containerd 1.7.14 → 2.3.5
64 releases · 35 breaking changes · 79 security fixes · 8 advisories fixed
79security35breaking41deprecated624feature140fix
Vulnerabilities fixed by this upgrade
- medium CVE-2026-95838 Unpack DoS via repeated opaque whiteouts
- medium CVE-2026-53495 containerd CRI plugin: Unbounded I/O draining in ExecSync causes node-level denial of service
- medium CVE-2026-47262 containerd image-triggered runtime DoS via unbounded group parsing
- critical CVE-2026-53488 containerd CRI — image-config LABEL flows to host-root command execution from an image pull
- medium CVE-2025-64329 Host memory exhaustion through goroutine leaks of Attach functionality in CRI server
- medium CVE-2024-25621 Local privilege escalation via wide permissions on several directories
- 4.6 CVE-2024-40635 Integer overflow in User ID handling
- medium GHSA-5j5w-g665-5m35 Ambiguous OCI manifest parsing
Breaking changes
- breaking plugins: remove some stray logrus imports () in 2.3.5
- breaking 6c59399bf plugins: remove some stray logrus imports in 2.3.5
- breaking 1c0d72890 Makefile: remove go mod download from integration in 2.2.10
- breaking pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const () in 2.2.1
- breaking 58d23ab63 pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const in 2.2.1
- breaking 73a08aa00 go.mod: remove exclude rules in 2.2.1
- breaking core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor () in 2.2.1
- breaking ed19c5420 core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor in 2.2.1
- breaking 8c0c9f6 Implement removal of RDT in 2.2.1
- breaking 3aff986 pkg/runtime-tools/generate: remove embedded field "Generator" in 2.2.1
- breaking 4ed50edce fix: ST1019: removed the duplicate imports in 2.1.7
- breaking go.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) () in 2.1.6
- breaking core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor () in 2.1.6
- breaking a4454c49a core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor in 2.1.6
- breaking Remove additional fuzzers from instrumentation repo () in 2.1.5
- breaking Update FreeBSD defaults and re-organize platform defaults () in 2.1.0
- breaking 23c28d68c Makefile: remove go mod download from integration in 2.0.14
- breaking Remove additional fuzzers from instrumentation repo () in 2.0.7
- breaking Remove disable_cgroup from CRI config () in 2.0.0
- breaking Move client to subpackage () in 2.0.0
- breaking go.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) () in 1.7.30
- breaking remove sha256-simd () in 1.7.30
- breaking Remove additional fuzzers from instrumentation repo () in 1.7.28
- breaking Remove hashicorp/go-multierror dependency and fix CI () in 1.7.27
- breaking device-injector: remove unreachable code. (containerd/nri#115) in 1.7.26
- breaking 235aa11 chore: remove unreachable code and fmt files in 1.7.26
- breaking cmd/continuity/commands: MountCmd: remove macOS remnants (containerd/continuity#254) in 1.7.25
- breaking 327ebdd cmd/continuity/commands: MountCmd: remove macOS remnants in 1.7.25
- breaking go-fix: remove pre-go1.17 build-tags (containerd/continuity#252) in 1.7.25
- breaking 433b975 go-fix: remove pre-go1.17 build-tags in 1.7.25
- breaking 760935e52 runc-shim: remove misleading comment in 1.7.22
- breaking remove imports of errdefs package, and add depguard linter () in 1.7.19
- breaking a00a2d20a reference/docker: remove deprecated SplitHostname in 1.7.19
- breaking Remove hcsshim import from repo (containerd/platforms#10) in 1.7.19
- breaking Remove references to package io/ioutil (containerd/imgcrypt#100) in 1.7.17
Security changes
- security CVE-2026-53495 in 2.3.5
- security GHSA-rp3h-jf77-q9p4 in 2.3.5
- security Fixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context in 2.3.4
- security CVE-2026-50195 in 2.3.2
- security CVE-2026-53488 in 2.3.2
- security CVE-2026-53492 in 2.3.2
- security CVE-2026-53489 in 2.3.2
- security CVE-2026-47262 in 2.3.2
- security CVE-2026-46680 in 2.3.1
- security CVE-2026-95839 in 2.2.10
- security GHSA-5p7c-hggf-c748 in 2.2.10
- security GHSA-8647-2jxj-p2rc in 2.2.10
- security GHSA-hc94-p972-ch66 in 2.2.10
- security CVE-2026-53493 in 2.2.9
- security CVE-2026-53495 in 2.2.8
- security GHSA-rp3h-jf77-q9p4 in 2.2.8
- security Fixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context in 2.2.7
- security CVE-2026-50195 in 2.2.5
- security CVE-2026-53488 in 2.2.5
- security CVE-2026-53492 in 2.2.5
- security CVE-2026-53489 in 2.2.5
- security CVE-2026-47262 in 2.2.5
- security CVE-2026-46680 in 2.2.4
- security CVE-2026-34986 in 2.2.4
- security Bump go-jose/go-jose to v4.1.4 to fix GHSA-78h2-9frx-2jm8 () in 2.2.4
- security 80311db63 chore: update go-jose for CVE-2026-34986 in 2.2.4
- security CVE-2026-35469 in 2.2.3
- security c22cf5d49 cri,nri: pass any linux security profile to plugins. in 2.2.1
- security Fixes CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion in 2.2.0
- security Fixes CVE-2025-64329: Host memory exhaustion through goroutine leaks of Attach functionality in CRI server in 2.2.0
- security Fixes CVE-2024-25621: Local privilege escalation via wide permissions on several directories in 2.2.0
- security CVE-2026-50195 in 2.1.9
- security CVE-2026-53488 in 2.1.9
- security CVE-2026-53492 in 2.1.9
- security CVE-2026-53489 in 2.1.9
- security CVE-2026-47262 in 2.1.9
- security CVE-2026-46680 in 2.1.8
- security CVE-2026-35469 in 2.1.7
- security GHSA-pwhc-rpq9-4c8w in 2.1.5
- security GHSA-m6hq-p25p-ffr2 in 2.1.5
- security GHSA-qw9x-cqr3-wc7r in 2.1.5
- security GHSA-cgrx-mc8f-2prm in 2.1.5
- security GHSA-9493-h29p-rfm2 in 2.1.5
- security The first patch release for containerd 2.1 fixes a critical vulnernability (CVE-2025-47290) which was first introduced in 2.1.0. See the Github Advisory for more details. This release also contains a few smaller updates and bux fixes. in 2.1.1
- security Fixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. in 2.1.0
- security GHSA-hc94-p972-ch66 in 2.0.14
- security CVE-2026-53493 in 2.0.13
- security CVE-2026-53495 in 2.0.12
- security GHSA-rp3h-jf77-q9p4 in 2.0.12
- security CVE-2026-53488 in 2.0.10
- security CVE-2026-47262 in 2.0.10
- security CVE-2026-46680 in 2.0.9
- security CVE-2026-35469 in 2.0.8
- security GHSA-pwhc-rpq9-4c8w in 2.0.7
- security GHSA-m6hq-p25p-ffr2 in 2.0.7
- security GHSA-qw9x-cqr3-wc7r in 2.0.7
- security GHSA-cgrx-mc8f-2prm in 2.0.7
- security GHSA-9493-h29p-rfm2 in 2.0.7
- security Fixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods. in 2.0.5
- security Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg) in 2.0.4
- security Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 () in 2.0.3
- security [medium] RAPL accessible to a container GHSA-7ww5-4wqc-m92c in 2.0.0
- security CVE-2026-53493 in 1.7.36
- security CVE-2026-53495 in 1.7.35
- security GHSA-rp3h-jf77-q9p4 in 1.7.35
- security CVE-2026-53488 in 1.7.33
- security CVE-2026-47262 in 1.7.33
- security CVE-2026-34986 in 1.7.33
- security Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 () in 1.7.33
- security 4dfc1844e Bump go-jose to v3.0.5 to address CVE-2026-34986 in 1.7.33
- security CVE-2026-46680 in 1.7.32
- security CVE-2026-35469 in 1.7.31
- security GHSA-pwhc-rpq9-4c8w in 1.7.29
- security GHSA-m6hq-p25p-ffr2 in 1.7.29
- security GHSA-qw9x-cqr3-wc7r in 1.7.29
- security GHSA-cgrx-mc8f-2prm in 1.7.29
- security GHSA-9493-h29p-rfm2 in 1.7.29
- security Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg) in 1.7.27
- security Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 () in 1.7.26
Deprecations
- deprecated nri,deprecation: record and emit warnings for NRI deprecations. () in 2.3.4
- deprecated 5966e2edb nri,deprecation: emit warnings for old NRI plugins. in 2.3.4
- deprecated cri: deprecate restore in CreateContainer () in 2.3.4
- deprecated dc98141df cri: deprecate restore in CreateContainer in 2.3.4
- deprecated Deprecate shim.Command () in 2.3.0
- deprecated cri: deprecate restore in CreateContainer () in 2.2.7
- deprecated c59d041d8 cri: deprecate restore in CreateContainer in 2.2.7
- deprecated Deprecate cgroup v1 () in 2.2.0
- deprecated Postpone v2.2 deprecation items to v2.3 () in 2.2.0
- deprecated Postpone v2.2 deprecation items to v2.3 () in 2.1.5
- deprecated 6374a8f9d Postpone v2.2 deprecation items to v2.3 in 2.1.5
- deprecated Update removal version for deprecated registry config fields () in 2.1.1
- deprecated 37d6c4236 Update removal version for deprecated registry config fields in 2.1.1
- deprecated Postpone cri config deprecations to v2.2 () in 2.1.0
- deprecated Remove deprecated dynamic library plugins () in 2.1.0
- deprecated Remove the support for Schema 1 images () in 2.1.0
- deprecated f58939c33 Remove deprecated WithCDIDevices in oci spec opts in 2.0.3
- deprecated Update warnings for deprecated CRI config fields () in 2.0.0
- deprecated Add type alias for event Envelope () in 2.0.0
- deprecated Postpone removal of deprecated CRI config properties () in 2.0.0
- deprecated Deprecate go-plugin configuration option () in 2.0.0
- deprecated CNI conf_template in CRI is no longer deprecated () in 2.0.0
- deprecated 3d7a50749 Replace use of deprecated api Envelope in 1.7.25
- deprecated 929e7bde6 Use api types over deprecated alias in 1.7.25
- deprecated 3ca0c62 gha: update CodeQL action to v3, as v2 is deprecated in 1.7.25
- deprecated Substitute deprecated rand.Seed() in Go 1.20 (containerd/continuity#231) in 1.7.25
- deprecated 242e29e Substitute deprecated rand.Seed() in Go 1.20 in 1.7.25
- deprecated 51939238f Revert "errdefs: denote deprecation as a godoc comment" in 1.7.23
- deprecated Update warnings for deprecated CRI config fields () in 1.7.21
- deprecated pkg/userns: deprecate and migrate to github.com/moby/sys/userns () in 1.7.21
- deprecated 65f7d0740 pkg/userns: deprecate and migrate to github.com/moby/sys/user/userns in 1.7.21
- deprecated 9afb8dcdf deprecation: update warnings for CRI config fields in 1.7.21
- deprecated errdefs: denote deprecation as a godoc comment () in 1.7.20
- deprecated c7d5e430a errdefs: denote deprecation as a godoc comment in 1.7.20
- deprecated reference: deprecate SplitObject () in 1.7.19
- deprecated dba53578c pkg/reference: deprecate SplitObject in 1.7.19
- deprecated 6ccdf6977 platforms: mark aliases as deprecated in 1.7.19
- deprecated Update GitHub Actions CI to resolve deprecation warnings (containerd/ttrpc#161) in 1.7.17
- deprecated 589a593 Update GitHub Actions CI to resolve deprecation warnings in 1.7.17
- deprecated 794b0c723 Add deprecated HTTPFallback for package compatibility in 1.7.16
- deprecated f2354894f Deprecate otel configs in 1.7.16
Every release in between
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureAvoid hangs and data races when streaming container standard I/O in CRI ()
featureFix missing error messages in OpenTelemetry trace attributes ()
featureFix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ()
featureFix configuration loading error when drop-in configuration files have a higher version than the root configuration ()
featureAvoid containerd startup hangs when loading shims ()
featureAdd context to error when shim delete times out ()
featureFix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)
featureFix unpack failure for EROFS images containing the erofs OS feature ()
other934efa5e0 Prepare release notes for v2.3.5
otherbe419b070 Merge commit from fork
other9ec55f024 cri: cancel ExecSync IO drain on context cancellation
other84ea25bc1 Merge commit from fork
otherc53577965 archive: skip redundant opaque whiteout walks
fixFix data races and a deadlock in the byte stream helpers ()
other9f6be869c Fix data races and a deadlock in the byte stream helpers
breakingplugins: remove some stray logrus imports ()
breaking6c59399bf plugins: remove some stray logrus imports
othersnapshots/erofs: advertise the erofs OS feature from the snapshotter plugin ()
otherf65732115 snapshots/erofs: test the advertised erofs feature platform
other5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
otherupdate runc to v1.5.1 ()
otheraf445ea0a update runc to v1.5.1
otherc077e43bd update runc to v1.5.0
othervendor: github.com/containerd/platforms v1.0.0-rc.5 ()
other676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
otherpkg/tracing: handle error and typed-nil Stringer attributes ()
otherc7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other58fb846d5 core/remotes/docker: normalize descriptor URL origins
otherc7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
otherupdate runhcs to v0.15.0-rc.4 ()
featureRevert "add check on version of drop in configs" ()
feature1125b053f Revert "add check on version of drop in configs"
fixfix(runtime): apply load timeout to load shim ()
featureAdd more context to the shim delete error ()
feature7f97bc122 Add more context to the shim delete error
fixFix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)
+7 more items in the release notessecurityFixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context
featureDisable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ()
featureSet default runtimeFeatures.UserNamespacesHostNetwork to true in CRI ()
featureDeprecate checkpoint restore in CreateContainer ()
featureSupport non-UTF-8 binary environment variable values in CRI ()
featureEnable OCI runtime feature introspection for non-runc runtimes in CRI ()
featureDisable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ()
featureNormalize sandbox image references in CRI to resolve images without domain prefixes ()
featureEmit deprecation warnings for plugins using deprecated NRI interfaces ()
featureEnable log scrubbing by default on Windows ()
featureFix memory leak in OOM watcher map when stopping container monitoring ()
featureAvoid orphaning shims on transient errors when loading process IDs ()
featureFix corruption of binary protobuf shim start responses caused by premature whitespace trimming ()
featureFix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata ()
otherc1f5360ef Prepare release notes for v2.3.4
othercri: disable restore in CreateContainer by default ()
other928c03c68 cri: disable restore in CreateContainer by default
deprecatednri,deprecation: record and emit warnings for NRI deprecations. ()
deprecated5966e2edb nri,deprecation: emit warnings for old NRI plugins.
