Linux 8
other[release/1.6] vendor: github.com/containerd/imgcrypt v1.1.4 ()
other7ede40c5c [release/1.6] vendor: github.com/containerd/imgcrypt v1.1.4
other[release/1.6 backport] moving up to go-cni v1.1.4 ()
other82a12edf2 moving up to go-cni v1.1.4
other[release/1.6 backport] Update prometheus client vendor ()
otherda35c19da Test turning off golang CI lint cache
featurea0213573b Add nolint:staticcheck to platform-specific calls
fix[release/1.6 backport] native: fix deadlock from leaving transactions open ()
fix28b44826b native: fix deadlock from leaving transactions open
fixFix Loopback Version ()
featureAdd integration test for linux and update go version from 1.16 to 1.17 ()
feature49aa5ab Add integration test and update go version
feature6fdd981 images: Add list of Platforms to CheckAuthorization()
+32 more items in the release notessecurityThe second patch release for containerd 1.6 includes a fix for CVE-2022-24769.
securityFix the inheritable capability defaults (GHSA-c9cp-9c75-9v8c)
otherPrepare release notes for v1.6.2 ()
otherPrepare release notes for v1.6.2
featureAdd static checks to shim for Windows
other[release/1.6] update go.mod go version ()
otherUpdate go.mod go version
feature[release/1.6] remove empty go mod to allow building for go 1.18 ()
feature[release/1.6] remove empty go mod to allow building for go 1.18
securityGithub Security Advisory GHSA-c9cp-9c75-9v8c
fixFix the Inheritable capability defaults.
other[release/1.6] cherry-pick: Update TestNormalize to only test Windows ()
otherUpdate TestNormalize to only test Windows
other[release/1.6] cherry-pick: Upgrade golangci-lint and its GitHub Action ()
otherUpgrade golangci-lint and its GitHub Action
other[release/1.6] cri: relax test for system without hugetlb ()
othercri: relax test for system without hugetlb
security[release/1.6] update to go 1.16.15, 1.17.8 to address CVE-2022-24921 ()
securityupdate to go 1.16.15, 1.17.8 to address CVE-2022-24921
securityThe first patch release for containerd 1.6 includes a fix for CVE-2022-23648 and other issues.
securityUse fs.RootPath when mounting volumes (GHSA-crp2-qrr5-8pq7)
otherReturn init pid when clean dead shim in runc.v1/v2 shims ()
other[release/1.6] Prepare release notes for v1.6.1 ()
otherPrepare release notes for v1.6.1
securityGithub Security Advisory GHSA-crp2-qrr5-8pq7
otherUse fs.RootPath when mounting volumes
other[release/1.6] runc.v1/v2: return init pid when clean dead shim ()
othercontainerd-shim-runc-v1: return init pid when clean dead shim
othercontainerd-shim-runc-v2: return init pid when clean dead shim
breakingRemove submodule go mod ()
breakingRemove api go submodule
breakingremove io/ioutil ()
breakingremove io/ioutil
securityGithub Security Advisory GHSA-mvff-h3cj-wj9c
breakingRemove Windows integration testing for 2004. ()
breakingRemove Windows integration testing for 2004.
breakingimages/converter: remove deprecated types
breakingIntegration: Remove explicit version passing to azure/CLI. ()
breakingIntegration: Remove explicit version passing to azure/CLI.
securityGithub Security Advisory GHSA-5j5w-g665-5m35
breakingRemove extra test_teardown
breakingpkg/cap: remove an outdated comment ()
breakingpkg/cap: remove an outdated comment
securityGithub Security Advisory GHSA-c2h3-6mxw-7mvq
breakingBUILDING.md: remove some bits about building runc ()
breakingBUILDING.md: remove some bits about building runc
breakingRemove redundant build tags ()
breakingRemove redundant build tags
breakingremove go 1.13 from containerd
breakingscripts: linting fixes, and remove support for Debian Jessie (as it's EOL) ()
breakingtest/build-utils.sh: remove support for Debian Jessie
breakingFuzzing: Remove panics of container_fuzzer ()
breakingFuzzing: Remove panics of container_fuzzer
securityGithub Security Advisory GHSA-c72p-9xmj-rx3w
breakingruntime: runc v2: remove redundant validation ()
breakingruntime: runc v2: remove redundant validation
breakingremove pkg/cri/platforms package ()
breakingremove pkg/cri/platforms package
breakingsys: remove StatAtime(), StatCtime(), StatMtime() and StatATimeAsTime() utils ()
breakingsys: remove StatAtime(), StatCtime(), StatMtime() and StatATimeAsTime() utils
breakingRemove mountpoints not commonly mounted on FreeBSD
breakingRemove useless lines ()
breakingRemove useless lines
breakingv2: remove unimplemented errors and ErrorHandler, IgnoreNotExist ()
breakingv2: remove ErrorHandler and IgnoreNotExist as they are not implemented
breakingv2: remove errors that are never returned
breakingRemove direct dependency on github.com/pkg/errors ()
breakingremove direct dependency on github.com/pkg/errors
breakingremove: Continue on "not found" errors ()
+1264 more items in the release notessecurityThe eighteenth patch release for containerd 1.5 includes fixes for CVE-2023-25153 and CVE-2023-25173 along with a security update for Go.
securityFix supplementary groups not being set up properly (GHSA-hmfx-3pcx-653p)
securityFix OCI image importer memory exhaustion (GHSA-259w-8hf6-59c2)
otherUpdate Go to 1.19.6 ()
other[release/1.5] Prepare release notes for v1.5.18 ()
otherddf9de6cb Prepare release notes for v1.5.18
securityGithub Security Advisory GHSA-hmfx-3pcx-653p
fixa62c38bf2 oci: fix additional GIDs
fix3b89da580 oci: fix loop iterator aliasing
otherb07ec6b25 oci: skip checking gid for WithAppendAdditionalGroups
other356672cb5 refactor: reduce duplicate code
feature6a7b7617c add WithAdditionalGIDs test
feature832bcf300 add WithAppendAdditionalGroups helper
securityGithub Security Advisory GHSA-259w-8hf6-59c2
other19a347e45 importer: stream oci-layout and manifest.json
other[release/1.5] Go 1.19.6 ()
other4209dc243 Go 1.19.6
other[release/1.5] Fix retry logic within devmapper device deactivation ()
other0d16d045d Fix retry logic within devmapper device deactivation
other[release/1.5] CI: skip some jobs when repo != containerd/containerd ()
other34451bc66 CI: skip some jobs when repo != containerd/containerd
otherUpdate shim to fail fast on dial error ()
fixFix no CNI info for pod sandbox on restart ()
fixFix push error propagation ()
other[release/1.5] Prepare release notes for v1.5.17 ()
other40a4d58de Prepare release notes for v1.5.17
other[release/1.5] integration/images: switch away from Docker Hub to avoid rate limit ()
otherd44769ad6 integration/images: switch away from Docker Hub to avoid rate limit
other[release/1.5 backport] pushWriter: correctly propagate errors ()
other1e848038d pushWriter: correctly propagate errors
other[release/1.5] update to go1.18.10 ()
other464c2fb7a [release/1.5] update to go1.18.10
other[release/1.5] runtime: should fail fast if dial error on shim ()
other7473711de runtime: should fail fast if dial error on shim
fix[release/1.5] CRI: Fix no CNI info for pod sandbox on restart ()
fix23c2a863e CRI: Fix no CNI info for pod sandbox on restart
other[release/1.5] go.mod: Bump hcsshim to v0.8.25 ()
other1c5d8d142 [release/1.5] Bump shim tag to v0.8.25
othergithub.com/Microsoft/hcsshim v0.8.24 -> v0.8.25
securityThe sixteenth patch release for containerd 1.5 contains a fix for CVE-2022-23471.
securityFix goroutine leak during Exec in CRI plugin (GHSA-2qjp-425j-52j9)
securityGithub Security Advisory GHSA-2qjp-425j-52j9
otherPrepare release notes for v1.5.16
fixCRI stream server: Fix goroutine leak in Exec
other[release/1.5] update to go1.18.9 ()
other[release/1.5] update to go1.18.9
fixFix CNI leaks by changing pod network setup order in CRI plugin ()
fixFix request retry on push ()
fixFix lease labels unexpectedly overwriting expiration ()
otherPrepare release notes for v1.5.15 ()
otherPrepare release notes for v1.5.15
fix[release/1.5] cherry-pick: Fix order of operations when setting lease labels ()
fixFix order of operations when setting lease labels
breaking[release/1.5] go.mod: use golang_protobuf_extensions v1.0.4 to prevent incompatible versions ()
other[release/1.5] go.mod: use golang_protobuf_extensions v1.0.4
other[release/1.5] retry request on writer reset ()
fixfix pusher concurrent close channel
otherretry request on writer reset
other[release/1.5] Setup pod network after creating the sandbox container ()
featureAdd integration tests with failpoint
security[release/1.5] update to Go 1.18.8 to address CVE-2022-41716 ()
security[release/1.5] update to Go 1.18.8 to address CVE-2022-41716
fixfix: wrong flag type
featurefeat: support import image for specific platform
feature[release/1.5] test: introduce failpoint control to runc-shimv2 and cni ()
featureintegration: Add injected failpoint testing for RunPodSandbox
featureintegration: simplify CNI-fp and add README.md
featurepkg/failpoint: add FreeBSD link and update pkg doc
featurepkg/failpoint: add DelegatedEval API
featurebin/ctr,integration: new runc-shim with failpoint
breakingcmd/continuity: remove FUSE for macOS
breakingsysx: remove unused sysx/generate.sh script
fixfs: fix minor linting and gofmt issue
breakingremove version package
breakingRemove deprecated io/ioutil (except ioutil.ReadDir)
fixFix wrapping errors ()
fixfs: fix wrapping nil err
fixfix fmt.Errorf("%w", err) on err == nil ()
fixfix fmt.Errorf("%w", err) on err == nil
breakingRemove direct dependency on github.com/pkg/errors ()
breakingremove direct dependency on github.com/pkg/errors
fixFix darwin issues ()
fixfix darwin usage of du command
featurefs/stat: add FreeBSD, and cleanup some nolint-comments ()
featurefs/stat: add FreeBSD
featuregoogle.golang.org/protobuf v1.27.1 new
+56 more items in the release notesfixFix WWW-Authenticate parsing to allow empty quoted string ()
breakingUpdate oci.WithDefaultUnixDevices(): remove tun/tap from the default devices ()
fixFix createTarFile: make xattr EPERM non-fatal ()
fixFix dockerPusher to handle abort correctly ()
otherMigrate from k8s.gcr.io to registry.k8s.io ()
fixFix CRI: PodSandboxStatus should tolerate missing task ()
fixFix io.containerd.runc.v1: Stats() shouldn't assume s.container is non-nil ()
other[release/1.5] Prepare release notes for 1.5.14 ()
othered672fe1c Prepare release notes for 1.5.14
other5150b97dd Update mailmap
security[release/1.5] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715 ()
otherf109930d5 fix install cni script
other1fea434b7 [release/1.5] sync gha with release/1.6 branch
securitya6672294a [release/1.5] Update go 1.18.7, addresses CVE-2022-2879, CVE-2022-2880, CVE-2022-41715
other1c1045d79 [release/1.5] update golangci-lint to v1.49.0
other03d7e8e49 Fix linter warnings
othere6de4d6ef [release/1.5] gofmt with go1.19
other699a1f90e Do not use go get to install executables
otherc24d508c9 update gotestsum to v1.7.0
other79f119b43 update gotestsum to current master
feature4806c2400 Update gotestsum to add timestamps to junit output
other[release/1.5] cri: PodSandboxStatus should tolerate missing task ()
other60dec1391 cri: PodSandboxStatus should tolerate missing task
other[release/1.5] Stats() shouldn't assume s.container is non-nil ()
other208615ca7 [release/1.5] Stats() shouldn't assume s.container is non-nil
other[release/1.5] migrate from k8s.gcr.io to registry.k8s.io ()
othera34a30b52 migrate from k8s.gcr.io to registry.k8s.io
other[release/1.5] vendor: golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f ()
otherac382a74d [release/1.5] vendor: golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f
fix[release/1.5] cherry-pick: remotes: fix dockerPusher to handle abort correctly ()
fix2fe813d36 remotes: fix dockerPusher to handle abort correctly
other[release/1.5] cherry-pick: make xattr EPERM non-fatal in createTarFile ()
breaking[release/1.5] .zuul: remove the zuul because it is offline ()
breaking83ea10446 .zuul: remove the zuul because it is offline
breaking[release/1.5] ci: remove GOPROXY environment variable due to https://github.com/go-… ()
breakingd3d97cce3 ci: remove GOPROXY environment variable due to https://github.com/go-yaml/yaml/issues/887
breaking[release/1.5 backport] oci: WithDefaultUnixDevices(): remove tun/tap from the default devices ()
breaking9bdd52b3a oci: WithDefaultUnixDevices(): remove tun/tap from the default devices
fix[release/1.5] ctr: fix label args used in NewContainer ()
fixfebb0e82d ctr: fix label args used in NewContainer
+24 more items in the release notessecurityThe thirteenth patch release for containerd 1.5 includes a fix for CVE-2022-31030.
securityFix ExecSync handler to cap console output size (GHSA-5ffw-gxpp-mxpf)
securityGithub Security Advisory GHSA-5ffw-gxpp-mxpf
other1ab043141 Prepare release notes for v1.5.13
otherb40a356cf Implicitly discard the input to drain the reader
other943588b54 [release/1.5] Limit the response size of ExecSync
fixFix inotify fd leak when cgroup is deleted ()
otherClose fifos when container is deleted in CRI plugin ()
otherUpdate unpack to to respect MaxConcurrentDownloads ()
otherMonitor OOMKill instead of OOM in cgroupv2 ()
otherMake the temp mount as ready only in container WithVolumes ()
fixFix deadlock from abandoned transactions in native snapshotter ()
otherPrepare release notes for v1.5.12 ()
other5a55f1efc Prepare release notes for v1.5.12
other[release/1.5] update golang to 1.17.11 ()
other3f61d5ed4 [release/1.5] update golang to 1.17.11
feature[release/1.5] archive: add human-readable hint to Lchown error ()
featuref67de000d archive: add human-readable hint to Lchown error
deprecated[release/1.5] config: improve config v1 deprecation message ()
deprecated4c98768bd config: improve config v1 deprecation message
other[release/1.5] upgrade containerd/cgroups to v1.0.3 ()
otherf890c79fd [release/1.5] upgrade containerd/cgroups to v1.0.3
other[release/1.5] update golang to 1.17.10, golang.org/x/sys v0.0.0-20220412211240-33da011f77ad ()
other9f6e1864c [release/1.5] vendor: golang.org/x/sys v0.0.0-20220412211240-33da011f77ad
otherc00476595 [release/1.5] update golang to 1.17.10
other[release/1.5 backport] update runc binary to v1.1.2 ()
otherc2f793349 update runc binary to v1.1.2
feature[release/1.5] cherry-pick: Allow git commands in Vagrantfile ()
feature1f9900830 Allow git commands in Vagrantfile
other[release/1.5] cri: close fifos when container is deleted ()
fix[release/1.5 backport] native: fix deadlock from leaving transactions open ()
fix603ef55e0 native: fix deadlock from leaving transactions open
fixv2: Fix inotify fd leak when cgroup is deleted ()
featurea7d6888 v2: add test case for Manager.EventChan() behavior
fix35b5b55 v2: Fix inotify leak when cgroup is deleted
fixfix Implicit memory aliasing in for loop ()
fixFix potential dirfd leak. ()
featurecgroup: Optionally add process and task to a subsystems subset ()
feature80a7821 cgroup: Optionally add process and task to a subsystems subset
breakingv2: remove unimplemented errors and ErrorHandler, IgnoreNotExist ()
breakingdb173a8 v2: remove ErrorHandler and IgnoreNotExist as they are not implemented
breakingb19a60d v2: remove errors that are never returned
featurecgroup v1: implement AddProc() ()
feature6659093 cgroup v1: implement AddProc()
deprecatedgo.mod: coreos/go-systemd/v22 v22.3.2 to prepare for deprecations ()
deprecatedf8918cf go.mod: coreos/go-systemd/v22 v22.3.2 to prepare for deprecations
+38 more items in the release notessecurityThe eleventh patch release for containerd 1.5 includes a fix for CVE-2022-24769.
