containerd 2.2.10 → 2.4.2
11 releases · 41 breaking changes · 22 security fixes · 0 advisories fixed
22security41breaking5deprecated111feature20fix
Breaking changes
- breaking 6e3b0d040 Makefile: remove go mod download from integration in 2.4.2
- breaking Remove deprecated CRI and tracing configuration options: in 2.4.0
- breaking Remove enable_cdi in CRI runtime configuration (CDI is now always enabled) in 2.4.0
- breaking Remove bin_dir in CRI CNI configuration (use bin_dirs) in 2.4.0
- breaking Remove endpoint, protocol, and insecure in OTLP tracing processor configuration (use standard OTLP environment variables) in 2.4.0
- breaking Remove service_name and sampling_ratio in internal tracing configuration (use standard OpenTelemetry environment variables) () in 2.4.0
- breaking Remove restore in CreateContainer () in 2.4.0
- breaking 531b3a37b9 tracing: remove deprecated tracing config options in 2.4.0
- breaking ee024b7c99 tracing: remove deprecated otlp configs in 2.4.0
- breaking f7c654fb4f cri: remove deprecated cni bin_dir in 2.4.0
- breaking 4f7de25abb cri: remove enable_cdi config option in 2.4.0
- breaking 4d13856983 cmd: remove redundant empty slice flag values in 2.4.0
- breaking 211cde9039 cmd: remove uses of urfave/cli.Commands in 2.4.0
- breaking c52e77eccd cmd/ctr: remove unused pluginCmds in 2.4.0
- breaking plugins: remove some stray logrus imports () in 2.4.0
- breaking b845501327 plugins: remove some stray logrus imports in 2.4.0
- breaking 329998caa9 runtime/v2: remove the runtime-allow-mounts annotation in 2.4.0
- breaking Remove shim.Command form pkg () in 2.4.0
- breaking internal/cri/server: remove remaining uses of k8s.io/utils () in 2.4.0
- breaking 10e82fac8d internal/cri/server: remove remaining uses of k8s.io/utils in 2.4.0
- breaking internal/cri/bandwidth: remove dead code () in 2.4.0
- breaking fcb54dc5fa internal/cri/bandwidth: remove dead code in 2.4.0
- breaking Remove dependency on github.com/opencontainers/runtime-tools () in 2.4.0
- breaking cri: remove restore in CreateContainer () in 2.4.0
- breaking 91be73ba62 cri: remove restore in CreateContainer in 2.4.0
- breaking README: remove Go Report Card badge () in 2.4.0
- breaking 5de7b675c6 README: remove Go Report Card badge in 2.4.0
- breaking 0274924d74 gha: remove uses of "read-all" permissions in 2.4.0
- breaking 8722c46313 gha: buf-breaking: pin actions by sha in 2.4.0
- breaking pkg/archive: remove redundant github.com/moby/sys/sequential dependency () in 2.4.0
- breaking 35f753cc44 pkg/archive: remove redundant github.com/moby/sys/sequential dependency in 2.4.0
- breaking pkg/oci: WithUser: remove redundant isErrRange utility () in 2.4.0
- breaking 633a5be1c9 pkg/oci: WithUser: remove redundant isErrRange utility in 2.4.0
- breaking remove 1.26.2 from CI builds as it is not supported any longer due to… () in 2.4.0
- breaking pkg: remove unused nolint annotations () in 2.4.0
- breaking 899dee1f59 pkg: remove unused nolint annotations in 2.4.0
- breaking 1ef7086 ci: remove custom working-directories and GOPATH in 2.4.0
- breaking Remove dependency on github.com/opencontainers/runtime-tools (containerd/nri#305) in 2.4.0
- breaking c73186ea6 Makefile: remove go mod download from integration in 2.3.7
- breaking plugins: remove some stray logrus imports () in 2.3.5
- breaking 6c59399bf plugins: remove some stray logrus imports in 2.3.5
Security changes
- security CVE-2026-95839 in 2.4.2
- security GHSA-8647-2jxj-p2rc in 2.4.2
- security GHSA-hc94-p972-ch66 in 2.4.2
- security Update to go1.26.9 / go1.27.2 (security) () in 2.4.2
- security CVE-2026-53493 in 2.4.1
- security vendor: github.com/go-jose/go-jose/v4 v4.1.5 (security) () in 2.4.0
- security docs/security: update security report triage criteria () in 2.4.0
- security fdf814c21a docs/security: update security report triage criteria in 2.4.0
- security CVE-2026-95839 in 2.3.7
- security GHSA-5p7c-hggf-c748 in 2.3.7
- security GHSA-8647-2jxj-p2rc in 2.3.7
- security GHSA-hc94-p972-ch66 in 2.3.7
- security CVE-2026-53493 in 2.3.6
- security CVE-2026-53495 in 2.3.5
- security GHSA-rp3h-jf77-q9p4 in 2.3.5
- security Fixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context in 2.3.4
- security CVE-2026-50195 in 2.3.2
- security CVE-2026-53488 in 2.3.2
- security CVE-2026-53492 in 2.3.2
- security CVE-2026-53489 in 2.3.2
- security CVE-2026-47262 in 2.3.2
- security CVE-2026-46680 in 2.3.1
Deprecations
- deprecated nri,deprecation: record and emit warnings for NRI deprecations. () in 2.3.4
- deprecated 5966e2edb nri,deprecation: emit warnings for old NRI plugins. in 2.3.4
- deprecated cri: deprecate restore in CreateContainer () in 2.3.4
- deprecated dc98141df cri: deprecate restore in CreateContainer in 2.3.4
- deprecated Deprecate shim.Command () in 2.3.0