otherSet the default of runtimeFeatures.UserNamespacesHostNetwork to true ()
otherab52c58f1 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
otherUse ScrubLogs by default on Windows ()
feature0c255158a ctr: add --scrub-logs flag for Windows
other1c2b13dc9 cri/config: use ScrubLogs by default on Windows
othersnapshots/erofs: keep lowers stacked above a merged fsmeta ()
other0c511e068 snapshots/erofs: keep lowers stacked above a merged fsmeta
deprecatedcri: deprecate restore in CreateContainer ()
deprecateddc98141df cri: deprecate restore in CreateContainer
fixinternal/oom: Fix memory leak by removing watcher from map on Stop ()
fix537d82d54 internal/oom: Fix memory leak by removing watcher from map on Stop
othershim_load: Consider shim leaked only if we can't find pids ()
otherdecf97a9c shim_load: Consider shim leaked only if we can't find pids
othercore/runtime/v2: Drop checkpointctl module dependency ()
other796f07dc8 core/runtime/v2: Drop checkpointctl module dependency
otherHandle []byte envvar value for CRI ()
other751fddddb Handle []byte envvar value
other0bce9060e update to v0.36.x kubernetes dependencies
fixfix(cri): introspect OCI runtime features for non-runc runtimes ()
featuredb03e3968 cri: add enable_criu configuration option
featurecri: auto-add prefix for pause image ()
+17 more items in the release notesfeatureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureFix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ()
featureReject CreateContainer calls when the target sandbox is not running ()
featureEnsure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ()
featureSurface OCI error bodies in registry 403 responses by falling back to GET requests ()
featureAlign default 4K mkfs block size for EROFS across all platforms ()
otherPrepare release notes for v2.3.3 ()
other7f6cee02a Prepare release notes for v2.3.3
otherCI: migrate Vagrant to Lima ()
other7316210ce CI: migrate Vagrant to Lima
otherremotes: surface OCI error body in registry 4xx responses ()
other457fba3a3 remotes: surface OCI error body on HEAD 403 via GET fallback
otherUpdate go to 1.26.5 ()
otherdc2df934e Update go to 1.26.5
otherci: pin fog-json to resolve gem conflict ()
other5be0495df ci: pin fog-json to resolve gem conflict
fixFix nil pointer dereference in NRI GetIPs ()
other36c713971 Fix nil pointer dereference in NRI GetIPs
otherSet SystemTemp env var to config temp on Windows ()
other26dce170d Set SystemTemp env var to config temp on Windows
otherupdate runhcs to v0.15.0-rc.3 ()
other9bc2c2349 update runhcs to v0.15.0-rc.3
otherUpdate to current setup-go version ()
other3e97edeb7 Update to current setup-go version
othercri: reject CreateContainer when sandbox is not running ()
other8856b0f9c cri: reject CreateContainer when sandbox is not running
otherupdate runhcs to v0.15.0-rc.2 ()
otherae796cec5 update runhcs to v0.15.0-rc.2
othertest: fix flaky image timestamp check on coarse clocks ()
fix168d56783 test: fix flaky image timestamp check on coarse clocks
featureAdd defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ()
featured1db61db8 Add deferred call to ShutdownSandbox to avoid leaks
othererofs: align default mkfs block size across platforms ()
other01b0f03f6 erofs: align default mkfs block size across platforms
securityCVE-2026-50195
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
featureFix a data race when reading shim logs on Windows ()
featureAllow the last host to retry on transient network errors ()
featureFix container startup failures caused by concurrent task RPC timeouts during slow container creation ()
otherPrepare release notes for v2.3.2 ()
otherfb8ca00b0 Prepare release notes for v2.3.2
other9c69960ba Merge commit from fork
other0f6251520 Merge commit from fork
other91d7471e2 cri: filter CDI annotations on checkpoint restore
other7c2e086bf Merge commit from fork
otherdae67765f cri: do not re-tag restored checkpoints
other94aa1e2c1 Merge commit from fork
other09599078f cri: make checkpoint restore robust to unexpected archive content
othere1fdb8d22 Merge commit from fork
otherff1d116ef Bound user-database file reads in openUserFile
otherd156e07cb Merge commit from fork
otherf99aad54a Do not propagate reserved labels from image configs
othervendor: golang.org/x/crypto v0.53.0 ()
other0b9469501 [release/2.3] vendor: golang.org/x/crypto v0.53.0
otherresolver: retry on transient network errors ()
other983bbddc1 resolver: retry on transient network errors
otherupdate runc binary to v1.4.3 ()
other3f76f2dc1 update runc binary to v1.4.3
otherupdate go to 1.26.4 ()
other8a49dfe85 update go to 1.26.4
other5aa6bb2b7 remove 1.26.2 from CI builds as it is not supported any longer due to the dependency
otherConfigure udevd children-max for root-test ()
otherbfb8aebc0 Configure udevd children-max for root-test
fixcore/runtime/v2: fix race on Windows deferredPipeConnection.c in Read ()
fix62ceafff0 core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
otherrunc-shim: don't hold the service lock across runc create ()
other9b0c0dc58 runc-shim: don't hold the service lock across runc create
othercontrib/checkpoint: increase timeouts to 30s ()
otherf588bc6fb contrib/checkpoint: increase timeouts to 30s
othergolang.org/x/crypto v0.49.0 -> v0.53.0
othergolang.org/x/mod v0.35.0 -> v0.36.0
+5 more items in the release notessecurityCVE-2026-46680
featureFix bug where failed gRPC plugins were not tolerated when starting listeners ()
featureEnsure metadata and mount plugin boltdb files are closed on server shutdown ()
featureFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
featureFix sandbox task API endpoints for non-runc runtimes and deprecate task fields in Runc options ()
featureApply hardening to default seccomp socket policy by blocking AF_ALG ()
featureDisable overlayfs "rebase" capability when running in user namespace ()
featureFix transfer plugin error when EROFS differ is configured but mkfs.erofs is unavailable ()
otherPrepare release notes for v2.3.1 ()
other58af96519 Prepare release notes for v2.3.1
other8f0b3ca83 Update api to v1.11.1
otheroci: return explicit error for out-of-range USER values ()
othera05ae7885 oci: return explicit error for out-of-range USER values
otherPrepare release notes for api/v1.11.1 ()
otherda7aef299 Prepare release notes for api/v1.11.1
fixFix sandbox task API endpoints for non-runc runtimes ()
other5282d4e09 Wire task address and version fields
othere44f5f9ec protos: include task API address to CreateTaskRequest
otherseccomp: Block AF_ALG in default socket policy ()
other4d80a31bf seccomp: Block AF_ALG in default socket policy
other2ed0d97b6 seccomp: Document socket rule scope and socketcall limitation
otherserver: tolerate failed gRPC plugins when starting listeners ()
other3a88fdde0 server: tolerate failed gRPC plugins when starting listeners
otheroverlay: disable "rebase" capability when running in UserNS ()
other2be0710b8 overlay: disable "rebase" capability when running in UserNS
otherUpdate Go to 1.26.3 ()
other3b199c22b Update Go to 1.26.3
fixfix: close boltdb on metadata and mount plugin close ()
other1d601271a fix: close boltdb on metadata and mount plugin close
fixFix optional EROFS differ setup in transfer plugin ()
otherd666d2e42 Refactor transfer unpack configuration setup
otherccc3bd7b9 Fix optional transfer differ setup
othergithub.com/containerd/containerd/api v1.11.0 -> v1.11.1
featureAdd transfer types for container filesystem copy ()
featureAdd option to inject trace ID to logs ()
featurePropagate OpenTelemetry traces in outgoing RPCs from plugin clients ()
featureUpdate plugin config migration to run on load ()
featureUpdate sandbox API to include spec field ()
featureAllow containers to use user namespaces with host networking ()
featureWire UpdatePodSandboxResources to Sandbox API ()
featureUnpack images with per-layer labels for specific runtime ()
featurePopulate ImageId field in container status ()
featureSet annotations parameter in CreateSandbox request ()
featureAdd background stats collector to calculate UsageNanoCores for containers and pod sandboxes ()
featureSupport zstd-wrapped EROFS layers ()
featureAdd os.features support for EROFS native container images ()
featureAdd EROFS layer media type ()
featureAdd dmverity support to the erofs snapshotter ()
featureUse fsmount API to avoid PAGE_SIZE limit for erofs ()
featurePass container user (uid, gids) to plugins ()
featurePass seccomp policy to plugins ()
featurePass any POSIX rlimits to plugins ()
featurePass extended container status to NRI. ()
featurePass injected CDI devices to plugins ()
featurePass linux sysctl to plugins ()
featureUse dedicated RPC calls for all pod and container life-cycle events via the NRI wire protocol (containerd/nri#274)
featureAdd basic metrics collection for the NRI framework (containerd/nri#277)
featureExchange NRI versions between plugins and the runtime during registration (containerd/nri#271)
featureEnable adjusting Linux memory policy from NRI plugins (containerd/nri#166)
featureClose plugins if initial synchronization fails to prevent unregistered connections (containerd/nri#279)
featureAccumulate owners for OCI hook adjustments, disallowing commas in plugin names (containerd/nri#264)
featureAdd nri_no_wasm build tag to allow disabling WASM support at compile time (containerd/nri#253)
featureSupport direct adjustment of the intelRdt container configuration (containerd/nri#215)
featureAllow setting kernel scheduling policy attributes via NRI (containerd/nri#160)
featureAllow adjusting Linux network devices via NRI (containerd/nri#157)
featureAdd support for sysctl adjustment via NRI (containerd/nri#248)
featureExpose container user, group, and supplemental group IDs to plugins (containerd/nri#230)
featureAdd configured socket directory to shim bootstrap protocol ()
featureIntroduce shim bootstrap protocol ()
featureFix binary logging driver not blocking container start on failure ()
featureUse new filtered cgroups stats API ()
featureUpdate OOMKilled event handling ()
deprecatedDeprecate shim.Command ()
+76 more items in the release notessecurityCVE-2026-95839
securityGHSA-5p7c-hggf-c748
securityGHSA-8647-2jxj-p2rc
securityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureAvoid hang and data corruption during multipart image fetch ()
featureApply hardening to reject image references with ".." path components ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
otherPrepare release notes for v2.2.10 ()
other27d59fe59 Prepare release notes for v2.2.10
otherUpdate to go1.26.9 ()
othercb4648a80 Update to go1.26.9, remove go1.25.12
other6fe70e5cc Merge commit from fork
other70c8ae49e remotes/docker: bound parallel fetch readers
otheraff52a508 Merge commit from fork
other2455fec2f images: skip malformed digests when computing referrer labels
other32fc74497 Merge commit from fork
other5f8c507a2 content, remotes: bound reads to expected size
other14da554b2 Merge commit from fork
otherc3b7534ed cri: unmount checkpoint view on every CRImportCheckpoint return path
otherSkip critest OOMKilled testcase for systemd cgroup ()
othera47da7e9b script/critest.sh: always skip OOMKilled on systemd cgroup
other32c566557 *: skip critest OOMKilled testcase for systemd cgroup
othermultipart fetch stability fixes ()
other5dde40350 multipart fetch stability fixes
fixintegration/client: fix TestContainerExecLargeOutputWithTTY ()
fix7dff2d997 integration/client: fix TestContainerExecLargeOutputWithTTY
othercri: should not follow log file ()
othera5e41909a cri: should not follow log file
otherreference: reject .. path components that rewrite the host ()
other4f71fd9b0 reference: reject .. path components that rewrite the host
othercore/unpack: don't honor id-mapping labels from image annotations ()
other4b3494a8d core/unpack: tighten comments around id-mapping label filtering
other076598878 core/unpack: don't honor id-mapping labels from image annotations
featureseccomp: Use an allow-list for socket domains ()
feature5ba51c0f2 seccomp: Use an allow-list for socket domains
otherConditional actions ()
otherfa5e5452e [CI] Prevents triggering of an inactive issue/PR check for forked repository.
breaking1c0d72890 Makefile: remove go mod download from integration
+2 more items in the release notessecurityCVE-2026-53493
featureFix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ()
featureEnable mount manager for image mounts in CRI ()
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other60acf78bc5 Prepare release notes for v2.2.9
other253f9cc140 Merge commit from fork
other053c0cc412 Bound Walk references
otherefd11fc9c2 Bound Dispatch concurrency and references
othercri: tolerate wrapped ENOTSUP during relabel ()
other39d0dd4b43 cri: tolerate wrapped ENOTSUP during relabel
otherpkg/oci: mask thermal interrupt info ()
otherbaffef9669 pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other9e1ae6a9e9 core/unpack: fetch layers of every config-sharing manifest
othercri: Backport image mount fixes 2.2 ()
other2cdf8d80cc cri: only unmount image volumes when mounting fails
other2e1dcc5da0 cri: enable mount manager for image mounts
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureFix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ()
featureFix EROFS snapshot creation failure caused by concurrent snapshot removal ()
other4864b1814 Prepare release notes for v2.2.8
other3458b7fd3 Merge commit from fork
other22ccf4314 cri: cancel ExecSync IO drain on context cancellation
other2bf01ce17 Merge commit from fork
other45166eb82 archive: skip redundant opaque whiteout walks
otherSet SystemTemp env var to config temp on Windows ()
other2c722ad04 Set SystemTemp env var to config temp on Windows
otherpkg/oci: resolve rootfs symlinks for user lookup ()
other196664bc0 pkg/oci: resolve rootfs symlinks for user lookup
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other6da9d9528 core/remotes/docker: normalize descriptor URL origins
other4f7851699 core/remotes/docker: strip sensitive headers on desc.urls fetch
othersnapshots/erofs: protect snapshot staging from cleanup ()
otherf7075a224 snapshots/erofs: protect snapshot staging from cleanup
securityFixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context
featureDisable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ()
featureDeprecate checkpoint restore in CreateContainer ()
featureSupport non-UTF-8 binary environment variable values in CRI ()
featureDisable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ()
featureEnable OCI runtime feature introspection for non-runc runtimes in CRI ()
featureEnable log scrubbing by default on Windows ()
featureFix mount manager activation error when activation already exists ()
other43f299db6 Prepare release notes for v2.2.7
othercri: disable restore in CreateContainer by default ()
other5c3a47036 cri: disable restore in CreateContainer by default
otherUse ScrubLogs by default on Windows ()
feature4c93ae6d5 ctr: add --scrub-logs flag for Windows
othera124c7e35 cri/config: use ScrubLogs by default on Windows
deprecatedcri: deprecate restore in CreateContainer ()
deprecatedc59d041d8 cri: deprecate restore in CreateContainer
otherHandle []byte envvar value for CRI ()
other6cdc2ddce Handle []byte envvar value
othera60898833 update to v0.34.x kubernetes dependencies
fixFix mount manager activation error when already exists ()
fix54ecff6ca core/mount: Fix mount manager activation error when already exists
otherDisable checkpoint restore codepath when CRIU is not installed ()
otherfd966ba29 github/workflows: install criu in node-e2e
feature7d41b25c9 cri: add enable_criu configuration option
other48116fa59 cri: validate CRIU availability and version early
fixfix(cri): introspect OCI runtime features for non-runc runtimes ()
other6a3d14e8a fix(cri): introspect OCI runtime features for non-runc runtimes
otherci: bound Go fuzzing by execution count ()
other424b714f0 ci: bound Go fuzzing by execution count
othergo.opentelemetry.io/otel v1.38.0 -> v1.41.0
othergo.opentelemetry.io/otel/metric v1.38.0 -> v1.41.0
othergo.opentelemetry.io/otel/trace v1.38.0 -> v1.41.0
othergoogle.golang.org/protobuf v1.36.10 -> f2248ac996af
otherk8s.io/api v0.34.1 -> v0.34.10
otherk8s.io/apimachinery v0.34.1 -> v0.34.10
otherk8s.io/client-go v0.34.1 -> v0.34.10
otherk8s.io/cri-api v0.34.1 -> v0.34.10
featureFix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ()
featureReject CreateContainer calls when the target sandbox is not running ()
featureEnsure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ()
featureLimit fallback to /blobs endpoint during ref resolution to prevent content store pollution ()
otherPrepare release notes for v2.2.6 ()
other701734d2f Prepare release notes for v2.2.6
otherCI: migrate Vagrant to Lima ()
other672ea355f CI: migrate Vagrant to Lima
otherUpdate go to 1.26.5/1.25.12 ()
otherd7eba3f42 Update go to 1.26.5/1.25.12
otherci: pin fog-json to resolve gem conflict ()
other8f123e4f7 ci: pin fog-json to resolve gem conflict
fixFix nil pointer dereference in NRI GetIPs ()
otherd3e1a2be9 Fix nil pointer dereference in NRI GetIPs
othercri: reject CreateContainer when sandbox is not running ()
other872a9502e cri: reject CreateContainer when sandbox is not running
featureAdd defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ()
featureba7605ee7 Add deferred call to ShutdownSandbox to avoid leaks
fixfix: avoid content storage pollution by limiting the fallback on ref resolution ()
other36c4275ee fix:avoid content storage pollution by limiting the fallback on ref resolution
securityCVE-2026-50195
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
otherPrepare release notes for v2.2.5 ()
other269031099 Prepare release notes for v2.2.5
otherad59aa564 Merge commit from fork
other0b4d23690 Merge commit from fork
otherbe8460656 cri: filter CDI annotations on checkpoint restore
other347240f72 Merge commit from fork
othercff578841 cri: do not re-tag restored checkpoints
other668cf2c2f Merge commit from fork
other357652293 cri: make checkpoint restore robust to unexpected archive content
otherd43da05af Merge commit from fork
other30708e8d1 Bound user-database file reads in openUserFile
other028647ea2 Merge commit from fork
otherb6072a49f Do not propagate reserved labels from image configs
othervendor: golang.org/x/crypto v0.53.0 ()
othercfea2c141 [release/2.2] vendor: golang.org/x/crypto v0.53.0