securityFix the inheritable capability defaults (GHSA-c9cp-9c75-9v8c)
otherPrepare release notes for v1.5.11 ()
otherPrepare release notes for v1.5.11
other[release/1.5] Upgrade Go to 1.17 and golangci-lint ()
otherUpdate go version to 1.17
otherUpdate linter errors
otherRun gofmt
otherUpgrade golangci-lint and its GitHub Action
other[release/1.5] fix critools installation ()
otherUpdate get to install for cri tools
feature[release/1.5] remove empty go mod to allow building for go 1.18 ()
otherinstall-dev-tools: use go install, and pin by version
feature[release/1.5] remove empty go mod to allow building for go 1.18
securityGithub Security Advisory GHSA-c9cp-9c75-9v8c
fixFix the Inheritable capability defaults.
security[release/1.5] update to go 1.16.15 to address CVE-2022-24921 ()
security[release/1.5] update to go 1.16.15 to address CVE-2022-24921
other[release/1.5] go.mod: Bump hcsshim to v0.8.24 ()
othergo.mod: Bump hcsshim to v0.8.24
othergithub.com/Microsoft/hcsshim v0.8.23 -> v0.8.24
securityThe tenth patch release for containerd 1.5 includes a fix for CVE-2022-23648 and other issues.
securityUse fs.RootPath when mounting volumes (GHSA-crp2-qrr5-8pq7)
otherReturn init pid when clean dead shim in runc.v1/v2 shims ()
otherHandle sigint/sigterm in shimv2 ()
otherUse readonly mount to read user/group info ()
other[release/1.5] Prepare release notes for v1.5.10 ()
otherPrepare release notes for v1.5.10
securityGithub Security Advisory GHSA-crp2-qrr5-8pq7
otherUse fs.RootPath when mounting volumes
other[release/1.5] runc.v1/v2: return init pid when clean dead shim ()
otherrunc.v1/v2: return init pid when clean dead shim
other[release/1.5] Update Go to 1.16.14 ()
other[release/1.5] Update Go to 1.16.14
otherWait for containerd installation in GCE scripts [1.5 backport] ()
otherWait for containerd installation in GCE scripts
other[release/1.5] shimv2: handle sigint/sigterm ()
othershimv2: handle sigint/sigterm
other[release/1.5] Update Go to 1.16.13 ()
other[release/1.5] Update Go to 1.16.13
other[release/1.5 backport] GHA fixes, update GolangCI-Lint v1.42.0, and go-mdman v2.0.1 ()
otherscript: update golangci-lint from v1.38.0 and v1.36.0 to v1.42.0
fixFix Linux CI Linter using go 1.15.14
otherUpdate cpuguy83/go-md2man binary to v2.0.1
other[release/1.5] oci: use readonly mount to read user/group info ()
otheroci: use readonly mount to read user/group info
feature[release/1.5] add-list-stat: return container list if filter is nil ()
featureadd-list-stat: return container list if filter is nil
securityThe ninth patch release for containerd 1.5 is a security release to fix CVE-2021-43816.
securityFix unprivileged pod using 'hostPath' bypassing SELinux labels (GHSA-mvff-h3cj-wj9c)
fixFix setting the "container_kvm_t" SELinux label ()
securityGithub Security Advisory GHSA-mvff-h3cj-wj9c
othere4b62aaa5 Prepare release notes for v1.5.9
othera41213fed only relabel cri managed host mounts
fix[release/1.5] seutil: Fix setting the "container_kvm_t" label ()
fixda5749b67 seutil: Fix setting the "container_kvm_t" label
other[release/1.5] Update Go to 1.16.12 ()
other8c24a6199 [release/1.5] Update Go to 1.16.12
other[release/1.5] go.mod github.com/opencontainers/image-spec v1.0.2 ()
other7ab52528b [release/1.5] go.mod github.com/opencontainers/image-spec v1.0.2
other[release/1.5] update runc binary to v1.0.3 ()
other16b5aa2c8 update runc binary to v1.0.3
other[release/1.5] Update Go to 1.16.11 ()
other3ff8be2d9 [release/1.5] Update Go to 1.16.11
othergithub.com/opencontainers/image-spec v1.0.1 -> v1.0.2
securityThe eighth patch release for containerd 1.5 contains a mitigation for CVE-2021-41190 as well as several fixes and updates.
securityHandle ambiguous OCI manifest parsing (GHSA-5j5w-g665-5m35)
otherFilter selinux xattr for image volumes in CRI plugin ()
otherUse DeactiveLayer to unlock layers that cannot be renamed in Windows snapshotter ()
fixFix pull failure on unexpected EOF ()
otherClose task IO before waiting on delete ()
otherLog a warning for ignored invalid image labels rather than erroring ()
otherUpdate pull to handle of non-https urls in descriptors ()
other[release/1.5] Prepare release notes for v1.5.8 ()
other2385fd14d Prepare release notes for v1.5.8
feature[release/1.5] mailmap: Add Kevin Parsons ()
featureef071b07b mailmap: Add Kevin Parsons
securityMerge Github Security Advisory GHSA-5j5w-g665-5m35
other15d8c03e3 schema1: reject ambiguous documents
other833407fbf images: validate document type before unmarshal
other[release/1.5] Fix containerd fails to pull OCI image with non-http(s):// urls ()
other01428ec40 Fix containerd fails to pull OCI image with non-http(s):// urls
other[release/1.5] go.mod: Bump hcsshim to v0.8.23 ()
other2bd3f18d9 [release/1.5] go.mod: Bump hcsshim to v0.8.23
other[release/1.5] go.mod: Bump ttrpc to 1.1.0 ()
other047ea15d2 [release/1.5] go.mod: Bump ttrpc to 1.1.0
other[release/1.5] update Go to 1.16.10 ()
other7b20299bc [release/1.5] update Go to 1.16.10
other641976bea [release/1.5] update Go to 1.16.9
other[release/1.5] Output a warning for label image labels instead of erroring ()
otherb988fc918 Output a warning for label image labels instead of erroring
other[release/1.5] task delete: Closes task IO before waiting ()
otherbf02a8330 task delete: Closes task IO before waiting
other[release/1.5] Update test timeout based on recent cancellations ()
other3109820f5 Update test timeout based on recent cancellations
other[release/1.5] Use deactivatelayer to recover layers that we cannot rename ()
featureAdd protoc-gen-go-ttrpc ()
feature6eabacc Add protoc-gen-go-ttrpc
featureReturn Unimplemented when services or methods are not implemented ()
featurefede9db Return Unimplemented when services or methods are not implemented
breakingRemove "Very new" and checked TODO items ()
featuredcc7d39 Remove "Very new" and checked TODO items
breakingremove travis, add codecov badge ()
feature88f2525 CI: add codecov badge to readme
breaking6773702 CI: remove travis
+33 more items in the release notessecurityThe seventh patch release for containerd 1.5 is a security release to fix CVE-2021-41103.
securityFix insufficiently restricted permissions on container root and plugin directories GHSA-c2h3-6mxw-7mvq
security8686ededf Merge pull request from GHSA-c2h3-6mxw-7mvq
otherbc2f973ff Prepare release notes for v1.5.7
otherf95fca079 btrfs: reduce permissions on plugin directories
other68119b417 v1 runtime: reduce permissions for bundle dir
other97db45e83 v2 runtime: reduce permissions for bundle dir
otherInstall apparmor parser for arm64 and update seccomp to 2.5.1
otherUpdate runc binary to 1.0.2
otherUpdate hcsshim to v0.8.21 to fix layer issue on Windows Server 2019
fixAdd support for 'clone3' syscall to fix issue with certain images when seccomp is enabled
featureAdd image config labels in CRI container creation
fixFix panic in metadata content writer on copy error
other1a1b383ad Merge pull request from dmcgowan/prepare-1.5.6
otherbc8fdf832 Update release notes and mailmap
other77dafa20c Prepare release notes for v1.5.6
other063195739 Merge pull request from dmcgowan/1.5-fix-metadata-content-panic
othera4b51d119 Fix panic in metadata content writer on copy error
other4de759ab5 Merge pull request from dmcgowan/backport-1.5-use-ghcr-test-images
other147705920 Use github images for integration tests
other3f4f6bca9 Merge pull request from scuzhanglei/release-1.5-privileged-device
other980646e3c Merge pull request from estesp/cp-6012
feature514137aa0 cri: add devices for privileged container
other6bfd09f7c Enable image config labels in ctr and CRI container creation
other00e5fbe2a Merge pull request from AkihiroSuda/cherrypick-5982-1.5
other2726be136 Merge pull request from AkihiroSuda/runc-v1.0.2-15
other79e05529e Merge pull request from dmcgowan/1.5-fix-unexpected-eof-handling
other923088852 seccomp: support "clone3" (return ENOSYS unless SYS_ADMIN is granted)
other4133c775c go.mod: update runc to v1.0.2
other011fb4c0b update runc binary to v1.0.2
other78a5a2c16 Merge pull request from thaJeztah/1.5_update_go
other210d3bc15 Fix content copy to not ignore unexpected EOF
othera863339c5 [release/1.5] update Go to 1.16.8
other217ab73b1 Merge pull request from AkihiroSuda/cherrypick-5987-1.5
otherf3d46f828 CI: Switch to available latest images
other36d09a433 Merge pull request from alexandref75/release/1.5
otherf40ee0785 Merge pull request from dcantah/15-hcsshim-backport
otherc7ed09d55 Adding testing of two devices in a directory
feature0ca2e2751 Fix dir support for devices V3 (#4847)
other0fd19511e go.mod: Update hcsshim to v0.8.21
other69e5db821 Merge pull request from gjkim42/cherry-pick-of-#5878
feature27e164648 Allow expanded DNS configuration
other337ede532 Merge pull request from estesp/cp-5625
other8cfab161f CI: Switch to available latest images
other25ad9449c Merge pull request from thaJeztah/1.5_backport_install_apparmor_parser_for_arm64_env
other84cfadfa4 Merge pull request from thaJeztah/1.5_backport_update_go_116
otherb9d5cff5d Update Go to 1.16.7
+7 more items in the release notesotherUpdate runc binary to 1.0.1
otherUpdate pull logic to try next mirror on non-404 response
otherUpdate pull authorization logic on redirect
other72cec4be5 Merge pull request from dmcgowan/prepare-1.5.5
other677fade0f Prepare release notes for v1.5.5
other1c13c54ca Merge pull request from thaJeztah/1.5_backport_dm_log
other883750151 Merge pull request from thaJeztah/1.5_backport_fix_missing_body_close
fix7b17268fd remotes/docker/pusher.go: Fix missing Close()
fix2f11d5855 remotes/docker/fetcher.go: Fix missing Close()
otherbc12da7f6 Merge pull request from thaJeztah/1.5_backport_fix_authorization_on_redirect
other4c1722e2b Update docker resolver to authorize redirects
other166a81f88 snapshot/devmapper: log exported methods correctly
other47d0f52cb Merge pull request from fuweid/cp-15-5275
otherc355601d3 Merge pull request from AkihiroSuda/runc-v1.0.1-15
otherd2cb9949b go.mod: runc v1.0.1
other6807d070e update runc binary to v1.0.1
otherd9b284bfd Try next mirror in case of non-404 errors, too
featuregithub.com/bits-and-blooms/bitset v1.2.0 new
othergithub.com/cilium/ebpf v0.4.0 -> v0.6.2
othergithub.com/google/go-cmp v0.5.4 -> v0.5.5
othergithub.com/opencontainers/runc v1.0.0-rc93 -> v1.0.1
othergithub.com/opencontainers/runtime-spec e6143ca7d51d -> 1c3f411f0417
othergithub.com/opencontainers/selinux v1.8.0 -> v1.8.2
othergithub.com/sirupsen/logrus v1.7.0 -> v1.8.1
othergolang.org/x/sys 47abb6519492 -> d19ff857e887
securityThe fourth patch release for containerd 1.5 is a security release to address CVE-2021-32760.
other69107e47a Merge pull request from dmcgowan/prepare-1.5.4
other81cfab8f5 Prepare release notes for v1.5.4
security7ad08c69e Merge pull request from GHSA-c72p-9xmj-rx3w
featuref5c7cb6e0 Add test for archive breakout test for lchmod
other37a44de17 Cleanup lchmod logic in archive
otherUpdate runc binary to 1.0.0 5552
otherSend pod UID to CNI plugins as K8S_POD_UID
fixFix invalid validation error checking
fixFix error on image pull resume
fixFix User Agent sent to registry authentication server
fixFix symlink resolution for disk mounts on Windows
other0e8719f54 Merge pull request from dmcgowan/prepare-1.5.3
other48d7a5c5c Prepare release notes for 1.5.3
otherdefaec610 Update mailmap
other4b724071e Merge pull request from AkihiroSuda/go1.16.6-15
other43d089233 integration/client: go mod tidy
otherac7bd5483 Update Go to 1.16.6 (cont.)
other385d9ed00 Update Go to 1.16.6
other911cd5725 Merge pull request from dcantah/backport-hcsshim-0.8.18
otherd4afc8222 Merge pull request from thaJeztah/1.5_backport_docker_push_close_body
othera695a0704 [Vendor] Update hcsshim to 0.8.18
fix0515f9d2d Fix missing Body.Close() calls on push to docker remote
other9be04c276 Merge pull request from thaJeztah/1.5_backport_bump_runc
other78b95dff2 update runc binary to v1.0.0 GA
other9b7142598 Merge pull request from dcbw/15-cni-plugin-pod-uid
othera2dc682f1 sandbox: send pod UID to CNI plugins as K8S_POD_UID
other8098a6e61 Merge pull request from thaJeztah/1.5_backport_inline_statatimeastime
other9d8880816 content/local: inline sys.StatATimeAsTime()
other116b2e066 Merge pull request from povsister/release/1.5
otherd8b66825e Merge pull request from tnqn/release/1.5
fix3735a7dfe Fix incorrect UA used for registry authentication
other31ecdf77d Fix cleanup context of teardownPodNetwork
otherf5f2b68b5 Merge pull request from estesp/go-for-proj-1.5
featureb441ec19f Add proper Go version before project checks
otherbf16e9e92 Merge pull request from mikebrow/cherrypick-#5565-release-1.5
otherd31f5e6b6 fix invalid validation error checking
other9a573903b Merge pull request from estesp/cp-5560-1.5
other3fd01c4ea Change Wrapf of non-error to an actual error
otherd1119dc60 Merge pull request from kevpar/symlink-1.5
othercba7b44b6 windows: Use GetFinalPathNameByHandle for ResolveSymbolicLink
othergithub.com/Microsoft/hcsshim v0.8.16 -> v0.8.18
securityThe second patch release for containerd 1.5 is a security release to update runc for CVE-2021-30465
other36cc87449 Merge pull request from dmcgowan/prepare-1.5.2
other354f729a4 Prepare release notes for v1.5.2
other55c147d5b Merge pull request from AkihiroSuda/runc-rc95-15
otherccfb9c509 update runc binary to v1.0.0-rc95
otherUpdate runc to rc94
fixFix registry mirror authorization logic in CRI plugin
fixFix regression in cri-cni-release to include cri tools
other12dca9790 Merge pull request from dmcgowan/prepare-1.5.1
otherc31e19abb Prepare release notes for v1.5.1
other38deeccac Merge pull request from dmcgowan/backport-imgcrypt-binary-release-update
other47507a6e1 just release ctd-decoder not ctr-enc
other799eef87c Merge pull request from dmcgowan/1.5-backport-integration-pin-image
other109d65794 Pin integration test image for alpine
other07bde83ef Merge pull request from dmcgowan/backport-1.5-host-documentation
feature042e49fe1 adds credentials description
featureaeee09344 adds description for hosts.toml
othereebc91450 Merge pull request from Random-Liu/cherrypick-#5446-release-1.5
other5e742ea04 Fix different registry hosts referencing the same auth config.