Every release in between
securityCVE-2026-95839
securityGHSA-8647-2jxj-p2rc
securityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureFix excessive memory usage during image pulls when registry downloads outpace content writes ()
featureApply hardening to reject image references with ".." path components ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
other4b342aeaf Prepare release notes for v2.4.2
securityUpdate to go1.26.9 / go1.27.2 (security) ()
other9c06c813e Update to go1.26.9 / go1.27.2
otherci: update to golangci-lint v2.14.0 (go1.27.2 compatibility) ()
other3fb9faa68 ci: update to golangci-lint v2.14.0 (go1.27.2 compatibility)
other187caba38 Merge commit from fork
other44fd201a8 remotes/docker: bound parallel fetch readers
otherfc7adbfab Merge commit from fork
othera2eb01f66 images: skip malformed digests when computing referrer labels
other39cff482d Merge commit from fork
other7f0c0b822 content, remotes: bound reads to expected size
otherremotes/docker: throttle worker chunk buffers ()
other6a78f854a remotes/docker: limit chunk buffers per layer
othercri: should not follow log file ()
other098de667d cri: should not follow log file
otherreference: reject .. path components that rewrite the host ()
other6b631559b reference: reject .. path components that rewrite the host
featureseccomp: Use an allow-list for socket domains ()
feature7936ee578 seccomp: Use an allow-list for socket domains
otherupdate runc binary to v1.5.2 ()
other54a82dcf0 update runc binary to v1.5.2
otherConditional actions ()
breaking6e3b0d040 Makefile: remove go mod download from integration
other694cfb371 ci: skip linters steps in private repositories
otherca0452717 workflows: skip non-CI jobs in private forks
securityCVE-2026-53493
featureFix bug where failed container start cleanup leaked tasks and prevented container removal ()
featureFix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ()
featureFix content upload failures when retrying fetch content after reaching EOF ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
featureFix bug where arguments following "-" were dropped in "ctr images export" ()
featureFix bug where container command arguments were parsed as flags in "ctr run", "ctr containers create", "ctr tasks exec", and "containerd oci-hook" ()
featureFix bug where comma-separated flag values were incorrectly split in ctr subcommands ()
other9f7f70fc31 Prepare release notes for v2.4.1
other98e88f2afe Merge commit from fork
othere0c8eed120 Bound Walk references
otherddf544326a Bound Dispatch concurrency and references
othercri: don't leak task when StartContainer cleanup fails to delete task ()
fix9e8abe0405 cri: fix process leak when start cleanup fails to delete task
otherctr: preserve args after "-" in images export ()
otheracbdd57f0d ctr: preserve args after "-" in images export
fixctr: fix flag parsing issues in run, containers create, tasks exec, and oci-hook ()
othera2e9a5196e cmd/containerd: stop flag parsing on oci-hook
other2d0e53474d ctr: stop flag parsing before container command
othercri: tolerate wrapped ENOTSUP during relabel ()
othereb2dfa125d cri: tolerate wrapped ENOTSUP during relabel
othercore/unpack: don't honor id-mapping labels from image annotations ()
other429f317b55 core/unpack: tighten comments around id-mapping label filtering
othercc1b8a2dc5 core/unpack: don't honor id-mapping labels from image annotations
otherremotes: revert closing fetch readers at EOF ()
otherd265baec5a remotes: test fetch retries and HTTP reader lifetime
other9e8507bea8 Revert "remotes: close fetch reader immediately on EOF"
otherctr: disable slice flag separator on commands ()
other2543d23905 ctr: disable slice flag separator on commands
othervendor: github.com/fxamacker/cbor/v2 v2.9.4 ()
otherf00dd7552e vendor: github.com/fxamacker/cbor/v2 v2.9.4
othergithub.com/fxamacker/cbor/v2 v2.9.1 -> v2.9.4
breakingRemove deprecated CRI and tracing configuration options:
breakingRemove enable_cdi in CRI runtime configuration (CDI is now always enabled)
breakingRemove bin_dir in CRI CNI configuration (use bin_dirs)
breakingRemove endpoint, protocol, and insecure in OTLP tracing processor configuration (use standard OTLP environment variables)
breakingRemove service_name and sampling_ratio in internal tracing configuration (use standard OpenTelemetry environment variables) ()
breakingRemove restore in CreateContainer ()
breaking531b3a37b9 tracing: remove deprecated tracing config options
breakingee024b7c99 tracing: remove deprecated otlp configs
breakingf7c654fb4f cri: remove deprecated cni bin_dir
breaking4f7de25abb cri: remove enable_cdi config option
breaking4d13856983 cmd: remove redundant empty slice flag values
breaking211cde9039 cmd: remove uses of urfave/cli.Commands
breakingc52e77eccd cmd/ctr: remove unused pluginCmds