otherupdate runc binary to v1.3.6 ()
otherfc96ea6b3 update runc binary to v1.3.6
otherupdate go to 1.26.4/1.25.11 ()
other5a125fd66 update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
other2b7dfbd7f Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
other1500e586f Clean up disk space in node e2e workflow
othercontrib/checkpoint: increase timeouts to 30s ()
other9991e944e contrib/checkpoint: increase timeouts to 30s
otherrelease: don't mark 2.2 releases as latest ()
other55a1f85d5 release: don't mark 2.2 releases as latest
othergolang.org/x/crypto v0.45.0 -> v0.53.0
othergolang.org/x/mod v0.29.0 -> v0.36.0
othergolang.org/x/net v0.47.0 -> v0.55.0
othergolang.org/x/sync v0.18.0 -> v0.21.0
othergolang.org/x/sys v0.38.0 -> v0.46.0
othergolang.org/x/term v0.37.0 -> v0.44.0
othergolang.org/x/text v0.31.0 -> v0.38.0
securityCVE-2026-46680
securityCVE-2026-34986
otherUse mount manager during image volume processing to support snapshotters that require writable block volumes (e.g., EROFS) ()
fixFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
otherApply hardening to block AF_ALG in default socket policy ()
fixFix bugs in sandbox service affecting sandbox creation configuration and event publishing ()
otherSet AppArmor abi conditionally to support versions < 3.0 ()
otherDisable overlay "rebase" capability when running in a user namespace to fix layer extraction failures ()
otherSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
otherWei Fu
otherAkihiro Suda
otherChris Henzie
otherPaweł Gronowski
otherSamuel Karp
otherBrian Goff
otherChamp-Goblem
otherChris Chang
otherLEI WANG
otherPhil Estes
otherWilliam Myers
otheroci: return explicit error for out-of-range USER values ()
otherd20c6267b oci: return explicit error for out-of-range USER values
otherseccomp: Block AF_ALG in default socket policy ()
otherdb34dc4b4 seccomp: Block AF_ALG in default socket policy
other214b141ee seccomp: Document socket rule scope and socketcall limitation
otherupdate Go to 1.25.10, 1.26.3 ()
otherc2b1856fa update Go to 1.25.10, 1.26.3
otheroverlay: disable "rebase" capability when running in UserNS ()
other63874d262 overlay: disable "rebase" capability when running in UserNS
otherSupport both styles of volatile mount option ()
other2c7d48acf Support both styles of volatile mount option
securityBump go-jose/go-jose to v4.1.4 to fix GHSA-78h2-9frx-2jm8 ()
security80311db63 chore: update go-jose for CVE-2026-34986
othersandbox: forward Create fields, fix event topics ()
othercaa29a741 sandbox: forward Create fields, fix event topics
otherapparmor: Set abi conditionally ()
other5ab0a1206 apparmor: Set abi conditionally
otherParameterize K8s version in node-e2e workflow ()
otherf9c34f7b1 Parameterize K8s version in node-e2e workflow
othercri: use mount manager when image has volumes ()
+4 more items in the release notessecurityCVE-2026-35469
featurePreserve cgroup mount options for privileged containers ()
featureEnsure UpdatePodSandbox returns Unimplemented instead of a generic error ()
featureHandle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 ()
featureEnable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) ()
featureApply hardening to prevent TOCTOU race during tar extraction ()
featureRestore support for client-mounted roots in Windows containers using process isolation ()
featureUpdate runc to v1.3.5 ()
featureApply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems ()
featureFix bug that caused whiteouts to be ignored when parallel unpack was used ()
otherPrepare release notes for v2.2.3 ()
other8a0f4ed5d Prepare release notes for v2.2.3
otherupdate github.com/moby/spdystream v0.5.1 ()
other31bd34a06 update github.com/moby/spdystream v0.5.1
othervendor: github.com/klauspost/compress v1.18.5 ()
other1336f6c45 vendor: github.com/klauspost/compress v1.18.5
otherdiff/walking: enable mount manager ()
other409f75be8 diff/walking: enable mount manager
otherupdate runhcs to v0.14.1 ()
other3f33146c1 update runhcs to v0.14.1
othervendor: github.com/Microsoft/hcsshim v0.14.1 ()
other8bd1b74e5 vendor: github.com/Microsoft/hcsshim v0.14.1
otherc6b0be8e1 vendor: github.com/Microsoft/hcsshim v0.14.0
otherupdate to Go 1.25.9, 1.26.2 ()
other2ecde8cfe update to Go 1.25.9, 1.26.2
otherSkip TestExportAndImportMultiLayer on s390x ()
otherbe554f478 Skip TestExportAndImportMultiLayer on s390x
otherTweak mount info for overlayfs in case of parallel unpack ()
other660de195b Tweak mount info for overlayfs in case of parallel unpack
featurebc9274a4b Add integration test for issue 13030
featurec387890b5 Add integration test for privileged container cgroup mounts
other047a335a6 Forward RUNC_FLAVOR env var down to integration tests
other9b2d72ee0 Preserve host cgroup mount options for privileged containers
other5b66cd6a0 Move cgroup namespace placement higher in spec builder
otherupdate runc binary to v1.3.5 ()
fixFix vagrant on CI ()
fixFix TOCTOU race bug in tar extraction ()
fixfbed68b8f Fix TOCTOU race bug in tar extraction
fixfix(oci): apply absolute symlink resolution to /etc/group ()
fixfix(oci): handle absolute symlinks in rootfs user lookup ()
+12 more items in the release notesfeatureFix migrated CRI image config when using legacy registry mirrors ()
featureUnpack images with per-layer labels for runtime-specific snapshotters ()
featureFix CNI issue where DEL is never executed after a restart ()
featureHarden error handling to strip potentially-sensitive registry parameters ()
featureFix nil pointer dereference in container spec memory metrics when memory constraints are not fully configured ()
featureUse the specified runtime handler when pulling images ()
featureReduce noisy CDI logs ()
featureFix regression for pulling encrypted images ()
featureFix unintended dropping of mount flags for read-only bind-mounts in user namespaces ()
featureFix AppArmor bug disallowing unix domain sockets on newer kernels ()
featureFix ctr image mount failing with "no such device" ()
otherPrepare release notes for v2.2.2 ()
other7e6ecf434 Prepare release notes for v2.2.2
othera20dead7c set default config_path in plugin init
othera5f83d8c2 cri: unpack images with per-layer labels for runtime-specific snapshotters
otherci: modprobe xt_comment on almalinux ()
other68855cb0b ci: modprobe xt_comment on almalinux
featureef7a8beb3 core/mount: add test for getUnprivilegedMountFlags
fix07b2cc07e core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
feature54101116f add integration test for cni result nil
otherd44c4384e address comment
fixf1835270b fix issue where cni del is never executed
other6c05047b4 apparmor: explicitly set abi/3.0
otherci: add build/test go1.26.0, drop go1.24 ()
other5dbf1b915 update golangci-lint to v2.9.0 with go1.26 support
other8ec695ebe remove windows/arm from cross build
otherb9c22a6e3 ci: build/test go1.26.0
fixintegration: Fix TestImageLoad() failure on CI ()
fix09b876a81 integration: Fix TestImageLoad() failure on CI
fixcri: Fix image volumes with user namespaces ()
fix172ba65b6 cri: Fix image volumes with user namespaces
otherupdate to go1.24.13, go1.25.7 ()
otherb4240ef87 update to go1.24.13, go1.25.7
other94dbfaea7 ci: bump go 1.24.12, 1.25.6
otherci: set fetch-depth for containerd to 0 for version parsing ()
othere46a7a286 set fetch-depth for containerd to 0 for version parsing
fix1d7908273 core/mount/manager: fix bind mount missing rbind option
feature3d509bcd3 core/mount/manager: add tests for WithTemporary option
othercb3ae2119 fix: sanitize error before gRPC return to prevent credential leak in pod events
otherbump google.golang.org/grpc from 1.76.0 to 1.78.0 ()
+18 more items in the release notesfeatureRedact all query parameters in CRI error logs ()
featureFix image defaults on Darwin to usable configuration ()
featureFix possible panic from WithMediaTypeKeyPrefix ()
featureUpdate runc binary to v1.3.4 ()
featureFix parsing of hugetlb..events files (containerd/cgroups#379)
securityc22cf5d49 cri,nri: pass any linux security profile to plugins.
breakingpkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const ()
breaking58d23ab63 pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const
breaking73a08aa00 go.mod: remove exclude rules
breakingcore/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor ()
breakinged19c5420 core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor
featureRevert "Implement io.ReaderAt on docker fetch reader" ()
feature678f944dd Revert "Implement io.ReaderAt on docker fetch reader"
featureadaptation: allow compiling out WASM support altogether. (containerd/nri#253)
featureab88fe6 adaptation: allow compiling out WASM support altogether.
breaking8c0c9f6 Implement removal of RDT
featuredfbae8a plugins: add sample rdt plugin
featured05dd81 pkg/adaptation: support new RDT fields
feature725289b pkg/runtime-tools/generate: support new RDT fields
featurea7832a2 api: add rdt
featurepkg/api: add OptionalRepeatedString type (containerd/nri#212)
feature687c1a6 pkg/api: add OptionalRepeatedString type
featureapi,adaptation,generate: allow setting kernel scheduling policy attributes. (containerd/nri#160)
feature6a371ac device-injector: add scheduling policy adjustment.
featuree06369e api,adaptation,generate: allow setting scheduler attributes.
featureapi,adaptation,generate: allow adjusting linux net devices (containerd/nri#157)
feature5145c92 device-injector: add network device injection.
feature8a03823 api,adaptation,generate: allow adjusting linux net devices.
featureAdd support for sysctl adjustment (containerd/nri#248)
feature8705f9b api: add sysctl container adjustment
featurefeat: Make logger a configurable struct member for stub (containerd/nri#239)
feature71b0335 api,adaptation: add container uid/gid info.
featurecontrib: add example for enabling per-container RDT monitoring (containerd/nri#228)
feature91fbf06 contrib: add example for enabling per-container RDT monitoring
feature1a50ff5 Add nolint directives
feature00fa1a1 Add and fix comments for exported types
featureac21da7 pkg/api/seccomp: add comments for exported functions
breaking3aff986 pkg/runtime-tools/generate: remove embedded field "Generator"
featurec0c4bb6 pkg/api/validate: add comments for exported methods
featurec0ba9da adaptation/builtin: add comment for exported symbols
+133 more items in the release notessecurityFixes CVE-2026-46680: containerd user ID handling bypass allows runAsNonRoot evasion
securityFixes CVE-2025-64329: Host memory exhaustion through goroutine leaks of Attach functionality in CRI server
securityFixes CVE-2024-25621: Local privilege escalation via wide permissions on several directories
featureAdd mount manager () The mount manager is a new service that provides lifecycle management for filesystem mounts to support more advanced use cases, such as:
featureDevice formatting to create formatted filesystems (xfs, ext4) on-demand
featureMount activation to prepare devices such as loopbacks or network fileystems
featureMount transformation to allow mount arguments to be filled in dynamically from previous mounts
featureGarbage collection of mounts to ensure temporary mounts are never leaked
featureAdd conf.d include in the default config ()
featureAdd support for back references in the garbage collector ()
featurePod Sandbox Metrics () Full implementation of Kubernetes CRI pod-level metrics API
featureListPodSandboxMetrics: Query metrics for running pods/sandboxes
featureListMetricsDescriptors: Discover available metrics and their descriptions
featureSupport image volume mount subpath ()
featureUpdate pkg/oci to use fs.FS interface and os.OpenRoot ()
featureParallel Unpack () Adds support for unpacking layers in parallel during pull operations. This feature is supported with overlayfs and EROFS snapshotters.
featureOCI Referrers Support () Adds new referrers fetcher to remote registry interface using the new referrers endpoint added in OCI distribution-spec 1.1
featureTar unpack progress through transfer service ()
featureEROFS enhancements using mount manager () Improvements to EROFS snapshotter using the new mount manager service
featureQuota Support: Support for sized block devices as the upper layer for overlayfs
featureMount Lifecycle: Loopback setup, block device creation, and overlayfs argument formatting is moved to the mount manager to be performed on-demand or within the runtime.
featureMount handler: To allow optimization of EROFS mount types based on the current system
featuremacOS Support: EROFS snapshotter can now be used on Darwin to natively allow image pulls
featureTar index mode: Efficiently generate EROFS metadata backed by original tar content ()
featureAdd snapshotter and differ for block CIMs ()
featureEnable otel traces in NRI ()
featureAdd WASM plugin support (containerd/nri#121)
featureImprove shim load time after restart by loading in parallel ()
featureFix pidfd leak in UnshareAfterEnterUserns ()
deprecatedDeprecate cgroup v1 ()
deprecatedPostpone v2.2 deprecation items to v2.3 ()
featuregithub.com/StackExchange/wmi cbe66965904d new
featuregithub.com/go-ole/go-ole v1.2.6 new
featuregithub.com/google/certtostore v1.0.6 new
featuregithub.com/google/deck 105ad94aa8ae new
featuregithub.com/hashicorp/errwrap v1.1.0 new
featuregithub.com/knqyf263/go-plugin v0.9.0 new
featuregithub.com/moby/sys/capability v0.4.0 new
featuregithub.com/tetratelabs/wazero v1.9.0 new
featurego.uber.org/goleak v1.3.0 new
+59 more items in the release notessecurityCVE-2026-50195
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
otherPrepare release notes for v2.1.9 ()
otherb8b3a86e9 Prepare release notes for v2.1.9
otheree965da63 Merge commit from fork
otherb5e0c4733 Merge commit from fork
other02045fd46 cri: filter CDI annotations on checkpoint restore
othere9c26cf3c Merge commit from fork
other2e4583a9f cri: do not re-tag restored checkpoints
other6e4ec908a Merge commit from fork
other570e69884 cri: make checkpoint restore robust to unexpected archive content
other3788b4b9e Merge commit from fork
other290420fa7 Bound user-database file reads in openBoundedUserFile
otherbc5014f45 Merge commit from fork
other429bcb924 Do not propagate reserved labels from image configs
otherupdate runc binary to v1.3.6 ()
other698f2fd66 update runc binary to v1.3.6
otherupdate go to 1.26.4/1.25.11 ()
otherb8b75a90e update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
other22515b56f Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
otheraf88d4f60 Clean up disk space in node e2e workflow
other[github-action] release - Empty allowedSignersFile ()
other06df49576 release - Empty allowedSignersFile
securityCVE-2026-46680
featureFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
featureFix bugs in sandbox service affecting sandbox creation configuration and event publishing ()
featureSet AppArmor abi conditionally to support versions < 3.0 ()
featureSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
otherPrepare release notes for v2.1.8 ()
other07f2265d4 Prepare release notes for v2.1.8
otheroci: return explicit error for out-of-range USER values ()
other2054cc54c oci: return explicit error for out-of-range USER values
otherSupport both styles of volatile mount option ()
other677e8f08a Support both styles of volatile mount option
otherbackport: sandbox: forward Create fields, fix event topics ()
otherf3b4b35c9 sandbox: forward Create fields, fix event topics
otherapparmor: Set abi conditionally ()
othereba90da61 apparmor: Set abi conditionally
featureAdd GitHub Action for k8s node e2e tests ()
featureb8b110584 Add GitHub Action for k8s node e2e tests
securityCVE-2026-35469
featurePreserve host cgroup mount options for privileged containers ()
featureFix image volumes when using user namespaces in CRI ()
featureFix issue where CNI DEL was never executed after a restart ()
featureHardening: sanitize errors before returning via gRPC to prevent possible credential leaks in pod events ()
featureEnable options for pulling encrypted images in CRI ()
featureFix possible panic from WithMediaTypeKeyPrefix ()
featureUpdate runc binary to v1.3.5 ()
featureHardening: fix possible TOCTOU race bug in tar extraction ()
featureFix unintended dropping of mount flags for read-only bind-mounts in user namespaces ()
featureExplicitly set AppArmor ABI to 3.0 ()
otherPrepare release notes for v2.1.7 ()
other3a06b6847 Prepare release notes for v2.1.7
otherupdate github.com/moby/spdystream v0.5.1 ()
other82910b8c1 update github.com/moby/spdystream v0.5.1
otherupdate to Go 1.25.9, 1.26.2 ()
other295bdbbff update to Go 1.25.9, 1.26.2
otherSkip TestExportAndImportMultiLayer on s390x ()
other8d0c87494 Skip TestExportAndImportMultiLayer on s390x
fixfe316cc1f remotes: fix possible panic from WithMediaTypeKeyPrefix
otherPreserve cgroup mount options for privileged containers ()
featurec5ee417ab Add integration test for privileged container cgroup mounts
othera5d5a70ed Forward RUNC_FLAVOR env var down to integration tests
other515c7f98d Preserve host cgroup mount options for privileged containers
otherffd9b61c9 Move cgroup namespace placement higher in spec builder
fixFix vagrant on CI ()
fixFix TOCTOU race bug in tar extraction ()
fixaecfb3dc6 Fix TOCTOU race bug in tar extraction
breaking4ed50edce fix: ST1019: removed the duplicate imports
fixcri: Fix image volumes with user namespaces ()
fix8d5351929 cri: Fix image volumes with user namespaces
fixcore/mount: fix getUnprivilegedMountFlags iterating over indices instead of values ()
feature74e575ce8 core/mount: add test for getUnprivilegedMountFlags
fixc62466642 core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
fixFix CNI issue where CNI DEL is never executed ()
fix9710aed4a fix issue where cni del is never executed
fixintegration: Fix TestImageLoad() failure on CI ()
fix51a63212f integration: Fix TestImageLoad() failure on CI
fixfix: sanitize error before gRPC return to prevent credential leak in pod events ()
featureUncomment call to add options for pulling encrypted images ()
+49 more items in the release notesfeatureUpdate runc binary to v1.3.4 ()
otherPrepare release notes for v2.1.6 ()
other93f79087a Prepare release notes for v2.1.6
othergo.mod: containerd/zfs v2.0.0 ()
other7e75db3a9 build(deps): bump github.com/containerd/zfs/v2 from 2.0.0-rc.0 to 2.0.0
othercri/nri: short-circuit nil adjustment. ()
other2b8e11b12 cri/nri: short-circuit nil adjustment.