otherb60331a92 Merge pull request from thaJeztah/1.5_backport_bump_runc
other384b05a5a Update the runc binary used with containerd to runc v1.0.0-rc94
other423cd4006 Merge pull request from dmcgowan/1.5-cherry-pick-build-updates
other3a8611039 Update Go to 1.16.4
feature50d371ea7 Makefile: allow overriding go command by environment
otherc48044f6d Merge pull request from mikebrow/1.5_cherrypick_correct-critools-release
feature7783f5893 update to new cri-tools make install
other7507b47c3 Merge pull request from thaJeztah/1.5_backport_dont_loop_da_loop
otherb35aa7250 go.mod: cut circular dependency on github.com/containerd/containerd
otherb68405639 integration/client: go mod tidy
featuregithub.com/satori/go.uuid v1.2.0 new
deprecated4dc758d0c Merge pull request from AkihiroSuda/deprecate-aufs
deprecatedc19b7b64d RELEASES.md: recommend alternatives for deprecated features
deprecated8a62aa1c3 Deprecate built-in aufs snapshotter
deprecated6bf77c5eb Merge pull request from containerd/revert-5303-cri-remove-deprecated-default-untrusted
deprecatedd4be6aa8f rm mirror defaults; doc registry deprecations
breaking7bb73da6b runtime/v2/shim: remove unused SetScore() and remove sys.OOMScoreMaxKillable
deprecateddc8af03ba Merge pull request from mikebrow/cri-remove-deprecated-default-untrusted
breaking61c749036 integration/util: remove dependency on k8s.io/klog/v2
deprecatedb5bf1fd5d Fix deprecated registry auth conversion.
security550b4949c Merge pull request from mikebrow/cri-security-profile-update
breaking757291920 mount: remove remaining uses of mount.Self()
breaking474abe572 mount: remove unused mount.PID()
securityd50de11ce ISSUE_TEMPLATE: remove redundant "report a security issue" button
breaking1cc3c7f4a docs: Remove appveyor badge
security3d358c9df [cri] don't clear base security settings
security4a4bb851f Merge pull request from GHSA-36xw-fx78-c5r4
breakingeba94a15c pkg/cri/server: remove dependency on libcontainer/apparmor, libcontainer/utils
breaking1edeea766 install-runc: remove unused USESUDO variable
breaking5b13dcc73 mount.isFUSE(): remove unused error return
breakingfad87288f switching to windows-2016 latest is breaking due to wsl conflict with bash
breakingc96373f6d newTransport(): remove deprecated DualStack option
deprecatedbefc70b44 Merge pull request from mikebrow/fix-deprecated-greeting
securityf673f0cf5 remove greetings due to security issue
securityef54a7839 vendor: bump golang.org/x/crypto bac4c82f6975 (CVE-2020-9283)
security5f0bf0523 pick up fix for CVE-2019-19921 in opencontainers/selinux
breaking7fcef89b7 add removal of old go
deprecatedf9760af8d Merge pull request from Random-Liu/remove-no-pivot-deprecation
deprecated871a8b89c Do not deprecate no_pivot yet.
deprecatedfb5210e2a Merge pull request from Random-Liu/print-deprecated-notice
deprecatedb74653b82 Print warning message for deprecated options.
deprecateddb9080847 Update doc and add deprecation policy for CRI options.
breakingfda30c3ad Do not teardown when network namespace is removed already.
securitye1f74f00a Various security related fixes
breaking2cbde20 cmd/btrfs-test: remove duplicate copyright header
breaking95a317e CI: remove travis
breaking4029019 memory: remove wrong memory.kmem.limit_in_bytes check
breakinga348cec go.mod: remove github.com/stretchr/testify "indirect"
breakingdf04ad1 mkfifo: remove solaris code
breaking6f2eab6 Travis: Remove Travis testing
breaking5a63297 Drop support for 1.12.x
+3451 more items in the release notessecurityThe thirteenth patch release for containerd 1.4 is a security release to address CVE-2022-23648.
securityUse fs.RootPath when mounting volumes (GHSA-crp2-qrr5-8pq7)
securityGithub Security Advisory GHSA-crp2-qrr5-8pq7
otherPrepare release notes for v1.4.13
otherUse fs.RootPath when mounting volumes
other[release/1.4] backport: Wait for containerd installation in GCE scripts ()
otherWait for containerd installation in GCE scripts
other[release/1.4] Update Go to 1.16.14 ()
otherDo not use go get to install executables
other[release/1.4] update Go to 1.16.14
other[release/1.4] Update Go to 1.16.13
other[release/1.4] vendor: github.com/opencontainers/image-spec v1.0.2 ()
other[release/1.4] vendor: github.com/opencontainers/image-spec v1.0.2
other[release/1.4] Update Go to 1.16.12 ()
other[release/1.4] Update Go to 1.16.12
other[release/1.4] update runc binary to v1.0.3 ()
otherupdate runc binary to v1.0.3
other[release/1.4] Update Go to 1.16.11 ()
other[release/1.4] Update Go to 1.16.11
other[release/1.4] Use fs.RootPath when mounting volumes ()
other[release/1.4] update Go 1.15.14 (to match containerd) ()
other[release/1.4] update Go 1.15.14 (to match containerd)
othergithub.com/containerd/cri 3b02bec16031 -> 8f1a8a1fb9eb
othergithub.com/opencontainers/image-spec v1.0.1 -> v1.0.2
securityThe twelfth patch release for containerd 1.4 contains a few minor bug fixes and an update to mitigate CVE-2021-41190.
securityHandle ambiguous OCI manifest parsing (GHSA-5j5w-g665-5m35)
otherUpdate pull to try next mirror for non-404 errors ()
otherUpdate pull to handle of non-https urls in descriptors ()
other[release/1.4] Prepare release notes for v1.4.12 ()
other540b70454 Prepare release notes for v1.4.12
securityMerge Github Security Advisory GHSA-5j5w-g665-5m35
othereb875416e schema1: reject ambiguous documents
other53e0c8c35 images: validate document type before unmarshal
other[release/1.4] Try next mirror in case of non-404 errors, too ()
other9b538c7c7 Try next mirror in case of non-404 errors, too
other[release/1.4] Fix containerd fails to pull OCI image with non-http(s):// urls ()
othere9f59a95e Fix containerd fails to pull OCI image with non-http(s):// urls
other[release/1.4] update Go to 1.16.10 ()
other16921116b [release/1.4] update Go to 1.16.10
other[release/1.4] update Go to 1.16.9 ()
otherb742b36fb [release/1.4] update Go to 1.16.9
securityThe eleventh patch release for containerd 1.4 is a security release to fix CVE-2021-41103.
securityFix insufficiently restricted permissions on container root and plugin directories GHSA-c2h3-6mxw-7mvq
security5b46e404f Merge pull request from GHSA-c2h3-6mxw-7mvq
otheradc279b83 Prepare release notes for v1.4.11
other0b1bde385 btrfs: reduce permissions on plugin directories
other38532c6ed v1 runtime: reduce permissions for bundle dir
other403846c95 v2 runtime: reduce permissions for bundle dir
other8a3cfaf33 Merge pull request from dmcgowan/1.4-update-test-images
other3cd12c7d4 Update test images to use Github package registry
otherUpdate runc to v1.0.2
otherUpdate hcsshim to v0.8.21
otherSupport "clone3" in default seccomp profile
fixFix panic in metadata content writer on copy error
other8848fdb7c Merge pull request from dmcgowan/prepare-1.4.10
other87d81c4f2 Update release notes for v1.4.10
other16c175576 Prepare release notes for v1.4.10
otherf8a9b3b61 Merge pull request from thaJeztah/1.4_update_golang_1.16
other9b712ec73 Merge pull request from dmcgowan/1.4-fix-metadata-content-panic
other6dddee4c8 Fix panic in metadata content writer on copy error
other780289586 Merge pull request from AkihiroSuda/cherrypick-5982-1.4
other668960dd3 seccomp: support "clone3" (return ENOSYS unless SYS_ADMIN is granted)
otherbfe529e43 [release/1.4] update Go to 1.16.8
other46f70c5d8 Update Go to 1.16.7
other6b98d33b8 Update Go to 1.16.6
other8cc99a88d Update Go to 1.16.4
otherc1a8d3b4f Update Go to 1.16.3
other80cbe4160 Update to Go 1.16.2
otheref6ce6c0c Update to Go 1.16.1
otherc9f216407 [release/1.4] disable go modules where needed
otherb9cc6ec62 Revert "[release/1.4] update Go to 1.15.11"
other8d271b339 Revert "[release/1.4] Update Go to 1.15.13"
otherafaa37975 Revert "Update Go to 1.15.14"
other4ce1ce6f7 Revert "[release/1.4] Update Go to 1.15.15"
otherf961e7b3c Merge pull request from AkihiroSuda/runc-v1.0.2-14
otherb9d8ae17f update runc binary to v1.0.2
othere25371f79 Merge pull request from dcantah/hcsshim-backport-1.4
othera503d4c11 [release/1.4] go.mod: Update hcsshim to v0.8.21
otherd30f83879 Merge pull request from thaJeztah/1.4_update_golang
other2009fa71e [release/1.4] Update Go to 1.15.15
othergithub.com/Microsoft/hcsshim v0.8.16 -> v0.8.21
otherUpdate runc binary to 1.0.1
otherUpdate pull authorization logic on redirect
fixFix user agent used for fetching registry authentication tokens
othere25210fe3 Merge pull request from dmcgowan/prepare-v1.4.9
otherad26f4713 Prepare release notes for v1.4.9
other11996c194 Merge pull request from thaJeztah/1.4_backport_dm_log
other53add4cde Merge pull request from thaJeztah/1.4_backport_fix_missing_body_close
othera5cefbaac Merge pull request from thaJeztah/1.4_backport_fix_authorization_on_redirect
fix14c3a8e21 remotes/docker/pusher.go: Fix missing Close()
fix06c90e7b5 remotes/docker/fetcher.go: Fix missing Close()
othere4418dbea Merge pull request from thaJeztah/1.4_backport_fix_auth_ua
other30d0c9199 Update docker resolver to authorize redirects
other55794673b snapshot/devmapper: log exported methods correctly
fix67a0576df [release/1.4] Fix incorrect UA used for registry authentication
othera368d2872 Merge pull request from AkihiroSuda/runc-v1.0.1-14
other34861f1aa update runc binary to v1.0.1
securityThe eighth patch release for containerd 1.4 is a security release to address CVE-2021-32760.
other7eba59304 Merge pull request from dmcgowan/prepare-1.4.8
othera12c29996 Prepare release notes for v1.4.8
security22e9a70c7 Merge pull request from GHSA-c72p-9xmj-rx3w
feature664f93ead Add test for archive breakout test for lchmod
other03aa748c1 Use chmod path for checking symlink
otherUpdate runc binary to 1.0.0 5552
fixFix invalid validation error checking
fixFix error on image pull resume
fixFix symlink resolution for disk mounts on Windows
other3194fb46e Merge pull request from dmcgowan/prepare-1.4.7
other0baf36281 Prepare release notes for 1.4.7
other48073fc85 Update mailmap
other77e22ba48 Merge pull request from AkihiroSuda/go1.15.14
other287fd67ae Update Go to 1.15.14
othere6d4da0b4 Merge pull request from thaJeztah/1.4_backport_docker_push_close_body
fix591744a85 [release/1.4] Fix missing Body.Close() calls on push to docker remote
other32c84bf7b Merge pull request from thaJeztah/1.4_backport_bump_runc
other86f0c476e Merge pull request from thaJeztah/1.4_update_golang
otherd02ed46d2 [release/1.4] Update Go to 1.15.13
other0ad0f506c update runc binary to v1.0.0 GA
otherf9542c935 Merge pull request from fuweid/update-cri-vendor
otherf96587420 vendor: update cri plugin with 3b02bec1603179debe2cde54509b2bfc45fc27d3
otherae76fadde Merge pull request from mikebrow/cherrypick-#5565-release-1.4
other208a2f649 fix invalid validation error checking
other3c43937ec Merge pull request from estesp/cp-5560-1.4
othere6729fa27 Change Wrapf of non-error to an actual error
other3b02bec1 Merge pull request from adisky/release/1.4
otherf3ae4a5c Fix cleanup context of teardownPodNetwork
other4cc8ca2c Merge pull request from kevpar/1.4-symlink
otheree825af5 windows: Use GetFinalPathNameByHandle for ResolveSymbolicLink
other76356c40 Update vendored dependencies
otherc3073a37 Merge pull request from containerd/update-pull-cri-containerd-node-e2e
otherf6d33aea sync vendor with latest containerd 1.4
otherb617b6c7 go mod off
other69ecac89 Merge pull request from containerd/update-critools
othercfeebd4c moves up version of critest
othergithub.com/Microsoft/go-winio v0.4.14 -> v0.4.19
othergithub.com/Microsoft/hcsshim v0.8.10 -> v0.8.16
othergithub.com/containerd/cri 1360416eca4f -> 3b02bec16031
othergithub.com/opencontainers/runc v1.0.0-rc92 -> v1.0.0-rc94
othergolang.org/x/sys 5cba982894dd -> d19ff857e887
securityThe sixth patch release for containerd 1.4 is a security release to update runc for CVE-2021-30465
otherd71fcd7d8 Merge pull request from dmcgowan/update-v1.4.6-version
otherb6cbb3f6e Update v1.4.6 version
other9d293ea7b Merge pull request from dmcgowan/prepare-v1.4.6
othera0baf8c1d Prepare release notes for v1.4.6
other14168c723 Merge pull request from AkihiroSuda/runc-rc95-14
other0b034bbdb update runc binary to v1.0.0-rc95
otherUpdate runc to rc94
fixFix leaking socket path in runc shim v2
fixFix cleanup logic in new container in runc shim v2
fixFix registry mirror authorization logic in CRI plugin
featureAdd support for userxattr in overlay snapshotter for kernel 5.11+
other8263eb3ea Merge pull request from dmcgowan/fix-1.4-seccomp-build
other691606d45 Fix seccomp build in release
otherb9f5e5300 Merge pull request from dmcgowan/prepare-1.4.5
otherafab285d6 Prepare v1.4.5 release notes
other31c92d9d3 Merge pull request from thaJeztah/1.4_backport_bump_runc
other392db0f15 Update the runc binary used with containerd to runc v1.0.0-rc94
othercdd833d84 Merge pull request from mikebrow/update-cri-commit
otherc39fb7539 vendoring in cherry pick #5446
feature409c87ba5 Merge pull request from Iceber/fix-new-container-1.4
fixc64cfa03b runtime/v2/runc: fix the defer cleanup of the NewContainer
otherb5c6f3dc5 Merge pull request from thaJeztah/1.4_update_gha
other60c139c9a gha: use sudo -E in some places to prevent dropping env-vars
othere0d452986 GHA: use setup-go@v2
other6ca7441e5 Merge pull request from thaJeztah/1.4_update_k8s
otherc4008afaa Merge pull request from thaJeztah/1.4_update_golang
otherac87e05f6 [release/1.4] update Go to 1.15.11
feature425a6e4f8 night ci fix: add packages for ubuntu 20.04
other80de6e2b4 vendor: golang.org/x/sys 5cba982894dd4e8879e3ef0a0c308ceff39f6154
other92da2dbfa vendor: golang.org/x/sync 67f06af15bc961c363a7260195bcd53487529a21
otherb24c8a2ec vendor: golang.org/x/net 69a78807bb2bb6d1599c68698c6b009505012083
otherebdd88cc0 vendor: sigs.k8s.io/structured-merge-diff/v4 v4.0.3
otherfe197b9b5 vendor: update kubernetes to v1.19.10
other2ca27bc45 Merge pull request from mikebrow/cherrypick-#5351-release-1.4
feature07e347903 adds log for each failed host and status not found on host
other218f47057 Merge pull request from mikebrow/move-up-to-fixed-cri-tools
other18a271509 need to bring critest backup
other1322c7093 Merge pull request from wzshiming/cherry-pick/upstream/release/1.4/#5229
other8c5422eb6 Fix error log when copy file
otherb0537800a Merge pull request from fuweid/cp-5195
fixf9d6a7604 runtime/v2/runc: fix leaking socket path
fix24921417f Fix missing close
other6bcbb683f Merge pull request from thaJeztah/1.4_update_runc
otherbfe95947f install-runc: set GO111MODULE=off to use vendor
other520d179ed Prevent runc inheriting BUILDTAGS from containerd
fix4c875c81a cmd/ctr: fix export command
+20 more items in the release notessecurityThe fourth patch release for containerd 1.4 contains a fix for CVE-2021-21334 along with various other minor issues. See GHSA-6g2q-w5j3-fwh4 for more details related to CVE-2021-21334.