othergo.mod: github.com/containernetworking/plugins v1.9.0 ()
other69efd067c go.mod: github.com/containernetworking/plugins v1.9.0
breakinggo.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) ()
othere81678853 go.mod: golang.org/x/crypto v0.45.0
other55a2d8c8d CI: drop Go 1.23
otherfd8e3c39b Update Go requirements in BUILDING
breakingcore/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor ()
breakinga4454c49a core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor
other251f0a285 runc: Update runc binary to v1.3.4
otherci: bump Go 1.24.11, 1.25.5 ()
otherc07c29bca ci: bump Go 1.24.11, 1.25.5
othere52817652 ci: bump Go 1.24.10, 1.25.4
other04bbb66e4 ci(release): set GO_VERSION in Dockerfile
otherci: update CIFuzz actions to support Ubuntu 24.04 ()
other492987ccc ci: update CIFuzz actions to support Ubuntu 24.04
otherbuild(deps): bump github.com/opencontainers/selinux ()
other55a25ec6e build(deps): bump github.com/opencontainers/selinux
otherRedact all query parameters in CRI error logs ()
otherb72d0dfe0 fix: redact all query parameters in CRI error logs
otherUpdate 2.1 branch to no longer build as latest ()
otherecd58bd65 Update 2.1 branch to no longer build as latest
otheruse windowsMatchComparer for OSVersion match order (containerd/platforms#25)
other8c0d9f9 use windowsMatchComparer for OSVersion match order
featureAdd WS2025 to Windows matcher and code optimizations (containerd/platforms#24)
other8447b0a Update ci.yml
feature4549974 Add WS2025 to Windows matcher and code optimizations
othergithub.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
othergithub.com/containerd/zfs/v2 v2.0.0-rc.0 -> v2.0.0
othergithub.com/containernetworking/plugins v1.7.1 -> v1.9.0
othergithub.com/coreos/go-systemd/v22 v22.5.0 -> v22.6.0
featuregithub.com/cyphar/filepath-securejoin v0.5.1 new
othergithub.com/go-logr/logr v1.4.2 -> v1.4.3
othergithub.com/opencontainers/selinux v1.12.0 -> v1.13.1
+9 more items in the release notessecurityGHSA-pwhc-rpq9-4c8w
securityGHSA-m6hq-p25p-ffr2
securityGHSA-qw9x-cqr3-wc7r
securityGHSA-cgrx-mc8f-2prm
securityGHSA-9493-h29p-rfm2
featureDisable event subscriber during task cleanup ()
featureAdd SystemdCgroup to default runtime options ()
featureFix userns with container image VOLUME mounts that need copy ()
featureEnsure errContentRangeIgnored error when range-get request is ignored ()
featureUpdate runc binary to v1.3.3 ()
deprecatedPostpone v2.2 deprecation items to v2.3 ()
otherPrepare release notes for v2.1.5 ()
otherfc5bdfeac Prepare release notes for v2.1.5
otherc578c26bf Update mailmap
other46a4a03fb Merge commit from fork
other232786c90 Fix directory permissions
other239ab877d Merge commit from fork
other0766796e8 fix goroutine leak of container Attach
other3d713d3d0 runc: Update runc binary to v1.3.3
otherUpdate GHA runners to use latest images for basic binaries build ()
otherde4221cb7 Update GHA runners to use latest images for basic binaries build
otherci: bump Go 1.24.9, 1.25.3 ()
other2045b1920 ci: bump Go 1.24.9, 1.25.3
otherUpdate GHA runners to use latest image for most jobs ()
other21ec7cc7d Update GHA runners to use latest image for most jobs
deprecated6374a8f9d Postpone v2.2 deprecation items to v2.3
fixFix lost container logs from quickly closing io ()
fix7d9f09ba0 bugfix:fix container logs lost because io close too quickly
breakingRemove additional fuzzers from instrumentation repo ()
featureupdate release builds to 1.24.7 and add 1.25.1 to CI ()
featurec54585ba7 update release builds to 1.24.7 and add 1.25.1 to CI
featuref13f8c431 add SystemdCgroup to default runtime options
feature10944e19f integration: Add test for directives with userns
fix41d74aee2 cri: Fix userns with Dockerfile VOLUME mounts that need copy
fixFix overlayfs issues related to user namespace ()
featureAdd documentation for cgroup_writable field ()
feature4832b4d15 Add documentation for cgroup_writable field
fixfix: create bootstrap.json with 0644 permission ()
fixsys: fix pidfd leak in UnshareAfterEnterUserns ()
fix5ef6ea747 sys: fix pidfd leak in UnshareAfterEnterUserns
+23 more items in the release notesfeatureFix containerd panic when sandbox extension is missing ()
featureUpdate status response to return stable order for runtime handlers ()
featureFix lazy gRPC connection mode waiting for connect on client creation ()
featureFix resolve deadlock issue in docker fetcher open ()
featureUpdate erofs snapshotter to make immutable optional ()
featureFix erofs filesystem UUID for tar-converted layers ()
featureFix close container io not closed when runtime create failed ()
otherPrepare release notes for v2.1.4 ()
feature112e41363 Add release notes for v2.1.4
otheradd2dcf86 Ensure fetcher always closes body and properly calls release
other34a1cb1dd fix(dockerFetcher): resolve deadlock issue in dockerFetcher open
otherci: bump Go 1.23.11, 1.24.5 ()
other82c4d6875 ci: bump Go 1.23.11, 1.24.5
otherBackport windows test fixes ()
other6cc2a8d77 Fix intermittent test failures on Windows CIs
fix6adc69312 Remove WS2025 from CIs due to regression
other8d194c19f erofs-snapshotter: make IMMUTABLE_FL optional
feature2df7175d7 client/New: Don't unlazy the gRPC connection implicitly
otherbackport: update go-md2man binary to v2.0.7 ()
other4902adb92 update go-md2man binary to v2.0.7
other02298e1a0 cri:fix containerd panic when can't find sandbox extension
fix583133e71 erofs-differ: fix filesystem UUID for tar-converted layers
other57db13d50 Amend runtime handler test for stable order
otherd822c9048 CRI: Stable sort for RuntimeHandlers
othera2fd70639 Test showing RuntimeHandlers in Status() are unordered
fixb74268f86 bugfix:close container io when runtime create failed
featureFix multipart fetch issue when the server does not return content length ()
featureUpdate transfer service supported platforms logic ()
featureFix import for local transfer service ()
featureFix registry errors with transfer service ()
featureFix fetch always adding range to requests ()
featureUpdate fetcher errors to include full registry error ()
otherPrepare release notes for v2.1.3 ()
other627729341 Prepare release notes for v2.1.3
other7636bd5eb fix when multipart fetching and the server does not return content length
other3c5ede878 Update transfer supported platforms logic
otherfb752bc8e fix import for local transfer service
otherf6d926314 Register remote errors for clients to access registry errors
other7c1813345 Decode grpc errors in the transfer client proxy
otherbabacebad Fix fetch always adding range to requests
otherf30be44ad Update fetcher errors to include full registry error
featureFix check of wrapped errors in erofs snapshotter ()
featureImprove mount error message ()
featureFix transfer differ selection ()
featureEnable DuplicationSuppressor in transfer service ()
featureProperly shutdown non-groupable shims to prevent resource leaks ()
otherPrepare release notes for v2.1.2 ()
other63b9eae62 Prepare release notes for v2.1.2
othercff1feb28 *: properly shutdown non-groupable shims to prevent resource leaks
otherci: bump golang [1.23.10,1.24.4] in build and release ()
other2ce169aae ci: bump golang [1.23.10,1.24.4] in build and release
otherBackport Enable CIs to run on WS2022 and WS2025 ()
other70bcb9b55 Enable CIs to run on WS2022 and WS2025
othercri:use debug level when receive exec process exited events ()
other40575a15f cri:use debug level when receive exec process exited events
otherbuild(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.2 ()
otherc71f77170 build(deps): bump google.golang.org/grpc from 1.72.0 to 1.72.2
other4bcea74de Update differ selection in transfer service to prefer default
feature0c3cd8a99 Add debug log when transfer returns not implemented
feature820e56765 Add more error details when unpack fails to extract
otherFetch image with default platform only in TestExportAndImportMultiLayer ()
other9b6c1949a Fetch image with default platform only in TestExportAndImportMultiLayer
fix480126f50 erofs-snapshotter: fix to work with wrapped errors
otherd82921ff5 Enable DuplicationSuppressor in transfer service
otherci: bump golang [1.23.9, 1.24.3] in build and release ()
other0bb25c3d6 ci: bump golang [1.23.9, 1.24.3] in build and release
otherac8e84efc client:improve mount error message
featureAdd symlink breakout test for overriden path ()
featuredd2ce49d0 Add symlink breakout test for overriden path
othergoogle.golang.org/grpc v1.72.0 -> v1.72.2
securityThe first patch release for containerd 2.1 fixes a critical vulnernability (CVE-2025-47290) which was first introduced in 2.1.0. See the Github Advisory for more details. This release also contains a few smaller updates and bux fixes.
featureFix erofs media type handling ()
featureReduce shim cleanup log level and add more context ()
deprecatedUpdate removal version for deprecated registry config fields ()
othercb1076646 Merge commit from fork
other216667ba0 Prepare release notes for 2.1.1
otherac00b8e61 Revert "perf(applyNaive): avoid walking the tree for each file in the same directory"
otherbuild(deps): bump github.com/Microsoft/hcsshim ()
other444ca17cd update runhcs version to v0.13.0
other0684f1c44 build(deps): bump github.com/Microsoft/hcsshim
othere1817a401 docs/snapshotters/erofs.md: a tip for improved performance
fix2168cb92c erofs-differ: fix EROFS native image support
other7fcbc3c46 core/runtime/v2: cleanup shim-cleanup logs
deprecated37d6c4236 Update removal version for deprecated registry config fields
otherctr:make sure containerd socket exist before create client ()
othere7be076d4 ctr:make sure containerd socket exist before create client
othergithub: mark 2.1 releases as latest ()
otherc90524d5f .github: mark 2.1 releases as latest
othergithub.com/Microsoft/hcsshim v0.13.0-rc.3 -> v0.13.0
securityFixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
featureAdd no_sync option to boost boltDB performance on ephemeral environments ()
featureAdd content create event ()
featureErofs snapshotter and differ ()
featureUpdate CRI to use transfer service for image pull by default ()
featureSupport multiple cni plugin bin dirs ()
featureSupport container restore through CRI/Kubernetes ()
featureAdd OCI/Image Volume Source support ()
featureEnable Writable cgroups for unprivileged containers ()
featureFix recursive RLock() mutex acquisition (containerd/go-cni#126)
featureSupport CNI STATUS Verb (containerd/go-cni#123)
featureRetry last registry host on 50x responses ()
featureMultipart layer fetch ()
featureEnable HTTP debug and trace for transfer based puller ()
featureAdd support for unpacking custom media types ()
featureAdd dial timeout field to hosts toml configuration ()
featureExpose Pod assigned IPs to NRI plugins ()
featureSupport multiple uid/gid mappings ()
featureFix race between serve and immediate shutdown on the server (containerd/ttrpc#175)
breakingUpdate FreeBSD defaults and re-organize platform defaults ()
deprecatedPostpone cri config deprecations to v2.2 ()
deprecatedRemove deprecated dynamic library plugins ()
deprecatedRemove the support for Schema 1 images ()
othergithub.com/Microsoft/hcsshim v0.12.9 -> v0.13.0-rc.3
othergithub.com/cilium/ebpf v0.11.0 -> v0.16.0
othergithub.com/containerd/cgroups/v3 v3.0.3 -> v3.0.5
othergithub.com/containerd/containerd/api v1.8.0 -> v1.9.0
othergithub.com/containerd/continuity v0.4.4 -> v0.4.5
othergithub.com/containerd/go-cni v1.1.10 -> v1.1.12
othergithub.com/containerd/imgcrypt/v2 v2.0.0-rc.1 -> v2.0.1
othergithub.com/containerd/otelttrpc ea5083fda723 -> v0.1.0
othergithub.com/containerd/platforms v1.0.0-rc.0 -> v1.0.0-rc.1
othergithub.com/containerd/ttrpc v1.2.6 -> v1.2.7
othergithub.com/containerd/typeurl/v2 v2.2.2 -> v2.2.3
othergithub.com/containernetworking/cni v1.2.3 -> v1.3.0
othergithub.com/containernetworking/plugins v1.5.1 -> v1.7.1
othergithub.com/containers/ocicrypt v1.2.0 -> v1.2.1
featuregithub.com/petermattis/goid 4fcff4a6cae7 new
featuregithub.com/sasha-s/go-deadlock v0.3.5 new
featuregithub.com/smallstep/pkcs7 v0.1.1 new
+58 more items in the release notessecurityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
other30145a48d Prepare release notes for v2.0.14
othereaae6434c Merge commit from fork
other21fd0a996 content, remotes: bound reads to expected size
otherSkip critest OOMKilled testcase for systemd cgroup ()
othereb878c296 script/critest.sh: always skip OOMKilled on systemd cgroup
other95be879a5 *: skip critest OOMKilled testcase for systemd cgroup
fixintegration/client: fix TestContainerExecLargeOutputWithTTY ()
fix9101dc4e3 integration/client: fix TestContainerExecLargeOutputWithTTY
other16e119c17 ci:fix ci TestContainerExecLargeOutputWithTTY panic
othercri: should not follow log file ()
other85b6459b2 cri: should not follow log file
othercore/unpack: don't honor id-mapping labels from image annotations ()
other1e0b4964e core/unpack: tighten comments around id-mapping label filtering
other6e9229820 core/unpack: don't honor id-mapping labels from image annotations
featureseccomp: Use an allow-list for socket domains ()
feature1183551f1 seccomp: Use an allow-list for socket domains
otherConditional actions ()
other29ab0dcca [CI] Prevents triggering of an inactive issue/PR check for forked repository.
breaking23c28d68c Makefile: remove go mod download from integration
other4b3976166 ci: skip linters steps in private repositories
otherdb335dfa0 workflows: skip non-CI jobs in private forks
securityCVE-2026-53493
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other87c035016f Prepare release notes for v2.0.13
other9bb64e7024 Merge commit from fork
other2dbcee240e Bound Walk references
othera2e7a37e0c Bound Dispatch concurrency and references
otherpkg/oci: mask thermal interrupt info ()
other16ba4910fe pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other6850f41724 core/unpack: fetch layers of every config-sharing manifest
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureSurface OCI error bodies in registry 403 responses by falling back to GET requests ()
featureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureEnable log scrubbing by default on Windows ()
otherd6a01e72a Prepare release notes for v2.0.12
other2e964db90 Merge commit from fork
othereebea8c4c cri: cancel ExecSync IO drain on context cancellation
otherd93c158a6 Merge commit from fork
other6c060c952 archive: skip redundant opaque whiteout walks
otherSet SystemTemp env var to config temp on Windows ()
other56058341c Set SystemTemp env var to config temp on Windows
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other88c95d56d core/remotes/docker: normalize descriptor URL origins
other7711c3d21 core/remotes/docker: strip sensitive headers on desc.urls fetch
otherUse ScrubLogs by default on Windows ()
feature84c6caa67 ctr: add --scrub-logs flag for Windows
other5fcdfaab2 cri/config: use ScrubLogs by default on Windows
otherci: bound Go fuzzing by execution count ()
otherb452f2856 ci: bound Go fuzzing by execution count
otherCI: migrate Vagrant to Lima ()
othera15448870 CI: migrate Vagrant to Lima
otherremotes: surface OCI error body on HEAD 403 via GET fallback ()
other71a73c8a0 remotes: surface OCI error body on HEAD 403 via GET fallback
featureLimit fallback to /blobs endpoint during ref resolution to prevent content store pollution ()
otherPrepare release notes for v2.0.11 ()
other24a2ac9db Prepare release notes for v2.0.11
otherUpdate go to 1.26.5/1.25.12 ()
other8f0774f1a Update go to 1.26.5/1.25.12
otherci: pin fog-json to resolve gem conflict ()
otherf89266ecb ci: pin fog-json to resolve gem conflict
fixfix: avoid content storage pollution by limiting the fallback on ref resolution ()
other179b642d6 fix:avoid content storage pollution by limiting the fallback on ref resolution
securityCVE-2026-53488
securityCVE-2026-47262
otherPrepare release notes for v2.0.10 ()
othercbbd21672 Prepare release notes for v2.0.10
other200a4005f Merge commit from fork
otherda4098647 Merge commit from fork
other03a19324f Bound user-database file reads in openBoundedUserFile
other126177ea4 Merge commit from fork
otherbbf4a2b8e Do not propagate reserved labels from image configs
otherupdate runc binary to v1.3.6 ()
othera15e98122 update runc binary to v1.3.6
otherba2ed2a5e [release/2.2] update runc binary to v1.3.5
other474184497 runc: Update runc binary to v1.3.4
otherupdate go to 1.26.4/1.25.11 ()
otherbecbb802e update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
other55bdc8bc5 Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
other6d81e8867 Clean up disk space in node e2e workflow
securityCVE-2026-46680
otherEnsure container exit events are not lost during containerd restart ()
otherApply hardening to avoid TOCTOU race in tar extraction ()
fixFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
otherApply hardening to block AF_ALG in default socket policy ()
otherSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
fixFix bugs in sandbox service affecting sandbox creation configuration and event publishing ()
otherSet AppArmor abi conditionally to support versions < 3.0 ()
otherSamuel Karp
otherChris Henzie
otherMaksym Pavlenko
otherPaweł Gronowski
otherWei Fu
otherBrian Goff
otherLEI WANG
otherShachar Tal
otherWilliam Myers
otherningmingxiao
other2da65b8bd Prepare release notes for v2.0.9
otheroci: return explicit error for out-of-range USER values ()
other1a3d1c85e oci: return explicit error for out-of-range USER values
otherseccomp: Block AF_ALG in default socket policy ()
otherfa2a97505 seccomp: Block AF_ALG in default socket policy
other4b2b07879 seccomp: Document socket rule scope and socketcall limitation
otherSupport both styles of volatile mount option ()
otherea56c9605 Support both styles of volatile mount option
otherbackport: sandbox: forward Create fields, fix event topics ()
other3d34dc820 sandbox: forward Create fields, fix event topics
otherapparmor: Set abi conditionally ()
other4b260843e apparmor: Set abi conditionally
featureAdd GitHub Action for k8s node e2e tests ()
feature3e9c4d1e0 Add GitHub Action for k8s node e2e tests
fixFix TOCTOU race bug in tar extraction ()
fixcf73e6873 Fix TOCTOU race bug in tar extraction
othercri:fix lost container exit events if they arrive before info is cached ()
other2320b319e cri:fix lost container exit events if they arrive before info is cached
othercontainerd---.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
othercontainerd-static---.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.
securityCVE-2026-35469
featureSanitize error before gRPC return to prevent possible credential leak in pod events ()
featureFix CNI issue where DEL is never executed after a restart ()
featureUpdate selinux to v1.13.1 ()
otherPrepare release notes for v2.0.8 (missed line) ()
otherc07b94f19 Prepare release notes for v2.0.8 (missed line)
otherPrepare release notes for v2.0.8 ()
otherc54b69f1a Prepare release notes for v2.0.8
otherupdate github.com/moby/spdystream v0.5.1 ()
otherfde1480df update github.com/moby/spdystream v0.5.1
otherupdate to Go 1.25.9, 1.26.2 ()
other5b2eee8a2 update to Go 1.25.9, 1.26.2
otherc579db16e update golangci-lint to v2.9.0 with go1.26 support
other185ddcfd0 remove windows/arm from cross build
other8538158df Ignore warnings for golangci-lint bump
other1cff32695 ci: bump golangci from 6.5.2 to 7.0.0
otherUpdating selinux to v1.13.1 ()
other2e02b8bb3 Skip github.com/cyphar/filepath-securejoin license checks
othere71fc560b Updating selinux to v1.13.1
fixfix: sanitize error before gRPC return to prevent credential leak in pod events ()
other868869eb9 fix: sanitize error before gRPC return to prevent credential leak in pod events
other40632e4f2 fix: redact all query parameters in CRI error logs
otherCODEOWNERS: mark Sam and Chris as owners for 2.0 ()
other85c3b2b02 CODEOWNERS: mark Sam and Chris as owners for 2.0
otherUpdate github.com/moby/spdystream v0.4.0->v0.5.0 ()
other902d804c9 Update github.com/moby/spdystream v0.4.0->v0.5.0
fixFix CNI issue where CNI DEL is never executed ()
othere92d7b131 make linter happy in release
feature12fc0e6ca add integration test for cni result nil
other8d912c6a2 address comment
fix742f8b8f6 fix issue where cni del is never executed
otherCherry-picks to fix CI ()
otherf24653597 Ignore NOCHANGE error
other9c656fab4 ci: update CIFuzz actions to support Ubuntu 24.04
fixc71c4a091 integration: Fix TestImageLoad() failure on CI
otherbfee29999 ci: modprobe xt_comment on almalinux
featuregithub.com/cyphar/filepath-securejoin v0.5.1 new
othergithub.com/moby/spdystream v0.4.0 -> v0.5.1
othergithub.com/opencontainers/selinux v1.11.1 -> v1.13.1
securityGHSA-pwhc-rpq9-4c8w
securityGHSA-m6hq-p25p-ffr2
securityGHSA-qw9x-cqr3-wc7r
securityGHSA-cgrx-mc8f-2prm
securityGHSA-9493-h29p-rfm2
featureDisable event subscriber during task cleanup ()
featureAdd SystemdCgroup to default runtime options ()
featureFix userns with container image VOLUME mounts that need copy ()
featureAdd dial timeout field to hosts toml configuration ()
featureUpdate runc binary to v1.3.3 ()
featureFix lost container logs from quickly closing io ()
featureCreate bootstrap.json with 0644 permission ()
featureFix pidfd leak in UnshareAfterEnterUserns ()
otherPrepare release notes for v2.0.7 ()
other4931e24f1 Prepare release notes for v2.0.7
other205bc4f2d Update mailmap
other5f708b76a Merge commit from fork
other8cd112d82 Fix directory permissions
other05290b5bc Merge commit from fork
other4d1edf4ad fix goroutine leak of container Attach
otherb46dc6a67 runc: Update runc binary to v1.3.3
otherci: bump Go 1.24.9; 1.25.3 ()
other5e9c82178 Update GHA runners to use latest images for basic binaries build
other7f59248dc Update GHA runners to use latest image for most jobs
othere1373e8a8 ci: bump Go 1.24.9, 1.25.3
othere1a910a6a ci: bump Go 1.24.8; 1.25.2
otherfd04b7f17 move exclude-dirs to issues.exclude-dirs
otherb49377975 update golangci-lint to v1.64.2
other6e45022a1 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
other09ce0f2a1 build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
fixf953ee8a3 bugfix:fix container logs lost because io close too quickly
breakingRemove additional fuzzers from instrumentation repo ()
feature427cdd06c add SystemdCgroup to default runtime options
feature3212afc2f integration: Add test for directives with userns
fixb855c6e10 cri: Fix userns with Dockerfile VOLUME mounts that need copy
fixFix overlayfs issues related to user namespace ()
fix5bec0a332 sys: fix pidfd leak in UnshareAfterEnterUserns
fixFix windows test failures ()
fix018470948 Remove WS2025 from CIs due to regression
featureb50cbbc98 Add dial timeout field to hosts toml configuration
+21 more items in the release notesfeatureUpdate containerd config dump to reflect plugin config migrations ()
featureFix containerd panic when sandbox extension is missing ()
featureFix the panic caused by the failure of RunPodSandbox ()
featureAdd extension to sandbox metadata store on create sandbox ()
featureFix issue where Prometheus metric names changed for CRI ()
featureFix issue preventing some v2 shims from shutting down properly ()
featureFix lazy gRPC connection mode waiting for connect on client creation ()
featureFix cross-repo mount fallback after authorization failure ()
featureFix container io to close after runtime create failure ()
featureFix incompatibility with some pre-v3 shims ()
featureUpdate runc binary to v1.3.0 ()
otherPrepare release notes for v2.0.6 ()
otherd94b0fee6 Prepare release notes for v2.0.6
otherci: bump Go 1.23.11, 1.24.5 ()
otherf901e3c81 ci: bump Go 1.23.11, 1.24.5
othergo.mod: golang.org/x/* latest ()
other7e4ac4761 go.mod: golang.org/x/* latest
featurebed6d1401 client/New: Don't unlazy the gRPC connection implicitly
other8094fa21a cri:fix containerd panic when can't find sandbox extension
fix552f717be bugfix:close container io when runtime create failed
fixc4394d05a Fix the panic caused by the failure of RunPodSandbox
otherci: bump golang [1.23.10, 1.24.4] in build and release ()
other54f923a30 ci: bump golang [1.23.10, 1.24.4] in build and release
other2de777dfe ci: bump golang [1.23.9, 1.24.3] in build and release
otherEnable CIs to run on WS2022 and WS2025 ()
other9724cd5ea Enable CIs to run on WS2022 and WS2025
other7fc3151fc *: properly shutdown non-groupable shims to prevent resource leaks
other4396336a1 core/runtime: should invoke shim binary
other10bcc6929 Revert "not set sandbox id when use podsandbox type"
featuref38eb62b6 integration: add testcase to recover ungroupable shim
other2358561d5 Update release upgrade tests to test 1.7 and 2.0
other8931b1464 Fix upgrade test runtime config
otherFetch image with default platform only in TestExportAndImportMultiLayer ()
otherfc9235910 Fetch image with default platform only in TestExportAndImportMultiLayer
otherf8679737e store extension when create sandbox in store
othercbfa66223 fix(docker pusher): if authorizing a cross-repo mount fails, fall back
othergithub: do not mark 2.0 releases as latest ()
other7bf4d0a40 .github: do not mark 2.0 releases as latest
otherfa5a08244 Update runc binary to v1.3.0
otherRevert "disable portmap test in ubuntu-22 to make CI happy" ()
+19 more items in the release notessecurityFixes CVE-2025-47291: containerd CRI plugin: Incorrect cgroup hierarchy assignment for containers running in usernamespaced Kubernetes pods.
featureUpdate go to 1.23.8 ()
featureUpdate ImageService to delete images synchronously ()
featurePrevent panic on zero length push ()
featureSet default differ for the default unpack config of transfer service ()
featureRemove invalid error log when stopping container after containerd restart ()
featureUpdate taskOptions based on runtimeOptions when creating a task ()
other5bcf0a95e use go1.23.8 as the default go version
other4838f33f7 update to go 1.24.2, 1.23.8
otherPrepare release notes for v2.0.5 ()
othera8082cd60 Prepare release notes for v2.0.5
otherDisable criu test on arm64 ()
other58b715ad8 Disable arm64 criu testing in GH Actions
otherb4a53e826 disable portmap test in ubuntu-22 to make CI happy
feature4bcf472de add option to skip tests in critest
other8a638b71a Prevent panic in Docker pusher.
other84d9658c3 Set default differ for the default unpack config of transfer service
otherci: update GitHub Actions release runner to ubuntu-24.04 ()
otherb184a97d3 ci: update GitHub Actions release runner to ubuntu-24.04
othere04543db0 use shimCtx for fifo copy
feature9f46e7a44 integration/client: add tests for TaskOptions is not empty
other8a16a6a04 prefer task options for PluginInfo request
othera183b2d23 update taskOptions based on runtimeOptions when creating a task
other091143135 *: CRIImageService should delete image synchronously
otherUpdate runc binary to v1.2.6 ()
otherc2372c072 Update runc binary to v1.2.6
othergo.{mod,sum}: bump CDI deps to stable v1.0.0. ()
othere8506511b go.{mod,sum}: bump CDI deps to stable v1.0.0.
othersilence govulncheck false positives ()
other4cfb89430 go.mod: github.com/go-jose/go-jose/v4
other2b9e6a29d go.mod: golang.org/x/oauth2 v0.28.0
other6df1ea0d9 go.mod: golang.org/x/net v0.37.0
fixFix CI lint error (cherry-picked #11555) ()
other16f20abdf Fix CI lint error
othergithub.com/go-jose/go-jose/v4 v4.0.4 -> v4.0.5
othergolang.org/x/crypto v0.31.0 -> v0.36.0
othergolang.org/x/net v0.33.0 -> v0.37.0
othergolang.org/x/oauth2 v0.23.0 -> v0.28.0
othergolang.org/x/sync v0.10.0 -> v0.12.0
othergolang.org/x/sys v0.28.0 -> v0.31.0
+4 more items in the release notessecurityFix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
featureRespect client.WithTimeout option on connect ()
featureUpdate image type checks to avoid unnecessary logs for attestations ()
featureFix incorrect runtime name being passed to NRI ()
other1a43cb6a1 Merge commit from fork
other07a0b5419 (cherry picked from commit de1341c201ffb0effebbf51d00376181968c8779)
otherPrepare release notes for v2.0.4 ()
other06a886a8e Prepare release notes for v2.0.4
other6b5efba83 client: Respect client.WithTimeout option
other916d48722 core/remotes: Handle attestations in MakeRefKey
otherdf4d905a6 core/images: Ignore attestations when traversing children
feature4f037050c add name in package version
otherupdate build to go1.23.7, test go1.24.1 ()
othere5ad0d0a0 update build to go1.23.7, test go1.24.1
otherdocs: include note about unprivileged sysctls ()
othera39f1146b docs: include note about unprivileged sysctls
othere2e: use the shim bundled with containerd artifact ()
other81b3384a0 e2e: use the shim bundled with containerd artifact
otherbuild(deps): bump containerd/project-checks from 1.1.0 to 1.2.1 ()
other7215a7d2c build(deps): bump containerd/project-checks from 1.1.0 to 1.2.1
featureUpdate remote content to break up writes to avoid grpc message size limits ()
featureUpdate runc binary to v1.2.5 ()
featureFix privileged container sysfs can't be rw because pod is ro by default ()
featureFix recursive RLock() mutex acquisition (containerd/go-cni#126)
featureFix initial sync race when registering NRI plugins ()
otherPrepare release notes for v2.0.3 ()
otherb8dde9189 Prepare release notes for v2.0.3
othereaa7ca80d proxy: break up writes from the remote writer to avoid grpc limits
otherc7f64196f Fix privileged container sysfs can't be rw because pod is ro by default
othergo.{mod,sum}: bump CDI deps to v.0.8.1. ()
other92ae2951f Update CDI dependency to v0.8.1.
otherPrefer runtime options for PluginInfo request ()
other569af34cb Prefer runtime options for PluginInfo request
otherpkg: prevent oom watcher from depending on shim pkg ()
other0ce93e16a prevent oom watcher depend on shim pkg.