fixFix container create in CRI to prevent possible environment variable leak between containers
otherUpdate shim server to return grpc NotFound error
featureAdd bounds on max oom_score_adj value for shim's AdjustOOMScore
otherUpdate task manager to use fresh context when calling shim shutdown
otherUpdate Docker resolver to avoid possible concurrent map access panic
otherUpdate shim's log file open flags to avoid containerd hang on syscall open
fixFix incorrect usage calculation
security05f951a37 Merge pull request from GHSA-6g2q-w5j3-fwh4
other3ba4a3171 Prepare release notes for 1.4.4
othera22f1f642 Merge pull request from zhsj/update-cri
othercbcb2f57f vendor: update cri
otherda919aa2a Merge pull request from AkihiroSuda/cache-vagrant-14
other633bfb712 CI: cache ~/.vagrant.d/boxes
other23495ab4a Merge pull request from AkihiroSuda/fix-5077-14
fixe7851d743 CI: fix "ls: cannot access '/etc/cni/net.d': Permission denied"
other8a7e41c5c Merge pull request from zhsj/bpo-4974
other758f07631 Merge pull request from zhsj/bpo-4808
otherf4a6e163e Update continuity
other2ec4a495f Update gogo/protobuf to v1.3.2
other33d90b72d Merge pull request from thaJeztah/1.4_update_golang
other232cee448 Update to go 1.15.8
other02df14f78 Merge pull request from Iceber/fix-runc-v2-service-1.4
fixf087d7849 runtime: fix shutdown runc v2 service
fix349f7a5ef Merge pull request from payall4u/bugfix/fix-open-shim-fifo-rebase
otheredffc830b change flag from RDONLY to RDWR and close the fifo correct
otherc36f12a27 Merge pull request from zhsj/cherry-pick-4854
other86f5704c6 Merge pull request from zhsj/cherry-pick-4855
featuree7cd2030e pusher: add missing authentication support for requests
otherec752e8ba docker: avoid concurrent map access panic
other00f5ffa45 Merge pull request from fuweid/cherry-pick-1.4-846cb963c
otherb73052d34 runtime/v2: should use defer ctx to cleanup
othered8ec9749 Merge pull request from masters-of-cats/pr-process-not-found-err-14
featurea6f6eb00c Add bounds on max oom_score_adj value for AdjustOOMScore
feature363153d Add directory size to usage calculation test
fixb97555e Fix incorrect usage calculation
fix310e183 gha: fix invalid workflow definition
deprecated03c371a gha: replace uses of deprecated "set-env", "add-path"
deprecated7efa54f0 Fix deprecated registry auth conversion.
fix5848b5ba cri/config: fix range iterator issue in ValidatePluginConfig
+30 more items in the release notessecurityThe third patch release for containerd 1.4 is a security release to address CVE-2020-15257. See GHSA-36xw-fx78-c5r4 for more details.
security269548fa2 Merge pull request from GHSA-36xw-fx78-c5r4
other727e1728d Prepare 1.4.3 release notes
otherae3a64aa1 containerd-shim: use path-based unix socket
other428f10fd2 Use path based unix socket for shims
fixFix bug limiting the number of layers by default containerd/cri#1602
fixFix selinux shared memory issue by relabeling /dev/shm containerd/cri#1605
breakingFix unknown state preventing removal of containers containerd/containerd#4656
fixFix nil pointer error when restoring checkpoint containerd/containerd#4754
otherImprove image pull performance when using HTTP 1.1 containerd/containerd#4653
otherUpdate default seccomp profile for pidfd containerd/containerd#4730
otherUpdate Go to 1.15
fixFix integer overflow on Windows containerd/containerd#4589
fixFix lcow snapshotter to read trailing tar data containerd/containerd#4628
otherb321d358e Merge pull request from dmcgowan/prepare-1.4.2
otherf2e4291b6 Prepare 1.4.2 release
other76f3d1955 Update mailmap for 1.4.2 release
otherca9950755 Update cri version to pickup unknown state fix
other21baf7109 Merge pull request from dmcgowan/update-1.4-cri
other3458984bb Merge pull request from dmcgowan/backport-4765
other0b97c6204 Update cri plugin
otherc0f1add3c Fix Windows service panic file to not be read-only
other9c24574c9 Merge pull request from estesp/cp-tests-fix-1.4
fixfbe18caa1 Update btrfs vendor for chkptr fix for Go >= 1.14
featurecbbf257ab Add Go test runs to GitHub Actions CI
other19776b75b Adjust overlay tests to expect "index=off"
feature7eb852214 Allow oom adj test to run in environments with a score
other036ede698 Import crypto for all snapshotters during testsuite
other8d839c4b3 Merge pull request from amrmahdi/amrh/cherry-pick-cc3785-1.4
other31bbc1f7d Merge pull request from thaJeztah/1.4_restore_nil_pointer
feature5618423a0 Add comments clarifying copyWithBuffer implementation
othera2ebee357 replicate io.Copy optimizations
other9b2156aa8 Improve image pull performance from http 1.1 container registries
other7fe3f1301 Merge pull request from thaJeztah/1.4_backport_windows_int_overflow
fix56291a221 bug fix:#3448
other16e51fc31 Fix integer overflow on windows
other957bcaa9f Merge pull request from estesp/cp-4745-1.4
deprecated0a3488c71 Fix GH Actions CI deprecations
featureebffce3ad seccomp: add pidfd_getfd syscall (gated by CAP_SYS_PTRACE)
feature229f5ea4e seccomp: add pidfd_open and pidfd_send_signal
feature84ed5ce Add vendor explicity in project
featuref7fce607 Merge pull request from shahzzzam/add-annotation2
feature1dc3b8a7 Add manifest digest annotation for snapshotters
deprecatedbb8b690f gha: replace uses of deprecated "set-env", "add-path"
featuresigs.k8s.io/structured-merge-diff/v4 v4.0.1 new
+67 more items in the release notesotherAlways consume shim logs to prevent logs in the shim from blocking containerd/containerd#4546
fixFix error deleting v2 bundle directory when removing rootfs returns ErrNotExist containerd/containerd#4472
fixFix metrics monitoring of v2 runtime tasks containerd/containerd#4486
fixFix incorrect stat for Windows containers containerd/containerd#4468
fixFix devmapper device deletion on rollback containerd/containerd#4437
otherUpdate seccomp default profile containerd/containerd#4481
otherc623d1b3 Merge pull request from dmcgowan/prepare-1.4.1
other97d690d2 Prepare v1.4.1 release
other910da2fb Merge pull request from thaJeztah/1.4_backport_bumpcni
otherca3b91d8 Merge pull request from dmcgowan/backport-4546
other42f38718 Always consume shim logs
otherea29a60a Merge pull request from thaJeztah/1.4_backport_winstats
otherdb931948 Merge pull request from thaJeztah/1.4_backport_makefile_test_tags
other9b5066aa Merge pull request from thaJeztah/1.4_backport_fix_static_plugin
other3bcce819 Merge pull request from thaJeztah/1.4_backport_add_openat2_syscall
other98a733e0 Merge pull request from thaJeztah/1.4_backport_shim_exec_p_debug
otherf247618a Report correct stats for windows containers
othercc5d1518 Update go list to respect build tags
fix086e859d BUILDING.md: fix description about static builds
other16712ae4 bump cni version to v0.8.0
feature1575c88c seccomp: add faccessat2 syscall.
feature8bd2bece seccomp: add openat2 syscall.
other4e3397e0 shimv1: downgrade poroccess missing log to debug
other6b5fc7f2 Merge pull request from thaJeztah/1.4_backport_forward_signal_not_found
otherd118c90d Ignore SIGURG signals in signal forwarder
other3ee6189f Exit signal forward if process not found
other1a367762 Merge pull request from fuweid/14-cherry-pick-4486
othera1289d6b tasks: Monitor v2 tasks in initFunc as well
other12f20c99 Merge pull request from thaJeztah/1.4_backport_seccomp_updates
feature1f823f76 seccomp: allow io-uring related system calls
feature3d28944b seccomp: allow clock_settime when CAP_SYS_TIME is added
featuree5cc7d52 seccomp: allow quotactl with CAP_SYS_ADMIN
feature20273a80 seccomp: allow sync_file_range2 on supported architectures.
feature357d1002 seccomp: allow personality with UNAME26 bit set
feature0c9de662 seccomp: allow syscall membarrier
featurecaa46116 seccomp: allow adjtimex get time operation
feature2b80b7dc seccomp: allow add preadv2 and pwritev2 syscalls
othere71eccbc seccomp: move the syslog syscall to be gated by CAP_SYS_ADMIN or CAP_SYSLOG
other881db9b5 Merge pull request from fuweid/cherry-pick-4472
fix23e0ea27 snapshots/devmapper: fix rollback
+9 more items in the release notesdeprecatedDeprecate io.containerd.runtime.v1.* and io.containerd.runc.v1
featureSupport target snapshot option on prepare to allow skipping prepare when snapshot reports target already exists
featureAdd filters to walk function
featureSupport for FUSE mounts
featureSupport for lazy-pull snapshotters such as stargz-snapshotter
featureProxy snapshotter support for cleanup
featureAdd spec options for host device and privileged handling
featureAdd unpack options for pull
featureAdd Linux resources to spec options
featureNew registry configuration tooling for improved mirror and endpoint options
featureAdd namespace query parameter when using a registry proxy
featureAdd filters to snapshot list
featureAdd snapshot cleanup
breakingRemove libseccomp requirement, seccomp support is now always built-in
featureAdd support for custom wcow and lcow sandbox scratch sizes
breakingRemove socat for port forwarding cri#1470
deprecatedd4b17275 Merge pull request from AkihiroSuda/deprecate-legacy-shims
deprecated04b98bb0 Deprecate legacy shims
breakingc4418bb3 CI: remove an unreferenced variable
deprecatedb96f5f4b Fix deprecation warnings in CRI tests due to missing unix:// scheme
breaking03755821 seccomp: remove the unused query_module(2)
breaking1b964049 ConfigureHosts: remove deprecated DualStack option
breaking37c839e5 sys/proc: remove GetSystemCPUUsage as it is unused
breaking295e7400 sys: remove custom setChildSubreaper const
breaking4756258f service_windows.go: remove unused "service" variable
deprecateda30225b2 Merge pull request from thaJeztah/deprecate_sys_epoll
deprecated0a7fd55f sys: deprecate EpollCreate1, EpollCtl, EpollWait
security32ba75f0 Update Golang 1.13.7 (CVE-2020-0601, CVE-2020-7919)
securityfaf03c3d Pick up fix for CVE-2019-16884 in opencontainers/selinux
security6356e55b Update Golang 1.12.12 (CVE-2019-17596)
breaking382444c v2: remove unneeded import
deprecatedd616474 remove deprecated controller
breakingfad87288 switching to windows-2016 latest is breaking due to wsl conflict with bash
breakingc96373f6 newTransport(): remove deprecated DualStack option
deprecatedbefc70b4 Merge pull request from mikebrow/fix-deprecated-greeting
securityf673f0cf remove greetings due to security issue
securityef54a783 vendor: bump golang.org/x/crypto bac4c82f6975 (CVE-2020-9283)
security5f0bf052 pick up fix for CVE-2019-19921 in opencontainers/selinux
breaking7fcef89b add removal of old go
breaking0025117 blockcipher: Remove an unused field from the 'state' of the AES CTR cryptor
+1736 more items in the release notessecurityThe tenth patch release for containerd 1.3 contains a fix for CVE-2021-21334 along with various other minor issues. This is the final release for containerd 1.3.
securitySee GHSA-6g2q-w5j3-fwh4 for more details related to CVE-2021-21334.
fixFix container create in CRI to prevent possible environment variable leak between containers
featureAdd bounds on max oom_score_adj value for shim's AdjustOOMScore
otherUpdate task manager to use fresh context when calling shim shutdown
fixFix incorrect usage calculation
security1c5970efb Merge pull request from GHSA-6g2q-w5j3-fwh4
other9d46f241e Prepare release notes for 1.3.10
other0eb8cbd29 Merge pull request from dmcgowan/backport-1.3-continuity-usage-calculation
other8f71d98c6 Update continuity to fix usage calculation
otherdc49905ce Merge pull request from fuweid/update-cri-plugin
other2d9c8aa4b vendor: update CRI plugin with commit ca9c55
other3405c1d61 Merge pull request from Iceber/fix-runc-v2-service-1.3
fixfb872ce79 runtime: fix shutdown runc v2 service
other070cc0129 Merge pull request from fuweid/cherry-pick-1.3-846cb963c
othere97824177 runtime/v2: should use defer ctx to cleanup
other804621064 Merge pull request from johnathanmdell/release/1.3
featureff9f916b4 Add bounds on max oom_score_adj value for AdjustOOMScore
other1e683ff22 Merge pull request from thaJeztah/1.3_backport_cancel_shim_log_ctx_by_onclose
other3f694f1a3 v2: Cancel shim log ctx when ttrpc is closed
fix7a2410592 v2: Fix missing ns when openShimLog on windows
othere9518fb31 v2: Call shim.Delete at first when create is failed
other1d9893e Merge pull request from dmcgowan/fix-usage-block-size
feature363153d Add directory size to usage calculation test
fixb97555e Fix incorrect usage calculation
other91328d7 Merge pull request from zhsj/fix-riscv64
other809d89c go.mod: golang.org/x/sys to latest
other62ef0ff Merge pull request from zhsj/fix-arm64
other25269ef Fix building on arm64
fix310e183 gha: fix invalid workflow definition
other04c754f Merge pull request from dmcgowan/fix-sparse-file-usage
otherbc5e3ed Fix usage calculation to account for sparse files
deprecated03c371a gha: replace uses of deprecated "set-env", "add-path"
feature5a33969 Add a comment to clarify that we're handling the empty file case
featured7961f4 travis.yml: rm unsupported go releases, add 1.14
fix9e256e6 sysx/xattr: fix getxattrAll
feature38f9467 Add src string to copyDirectory error message.
featurecad9e55 fs: support for OpenBSD
feature52678022 Fix header for new seccomp files.
fix2cc11e5e fix for image pull linter change
+51 more items in the release notessecurityThe ninth patch release for containerd 1.3 is a security release to address CVE-2020-15257. See GHSA-36xw-fx78-c5r4 for more details.
securityea765aba0 Merge pull request from GHSA-36xw-fx78-c5r4
other25f3b2972 Prepare 1.3.9 releases notes
other85d3b5c78 containerd-shim: use path-based unix socket
other689d92ce1 Use path based unix socket for shims
otherea04599ed Use named error return for service#StartShim
fixFix metrics monitoring of v2 runtime tasks containerd/containerd#4486
fixFix nil pointer error when restoring checkpoint containerd/containerd#4754
fixFix devmapper device deletion on rollback containerd/containerd#4437
fixFix integer overflow on Windows containerd/containerd#4589
otherUpdate seccomp default profile containerd/containerd#4481
other7fb6e1713 Merge pull request from dmcgowan/prepare-1.3.8
other3b63746c0 Prepare 1.3.8 release
otherb2f19447a Merge pull request from thaJeztah/1.3_restore_nil_pointer
fixbcb8bd3e4 bug fix:#3448
deprecated651188ccf Fix GH Actions CI deprecations
featuree5afa333a Add CRI release build
featured8ef77eb8 Add TaskMax=infinity
featureb3ef77e56 Add DefaultRuntimeName option.
feature5a5581694 Add cri as required plugin.
feature7423599a9 Disable TLS streaming to work with new kubelet streaming proxy.
feature7e4202681 Add unix:// prefix for socket addresses used by CRI remote client.
feature78bc3160c Add KUBE_CONTAINER_RUNTIME_NAME to fix fluentd support.
featureb3d92c5dd Add log level support.
featurebae03ff7c Add cni config template support.
fixeca3ca166 Fix for kube-up.sh and update several documments.
feature206b239d6 Add initial wait for health-monitor and use pkill -x.
feature1b4ef5d64 Add a separate CLI for cri-containerd ctrcri.
fix5ad7db207 Add runtime cgroup and fix a cli panic.
feature077721211 Add document for kube-up.sh
featurea797a6ce2 Add OS and arch in release tarball.
feature2ad761ddb Add cluster directory and health-monitor.sh.
feature1f5b5c909 seccomp: allow io-uring related system calls
feature37c1a8ecb seccomp: allow clock_settime when CAP_SYS_TIME is added
featuref959608b0 seccomp: allow quotactl with CAP_SYS_ADMIN
feature61f1b4ee2 seccomp: allow sync_file_range2 on supported architectures.