otherCI: arm64-8core-32gb -> ubuntu-24.04-arm ()
otherf3284aa68 CI: arm64-8core-32gb -> ubuntu-24.04-arm
featureRevert "Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG" ()
featureb5313993c Revert "Add timestamp to PodSandboxStatusResponse for kubernetes Evented PLEG"
othermove the device after the options when using mkfs.ext4 ()
otherf95a426b8 move the device after the options when using mkfs.ext4
otherupdate build to go1.23.6, test go1.24.0 ()
other4d19a6adf update build to go1.23.6, test go1.24.0
otherbuild(deps): bump actions/cache from 4.1.2 to 4.2.0 ()
otherc738c3aab build(deps): bump actions/cache from 4.1.2 to 4.2.0
securityUpgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 ()
otherfcf64305c Update vendor files to fix build failure
otherd3437eb29 Upgrade x/net to 0.33.0
featureUpdate install-imgcrypt to allow change install repo ()
feature0785bd8cc Update install-imgcrypt to allow change install repo
other697c59c63 Update runc binary to v1.2.5
otherUpdate go-cni version to fix Race Condition issue ()
other06891f899 fix go-cni race condition
other79cdbf61b cri,nri: block NRI plugin sync. during event processing.
otherUpdate github.com/containerd/imgcrypt to v2.0.0 ()
other9d5cfce83 Update github.com/containerd/imgcrypt to v2.0.0
deprecatedf58939c33 Remove deprecated WithCDIDevices in oci spec opts
featuregithub.com/petermattis/goid 4fcff4a6cae7 new
featuregithub.com/sasha-s/go-deadlock v0.3.5 new
featuregithub.com/smallstep/pkcs7 v0.1.1 new
+20 more items in the release notesfeatureRemove confusing warning in cri runtime config migration ()
featureFix runtime platform loading in cri image plugin init ()
featureUpdate runc binary to v1.2.4 ()
otherPrepare release notes for v2.0.2 ()
othercdaf4dfb4 Prepare release notes for v2.0.2
otherUpdate platforms to latest rc ()
othereb125e1dd Update platforms to latest rc
other468079c5c Remove confusing warning in cri runtime config migration
othera2d9d4fd5 Fix runtime platform loading in cri image plugin init
othermake sure console master tty is closed on task exit ()
feature184ffad01 Add integ test to check tty leak
other17181ed33 fix master tty leak due to leaking init container object
otherBump up otelttrpc to 0.1.0 ()
other8666e7422 Bump up otelttrpc to 0.1.0
fixctr: ctr images import --all-platforms: fix unpack ()
fixc4270430d ctr: ctr images import --all-platforms: fix unpack
other7373ddd70 update runc binary to v1.2.4
otherdowngrade go-difflib and go-spew to tagged releases ()
otherf34147772 downgrade go-difflib and go-spew to tagged releases
featureAdd a build tag to disable std plugin import ()
featuredca769485 chore: add a build tag to disable containerd plugin import
otherUpdate golangci to 1.60.3 ()
other5942b3fcb Update golangci to 1.60.3
featureAdd dependabot and upgrade golang and dependency versions (containerd/otelttrpc#3)
other2d46141 upgrade golang, deps, CI versions
feature64922e7 Add dependabot CI
fixFix concurrent map panic on metadata (containerd/otelttrpc#2)
other2ba3be1 Fix concurrent map panic on inject metadata
otherf50a922 UT for concurrent inject/extract metadata
otherMove windows matcher logic so all platforms can use (containerd/platforms#22)
other7c58292 Move windows matcher logic so all platforms can use
otherreplace testify with stdlib in tests (containerd/platforms#21)
other86a86b7 replace testify with stdlib in tests
otherReplace arm64 minor variant logic with lookup table (containerd/platforms#18)
other364665a Replace arm64 minor variant logic with lookup table
featureAdd MD.Clone function (containerd/ttrpc#177)
feature430f734 Add MD.Clone
fixserver: fix a Serve() vs. (immediate) Shutdown() race (containerd/ttrpc#175)
fixc4d96d5 server: fix Serve() vs. immediate Shutdown() race.
featureed6c3ba server_test: add Serve()/Shutdown() race test.
+6 more items in the release notesfeatureFix apply IoOwner options when not in user namespace ()
featureFix cri grpc plugin config migration ()
featureSupport CNI STATUS Verb (containerd/go-cni#123)
featureUpdate differ to handle zstd media types ()
featureUpdate runc binary to v1.2.3 ()
featureFix panic due to nil dereference cgroups v2 ()
otherPrepare release notes for v2.0.1 ()
otherb0ece5dc5 Prepare release notes for v2.0.1
otherbuild(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0 ()
otherfe6957084 build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0
otherupdate xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+ ()
othereb2ce6882 update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+
otherctr pull should unpack for default platform when transfer service is used ()
other44cdca68b ctr pull unpack for default platform using transfer service
other018d83650 internal/cri: should not apply IoOwner options
otherUpdate go-cni for CNI STATUS ()
other5eb7995a9 feat: update go-cni version for CNI STATUS
featurea2302ea89 Add integration test for custom configuration
otherbe5eda069 complete cri grpc config migration
othera53eff53d update runc binary to v1.2.3
other73f57acb0 Update differ to handle zstd media types
otherupdate to go1.23.4 / go1.22.10 ()
other290e8bc70 update to go1.23.4 / go1.22.10
otherCI: update Fedora to 41 ()
other62b790bfa CI: update Fedora to 41
other3ba2df924 fix panic due to nil dereference cgroups v2
otherPublish attestation as release artifact ()
other34a45cab2 Publish attestation as release artifact
otherMove rockylinux 9.4 to almalinux/9 in CI ()
other7dec6b460 move rocky 9.4 to almalinux/9 in CI
other*: should align pipe's owner with init process ()
othercf07f28ee *: should align pipe's owner with init process
fixfix: set the credentials even if not provided ()
other986088866 fix: set the credentials even if not provided
fixfsverity_test.go: fix nil pointer derefence, fix test fail, fix minor/major device numbers resolving ()
fix30b929ece fsverity_test.go: fix major/minor device number resolving
fix10996a334 fsverity_test.go: fix nil pointer dereference, fix test fail
otherupdate runc binary to 1.2.2 ()
fixfsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems ()
fixa7f2b562f fsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems
+19 more items in the release notesfeatureAllow sections of Plugins to be merged, and not overwritten as entire sections. ()
featureAdd Update API for sandbox controller ()
featureConfigure otel from env instead of config.toml ()
featureEnable NRI by default ()
featureAdd PluginInfo to introspection API ()
featureRemove overlayfs volatile option on temp mounts ()
featureExpose usage of deprecated features ()
featureUse Intel ISA-L's igzip if available ()
featureIntroduce top level config migration ()
featureAdd image delete target ()
featureRemove LimitNOFILE from containerd.service ()
featureAdd support for image expiration during garbage collection ()
featureReduce the contention between ref lock and boltdb lock in content store ()
featureRemove "containerd.io/restart.logpath" label ()
featureRemove aufs snapshotter ()
featureFix deadlock during NRI plugin registration (containerd/nri#79)
featureSupport arm64/v9 and minor variants (containerd/platforms#8)
featureFix deadlock when writing to pipe blocks (containerd/ttrpc#168)
featureGenerate attestation for artifacts during release ()
featureRemove cri-containerd-*.tar.gz release bundles ()
featureUse 'UserSpecifiedImage' from CRI to set the image-name annotation ()
featureFine-grained SupplementalGroups control ()
featureAdd support to set loopback to up ()
featureKEP-3857: Recursive Read-only (RRO) mounts ()
featureAdd support for multiple subscribers to CRI container events ()
featureEnable CDI by default ()
featureRemove non-sandboxed CRI implementation ()
featureAdd support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ()
featureUse sandboxed CRI by default ()
featureImplement RuntimeConfig CRI call ()
featureAdd support for user namespaces (KEP-127) ()
featureRemove CRI v1alpha2 ()
security[medium] RAPL accessible to a container GHSA-7ww5-4wqc-m92c
breakingRemove disable_cgroup from CRI config ()
breakingMove client to subpackage ()
deprecatedUpdate warnings for deprecated CRI config fields ()
deprecatedAdd type alias for event Envelope ()
deprecatedPostpone removal of deprecated CRI config properties ()
deprecatedDeprecate go-plugin configuration option ()
deprecatedCNI conf_template in CRI is no longer deprecated ()
+146 more items in the release notessecurityCVE-2026-53493
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
otherb0ab39c205 Prepare release notes for v1.7.36
other670a5de22f Merge commit from fork
othera3a39e5873 Bound Walk references
otherffc673f859 Bound Dispatch concurrency and references
otherpkg/oci: mask thermal interrupt info ()
other19334a4d7e pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other4684c683c2 core/unpack: fetch layers of every config-sharing manifest
feature7fba9f7c3c Create new imagetest package
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureEnable log scrubbing by default on Windows ()
other05aa78da3 Prepare release notes for v1.7.35
other3bd79bb36 Merge commit from fork
other5a2a3a759 cri: cancel ExecSync IO drain on context cancellation
other323e148f2 Merge commit from fork
other9205b1903 archive: skip redundant opaque whiteout walks
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
otherb01d66349 core/remotes/docker: normalize descriptor URL origins
otherb5d936dca core/remotes/docker: strip sensitive headers on desc.urls fetch
otherUse ScrubLogs by default on Windows ()
featurecff94ea40 ctr: add --scrub-logs flag for Windows
other544e4657d cri/config: use ScrubLogs by default on Windows
otherci: bound Go fuzzing by execution count ()
other71e00ba9c ci: bound Go fuzzing by execution count
featureFix lost container exit events when events arrive before container info is cached ()
otherPrepare release notes for v1.7.34 ()
other7db112471 Prepare release notes for v1.7.34
otherUpdate go to 1.26.5/1.25.12 ()
otherc06144c85 Update go to 1.26.5/1.25.12
otherci: pin fog-json to resolve gem conflict ()
otherb84460e50 ci: pin fog-json to resolve gem conflict
othercri:fix lost container exit events if they arrive before info is cached ()
other2fe076ea7 cri:fix lost container exit events if they arrive before info is cached
otherbuild(deps): bump golang.org/x/* dependencies ()
other862057716 bump golang.org/x/* dependencies
othergolang.org/x/crypto v0.45.0 -> v0.52.0
othergolang.org/x/mod v0.29.0 -> v0.35.0
othergolang.org/x/net v0.47.0 -> v0.55.0
othergolang.org/x/sync v0.18.0 -> v0.20.0
othergolang.org/x/sys v0.38.0 -> v0.45.0
othergolang.org/x/term v0.37.0 -> v0.43.0
othergolang.org/x/text v0.31.0 -> v0.37.0
securityCVE-2026-53488
securityCVE-2026-47262
securityCVE-2026-34986
otherPrepare release notes for v1.7.33 ()
other7517e6737 Prepare release notes for v1.7.33
otherab306518a Merge commit from fork
otherd34cdafda Merge commit from fork
other9ab2b7a89 Bound user-database file reads in openBoundedUserFile
other1e9806f90 Merge commit from fork
other4d8ba4d23 Do not propagate reserved labels from image configs
otherupdate runc binary to v1.3.6 ()
other74c728c13 update runc binary to v1.3.6
otherupdate go to 1.26.4/1.25.11 ()
other947caa4b7 update go to 1.26.4/1.25.11
otherConfigure udevd children-max for root-test ()
othere884e964e Configure udevd children-max for root-test
otherClean up disk space in node e2e workflow ()
otherb9e756888 Clean up disk space in node e2e workflow
securityBump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 ()
security4dfc1844e Bump go-jose to v3.0.5 to address CVE-2026-34986
othergithub.com/go-jose/go-jose/v3 v3.0.4 -> v3.0.5
securityCVE-2026-46680
featureAllow hosts.toml to contain only root-level fields without an explicit [host] section ()
fixFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
otherApply hardening to block AF_ALG in default socket policy ()
otherSupport both "volatile" and "fsync=volatile" mount options for volatile snapshotter ()
otherSet AppArmor abi conditionally to support versions < 3.0 ()
otherMaksym Pavlenko
otherChris Henzie
otherDerek McGowan
otherPaweł Gronowski
otherSamuel Karp
otherWei Fu
otherBrad Davidson
otherBrian Goff
otherLEI WANG
otherPhil Estes
otherbc87d865c Prepare release notes for v1.7.32
otheroci: return explicit error for out-of-range USER values ()
other503f47946 oci: return explicit error for out-of-range USER values
otherseccomp: Block AF_ALG in default socket policy ()
othere55b747d3 seccomp: Block AF_ALG in default socket policy
other4627a65f8 seccomp: Document socket rule scope and socketcall limitation
fixFix issue with empty host tree in hosts.toml ()
other24007441d Fix error parsing hosts.toml without any host tree
otherSupport both styles of volatile mount option ()
other940733149 Support both styles of volatile mount option
otherapparmor: Set abi conditionally ()
other2b732c892 apparmor: Set abi conditionally
featureAdd GitHub Action for k8s node e2e tests ()
feature0db1e143a Add GitHub Action for k8s node e2e tests
otherUpdate release process after 1.7 ()
other3223a75c2 Update for latest updates to release tool
other1b30082eb Update release process after 1.7
securityCVE-2026-35469
featureFix CNI issue where DEL is never executed after a restart ()
featureSanitize error before gRPC return to prevent possible credential leak in pod events ()
featureImprove error message and add warning when concurrent container creation is detected ()
otherPrepare release notes for v1.7.31 ()
other7d2662653 Prepare release notes for v1.7.31
otherupdate github.com/moby/spdystream v0.5.1 ()
other3f795c02a update github.com/moby/spdystream v0.5.1
otherupdate to Go 1.25.9, 1.26.2 ()
other7b1e1b17b update to Go 1.25.9, 1.26.2
otherb673f2d42 update golangci-lint to v2.9.0 with go1.26 support
otherd88d8513a remove windows/arm from cross build
othera763407b5 Ignore warnings for golangci-lint bump
other03dcd8360 ci: bump golangci from 6.5.2 to 7.0.0
otherUpdate github.com/moby/spdystream v0.2.0->v0.5.0 ()
otherc08711218 Update github.com/moby/spdystream v0.2.0->v0.5.0
otherSkip TestExportAndImportMultiLayer on s390x ()
other043548f6d Skip TestExportAndImportMultiLayer on s390x
otherupdate runc binary to v1.3.5 ()
othere99bd6050 [release/1.7] update runc binary to v1.3.5
otherCODEOWNERS: mark Sam and Chris as owners for 1.7 ()
other3a3103aaf CODEOWNERS: mark Sam and Chris as owners for 1.7
fixFix vagrant on CI ()
other9b4cfa271 Ignore NOCHANGE error
otherci: modprobe xt_comment on almalinux ()
other53e9e73f0 ci: modprobe xt_comment on almalinux
fixFix TOCTOU race bug in tar extraction ()
fix61c2733fd Fix TOCTOU race bug in tar extraction
fixFix CNI issue where CNI DEL is never executed ()
fixf854c1890 fix issue where cni del is never executed
otherapparmor: explicitly set abi/3.0 ()
other5c091d92e apparmor: explicitly set abi/3.0
fixbackport: integration: Fix TestImageLoad() failure on CI ()
fix177ac10fe integration: Fix TestImageLoad() failure on CI
otherupdate to go1.24.13, go1.25.7 ()
other56da43d0f update to go1.24.13, go1.25.7
other5cb3cb9ba ci: bump go 1.24.12, 1.25.6
fixfix: sanitize error before gRPC return to prevent credential leak in pod events ()
otherb1fa03843 fix: sanitize error before gRPC return to prevent credential leak in pod events
othercri: emit warning for concurrent CreateContainer ()
+2 more items in the release notesfeatureFix NRI dropping requested CDI devices silently ()
featureRedact all query parameters in CRI error logs ()
featureUpdate runc binary to v1.3.4 ()
otherPrepare release notes for v1.7.30 ()
other3d0ca6d2e Prepare release notes for v1.7.30
other0bc74f47e cri,nri: don't drop requested CDI devices silently.