feature4748bb7d5 seccomp: allow personality with UNAME26 bit set
feature93a529467 seccomp: allow syscall membarrier
feature280fc55eb seccomp: allow adjtimex get time operation
feature2fb406bef seccomp: allow add preadv2 and pwritev2 syscalls
feature39052fa79 seccomp: allow 'rseq' syscall in default seccomp profile
breakinga3a385c9d seccomp: remove the unused query_module(2)
feature078b6d91b seccomp: add 64-bit time_t syscalls
featurebdb3ce2fa seccomp: add faccessat2 syscall.
feature44633cf1b seccomp: add openat2 syscall.
fixfd6c9153a snapshots/devmapper: fix rollback
+74 more items in the release notesotherTransfer error to ErrNotFound when kill a not exist container containerd/containerd#4361
othersnapshots/devmapper: suspend a device to avoid data corruption containerd/containerd#4416
othershim: move event context timeout to publisher containerd/containerd#4417
featureAllow empty scope authorization containerd/containerd#4422
otherReplace ocispec.MediaTypeImageManifest with manifest.MediaType containerd/containerd#4432
other8fba4e9a Merge pull request from joejulian/1.3.7
other7101a2a3 Merge pull request from dmcgowan/update-mailmap-1.3
other6816dfae Update mailmap for latest release
othera60b483c Prepare v1.3.7 fix release
otherc9831cbc Merge pull request from estesp/cp-3904
otherda855486 Merge pull request from cpuguy83/1.3-shim2_event_cancelled
other59b7f645 Merge pull request from kzys/backport-3889
other400c7841 Remove an empty line
otherf34fe9e5 Update checkImages to accept images.MediaTypeDockerSchema2Manifest
other0e29f9b8 Replace ocispec.MediaTypeImageManifest with manifest.MediaType
otherad19320c shim: move event context timeout to publsher
other2a76bb8a Merge pull request from kzys/backport-4374
other97938939 snapshots/devmapper: backport ResumeDevice() from master
othere59d348f snapshots/devmapper: suspend a device to avoid data corruption
feature4ee5184c Allow empty scope authorization
other4f6d25c2 Merge pull request from joejulian/backport-4214
other6bc17344 Update to later version of critools with timing fix.
otherb7831603 Don't clash with GH Actions runner's containerd
otherfcbd278b cleanup the image synchronously for Usage case
othera7dca07b test: Do SynchronousDelete cleanup before testing ImageIsUnpacked
fix431b5b5c fixes for backports to 1.3 from 1.4
other9053787a Minor actions fixes/updates
other57072568 [backport] Transfer error to ErrNotFound when kill a not exist container
otherPin libseccomp to 2.3.3 for the GH Actions-based release.yml containerd/containerd#4352
otherbe75852b8d Merge pull request from estesp/prepare-1.3.6
otherfc8f6c55d0 Merge pull request from estesp/pin-seccomp-release
otherfbdd528199 Prepare v1.3.6 fix release
other7013f1fccc Pin libseccomp to 2.3.3 for GH Actions release.yml
otherCleanup allocated resources in case of a binary I/O error containerd/containerd#4278
fixFix image usage calculation error containerd/containerd#4276
otherMake killing shims more resilient containerd/containerd#4307
othershim v2 runc: propagate options.Root to Cleanup containerd/containerd#4329
otherBump Golang 1.13.12 containerd/containerd#4337
other9b6f3ec030 Merge pull request from AkihiroSuda/prepare-v1.3.5
otherae8cac9eb6 Prepare release v1.3.5
other8d4a661618 release.yml: Bump Golang 1.13.12
other5c41fe4592 Streamline hcs shim release flow
featurec6d0967590 Add windows hcsshim to release pipeline
othercbc479bf6b Don't inadvertently clip release notes
featurea902cd85ae Add release GH Action triggered by signed tag
other60cf2f0374 Merge pull request from AkihiroSuda/golang-1.13.12-containerd1.3
other0ade3c24d0 Bump Golang 1.13.12
other885ab8fb0f Merge pull request from thaJeztah/1.3_backport_fix_4326
other1ceb0a815a shim v2 runc: propagate options.Root to Cleanup
othercc54652c61 Merge pull request from fuweid/cp-1_3-4204
otherd52ea2a627 Merge pull request from hakman/runc-selinux-1.3
otherfa88191a1a Build runc with selinux support
other1fa7a23e15 Make killing shims more resilient
other1e902b2d7e Merge pull request from estesp/cp-usage-fix
other868a235972 Fix image usage calculation error
othere655edce10 Merge pull request from kzys/1.3-backport-issue-4195
othercb32a60351 Merge pull request from estesp/disable-travis-1.3
feature0cca78f46d Add binary IO tests
other7699c5e936 Cleanup binary IO resources on error
otherb26e6abe00 Don't use timeout package when stopping shim logger
otherfc2579849a Disable travis and codecov comments
other3943a53731 Merge pull request from estesp/enable-actions-1.3
featurec77ae0e5c6 Re-add socat based on continued dependency
breaking229bfe2562 service_windows.go: remove unused "service" variable
other55b88c4598 Enable GH Actions for release/1.3
otherImprove host fallback behaviour in docker remote containerd/containerd#4007
featureCleanup dangling shim by brand new context containerd/containerd#4054
otherSupport notify socket containerd/containerd#4104
otherCorrect logic of FIFO cleanup containerd/containerd#4150
otherRework shim logger shutdown process containerd/containerd#4166
otherMan page fixes containerd/containerd#4144
otherBump Golang 1.13.10 containerd/containerd#4170
othersys/mount_linux: use pipe for communicating mount result containerd/containerd#4171
other814b7956fa Merge pull request from mxpv/prepare-1.3.4
other1f0a4fd60d Prepare release 1.3.4
other3801f2f1f3 Merge pull request from mxpv/release/1.3
other910dfcd727 Vendor containerd/cgroups 9f1c62dddf4bc7cc72822ebe353bae7006141b1b
other60bc128245 Merge pull request from mxpv/ci-fix
other7a57e50778 Fix protobuild
otherb3b3ea60ac Merge pull request from dmcgowan/1.3-revert-git-sha-pin
othere9836d9539 Revert pin vendors by git sha
other0e625fc987 Merge pull request from thaJeztah/1.3_backport_forkmount_use_pipe_instead_wait4
otherd3d7a0d57f Merge pull request from thaJeztah/1.3_backport_update_go_events
other76c6afbe23 Merge pull request from thaJeztah/1.3_backport_bump_golang_1.13
other7d41344804 vendor: update go-events to fix alignment for 32bit systems
otherd70d0f1a99 sys/mount_linux: use pipe for communicating mount result
otherec5e25d065 Bump Golang 1.13.10
other8b79d600f8 Bump Golang 1.13.9
other13ac9e74c4 Merge pull request from mxpv/release/1.3
otherc95854caca Rework shim logger shutdown process
other7665b4d7fd Merge pull request from thaJeztah/1.3_revert_bump_bolt
other782a4619ce Revert "vendor: update go.etcd.io/bbolt v1.3.4"
other0b27d9364c Merge pull request from thaJeztah/1.3_backport_no_del_rootdir_ios
other114bbed34e Merge pull request from thaJeztah/1.3_backport_bump_console
other064ace5914 Merge pull request from thaJeztah/1.3_backport_bump_bbolt
otherfd2c9e381d Correct logic of FIFO cleanup
feature5e9289d4e5 Add version numbers for newly tagged repos
securityb512c23a47 Update Golang 1.13.7 (CVE-2020-0601, CVE-2020-7919)
securitydde0ab66c5 Revert "Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)"
fixe71c7d0d27 bugfix: cleanup dangling shim by brand new context
fix9a428a3c9e Fix incorrect comment from copy/paste of starting script
fix9f1c62d Merge pull request from mxpv/bug-fix
feature02ecf6a Merge pull request from ulyssessouza/add-file-interface
featuref652dc3 Add File interface instead of using os.File
feature6214f20 Add vendor check now that content is vendored
+49 more items in the release notesotherClose platform in runc's shim Shutdown method containerd/containerd#3907
fixFix eventfd leak containerd/containerd#3961
fixFix API filters to properly handle and return parse errors containerd/containerd#3950
securityUpdate the runc vendor to v1.0.0-rc10 which includes a mitigation for CVE-2019-19921.
securityUpdate the opencontainers/selinux which includes a mitigation for CVE-2019-16884.
securityUpdate Golang runtime to 1.12.16, mitigating the CVE-2020-0601 certificate verification bypass on Windows, and CVE-2020-7919, which only affects 32-bit architectures.
otherUpdate Golang runtime to 1.12.15, which includes a fix to the runtime (Go 1.12.14, Go 1.12.15) and and the net/http package (Go 1.12.15)
securityUpdate the gopkg.in/yaml.v2 vendor to v2.2.8 with a mitigation for CVE-2019-11253
otherd76c121f76 Merge pull request from dmcgowan/prepare-1.3.3
feature5f15602214 Add release notes for v1.3.3
other7eac412007 Update mailmap
other163fb0bd28 Merge pull request from dmcgowan/1.3-update-yaml
otherd4345c335c Update yaml dependency
otheraa877d788e Merge pull request from dmcgowan/bump-cri-1.3
otherdb4c58b8c1 Update CRI vendor for 1.3
other8366042ca3 Merge pull request from thaJeztah/1.3_bump_golang_1.12.16
other14d166c632 [release/1.3] vendor: update golang.org/x/crypto 69ecbb4d6d5dab05e49161c6e77ea40a030884e1
securityd1e31f9f2d Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)
security9cf15235d0 Merge pull request from dims/bump-opencontainers/selinux-for-CVE-2019-16884-release-1.3
security3074db3a4b Pick up fix for CVE-2019-16884 in opencontainers/selinux
featureda15d825c0 Merge pull request from dims/update-to-new-rc10-of-opencontainers/runc-release-1.3
feature0db3c9b780 Bump to opencontainers/runc new version - v1.0.0-rc10
othera375ee006e Merge pull request from thaJeztah/1.3_bump_golang_1.12.15
other72d9dd9bb4 Update Golang 1.12.15
other92dc96af08 Merge pull request from sethp-nr/fix/eventfd-leak-1.3-backport
other03ee836eea fix: repair bad merge
otherc458f2fb41 fix: eventfd leak for v2 runtime with v1 cgroups
other258e10ddd6 fix: eventfd leak
othereb5e164812 Merge pull request from dmcgowan/backport-1.3-filters-fix
other7d0e217f53 Fix filter errors
other095a1afb19 Merge pull request from dmcgowan/backport-1.3-skip-tests
featuree7c463a1c7 Add Makefile variable to skip test packages
otherbc7c9547b1 Merge pull request from zhsj/bpo-3939
other054ce5844f platforms: fill default arm variant when parse platform specifier
otherb71555a8ba Merge pull request from zhsj/bpo-3720
othere49256efa5 Fix flaky btrfs test
othere4356016b6 Merge pull request from zhsj/bpo-3744
other2a38589a59 Move flag.Parse in tests to TestMain
othera24269519b Merge pull request from thaJeztah/1.3_bump_golang_1.12.14
otherf4824d5a61 Update Golang 1.12.14
+36 more items in the release notesfixFix containerd pid race condition containerd/containerd#3857
otherUse cached process state to reduce exec cost containerd/containerd#3711
featureAdded insecure_skip_verify option in the registry tls config to allow skipping registry certificate verification containerd/containerd#3847
otherff48f57fc8 Merge pull request from dmcgowan/prepare-1.3.2
feature99005c2647 Add release notes for v1.3.2
othere987ea3cac Merge pull request from Random-Liu/update-cri-release-1.3
other8bbd71e560 Update cri to b1bef15fbeb6c6f0569b67322acfa74ca3597755.
other070c27205c Merge pull request from Random-Liu/cherrypick-#3857-release-1.3
other306d6d4b55 Fix container pid.
other5028701f1a Merge pull request from thaJeztah/1.3_backport_avoid_unnecessary_runc_state
othere3d2b608cc Merge pull request from fuweid/cp-3853
other04fbb97ad0 Fix cleanup error on content client test
otherbe24f39454 Merge pull request from ameyag/1.3_backport_log_file_win
feature333679343b Add --log-file flag for windows service.
other9abfc70043 Use cached state instead of runc state.
otherb1bef15f Merge pull request from Random-Liu/cherrypick-#1345-release-1.3
feature27edfa06 Add insecure_skip_verify option.
othere5dd8053 Merge pull request from Random-Liu/cherrypick-#1319-release-1.3
otherc0dee957 Fix containerd build, use libbtrfs-dev when available.
other1fb415d2 Merge pull request from Random-Liu/cherrypick-#1312-release-1.3
other0973459d Update based on default xenial distro.
othera46f6baf Configure golangci-lint
othergithub.com/containerd/cri 5d49e7e51b43e36a6b9c4386257c7d08c602237f -> b1bef15fbeb6c6f0569b67322acfa74ca3597755
fixFix deadlock on image pull and unpack after a registry error containerd/containerd#3816.
securityUpdate the runc vendor to v1.0.0-rc9 which includes an additional mitigation for CVE-2019-16884.
otherMore details on the runc CVE in opencontainers/runc#2128, and the additional mitigations in opencontainers/runc#2130.
featureAdd local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in containerd/containerd#3671, and fixed by containerd/containerd#3745.
fixFix large output of processes with TTY getting occasionally truncated. Reported in containerd/containerd#3738 and fixed by containerd/containerd#3754.
fixFix direct unpack when running in user namespace. Reported in containerd/containerd#3762, and fixed by containerd/containerd#3779.
securityUpdate Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime, syscall and net packages (Go 1.12.12).
featureAdd Windows process shim installer containerd/containerd#3792
otherCRI fixes:
fixFix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in containerd/cri#1309, and fixed by containerd/containerd#3733 and containerd/containerd#3740.
other7fb78c1f2f Update notes for unpack error
otherd512382924 Prepare v1.3.1 release
other89d3753aa3 Merge pull request from Random-Liu/cherrypick-#3825-1.3
othera18acaf2cf Avoid deadlock in unpacker.
otherb5ede206a4 Merge pull request from fuweid/cherry-pick-3819-1.3
other780b5d5fc2 Merge pull request from thaJeztah/1.3_backport_limit_travis_release
othere19c621d0d snapshots: return error if readSnapshot fails
other54658b8831 Merge pull request from thaJeztah/1.3_backport_bump_golang_1.12.13
otherf7e59ae1a3 Update to Golang 1.12.13
other9488dd85ee Revert "[release/1.3] pin travis to go 1.12.12"
othere70ee589e4 Limit travis release script to a single build
other0aeaac0331 Merge pull request from ameyag/windows-shim-backport
other067be94641 windows process shim installer
otherd6f0c29b1b Merge pull request from AkihiroSuda/disable-mknod00-in-userns-1.3
otherf3c48daf71 apply: use naive applier when running in UserNS
other7af311b420 Merge pull request from thaJeztah/1.3_backport_bump_golang_1.12.x
otherc345050705 Merge pull request from estesp/update-vndr-1.3
other033612194b Catch up vndr with state of vendor/ dir
other7f6f2c7d4f [release/1.3] pin travis to go 1.12.12
security23b0ca70fe Update Golang 1.12.12 (CVE-2019-17596)
otheraa98dc6e4d Merge pull request from estesp/cp-1.3-3743
other0f6aab184a Handle large output in v2 shim with TTY
feature7aaa8fc685 Merge pull request from AkihiroSuda/native-copydir-allow-xattr-errors-1.3
other1c3929e594 Merge pull request from seemethere/fix_man_1_3
otherf6a32a79e1 snapshots/native: ignore xattr errors during CopyDir
other3866900d62 Merge pull request from crosbymichael/localfs3
fixffb05aeb1f build: Fix manpage generation
featured168e8ebeb Add local-fs.target to service file
other0b43a3115a Merge pull request from estesp/cp-1.3-3736
otherb3e9ded8ce Fix delete error code on the containerd daemon side.
+6 more items in the release notessecurityFixes CVE-2020-15157: containerd v1.2.x can be coerced into leaking credentials during image pull
featureNew Windows V2 runtime using shim API. Adds support for the Windows runtime shims in containerd. NOTE: while containerd's runtime is stable in this release, running Windows containers are not yet fully supported until the runhcs shim is fully supported.
securityUpdate runc dependency Updated runc for CVE-2019-16884
featureNew Devmapper snapshotter (https://github.com/containerd/containerd/pull/3022)
featureImproved label support for plugins. Allows snapshot plugins to use labels from clients for advanced use cases
featureAdd stream processor plugin. Allow handling of custom media types during unpack (https://github.com/containerd/containerd/pull/3482)
featureDefault handling from namespace labels. Allows defaults to be configured per containerd namespace (https://github.com/containerd/containerd/pull/3403)
featureSupport for cross repository push (https://github.com/containerd/containerd/pull/3218)
featureAdd support for direct resource management in leases (https://github.com/containerd/containerd/pull/3304)
featureSupported per-pod containerd shim. The io.containerd.runc.v2 runtime is fully validated and ready to be used in production. This helps minimizing per-pod resource overhead. Note that io.containerd.runtime.v1.linux is still the default runtime. (https://github.com/containerd/cri/issues/1075)
featureAdded file-based generic runtime config options. This will be used by out-of-tree runtimes like gvisor and kata (https://github.com/containerd/cri/pull/1029), e.g.
featureAdded the pod_annotations runtime option. Pod annotations specified in the list will be passed to the runtime as OCI annotations. This enables runtimes to support annotation-based experimental features. (https://github.com/containerd/cri/pull/1084)
featureAdded stream_idle_time option. This makes idle connection timeout of the streaming server configurable. (https://github.com/containerd/cri/issues/1057)
featureAdded traffic shaping pod annotations support. NOTE: traffic shaping is still an experimental feature in Kubernetes. (https://github.com/containerd/cri/issues/1150)
deprecatedctr cri load command is deprecated, use ctr -n=k8s.io images import instead.(https://github.com/containerd/cri/issues/909)
deprecatedThe plugins.cri.containerd.default_runtime option is deprecated, use plugins."io.containerd.grpc.v1.cri".containerd.default_runtime_name instead. (https://github.com/containerd/cri/issues/1076)
deprecatedRuntime options including systemd_cgroups, runtime_engine and runtime_root are deprecated, use runtime options instead. (https://github.com/containerd/cri/pull/1217)
deprecatedruntimeHandler field is moved from the sandbox info into status. (https://github.com/containerd/cri/pull/1063)
deprecatedplugins.cri.registry.auths is deprecated, use plugins.cri.registry.configs instead. (https://github.com/containerd/cri/pull/1227)
breakingFix garbage collection scheduling on reference removal. Ensures removal of leases or containers triggers the next scheduled garbage collection
security35d3bae1e1 AppVeyor: bump golang 1.12.10 (CVE-2019-16276)
security95dbbdc8c1 Bump runc for CVE-2019-16884
deprecatedc1fc21e92e ctr: use NewDockerAuthorizer instead of deprecated NewAuthorizer
security1b389b3628 AppVeyor: update to go 1.12.8 (CVE-2019-9512, CVE-2019-9514)
breaking282b19efd2 remotes: remove useless line
breaking4b4ce4a26c remotes: remove unnecessary string formatting
breakingec8d9d3d7a shimv2: remove the dead task from runtime task list
breaking2d03791158 docs: remove shim_no_newns in ops.md
securityaaca11c40d Merge pull request from dmcgowan/extended-security-releases
security14eaad0cd9 Update runc to 6635b4f0c6af3810594d2770f662f34ddc15b40d (CVE-2019-5736)
breaking34672d483d metadata/gc: remove the noop-loop for snapshot reference
securityb5a794649a Merge pull request from estesp/security-audit
securitya79879e9dd Add security audit report to README
breaking723797d320 docs: remove website leftovers
breaking6ccb0d0629 fix: remove dead code
breaking83f4ab8855 makefile: remove emoji on Linux
deprecatedf9760af8 Merge pull request from Random-Liu/remove-no-pivot-deprecation
deprecated871a8b89 Do not deprecate no_pivot yet.
deprecatedfb5210e2 Merge pull request from Random-Liu/print-deprecated-notice
deprecatedb74653b8 Print warning message for deprecated options.
+1705 more items in the release notessecurityThe fourteenth patch release for containerd 1.2 is a security release to fix CVE-2020-15157.
securityFix bug which allowed manifests to coerce containerd clients into leaking registry credentials GHSA-742w-89gc-8m9c
fixFix regression pushing manifests as octet stream
otherUpdate golang version
featuref8777f130 Add release notes for v1.2.14
securityabbb17959 Add comment clarifying fix for security issue
other1ead8d9de treat manifest provided URLs differently
other7f1f9b1cb Merge pull request from thaJeztah/1.2_backport_bump_golang_1.13.15
otherf52fbb8a9 Bump Golang 1.13.15
other0732aa7a6 Bump Golang 1.13.14
otherf6b342959 Bump Go 1.13.13
other0a454c2f7 Merge pull request from AkihiroSuda/golang-1.13.12-containerd1.2
other2f4dfde54 Bump Golang 1.13.12
other48cc59890 Merge pull request from hakman/runc-selinux-1.2
othercbdfca815 Build runc with selinux support
other3b72766af Merge pull request from dmcgowan/1.2-fix-bad-backport-push-octet-stream
fixf8ae16778 Fix incorrect backport of setting octet-stream
otherd4242f0d3 Merge pull request from estesp/travis-ci-fixes
other17a506c94 golangci-lint update and fix
other05bf3d63a Merge pull request from thaJeztah/1.2_backport_bump_golang_1.13
other4f6dc01a8 Bump Golang 1.13.10
other493665bd5 Bump Golang 1.13.9
otheredc830f98 Merge pull request from thaJeztah/1.2_backport_bump_console
other053f4d6fd Update containerd/console vendor for fix
othere72c2b5b1 Bump containerd console for os.File changes
other8810a1387 bump containerd/console 0650fd9eeb50bab4fc99dceb9f2e14cf58f36e7f
otherb3b1ef317 Merge pull request from payall4u/hotfix-delete-container-error
otherf8be3cf7f when kill container, check if container has been deleted
other8403abc6f Merge pull request from thaJeztah/1.2_backport_bump_golang_1.13
other35a174382 Update Golang 1.13.8
security305703670 Update Golang 1.13.7 (CVE-2020-0601, CVE-2020-7919)
other1591eb809 Update Golang 1.13.6
otherfc95ae8ed Update Golang 1.13.5
other77499e24e Update to Golang 1.13.4
securityc5843f944 Revert "Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)"
fix971ad613c bugfix: cleanup dangling shim by brand new context
feature02ecf6a Merge pull request from ulyssessouza/add-file-interface
featuref652dc3 Add File interface instead of using os.File
feature6214f20 Add vendor check now that content is vendored
feature0b9f189 Add common project repo checks/README references
+23 more items in the release notesfixFix container pid race condition containerd#4025
otherUpdate containerd/cgroups dependency to address blkio issue containerd#4001
otherSet octet-stream content-type on PUT request containerd#4028
otherPin to libseccomp 2.3.3 to preserve compatibility with hosts that do not have libseccomp 2.4 or higher installed containerd#4015
otherUpdate Golang runtime to 1.12.17, which includes a fix to the runtime containerd#4031
other7ad184331f Merge pull request from thaJeztah/release_1.2.13
otherf141d0f7a1 Prepare v1.2.13 release
other0c10aca55e Update .mailmap with changes from master
otherb9b4fa7f10 Merge pull request from thaJeztah/1.2_backport_fix_container_pid
other1f6ea50be7 Merge pull request from estesp/cp-1.2-4017
otherb970987628 Fix container pid.
other567ca6785c Set octet-stream content-type on put request
other89c46ed579 Merge pull request from fuweid/cp12-246a560e
otherc9524284e4 Merge pull request from thaJeztah/1.2_bump_golang_1.12.17
other28eb964b00 script: use github.com/kubernetes-sigs/cri-tools directly
other5bead4582c Merge pull request from DataDog/lbernail/upgrade-cgroups
other01edb7cddb Merge pull request from hakman/fix-libseccomp-ver
other2a0ca2d077 Update Golang 1.12.17
fixa7c9b7605c Fix incorrect comment from copy/paste of starting script
other6ad255383a Pin to libseccomp 2.3.3
other25a806c508 bump cgroups dependency to address blkio issue
otherc4b9ac5 Merge pull request from sofat1989/master
otherf627015 avoid adding io_serviced and io_service_bytes duplicately
otherd596c78 Merge pull request from lgtczh/add_mem_soft_limit
otherb589cd9 Merge pull request from crosbymichael/makefile
fix13a3ac4 fixed an issue with invalid soft memory limits
feature215221e Add makefile for go and protos
otherdb27230 Merge pull request from woshijpf/fix-cgroup-left-problem
fix0ecd2b6 cgroups: fix MoveTo function fail problem
other51b62d3 Merge pull request from gliptak/import1
other42091f5 Merge pull request from odinuge/cgroups-hugetlb-fix
other97bda9c Merge pull request from gliptak/patch-2
other38dc3ac Correct forked Travis builds
featurea9a304a Add Go 1.12 to Travis
other51dcf5f Fix cgroup hugetlb size prefix for kB
otherfc51a4c Merge pull request from ZeroMagic/add_network_stats
feature1741ae0 add network stats
othergithub.com/containerd/cgroups 4994991857f9b0ae8dc439551e8bebdbb4bf66c1 -> c4b9ac5c7601384c965b9646fc515884e091ebb9
securityThe twelfth patch release for containerd 1.2 includes an updated runc with a fix for CVE-2019-19921, an updated version of the opencontainers/selinux dependency, which includes a fix for CVE-2019-16884, an updated version of the gopkg.in/yaml.v2 dependency to address CVE-2019-11253, and a Golang…
securityUpdate the runc vendor to v1.0.0-rc10 which includes a mitigation for CVE-2019-19921.
securityUpdate the opencontainers/selinux which includes a mitigation for CVE-2019-16884.
securityUpdate Golang runtime to 1.12.16, mitigating the CVE-2020-0601 certificate verification bypass on Windows, and CVE-2020-7919, which only affects 32-bit architectures.
otherUpdate Golang runtime to 1.12.15, which includes a fix to the runtime (Go 1.12.14, Go 1.12.15) and and the net/http package (Go 1.12.15)
otherA fix to prevent SIGSEGV when starting containerd-shim containerd/containerd#3960
fixFixes to exec containerd/containerd#3755
otherPrevent docker exec hanging if an earlier docker exec left a zombie process
otherPrevent High system load/CPU utilization with liveness and readiness probes
otherPrevent Docker healthcheck causing high CPU utilization
otherCRI fixes:
securityUpdate the gopkg.in/yaml.v2 vendor to v2.2.8 with a mitigation for CVE-2019-11253
fixFix API filters to properly handle and return parse errors containerd/containerd#3950
other35bd7a5f69 Merge pull request from thaJeztah/release_1.2.12
other79d65767e4 Prepare v1.2.12 release
other9be62a7ee9 Update mailmap
other7018df2284 Merge pull request from thaJeztah/1.2_bump_containerd_cri
other9c7bd5072d Merge pull request from thaJeztah/1.2_backport_dockerfile_test_fixes
other89c589bf03 Merge pull request from thaJeztah/1.2_backport_bump_grpc
other8761b1bf86 Update name for btrfs headers package
other5db3987ebf Fix dependency in BUILDING.md
other945611681c [release/1.2] vendor: bump containerd/cri b1052f3b73fb9f0a6805d3c20e884a4cef265a38
other520c8cb846 bump google.golang.org/grpc v1.23.1
othera558638ee7 Merge pull request from thaJeztah/1.2_update_containerd_cri
otherc12aaf0e59 vendor: bump gopkg.in/yaml.v2 v2.2.8
other9d1954f2ec vendor: bump containerd/cri b075cc4e9f394780dbed101601c48dcc3d37c828 (release/1.2 branch)
other92b40b6254 Merge pull request from thaJeztah/1.2_bump_golang_1.12.16
other1bc2590d98 vendor: update golang.org/x/crypto 69ecbb4d6d5dab05e49161c6e77ea40a030884e1
security44b5bac0c0 Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)
security7276974071 Merge pull request from dims/bump-opencontainers/selinux-for-CVE-2019-16884-release-1.2
security4c03d5dfb8 Pick up fix for CVE-2019-16884 in opencontainers/selinux
feature318111bdfe Merge pull request from dims/update-to-new-rc10-of-opencontainers/runc-release-1.2
feature87648d2a7b Bump to opencontainers/runc new version - v1.0.0-rc10
other701a8d0db8 Merge pull request from thaJeztah/1.2_bump_golang_1.12.15
otherf106ae4ab5 Update Golang 1.12.15
other625b11b6e1 Merge pull request from fuweid/cp-3559
other4288ba10fd runtime: only check killall for init process
feature42aba6e0fe Add timeout for I/O waitgroups
securityae6b4816 pick up fix for CVE-2019-19921 in opencontainers/selinux
featuregoogle.golang.org/appengine 54a98f90d1c46b7731eb8fb305d2a321c30ef610 new
+28 more items in the release notessecurityThe eleventh patch release for containerd 1.2 includes an updated runc with an additional fix for CVE-2019-16884 and a Golang update.
securityUpdate the runc vendor to v1.0.0-rc9 which includes an additional mitigation for CVE-2019-16884.
otherMore details on the runc CVE in opencontainers/runc#2128, and the additional mitigations in opencontainers/runc#2130.
featureAdd local-fs.target to service file to fix corrupt image after unexpected host reboot. Reported in containerd/containerd#3671, and fixed by containerd/containerd#3746.
securityUpdate Golang runtime to 1.12.13, which includes security fixes to the crypto/dsa package made in Go 1.12.11 (CVE-2019-17596), and fixes to the go command, runtime, syscall and net packages (Go 1.12.12).
otherCRI fixes:
fixFix shim delete error code to avoid unnecessary retries in the CRI plugin. Discovered in containerd/cri#1309, and fixed by containerd/containerd#3732 and containerd/containerd#3739.
otherf772c10a58 Merge pull request from thaJeztah/release_1.2.11
other1b4aebd681 Prepare v1.2.11 release
otherdb4537e43d Merge pull request from fuweid/cherry-pick-3819-1.2
other128664b677 snapshots: return error if readSnapshot fails
othera287c087b6 Merge pull request from thaJeztah/1.2_backport_bump_golang_1.12.13
other342c953a53 Update to Golang 1.12.13
other6b94990c11 Revert "[release/1.2] pin travis to go 1.12.12"
otherc2383a5f2c Merge pull request from thaJeztah/1.2_backport_bump_golang_1.12.x
otherd1960b4129 Merge pull request from estesp/update-vndr
other0b9135f1dc Catch up vndr with state of vendor/ dir
other435e05fd0d [release/1.2] pin travis to go 1.12.12
securitye319caedc4 Update Golang 1.12.12 (CVE-2019-17596)
otherb0d7ef6110 Merge pull request from crosbymichael/localfs2
featurec471c95bc5 Add local-fs.target to service file
otherc3532a35cc Merge pull request from estesp/cp-1.2-3736
other847f74c284 Fix delete error code on the containerd daemon side.
other445638104e Merge pull request from Random-Liu/cherrypick-#3730-release-1.2
other611766aff3 Fix shim delete error code.
other816dfe3960 Merge pull request from thaJeztah/1.2_backport_bump_runc_1.0.0-rc9
other639be35858 bump runc v1.0.0-rc9
otherb30190905f Bump runc to 1b8a1eeec3f337ab5d94f28980
other8fb208fb14 Revert "Revert "bump libseccomp-golang v0.9.1""
otherdeca8e0e31 Merge pull request from Random-Liu/automate-cri-tarball-release
other889f5f8036 Automate CRI tarball release.
otherbab7348f Merge pull request from Random-Liu/cherrypick-#1266-release-1.2
otherec7287ac Support local containerd release.