otherscript/setup/install-cni: install CNI plugins v1.9.0 ()
other7db16b562 script/setup/install-cni: install CNI plugins v1.9.0
breakinggo.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) ()
otherbca897b47 go.mod: golang.org/x/crypto v0.45.0
other37cbd2224 CI: drop Go 1.23
otheree49d1747 Update Go requirements in BUILDING
otherci: bump Go 1.24.11, 1.25.5 ()
other145978224 ci: bump Go 1.24.11, 1.25.5
other3dbadfaa1 ci: bump Go 1.24.10, 1.25.4
other2bac971f0 ci(release): set GO_VERSION in Dockerfile
other34b89a574 runc: Update runc binary to v1.3.4
otherci: update CIFuzz actions to support Ubuntu 24.04 ()
other6e0dd8956 ci: update CIFuzz actions to support Ubuntu 24.04
otherbuild(deps): bump github.com/opencontainers/selinux ()
other3eea2a4af build(deps): bump github.com/opencontainers/selinux
breakingremove sha256-simd ()
other1194f5128 remove sha256-simd
othergithub: skip 5 critest cases for window-2022 ()
otherce2d3a67f .github: skip 5 critest cases in window CI pipeline
other65271ea89 fix: redact all query parameters in CRI error logs
featuregithub.com/cyphar/filepath-securejoin v0.5.1 new
othergithub.com/opencontainers/selinux v1.11.0 -> v1.13.1
othergolang.org/x/crypto v0.40.0 -> v0.45.0
othergolang.org/x/mod v0.26.0 -> v0.29.0
othergolang.org/x/net v0.42.0 -> v0.47.0
othergolang.org/x/sync v0.16.0 -> v0.18.0
othergolang.org/x/sys v0.34.0 -> v0.38.0
othergolang.org/x/term v0.33.0 -> v0.37.0
othergolang.org/x/text v0.27.0 -> v0.31.0
securityGHSA-pwhc-rpq9-4c8w
securityGHSA-m6hq-p25p-ffr2
securityGHSA-qw9x-cqr3-wc7r
securityGHSA-cgrx-mc8f-2prm
securityGHSA-9493-h29p-rfm2
featureUpdate differ to handle zstd media types ()
featureUpdate runc binary to v1.3.3 ()
featureFix lost container logs from quickly closing io ()
other442cb34bd Merge commit from fork
other0450f046e Fix directory permissions
othere5cb6ddb7 Merge commit from fork
otherc575d1b5f fix goroutine leak of container Attach
otherPrepare release notes for v1.7.29 ()
other1fc2daaf3 Prepare release notes for v1.7.29
other3f5f9f872 runc: Update runc binary to v1.3.3
otherUpdate GHA images and bump Go 1.24.9; 1.25.3 ()
other667409fb6 ci: bump Go 1.24.9, 1.25.3
other294f8c027 Update GHA runners to use latest images for basic binaries build
othercf66b4141 Update GHA runners to use latest image for most jobs
otherfa3e6fa18 pkg/epoch: extract parsing SOURCE_DATE_EPOCH to a function
fixac334bffc pkg/epoch: fix tests on macOS
otherd04b8721f pkg/epoch: replace some fmt.Sprintfs with strconv
otherCI: update Fedora to 43 ()
other5cfedbf52 CI: update Fedora to 43
otherCI: skip ubuntu-24.04-arm on private repos ()
othercf99a012d CI: skip ubuntu-24.04-arm on private repos
otherrunc:Update runc binary to v1.3.1 ()
other4c77b8d07 runc:Update runc binary to v1.3.1
fixd30024db2 bugfix:fix container logs lost because io close too quickly
otherci: bump Go 1.24.8 ()
otherf4b3d96f3 ci: bump Go 1.24.8
other334fd8e4b update golangci-lint to v1.64.2
other8a67abc4c Drop inactivated linter exportloopref
othere4dbf08f0 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
otherd7db2ba06 build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
otherd7182888f build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
other4be6c7e3b build(deps): bump actions/cache from 4.1.2 to 4.2.0
othera2e097e86 build(deps): bump actions/checkout from 4.2.1 to 4.2.2
other6de404d11 build(deps): bump actions/cache from 4.1.1 to 4.1.2
other038a25584 [StepSecurity] ci: Harden GitHub Actions
+3 more items in the release notesfeatureRefresh OAuth tokens when they expire during registry operations ()
featureSet default differ for the default unpack config of transfer service ()
featureUpdate runc binary to v1.3.0 ()
featureRemove invalid error log when stopping container after containerd restart ()
otherPrepare release notes for v1.7.28 ()
otherb01b809f8 Prepare release notes for v1.7.28
otherci: bump Go 1.23.11, 1.24.5 ()
otherce2373176 ci: bump Go 1.23.11, 1.24.5
otherBackport windows test fixes ()
other3c06bcc4d Fix intermittent test failures on Windows CIs
fixc6c0c6854 Remove WS2025 from CIs due to regression
otherci: use fedora 39 archive ()
other6d7e021cf ci: use fedora/39-cloud-base image from archive
otherupdate runners to ubuntu 24.04 ()
otherc362e18cc CI: install OVMF for Vagrant
fix1d99bec21 CI: fix "Unable to find a source package for vagrant" error
featuredafa3c48d add debian sources for ubuntu-24
otherb03301d85 partial: enable ubuntu 24 runners
other13fbc5f97 update release runners to ubuntu 24.04
othergo.mod: golang.org/x/* latest ()
otherda5d1a371 go.mod: golang.org/x/* latest
breakingRemove additional fuzzers from instrumentation repo ()
other5fef123ba Remove additional fuzzers from CI
otherbackport windows runner and golang toolchain updates ()
othera35978f5a ci: bump golang [1.23.10, 1.24.4] in build and release
otherdf035aa3e ci: bump golang [1.23.9, 1.24.3] in build and release
other2a6d9fc71 use go1.23.8 as the default go version
other15d4d6eba update to go 1.24.2, 1.23.8
other1613a3b1a Enable CIs to run on WS2022 and WS2025
othertest: added runc v1 tests using vagrant ()
feature60e73122c test: added runc v1 tests using vagrant
otherRevert "disable portmap test in ubuntu-22 to make CI happy" ()
other10e1b515e Revert "Disable port mapping tests in CRI-in-UserNS"
other7a680e884 fix unbound SKIP_TEST variable error
othere5f8cc995 Revert "disable portmap test in ubuntu-22 to make CI happy"
otherb001469c7 Update runc binary to v1.3.0
othera6421da84 remotes/docker/authorizer.go: invalidate auth tokens when they expire.
other[CI] Fix vagrant ()
fixFix CI ()
featureb300fd37b add option to skip tests in critest
+27 more items in the release notessecurityFix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
featureUpdate image type checks to avoid unnecessary logs for attestations ()
other05044ec0a Merge commit from fork
other11504c3fc validate uid/gid
otherPrepare release notes for v1.7.27 ()
other1be04be6c Prepare release notes for v1.7.27
other82b5c43fe core/remotes: Handle attestations in MakeRefKey
other2c670e79b core/images: Ignore attestations when traversing children
otherupdate build to go1.23.7, test go1.24.1 ()
othera39863c9f update build to go1.23.7, test go1.24.1
breakingRemove hashicorp/go-multierror dependency and fix CI ()
other49537b3a7 e2e: use the shim bundled with containerd artifact
otherfe490b76f Bump up github.com/intel/goresctrl to 0.5.0
other13fc9d313 update containerd/project-checks to 1.2.1
other585699c94 Remove unnecessary joinError unwrap
other4b9df59be Remove hashicorp/go-multierror
othergo.{mod,sum}: bump CDI deps to v0.8.1. ()
other5ba28f8dc go.{mod,sum}: bump CDI deps to v0.8.1, re-vendor.
otherCI: arm64-8core-32gb -> ubuntu-24.04-arm ()
other85f10bd92 CI: arm64-8core-32gb -> ubuntu-24.04-arm
other561ed520e increase xfs base image size to 300Mb
othergithub.com/intel/goresctrl v0.3.0 -> v0.5.0
othergithub.com/prometheus/client_golang v1.14.0 -> v1.16.0
othergithub.com/prometheus/common v0.37.0 -> v0.42.0
othergithub.com/prometheus/procfs v0.8.0 -> v0.10.1
otherk8s.io/apimachinery v0.26.2 -> v0.27.4
othersigs.k8s.io/json f223a00ba0e2 -> bc3834ca7abd
othertags.cncf.io/container-device-interface v0.7.2 -> v0.8.1
othertags.cncf.io/container-device-interface/specs-go v0.7.0 -> v0.8.0
featureAdd support for syncfs after unpack ()
featureUpdate runc binary to v1.2.5 ()
featureFix race between serve and immediate shutdown on the server (containerd/ttrpc#175)
featureReject oversized messages from the sender (containerd/ttrpc#171)
featureFix fatal concurrency error in port forwarding ()
featureFix initial sync race when registering NRI plugins ()
featureAdd API support for reading Pod IPs (containerd/nri#119)
featureFix plugin sync to use multiple messages if ttrpc max message limit is hit (containerd/nri#111)
featureUpdate API to pass configured timeouts to plugins. (containerd/nri#109)
featureFix mount removal in adjustments (containerd/nri#107)
featureClose plugin if initial synchronization fails (containerd/nri#103)
featureAdd support for adjusting OOM score (containerd/nri#94)
featureAdd API support for NRI-native CDI injection (containerd/nri#98)
featureAdd support for pids cgroup (containerd/nri#76)
featureFix console TTY leak in runc shim ()
securityUpgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 ()
featureUpdate install-imgcrypt to allow change install repo ()
feature83eaab482 Update install-imgcrypt to allow change install repo
featurec3e24e024 Add integ test to check tty leak
feature07bfc18 wip: generate: add test for oom score adj
breakingdevice-injector: remove unreachable code. (containerd/nri#115)
breaking235aa11 chore: remove unreachable code and fmt files
feature6fd59d6 api: add support for multiple sync messages.
fix5fe9b06 mux: fix maximum allowed message size.
fixcfcd2af Makefile: fix ginkgo-tests target.
feature966ac92 adaptation: implement plugin synchronization blocks.
feature3880f1d adaptation: add test case for mount removal.
fix0d3b376 adaptation: fix mount removal in adjustments.
featurecodespell: add codespell config, workflow, fix spelling errors. (containerd/nri#105)
featuredf84c47 .github: add codespell workflow.
featurea03dc93 pkg,plugins,.codespellrc: add codespellrc, fix spelling.
feature4bd8da8 device-injector: add support for CDI injection.
feature44773bd runtime-tools/generate: add support CDI injection.
feature65282fe adaptation: add CDI device injection unit test.
feature01f3b7a adaptation: add support for native CDI injection.
featuref1aa58f api: add support for native CDI device injection.
featureAdd MD.Clone function (containerd/ttrpc#177)
feature430f734 Add MD.Clone
featureed6c3ba server_test: add Serve()/Shutdown() race test.
featureb5cd6e4 channel: allow discovery of overflown message size.
+76 more items in the release notesfeatureUpdate runc binary to v1.2.4 ()
featureFix proto conflicts and update to 1.8 API ()
featureFix ip_pref configuration option ()
featureFix panic due to nil dereference cgroups v2 ()
otherPrepare release notes for v1.7.25 ()
otherbda53fc60 Prepare release notes for v1.7.25
otherd4a649130 update runc binary to v1.2.4
otherReduce shim plugin log level ()
other99c973791 runtime/v2: reduce shim plugin log
other0cfc1edf3 Fix "even if IPv4 comes first" test to have IPv4 first
other53d1fd0d9 Don't use To16() != nil to detect IPv6 addresses
featureAdd a build tag to disable std plugin import (#11202) ()
feature2b12ef2f4 chore: add a build tag to disable containerd plugin import
otherbump github.com/containerd/continuity from 0.4.2 to 0.4.4 ()
otherb99091838 build(deps): bump github.com/containerd/continuity from 0.4.3 to 0.4.4
other9f48f7af0 build(deps): bump google.golang.org/protobuf from 1.33.0 to 1.35.2
other79172ba16 go.mod: github.com/containerd/continuity v0.4.3
otherdeps: update golang.org/x/ ()
other2dfbe2c7c vendor: update golang.org/x/crypto dependencies
deprecated3d7a50749 Replace use of deprecated api Envelope
deprecated929e7bde6 Use api types over deprecated alias
other5a42503d1 Remove end of life api directory
otherc4069878e Update runtime/v2/runc/options to alias api type
other4d955223a Update to containerd api 1.8
breakingcmd/continuity/commands: MountCmd: remove macOS remnants (containerd/continuity#254)
breaking327ebdd cmd/continuity/commands: MountCmd: remove macOS remnants
fixkind.String(): fix missing case statements for iota consts in switch (containerd/continuity#256)
fix7d074e7 kind.String(): fix missing case statements for iota consts in switch
breakinggo-fix: remove pre-go1.17 build-tags (containerd/continuity#252)
breaking433b975 go-fix: remove pre-go1.17 build-tags
deprecated3ca0c62 gha: update CodeQL action to v3, as v2 is deprecated
fixFix TestDiffDirChangeWithOverlayfs (also updates the CI to use Ubuntu 24.04) (containerd/continuity#249)
featurefs: implement Atime for Windows (containerd/continuity#241)
feature3cbda8c fs: implement Atime for Windows
featurefs: add DiffDirChanges function to get changeset fast (containerd/continuity#145)
feature8b312bd fs: add DiffDirChanges function to get changeset fast
featureAdd type to iterate directory (containerd/continuity#229)
feature5c2d1b4 Add type to itterate directory
deprecatedSubstitute deprecated rand.Seed() in Go 1.20 (containerd/continuity#231)
deprecated242e29e Substitute deprecated rand.Seed() in Go 1.20
+43 more items in the release notesfeatureUpdate runc binary to 1.2.2 ()
featureFix "invalid metric type" error message for cgroup v1 ()
featureUpdate the container exit log to info level ()
featureFix retry logic and concurrency issue with http fallback ()
otherPrepare release notes for v1.7.24 ()
other936f8e2de Prepare release notes for v1.7.24
feature47ff8e2b6 add info of exited event
feature10af0d60f Adds a mutex to protect fallback host
othere426ec51b Use unix and windows specific connection error checks
feature49c9f303b Allow fallback across default ports
otherlocal: avoid writing to content root on readonly store ()
otherddf2b03ed local: avoid writing to content root on readonly store
other06e72da76 update runc binary to 1.2.2
otherRevert "Disable vagrant strict dependency checking" ()
other23a31ce63 Revert "Disable vagrant strict dependency checking"
othertestutil: avoid conflict with continuity/testutil ()
other4bd411f8c testutil: avoid conflict with continuity/testutil
otherupdate cri-tools to v1.29.0 ()
other216dc892e update cri-tools to v1.29.0
otherupdate build to go1.22.9, test go1.23.3 ()
other56a7d31cb update build to go1.22.9, test go1.23.3
otherci: disable marking 1.7 releases as latest ()
other205940716 ci: disable marking 1.7 releases as latest
otherAvoid arch info in the sed/replace when building cri-cni-containerd.tar.gz ()
otherb7bb8d515 Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz
otherbackport: Disable vagrant strict dependency checking ()
other860a51384 Disable vagrant strict dependency checking
otherUpdate runc binary to 1.2.1 ()
other710cd3716 update runc binary to 1.2.1
otherservices/snapshots: include name of snapshotter in debug logs ()
other5bd0834ce services/snapshots: include name of snapshotter in debug logs
otherMake TestContainerPids more resilient ()
other455787bf8 Make TestContainerPids more resilient
featureAdd After=dbus.service to containerd.service ()
featurecb82e52a4 Add After=dbus.service to containerd.service
otherd6f577843 metrics: Use UnmarshalTo instead of UnmarshalAny
featureAdd errdefs aliases ()
featureAllow proxy plugins to have capabilities ()
featureRevert errdefs package migration ()
featureAdd check for CNI plugins before tearing down pod network ()
featureFix the race condition during GC of snapshots when client retries ()
otherPrepare release notes for v1.7.23 ()
other921f554af Prepare release notes for v1.7.23
otherRevert "update runc binary to 1.1.15" ()
other8f16d6588 Revert "update runc binary to 1.1.15"
otherSwitch from actuated.dev to GH Action runners for arm64 ()
other41e8f24cd Switch from actuated.dev to GH Action runners for arm64
otherdd811f224 Update github actions ci to run on forks
otherbump golangci/golangci-lint-action from 4 to 6 ()
other284484af4 bump golangci/golangci-lint-action from 4 to 6
otherupdate to go1.23.2,go1.22.8 ()
featureprow: allow ENABLE_CRI_SANDBOXES to be configured ()
featureae11176fa prow: allow ENABLE_CRI_SANDBOXES to be configured
fixTestNewBinaryIOCleanup: fix a comment, minor rewrite ()
fix7fd794a7c TestNewBinaryIOCleanup: fix a comment, minor rewrite
feature0714a2952 Add errdefs aliases
feature950740390 Allow proxy plugins to have capabilities
fixcb5e6a01a Fix the race condition during GC of snapshots when client retries
feature278bd0f72 [release/1.7] Add check for CNI plugins before tearing down pod network
deprecated51939238f Revert "errdefs: denote deprecation as a godoc comment"
featureAdd errdefs/pkg package (containerd/errdefs#19)
feature46a6522 Add errdefs/pkg package
featureAdd support for grpc error details and multiple errors (containerd/errdefs#7)
featureb9dce4d Add support for grpc error details
featureAdd support for custom error messages (containerd/errdefs#10)
featuredc9b20e Add support for custom error messages
featureAdd a resolve error function to return first error (containerd/errdefs#9)
feature9f87502 Add a resolve error function to return first error
featureAdd stack support (containerd/errdefs#8)
featuref96dfda Add stack package for managing error stack traces
feature70fd2d7 Add collapsible error type
feature6022faf Add typeurl to go mod
fixFix Cancelled interface typo (containerd/errdefs#6)
featureAdd more grpc types (containerd/errdefs#3)
featuref727cdb Add HTTP status code and error type conversion
feature9854dc7 Add more grpc error types
+27 more items in the release notesfeatureUpdate to go1.22.7, go1.23.1 ()
featureCumulative stats can't decrease ()
featureFix bug where init exits were being dropped ()
featureUpdate runc binary to 1.1.14 ()
otherPrepare release notes for v1.7.22 ()
other43174ee6a Prepare release notes for v1.7.22
fixintegration: regression test for issue 10589 ()
fix0c4ba21d8 integration: regression test for issue 10589
other1cc2cfa4b fifosync: cross-process synchronization
otherf338717ed runc-shim: handle pending execs as running
other686c69490 runc-shim: refuse to start execs after init exits
breaking760935e52 runc-shim: remove misleading comment
other19d678f73 update to go1.22.7, go1.23.1
other3658d5b40 Include change in cri server
other88d001c74 Cumulative stats can't decrease
other33e8a2005 update runc binary to 1.1.14
featureRegenerate introspection UUID if state is empty ()
featureSet stderr to empty string when using terminal on Windows ()
featureMove builds to Go 1.22 and add support for testing with 1.23 ()
featureBorrow latest wsstream from k8s v1.31.x to 1.7 ()
featureEnsure the CRIAPIV1Alpha2 warning's lastOccurrence is accurate ()
featureMake StopContainer idempotent ()
featureMake StopPodSandbox idempotent ()
featureFix failed force deletion for tasks with PID 0 ()
featureFix packaged runc reporting incorrect version ()
featureEnsure /run/containerd gets created with correct perms ()
deprecatedUpdate warnings for deprecated CRI config fields ()
otherPrepare release notes for v1.7.21 ()
other975f279ee Prepare release notes for v1.7.21
othergo.mod: keep minimum go version at go1.21 ()
otherd63bd8464 go.mod: keep minimum go version at go1.21
otherc76028088 update golangci-lint to 1.60.1
feature3b263d082 add go1.23.0, drop go1.21.x
fixFix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4 ()
other09ca004de Fix TestNewBinaryIOCleanup on Go 1.23 and Linux 5.4
other9269d97b1 hide wsstream under internal/ to prevent external use
feature59815fa44 golangci-lint should only look for problems in new code
other1c431dc6f Run go mod tidy
feature226f93d92 Add copyright headers
feature6f3252733 switch over references to the new package
other0a85d476a Fix up some constant references
other82bfa44d0 Copy over wsstream from k8s v1.31.0-rc.1 release
other52b79f337 Update CRIAPIV1Alpha2 warning lastOccurrence every call
deprecatedpkg/userns: deprecate and migrate to github.com/moby/sys/userns ()
otherdce0b5a6d migrate to github.com/moby/sys/userns
deprecated65f7d0740 pkg/userns: deprecate and migrate to github.com/moby/sys/user/userns
otherf21675c27 vendor: github.com/moby/sys/user v0.2.0
otherupdate to go1.21.13 / go1.22.6 ()
other228914a5e update to go1.21.13 / go1.22.6
fixFix TestNewBinaryIOCleanup failing with gotip ()
other3ff82ba0f Fix TestNewBinaryIOCleanup failing with gotip
fixd51143f6f script/setup/install-runc: fix runc using incorrect version
otherupdate auths code comment ()
fix0db46f664 client: fix tasks with PID 0 cannot be forced to delete
deprecated9afb8dcdf deprecation: update warnings for CRI config fields
featuregithub.com/moby/sys/userns v0.1.0 new
+6 more items in the release notesfeatureSupport for dropping inheritable capabilities ()
featureMake PodSandboxStatus friendlier to shim crashes ()
featureHandle empty DNSConfig differently than unspecified ()
featureFix for [cri] ttrpc: closed during ListPodSandboxStats ()
otherPrepare release notes for v1.7.20 ()
other7f2d4cd97 Prepare release notes for v1.7.20
otherdeps: Update otelgrpc ()
other3a02c523d deps: Update otelgrpc
fixdf86bdd5d CRI Sbserver: Make PodSandboxStatus friendlier to shim crashes
other209ee4f10 CRI: An empty DNSConfig != unspecified
featurece65228af Support for dropping inheritable capabilities
fix610498df7 Fix for [cri] ttrpc: closed during ListPodSandboxStats
otherupdate to go1.21.12 / go1.22.5 ()
othere61c7932e update to go1.21.12 / go1.22.5
deprecatederrdefs: denote deprecation as a godoc comment ()
deprecatedc7d5e430a errdefs: denote deprecation as a godoc comment
othergithub.com/go-logr/logr v1.2.4 -> v1.3.0
othergithub.com/google/go-cmp v0.5.9 -> v0.6.0
othergithub.com/google/uuid v1.3.1 -> v1.4.0
othergo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.45.0 -> v0.46.1
othergo.opentelemetry.io/otel v1.19.0 -> v1.21.0
othergo.opentelemetry.io/otel/metric v1.19.0 -> v1.21.0
othergo.opentelemetry.io/otel/sdk v1.19.0 -> v1.21.0
othergo.opentelemetry.io/otel/trace v1.19.0 -> v1.21.0
othergoogle.golang.org/genproto e6e6cdab5c13 -> 989df2bf70f3
othergoogle.golang.org/genproto/googleapis/api 007df8e322eb -> 83a465c0220f
othergoogle.golang.org/genproto/googleapis/rpc d307bd883b97 -> 995d672761c0
featureFix support for OTLP config ()
featureAdd API go module ()
featureRemove overlayfs volatile option on temp mounts ()
featureUpdate runc binary to v1.1.13 ()
featureMigrate platforms package to github.com/containerd/platforms ()
featureMigrate reference/docker package to github.com/distribution/reference ()
featureFix panic in NRI from nil CRI reference ()
featureFix Windows HPC working directory ()
otherPrepare release notes for v1.7.19 ()
other74a3d2901 Prepare release notes for v1.7.19
other7f5d3c5f4 cri: ensure NRI API never has nil CRI
otherWindows: Supply windows shim version via file ()
other6efc5bb89 update runhcs binary to v0.11.7
other945ae09fd Windows: Supply windows shim version via file
deprecatedreference: deprecate SplitObject ()
deprecateddba53578c pkg/reference: deprecate SplitObject
feature57ce09b42 pkg/reference: SplitObject: add proper GoDoc
feature83822d144 Add api release action
feature1ce1c8f3e 1.7: Add back support for OTLP config from toml
breakingremove imports of errdefs package, and add depguard linter ()
feature3be919f3c Add support for 1.8 interfaces
feature5b87eb502 Add go mod replace when proto changes happen
featurea3a7431bc Add api go submodule
feature61b3e2261 Alias protobuf plugin to new api types package
deprecated6ccdf6977 platforms: mark aliases as deprecated
breakinga00a2d20a reference/docker: remove deprecated SplitHostname
breakingRemove hcsshim import from repo (containerd/platforms#10)
fixFix windows matching when os version is empty (containerd/platforms#11)
feature17c859f Add tests for osversion matching with no version
featureAdd format for platform string (containerd/platforms#6)
feature38a74d2 Add grammar for platform string
fixfix grammar and highlights in README (containerd/platforms#3)
fixFix link in README (containerd/platforms#1)
feature18e3da6 Add Github actions CI
featureb3f80ee Add go module
feature8ff004c Add license and readme
fixFix CI build status badge in readme (containerd/ttrpc#162)
featuregithub.com/containerd/containerd/api v1.7.19 new
featuregithub.com/containerd/platforms v0.2.1 new
featuregithub.com/distribution/reference v0.6.0 new
+63 more items in the release notesfeatureUpdate Go version to 1.21.11 ()
featureRemove uses of platforms.Platform alias ()
featureMigrate log imports to github.com/containerd/log ()
featureMigrate errdefs package to github.com/containerd/errdefs ()
featureFix usage of "unknown" platform ()
otherPrepare release notes for v1.7.18 ()
other9426aab62 Prepare release notes for v1.7.18
othercdd3ea913 Update Go version to 1.21.11
other1e3c662d6 [release/1.7] remove uses of platforms.Platform alias
other0af6825b1 migrate logs imports to github.com/containerd/log module
other308341a44 replace uses of github.com/containerd/containerd/errdefs
other47ff8cfce migrate errdefs package to github.com/containerd/errdefs module
fixf4d11912a core/image: fix usage of "unknown" platform
otherExplicitly set release latest to true ()
other5b0480009 Explicitly set release latest to true
otherd669b100d build(deps): bump softprops/action-gh-release from 1 to 2
featureAdd common files (containerd/errdefs#1)
feature78f3494 Add Github actions configuration
feature46f1770 Add go.mod configuration
feature959121a Add README.md
featureAdd LICENSE (containerd/errdefs#2)
feature33a2275 Add LICENSE
featuregithub.com/containerd/errdefs v0.1.0 new
othergoogle.golang.org/genproto b8732ec3820d -> e6e6cdab5c13
othergoogle.golang.org/genproto/googleapis/api b8732ec3820d -> 007df8e322eb
othergoogle.golang.org/genproto/googleapis/rpc b8732ec3820d -> d307bd883b97
featureUse LOOP_CONFIGURE when creating loop devices ()
featureUpdate unpacker to fetch all provided content ()
featurePreserve CL_UNPRIVILEGED locked flags during remount of bind mounts ()
featureUpdate metadata snapshotter to lease on already exists ()
featureHandle unsupported config versions ()
featureFix deadlock when writing to pipe blocks (containerd/ttrpc#168)
otherPrepare release notes for v1.7.17 ()
other114b07b97 Prepare release notes for v1.7.17
other803aaa680 Remove internal LoopConfig struct
feature7bd3be948 Swap internal ioctl implementation with golang.org/x/sys
othera0739dc0e Use LOOP_CONFIGURE when creating loop devices
other1573ea598 Update ctr image pull all platforms
other32b594f1b Update unpacker to always fetch all
otherUpdate hcsshim tag to v0.11.5 ()
other5a03a3aee Update hcsshim tag to v0.11.5
otherUpdate ttrpc tag to 1.2.4 ()
other9a1eda40f update ttrpc tag to 1.2.4
otherad85652fa Preserve CL_UNPRIVILEGED locked flags during remount of bind mounts
featureUpdate instrumentation fuzzer with new flag ()
feature582f3f43d Update instrumentation fuzzer with new flag
othervendor: github.com/containerd/[email protected] ()
othera5d13689b vendor: github.com/containerd/[email protected]
othervendor: golang.org/x/[email protected] ()
otherf853bc129 vendor: golang.org/x/[email protected]
fixUpdate tooling to Go 1.21.10, 1.22.3 for net/http bug fixes ()
featureeb930375c Add lease test for metadata snapshotter
feature00347b7fa Add check for unsupported config versions
fixFix some issues in the test script (containerd/imgcrypt#115)
fixaa517cc test: Fix order of parameters and remove unnecessary key parameter
featureec72311 test: Add comments to test case
feature2959ec0 test: To be able to run testLocalKeys alone add missing env variable
fixREADME: Fix a typo (containerd/imgcrypt#105)
fix12e84f5 README: Fix a typo
breakingRemove references to package io/ioutil (containerd/imgcrypt#100)
fix1b4f6f8 client: Fix deadlock when writing to pipe blocks
deprecatedUpdate GitHub Actions CI to resolve deprecation warnings (containerd/ttrpc#161)
deprecated589a593 Update GitHub Actions CI to resolve deprecation warnings
fixFix proto3 generation error (containerd/ttrpc#158)
feature73b6a91 Add optional feature in protobuf compiler
featuregithub.com/go-jose/go-jose/v3 v3.0.3 new
+86 more items in the release notesfeatureUpdate AppArmor template to allow confined runc to kill containers ()
featureFix config import relative path glob ()
featureUpdate AppArmor template to better support rootlesskit ()
featureUpdate HTTP fallback to better account for TLS timeout and previous attempts ()
featureAdd support for HPC port forwarding ()
featurePrevent GC from schedule itself with 0 period. ()
featureFix issue with using invalid token to retry fetching layer ()
featureAutomatically decompress archives for transfer service import ()
featureFix HTTPFallback fails when pushing manifest ()
featureAdd support for configuring otel from env and config deprecation notice ()
featureFix deadlock during NRI plugin registration (containerd/nri#79)
featureUpdate Go to 1.21.9 and 1.22.2 with net/http security fix ()
featureFix CRI snapshotter root path when not under containerd root ()
featureFix network creation failure from CreatedAt time as 269 years ago ()
featureInclude userns info in PodSandboxStatus ()
featureFix default working directory Windows HostProcess containers ()
featureFix ListPodSandboxStats to skip sandboxes with missing tasks ()
featureAdd release notes for v1.7.16 ()
feature1c623084f Add release notes for v1.7.16
feature18a2c36fa apparmor: Allow confined runc to kill containers
other62e9535f2 Fix config import relative path glob
othera8ebceb97 CRI: "Fix" imageFSPath behavior
otherbd423bf84 Snapshotters: Export the root path
feature8fb6bfa71 Add exports to proxy plugin config
feature8916e2cf9 Add platform config to proxy plugins
other293f5151d pod: CreatedAt time will be 269 years ago while creating cri network failed.
featureaf19e746e apparmor: add signal (receive) peer=/usr/local/bin/rootlesskit
other637d259dd update to go1.21.9, go1.22.2
deprecated794b0c723 Add deprecated HTTPFallback for package compatibility
other51c649d9d Update HTTPFallback to handle tls handshake timeout
otheraa14890ed Remove empty default tls configuration in ctr
feature3df5d4445 Add support for HPC port forwarding
other5c15bf406 Prevent GC from schedule itself with 0 period.
featureb57dc9fd3 cri/server: Add userns tests in PodSandboxStatus
fixf61de0864 fix bug that using invalid token to retry fetching layer
fixFix unexpected order of mounts since go 1.19 ()
fix9f774e438 fix(cri): fix unexpected order of mounts since go 1.19
fix18f4ad5ee remote: Fix HTTPFallback fails when pushing manifest
deprecatedf2354894f Deprecate otel configs
feature90c309fe2 Add IsNotFound case to ListPodSandboxStats
+18 more items in the release notesfeatureAdds mediatype to OCI index record on export ()
featureFix runc shim to only defer init process exits ()
otherPrepare for v1.7.15 release ()
other4d4759b54 Prep v1.7.15 release
other21df46766 runc-shim: only defer init process exits
fixFix compile from version control system (source) use case ()
other2a054213e Fix compile from version control system (source) use case
feature6605c47a4 adds mediatype to oci index record
othervendor: google.golang.org/protobuf 1.33.0, github.com/golang/protobuf v1.5.4 ()
othere6d91d843 vendor: github.com/golang/protobuf v1.5.4
other2d136c5f5 build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0
othera1a7af7a3 build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0
othergithub.com/golang/protobuf v1.5.3 -> v1.5.4
othergoogle.golang.org/protobuf v1.31.0 -> v1.33.0