othergithub.com/containerd/cri 40affe7c7402d41618b9791a8cf105ac74ce56d0 -> bab7348fcfcc795e0dda2cc02e8cac6316c85edc
othergithub.com/opencontainers/runc 3e425f80a8c931f88e6d94a8c831b9d5aa481657 -> d736ef14f0288d6993a1845745d6756cfc9ddd5a
othergithub.com/seccomp/libseccomp-golang 32f571b70023028bd57d9288c20efbcb237f3ce0 -> v0.9.1
securityUpdate the runc vendor to capture the fix for CVE-2019-16884. Fixed by PR #3685
otherMore details on the runc CVE in opencontainers/runc#2128, fixed by opencontainers/runc#2129
securityUpdate Golang runtime to 1.12.10 to handle CVE-2019-16276. More detail on the Golang CVE available in golang/go#34540
otherCRI fixes:
fixFix a bug that the default UNIX path is not in the default OCI config via the CRI plugin. Reported in containerd/cri#1279 and fixed by containerd/cri#1283
otherb34a5c8af5 Merge pull request from estesp/prep-v1.2.10
other9e6b7bb9f5 Prepare v1.2.10 release
other61f763ffef Merge pull request from thaJeztah/1.2_backport_bump_golang_1.12.10
security8d33d03519 AppVeyor: bump golang 1.12.10 (CVE-2019-16276)
other00427181b5 Merge pull request from crosbymichael/runc-release1.2
security0c961b1867 Bump runc for CVE-2019-16884
other8628ebfbaa Merge pull request from Random-Liu/update-cri-release-1.2
other4be2ad78fd Update cri to 40affe7c7402d41618b9791a8cf105ac74ce56d0.
other710fca10d9 Merge pull request from crosbymichael/1.2-go-runc
other5d464752c3 Update go-runc to e029b79d8cda8374981c64eba71f28e
other40affe7c Merge pull request from estesp/bp-1280
fix6d433c50 Backport fix for default UNIX environment in OCI container config
othere029b79 Merge pull request from tonistiigi/notify-socket
otherc0c55f3 avoid setting NOTIFY_SOCKET from calling process
otherb4bc25a Merge pull request from containerd/travis
other6b4a1ca Update travis to 1.12 and 1.13
other9007c24 Merge pull request from Ace-Tang/fix-error-return
other4e99c72 Fix Method of judging command execution failure
feature7d11b49 Merge pull request from fuweid/add-content-check
feature8e51df4 Add common project content/checks
othergithub.com/containerd/cri ad5dcc6cba067488d017540d06ebc08b21bb82bc -> 40affe7c7402d41618b9791a8cf105ac74ce56d0
othergithub.com/containerd/go-runc 5a6d9f37cfa36b15efba46dc7ea349fa9b7143c3 -> e029b79d8cda8374981c64eba71f28ec38e5526f
othergithub.com/opencontainers/runc v1.0.0-rc8 -> 3e425f80a8c931f88e6d94a8c831b9d5aa481657
otherCherry-pick update to gRPC 1.23.0. PR #3586 {cherry-picked from changes in master PRs and}.
fixFixes grpc/grpc-go#2970 transport: block reading frames when too many transport control frames are queued.
securityAddresses CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).
otherOther changes can be found in the gRPC release notes.
otherCRI fixes:
fixFix a bug that the default apparmor profile is mistakenly applied to privileged containers with runtime/default specified. containerd/cri#1239
fixFix a bug that image can't be pulled if an empty AuthConfig is specified. containerd/cri#1249
fixBug fix: Compute manifest data when not provided (Docker-Content-Digest header missing). PR #3591 {cherry-picked from master PR #3245 with backports of and required}.
fixBug fix: Use default UNIX env when image has no environment. PR #3601 {cherry-picked from master branch PR #3599}.
fixBug fix: archive: truncate modification time. PR #3602 {cherry-picked from master branch PR #3589}.
fixBug fix: zfs: Datasets don't seem to be cleaned up properly on image removal. Reported in containerd/zfs#22 and fixed by PR containerd/zfs#24 and re-vendored into containerd release/1.2 via PR #3596.
otherd50db0a420 Merge pull request from estesp/prep-v1.2.9
otherb3a8460684 Update mailmap
other1530fcac13 Merge pull request from awesomenix/release/1.2
other413609294d Prepare v1.2.9 release
other6ef0529f1f Merge pull request from thaJeztah/1.2_backport_compute_manifest_metadata
otherad5af8a4e3 Merge pull request from estesp/cp-3581
other322c57a10f Merge pull request from estesp/cp-3589
otherb1e40b64f8 [release/1.2] Update cri to ad5dcc6cba067488d017540d06ebc08b21bb82bc
otheref264a7411 Merge pull request from estesp/cp-3599
other14ff021bd6 archive: truncate modification time
other86ea2b7266 Use default UNIX env when image has no environment
other783f67d5ac Merge pull request from AkihiroSuda/zfs-20190829-12
other99c2e56e30 bump containerd/zfs 2ceb2dbb8154202ed1b8fd32e4ea25b491d7b251
other0d6d883a6d Compute manifest metadata when not provided.
featuree6275a02bf Add user agent header to all requests
other4bffd8855e Explicitly stating utf-8 when fetching oauth token
feature09c68d083f Add custom headers option to dockerResolver
feature5c284a771b Revert "Add user agent header to all requests"
other08325686b9 Update gRPC to v1.23.0
other5fbd02f81b Update ttrpc to 92c8520ef9f86600c650dd540266a00
otherad5dcc6c Merge pull request from awesomenix/release/1.2
otherce727bab fix: support empty auth config for anonymous registry
featurede8faac Add godocs for interceptors
featuree409d7d Add example binary for testing the example service
feature819653f Add client and server unary interceptors
feature31af176 Merge pull request from estesp/add-project-repo-checks
feature2f23511 Add common project content/checks to zfs
featurec6182c4 Add license headers to files
featuregithub.com/google/uuid v1.1.1 new
+32 more items in the release notesotherSkip rootfs unmount when no mounts are provided. Fixed by PR #3148 {cherry-picked as PR #3402}.
otherClose inherited socket file descriptor. Fixed in PR #3359 {cherry-picked as PR #3364}.
otherCall CloseIO when stdin closes in ctr. Fixed by PR #3462 {cherry-picked as PR 3490}.
featureSeveral multi-arch image fixes, including: ARM platform matching, selecting the proper manifest, and limited to best matched manifest to solve discrepancies with multi-arch image operations. Backported PR #3270 as PR #3404, PR #3484 as PR #3512, and added PR #3421.
otherOverride image's environment config with process config; including backport of fixes and tests for merging/replacing env variables; fix in PR #3542, backported via PR #3546 which included a backport of PR #2887. Additional fix to logic for override re: image $PATH cherry-picked in PR #3565.
otherShim hang fix in master via PR #3540 backported to release/1.2 via PR #3561.
otherUpdated Golang version to 1.12.9 patch release:
securityResolves CVE-2019-9512 and CVE-2019-9514 from the 1.12.8 security release. Originally fixed via PR #3531 which lists the details of the Golang CVEs, backported via PR #3532 to release/1.2.
fixResolves fd leaks reported via golang/go#33405 and resolved in the 1.12.9 patch release, updated via PR #3544. This fd leak bug was initially reported in containerd issue.
fixCRI: Fix a bug that if an image is deleted immediately after being pulled, the image may still exist after the deletion finishes successfully. (https://github.com/containerd/cri/issues/1161)
fixCRI: Fix a bug that runc and crictl binaries shipped in https://storage.googleapis.com/cri-containerd-release are versioned with the containerd version. (https://github.com/containerd/cri/pull/1193)
fixCRI: Fix a bug that the images become unusable if 2 images have the same image ID and RepoTag, but different RepoDigests. (https://github.com/containerd/containerd/issues/3401)
fixCRI: Fix ProcMount support (https://github.com/containerd/cri/pull/1216). NOTE: To use containerd 1.2.8+ with Kubernetes 1.11 or below, you MUST set disable_proc_mount=true in the cri plugin config. (https://github.com/containerd/cri/issues/1208)
fixCRI: Fix a bug that containerd tries to connect image registry with https even if the http endpoint is configured. (https://github.com/containerd/cri/issues/1201)
othera4bc1d432a Merge pull request from estesp/prep-v1.2.8
other5e060c4246 Merge pull request from estesp/cp-3551
othera9ba2e681c Prepare v1.2.8 point release
other1c309d804d Remove the process default ENV
otherde8fa9b614 Merge pull request from keloyang/shim-hung-1.2
otherf1c661f787 Change bufferSize back to 32
otherd161ab6327 Try to preserve exit event order
feature7e2864b8f0 Add retry and non-blocking send for exit events
otherdbf9a50175 Unifi reaper logic into package
other9b5b55b142 Fix shim hung
otherb21e4f466e Merge pull request from estesp/cp-3542
otherc8d75ca5ed do not mutate defaults in replaceOrAppendEnvValues
fix6c6b7e2976 bugfix: override image.Env with process.Env, rather than be contrary
othera0526340f7 Merge pull request from thaJeztah/1.2_backport_bump_golang_1.12.9
other17690cc2fe AppVeyor: update to go 1.12.9
otherc5bca64cd1 Merge pull request from thaJeztah/1.2_revert_bump_libseccomp
other8c0ec3c35e Revert "bump libseccomp-golang v0.9.1"
othereed8acd47c Merge pull request from Random-Liu/update-cri-release-1.2
other941dd9f2c3 Update cri to d928a4dd337fd2a992dbe72380eff2063c3ec62f.
othere70728b659 Merge pull request from thaJeztah/1.2_backport_bump_golang_1.12.8
security4097217bbd AppVeyor: update to go 1.12.8 (CVE-2019-9512, CVE-2019-9514)
otherbb238e05a1 AppVeyor: update to go 1.12.7
featurec675ea30c4 contrib: Dockerfile: add a base stage
featured0b89fd57e Add travis_wait to prevent vndr timing out
featurec54f640f Add test for disable_proc_mount.
featurecb317ddf Add cri managed image label when pulling the image.
+47 more items in the release notesotherSupport annotations in the OCI image descriptor, and filtering image by annotations.
otherSupport context timeout in ttrpc which can help avoid containerd hangs when a shim is unresponsive. ttrpc#31
fixFix a bug that containerd shim leaks goroutine and file descriptor after containerd restarts. ttrpc#37
fixFix a bug that a container can't be deleted if first deletion attempt is canceled or timeout.
fixFix a bug that containerd leaks file descriptor when using v2 containerd shims, e.g. containerd-shim-runc-v1.
fixFix a bug that a container with lingering processes can't terminate when it shares pid namespace with another container. moby/moby#38978
fixFix a bug that containerd can't read shim logs after restart.
fixFix a bug that shim_debug option is not honored for existing containerd shims after containerd restarts.
fixcri: Fix a bug that a container can't be stopped when the exit event is not successfully published by the containerd shim.
fixcri: Fix a bug that exec process is not cleaned up if grpc context is canceled or timeout. cri#1159
fixFix a selinux keyring labeling issue by updating runc to v1.0.0-rc.8 and selinux library to v1.2.2. opencontainers/selinux#50
otherUpdate ttrpc to f82148331ad2181edea8f3f649a1f7add6c3f9c2.
otherUpdate cri to 49ca74043390bc2eeea7a45a46005fbec58a3f88.
other85f6aa5 Merge pull request from Random-Liu/1.2.7-release-note
otherbad4fdd Prepare release note for v1.2.7.
other1bda2ed Merge pull request from dmcgowan/backport-user-agent-fix
feature1af8e6e Add user agent header to all requests
other71f5018 Merge pull request from crosbymichael/cherry
otherea70cd6 Merge pull request from Random-Liu/update-cri-release-1.2
fixe4e631a differ: fix deadlock on commit error
otherdbd25c8 Update cri to 49ca74043390bc2eeea7a45a46005fbec58a3f88
other7c69912 Merge pull request from estesp/update-ttrpc
otherd2d36e5 Bump ttrpc
other367c672 Merge pull request from fuweid/cp-v1_respect_shim_debug
other845990f Merge pull request from fuweid/cp-redirect-shim-v1-output
other57f79a1 v1: Respect the shim_debug flag when load tasks
other5508046 containerd-shim: redirect output into stdout fifo
other5a62161 Merge pull request from fuweid/cp-fifo-fd-leak
otherd0319ec Merge pull request from thaJeztah/1.2_backport_pidnamespace
other1014235 fix shouldKillAllOnExit check
other5cd83f3 Fix fd leak of shim log
other0717fe6 Use named pipes for shim logs
otherea75cfc Merge pull request from Random-Liu/cherry-pick-#3244-#3263-release-1.2
other3d276b4 Fix error handling for task deletion.
feature4bb9151 Add test for ocispec.Descriptor Annotations
feature9844ce4 Add missing annotations map to Descriptor for gRPC transfer
featured37c5e0 Add go.mod file for gopkg.in/yaml.v2
featurea364f44 Add support for request timeout propgation.
featuref51df44 Merge pull request from estesp/add-common-project-content
feature6c96b39 Add common check scripts and project references
+42 more items in the release notessecurityIt whitelists 2 new syscalls in the default seccomp profile, and also updates CNI to v0.7.5 to include the fix for CVE-2019-9946.
featureAllow overriding package name in containerd --version output.
featureAdd 2 new syscalls io_pgetevents and statx in the default seccomp whitelist.
fixFix a bug that custom containerd cgroup path does not work in containerd 1.2.5.
fixFix a bug in the containerd client that WithAllCapabilities applies incomplete capability list.
fixFix a bug that container output can be incomplete when stdout and stderr are pointed to the same file.
fixFix a bug that containerd can't properly handle space in mount point path. 3161
fixcri: fix a bug that containers being gracefully stopped are SIGKILLed when kubelet is restarted. cri#1098
fixcri: Fix a bug that pod UTS namespace is used for host network. cri#1111
securitycri: Update CNI plugins to v0.7.5 for CVE-2019-9946.
otherUpdate cri to eb926cd79d3bac188dcc4ed7694fc9298f8831be.
otherUpdate runc to v1.0.0-rc7-6-g029124da to fix potential container start failure on non-SELinux system. runc#2030
other894b81a4b8 Merge pull request from Random-Liu/1.2.6-release-note
other4be9af65b9 Prepare 1.2.6 containerd release.
other9d87dddaec Merge pull request from thaJeztah/1.2_bump_runc
othere01177391d bump runc to 029124da (v1.0.0-rc7-6-g029124da)
other7f8cf855a0 Merge pull request from Random-Liu/update-cri-release-1.2
other7c1ca26e2d Update cri to eb926cd79d3bac188dcc4ed7694fc9298f8831be
other02fd892d59 Merge pull request from Random-Liu/update-cri-release-1.2
other67def02025 Update cri to ffd9a66034aee582db04cf4c59e9b2262fd4fc59.
otherf2702c52a9 Merge pull request from thaJeztah/1.2_backport_fix_parseinfofile_parsing
otherf8d644ddc0 Use pkg/errors for all errors
other50cb294d08 fix parseInfoFile does not handle spaces in filenames
other0d58ce1a2b Merge pull request from thaJeztah/1.2_backport_issue_3118
other76d1f3e692 runtime: guard Close() until both streams are complete
other5236247ada runtime: log IO error when copying output streams
other5066e517ff Merge pull request from Random-Liu/cherrypick-#3137-release-1.2
otherde1b991122 Fix race and panic.
other667ff6a451 Merge pull request from thaJeztah/1.2_backport_bump_cgroups
other7f8deb37ed Merge pull request from thaJeztah/1.2_backport_bump_runc_v1.0.0-rc7
other1e75661aed bump containerd/cgroups 4994991857f9b0ae8dc439551e8bebdbb4bf66c1
other16a56020e6 update opencontainers/runc v1.0.0-rc7
other6d14516877 Merge pull request from thaJeztah/1.2_backport_whitelist_statx
otherc9042ae5b5 Merge pull request from thaJeztah/1.2_backport_whitelist_io_pgetevents
other2c2a86b019 seccomp: whitelist io_pgetevents
otherb0a8b6dd0b seccomp: whitelist statx syscall
other5296db1b90 Merge pull request from thaJeztah/1.2_backport_override_package_name
feature7700a82a47 Makefile: allow overriding package name
other4994991 Merge pull request from crosbymichael/load-none
other453efe3 Return ErrCgroupDeleted when no subsystems
+18 more items in the release notessecurityThe fifth patch release for containerd 1.2 contains fixes for image management, cgroup management and the CRI plugin. It also updates runc to include an improved fix for CVE-2019-5736 to reduce the increased memory-consumption introduced by the original patch. All these changes are noted below.
fixFix an issue that non-existent parent directory in image layers is created with permission 0700.
fixFix an issue that snapshots of the base image can be deleted by mistake, when images built on top of it are deleted.
featureSupport for GC references to content from snapshot and container objects.
fixcri: Fix a bug that pod can't get started when the same volume is defined differently in the image and the pod spec. cri#1059
fixcri: Fix a bug that causes container start failure after in-place upgrade containerd to 1.2.4+ or 1.1.6+. cri#1082
othercgroups updated to dbea6f2bd41658b84b00417ceefa416b97 to fix issues for systemd 420 and non-existent cgroups.
securityrunc updated to 2b18fe1d885ee5083ef9f0838fee39b62d653e30 to include the improved fix for CVE-2019-5736.
othercri updated to a92c40017473cbe0239ce180125f12669757e44f.
otherbb71b10fd8 Merge pull request from Random-Liu/prepare-release-1-2-5
other6878e2b3fa Prepare v1.2.5 release.
other075e1ed4e0 Merge pull request from Random-Liu/update-cri-release-1.2
other12f76332e6 Update cri to a92c40017473cbe0239ce180125f12669757e44f.
other8f312e3586 Merge pull request from dmcgowan/release-1.2-update-mailmap
other68f0866dfc Update mailmap for cgroup authors
other96a0d28390 Merge pull request from thaJeztah/1.2_backport_bump_runc
other9ead3ca72a Merge pull request from fuweid/me-cherry-pick-2876
fix88401ba68a bugfix: unpack should always set the snapshot gc label
otherc1f49fa74c Merge pull request from Random-Liu/update-cri-release-1.2
othera5e6b940ea Update cri to 8e7ca12f411d65de58ca672e8e4a0c1464b4fe34.
other0b7e80e347 Merge pull request from dmcgowan/backport-1.2-gc-content-references
otherb7e7f1140f update runc to 2b18fe1d885ee5083ef9f0838fee39b62d653e30
feature17a4289dee Add content gc ref labels from containers, images, and snapshots
otherf3ab47dd2b Merge pull request from crosbymichael/cherry-picks1.2
othere8091eb546 Bump cgroups to dbea6f2bd41658b84b00417ceefa416b97
other96a8180618 Merge pull request from thaJeztah/1.2_bump_golang
feature4a9f0f7 Add SkipOpts for handling how subsystems are registered
feature2fd912c Add tests for pids
featurea31a0ff Add functionality for retrieving all tasks of a cgroup
feature7d825b2 Add test for cgroups load when missing hierarchy in one subsystem
featureab9ec0e Add go-systemd dep for CI testing
featuree13f6cc Add GoReportCard badge to README
featured124595 Add Go 1.11 to Travis
featuree4cf832 Add project references and use common project travis
feature9de57ff Add godoc badge to README.md
fix5017d4e Merge pull request from WeiZhang555/bugfix
fix13aaafd Bugfix: can't write to cpuset cgroup
feature15ed73c systemd-239+ no longer allows delegate slice
fix3024bc7 Merge pull request from Sykomaniac/bugfix/slice-name
feature989fb1ab Add an OCI annotation for sandbox log directory.
+44 more items in the release notessecurityThe fourth patch release for containerd 1.2 re-vendors runc which includes the patch for the critical CVE-2019-5736 escape vulnerability. This release also includes a few fixes for the CRI plugin as well as a change for Windows; all these changes are noted below.
othercri: Set /etc/hostname
fixcri: Fix env performance issue
securityrunc updated to 6635b4f0c6af3810594d2770f662f34ddc15b40d to solve CVE-2019-5736
othercri updated to da0c016c830b2ea97fd1d737c49a568a816bf964
otherWindows: NewDirectIOFromFIFOSet
othere6b3f5632f Merge pull request from estesp/prepare-1.2.4-release
other5d1443dca7 Prepare v1.2.4 release
other2095626cff Merge pull request from thaJeztah/1.2_bump_cri
other78286104d0 Merge pull request from thaJeztah/1.2_backport_windows_changes
other3cbdf9e488 [release/1.2] update containerd/cri to da0c016c830b2ea97fd1d737c49a568a816bf964
otherdfa19e5969 Windows:NewDirectIOFromFIFOSet
other84a14ae000 Update runhcs options to include CRI Sandbox support
other6a8198b07d Forward ctr.exe --debug as io.containerd.runhcs.v1 options
featured40cc95fcf Implement io.containerd.runhcs.v1 shim log opts
feature30ca1c5544 Add io.containerd.runhcs.v1 shim proto options
other7908802cb5 Fix Makefile to run protobuild on paths with spaces
other583472f67a Merge pull request from thaJeztah/1.2_backport_bump_runc_cve_2019-5736
securityb4bf3e340c Update runc to 6635b4f0c6af3810594d2770f662f34ddc15b40d (CVE-2019-5736)
other74133fa4ea Merge pull request from thaJeztah/1.2_backport_remove_normalize_image_ref
othered756ffdd4 Use distribution's reference.ParseDockerRef
other2fb3823635 Bump github.com/docker/distribution to 0d3efadf0154c2b8a4e7b6621fff9809655cc580
otherda0c016c Merge pull request from Random-Liu/cherrypick-#1045-release-1.2
otherfd12e919 Merge pull request from Random-Liu/cherrypick-#1042-release-1.2
otherca6506b4 Include default envs from containerd.
feature2add88c1 Add env cache.
other50fbeb6f Don't log config at info level.
other1a51d430 Set /etc/hostname.
othergithub.com/containerd/cri c3cf754321fc38c6af5dfd2552fdde0ad192b31d -> da0c016c830b2ea97fd1d737c49a568a816bf964
othergithub.com/docker/distribution b38e5838b7b2f2ad48e06ec4b500011976080621 -> 0d3efadf0154c2b8a4e7b6621fff9809655cc580
othergithub.com/opencontainers/runc 12f6a991201fdb8f82579582d5e00e28fba06d0a -> 6635b4f0c6af3810594d2770f662f34ddc15b40d
othergolang.org/x/sys 1b2967e3c290b7c545b3db0deeda16e9be4f98a2 -> 41f3e6584952bb034a481797859f6ab34b6803bd
fixfix in Tar xattrs to restore compatibility with older container images
otherbackground O_NONBLOCK in OpenFifo to fix uncancelled context timeout issue
featureupdated PlatformRuntime interface to include Add/Delete methods
otherruntime: exec race condition fixed
fixcri: fixed issues with extra newline character in log without an extra newline
fixcri: fixed an issue with pods being ignored after load failures
otherrunc updated to 12f6a991201fdb8f82579582d5e00e28fba06d0a
othercri updated to c3cf754321fc38c6af5dfd2552fdde0ad192b31d
other7f5f1176 Merge pull request from ehazlett/release-v1.2.3
other7216861d Update for 1.2.3 release
other5de147d9 Merge pull request from Random-Liu/update-cri-release-1.2
otherf7ac34e3 Update cri plugin to c3cf754321fc38c6af5dfd2552fdde0ad192b31d.
other0137339c Merge pull request from crosbymichael/io-panic
other7daf0804 Fix potential containerd panic.
other2fd20f11 Merge pull request from crosbymichael/exec-lock
feature5730c500 Add a separate lock for pid.
otherb9b7ef32 Revert "use state machine management for exec.Pid()"
otherdba2e5e5 Merge pull request from fuweid/remove-noop
breaking9b6a318a metadata/gc: remove the noop-loop for snapshot reference
otherd86a73a4 Merge pull request from fuweid/platformruntime
otherdd29d5c3 Merge pull request from fuweid/pull-oct
fixa0b4da71 bugfix: support application/octet-stream during pull
featureb4d38c0f runtime: add Add/Delete method in PlatformRuntime interface
otheraf900154 Merge pull request from Random-Liu/cherrypick-#2944-release-1.2
otherab2cf013 Use context.Background for O_NONBLOCK OpenFifo.
otherfa60b5be Merge pull request from thaJeztah/1.2_backport_fix_xattr
other2244a20c fix: SCHILY.xattrs should be SCHILY.xattr
other8c9ede4f Merge pull request from crosbymichael/lint-release
otherbf3c932a [release 1.2] fix: linter issue
other5c38d942 Merge pull request from AkihiroSuda/runc20190115-1.2
other32f10c77 bump up runc
otherc3cf7543 Merge pull request from Random-Liu/cherrypick-#1037-release-1.2
other89672cc6 Update containerd to 0137339c8c1d55de5545ffdd723199dfba27cb24.
featurebba954f1 Add integration test for unknown state
other36d523d1 Support unknown state for sandbox and container
featuread9a8533 Add state machine for sandbox and container
otherc2ea49fa Change StateUnknown to StateInit
otherdf07fdd2 Merge pull request from Random-Liu/cherrypick-#1027-release-1.2
featureda7e1948 Add integration test.
fix283aac3d Fix the log ending newline handling.
+3 more items in the release notesfixFix rare deadlock on FIFO creation with timeout
fixFix a bug that a container can't be stopped or inspected when its corresponding image is deleted
fixFix a bug that the cri plugin handles containerd events outside of k8s.io namespace
other9754871865 Merge pull request from dmcgowan/release-1.2.2
otheref637041ed Update for 1.2.2 release
other4bb2b0c366 Merge pull request from Random-Liu/update-cri-release-1.2
otherf30fd02372 Update cri to 0d5cabd006cb5319dc965046067b8432d9fa5ef8 (branch release/1.2).
other46e633389b Merge pull request from thaJeztah/1.2_revert_temp_golang_fix
fixe71a191f6d Revert "Fix CI due to Golang 1.10.6 / 1.11.3 regressions (workaround)"
otheraa5e000c96 Merge pull request from andrewhsu/backport-1.2-fifo-timeout
other31be8649fd Merge pull request from thaJeztah/1.2_backport_fix_ci_golang_1.11
fix27c6449c2c Fix CI due to Golang 1.10.6 / 1.11.3 regressions (workaround)
feature18f57e20b0 Add timeout and cancel to shim fifo open
other0d5cabd0 Merge pull request from Random-Liu/revert-#999-release-1.2
fix6ca182a8 Revert "Temporary fix for golang regression #29241."
otherd0f8c33c Merge pull request from Random-Liu/cherrypick-#1004-release-1.2
other5e6b3386 Install libseccomp2 package based on debian version.
other763bf278 Merge pull request from Random-Liu/cherrypick-#995-release-1.2
other23e907d9 Merge pull request from Random-Liu/cherrypick-#997-release-1.2
fix298c7fd9 Temporary fix for golang regression #29241.
featuree38e269a Add integration test.
otherdcc9d279 Remove container lifecycle image ref dependency.
other47f62352 Merge pull request from mikebrow/cherrypick-#984-release-1.2
other2216805e filter namespace
othergithub.com/containerd/cri 0ca1e3c2b73b5c38e72f29bb76338d0078b23d6c -> 0d5cabd006cb5319dc965046067b8432d9fa5ef8
fixFix race in process state when pausing containers
otherOptimize runtime v1 shim locking
fixFix hang processing events
otherIncrease event buffer size
fixFix broken pipe causing shim hang
otherUpdate runc
breakingRemove auth config logs
fixFix NetNS cache state
fixFix a bug that containers sharing pod pid namespace can't be stopped
breakingRemove host pid usage to work better with katacontainer
otherIgnore modprobe failures in systemd ExecStartPre
other9b32062dc1 Merge pull request from dmcgowan/prepare-1.2.1
other51134077d1 Update version to 1.2.1
otherdcc47dddd1 Merge pull request from dmcgowan/cherrypick-1.2-2857
other4c327b8e56 Update runc to 96ec2177ae841256168fcf76954f7177af
otherb65a1137f4 Merge pull request from Random-Liu/update-cri-release-1.2
other18e453e4fd Update release note.
other586807a80c Update cri plugin to 0ca1e3c2b73b5c38e72f29bb76338d0078b23d6c.
other4b284fa3ab Merge pull request from Random-Liu/cherrypick-#2854-release-1.2
otherb413e843ad Kill should still work in stopped state.
othera06cddc2ed Merge pull request from nnttmm/backport_2826
other176a56216c Merge pull request from thaJeztah/1.2_backport_update_runc_1.0-rc6
other8dc87dd8d9 Merge pull request from thaJeztah/1.2_backport_mask_asound
feature703786c5c9 Add /proc/asound to masked paths
otherc42c8952b7 use state machine management for exec.Pid()
other93d5b4b018 Update runc to v1.0.0-rc6
otherde1f167ab9 Merge pull request from dmcgowan/prepare-1.2.1-rc
other27d72ba795 Update version
featuree3840cce17 Add 1.2.1 release notes
other940c0c06d2 Merge pull request from Random-Liu/cherrypick-2811-release-1.2
other4598ec2111 Lock KillAll.
othere429785ca0 Merge pull request from thaJeztah/1.2_backport_shimlockwhenstdinclose
other9be591e4a6 Merge pull request from crosbymichael/cherry-proc-lock
other309973edd9 Merge pull request from crosbymichael/cherry-runc
othere4c49d7053 Update runc to 10d38b660a77168360df3522881e2dc2be
othercd83a4e0ba fix pipe in broken may cause shim lock forever for runtime v1
other275f99feb9 fix pipe in broken may cause shim lock forever for runtime v2
other39cd86348c Merge pull request from estesp/cherrypick-optimize-shim-lock
other3afc3f149c Merge pull request from estesp/cherrypick-exit-ch-buffers
feature737587653d Temp: add appveyor enablement for release/1.2 branch
+28 more items in the release notesfeatureSupported ProcMount option introduced in Kubernetes 1.12.
featureAdded a new config option plugins.cri.registry.auths for user to config default credentials for specific registries. (doc)
featureAdded a new config option plugins.cri.x509_key_pair_streaming for user to config a valid certificate for the stream server. (config.md)
featureAdded a runtime options field for shim v2 runtime. Use the options field to config runtime specific options, e.g. NoPivotRoot and SystemdCgroup for runtime type io.containerd.runc.v1. (See config.md)
featurecri plugin stream server serves on http://localhost:0 by default. This is to work with the kubelet streaming proxy introduced in Kubernetes 1.11.
deprecatedcluster/health-monitor.sh in the release tarball will be deprecated next release. Please use Kubernetes health-monitor.sh instead.
featureAdd ListStream method to containers API. This allows listing a larger number of containers without hitting message size limts.
breakingAdd Sync flag to Delete in leases API. Setting this option will ensure a garbage collection completes before the removal call is returned. This can be used to guarantee unreferenced objects are removed from disk after a lease.
feature7b1b16b741 runtime-v2: add validation for runtime name
feature879b2ae291 allow idempotence when adding a task to cgroup metrics collection
feature7ea75ef4a9 ctr: add some metric item
featurea20603090f archive: add support for OpenBSD
feature0828b7aa96 mount: add support for OpenBSD
featuref67459929e Merge pull request from jiria/jiria/add-windows-arm-support
featuree6529f4ebc Add support to detect ARM variant on Windows
featureab2031236a Add blocking buffered writes to shim
featureddbeb3f7c7 Adds Windows shim reconnect logs support
featureb6107dca86 Add import integration test
feature81eb40fabf Adds containerd-shim-runhcs verbose logging support
feature3d5a408bfa Add Labels to client.Image.
feature94c33d4f94 Add nosuid,noexec,nodev to proc
feature47583aad28 Add release notes for containerd 1.2.0
feature9e6db71954 Add docker importer
feature13931e41d6 Add additional GIDs by default if they exist in /etc/group
featurec28ce39cea Add flag to ctr for running with NoNewPrivileges: false
featurec0cb2f2568 Add testcase for commit already exist
feature8e44270723 Adds a no-op migration for metadata v3
feature78e61af47a Add With-helper for supplemental gid support
feature60d13d63c4 Add optional install path
featureef910311e8 Add a Windows section for Linux oci on LCOW
feature85eb2c3c83 Add Windows build status
featured50e25360c Add context cancel for epoll
feature69e7c77e6a Add option to add links to changelog
feature0110b3c0bc Introduce the Windows lcow diff/snaphotter
featureb30d032a6a Add 1.2.0 beta 2 release notes
feature3d1082e06d Add a manifest filter limiting the number of matches
feature4b9b3e8fc9 Add WithAmbientCapabilities opt
feature66f6dd8b3b add -detach flag for 'ctr t start'
feature9edcfcc1cb Add platform match comparer interface
breaking2b69c16 sysx.Fchmodat(): remove
+888 more items in the release notes