securityvendor: github.com/go-jose/go-jose/v4 v4.1.5 (security) ()
breakingplugins: remove some stray logrus imports ()
breakingb845501327 plugins: remove some stray logrus imports
breaking329998caa9 runtime/v2: remove the runtime-allow-mounts annotation
breakingRemove shim.Command form pkg ()
breakinginternal/cri/server: remove remaining uses of k8s.io/utils ()
breaking10e82fac8d internal/cri/server: remove remaining uses of k8s.io/utils
breakinginternal/cri/bandwidth: remove dead code ()
breakingfcb54dc5fa internal/cri/bandwidth: remove dead code
breakingRemove dependency on github.com/opencontainers/runtime-tools ()
breakingcri: remove restore in CreateContainer ()
breaking91be73ba62 cri: remove restore in CreateContainer
securitydocs/security: update security report triage criteria ()
securityfdf814c21a docs/security: update security report triage criteria
breakingREADME: remove Go Report Card badge ()
breaking5de7b675c6 README: remove Go Report Card badge
breaking0274924d74 gha: remove uses of "read-all" permissions
breaking8722c46313 gha: buf-breaking: pin actions by sha
breakingpkg/archive: remove redundant github.com/moby/sys/sequential dependency ()
breaking35f753cc44 pkg/archive: remove redundant github.com/moby/sys/sequential dependency
breakingpkg/oci: WithUser: remove redundant isErrRange utility ()
breaking633a5be1c9 pkg/oci: WithUser: remove redundant isErrRange utility
breakingremove 1.26.2 from CI builds as it is not supported any longer due to… ()
breakingpkg: remove unused nolint annotations ()
breaking899dee1f59 pkg: remove unused nolint annotations
breaking1ef7086 ci: remove custom working-directories and GOPATH
breakingRemove dependency on github.com/opencontainers/runtime-tools (containerd/nri#305)
+847 more items in the release notessecurityCVE-2026-95839
securityGHSA-5p7c-hggf-c748
securityGHSA-8647-2jxj-p2rc
securityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureApply hardening to reject image references with ".." path components ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
otherPrepare release notes for v2.3.7 ()
otherc8b271adb Prepare release notes for v2.3.7
otherUpdate to go1.26.9 ()
other320278f96 Update to go1.26.9
otherca3d94d2f Merge commit from fork
other9621a5f9c remotes/docker: bound parallel fetch readers
otherdff0d82dd Merge commit from fork
other2181d7baa images: skip malformed digests when computing referrer labels
other29ed4ba2e Merge commit from fork
other80885a94d content, remotes: bound reads to expected size
other5c6687786 Merge commit from fork
other2e17e62e2 cri: unmount checkpoint view on every CRImportCheckpoint return path
fixintegration/client: fix TestContainerExecLargeOutputWithTTY ()
fixda23fb7af integration/client: fix TestContainerExecLargeOutputWithTTY
othercri: should not follow log file ()
other50a18659f cri: should not follow log file
otherreference: reject .. path components that rewrite the host ()
otherb3dd30ae5 reference: reject .. path components that rewrite the host
othervendor: google.golang.org/grpc v1.83.2 ()
other993898bbf [release/2.3] vendor: google.golang.org/grpc v1.83.2
othercore/unpack: don't honor id-mapping labels from image annotations ()
otherfe408f2a4 core/unpack: tighten comments around id-mapping label filtering
other3ab5f9c0e core/unpack: don't honor id-mapping labels from image annotations
featureseccomp: Use an allow-list for socket domains ()
feature658428e2f seccomp: Use an allow-list for socket domains
otherConditional actions ()
breakingc73186ea6 Makefile: remove go mod download from integration
other030b7b3f7 ci: skip linters steps in private repositories
otherec6240e3e workflows: skip non-CI jobs in private forks
otherupdate runc binary to v1.5.2 ()
other63092f411 update runc binary to v1.5.2
othergo.opentelemetry.io/otel v1.43.0 -> v1.44.0
+14 more items in the release notessecurityCVE-2026-53493
featureFix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ()
featureEnable mount manager for image mounts in CRI ()
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureAvoid unexpected mutation of mount options in mount helpers ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other086fc0d40e Prepare release notes for v2.3.6
other3e3b3daabc Merge commit from fork
other03fbef37da Bound Walk references
otherbfe167214b Bound Dispatch concurrency and references
fixFix input mutation in mount option helpers ()
other5f17a29a9b core/mount: Keep lazy copy for filtered options
other49796574fb core/mount: Return copied filtered mount options
othercb3f358aea mount: share lazy option filtering
fixee7ae5b7c7 mount: fix shallow copy of Options in RemoveVolatileOption and RemoveIDMapOption
fix1facedfb21 mount: fix input mutation in readonlyMounts
other5ca695a441 mount: replace copyMounts with slices.Clone
othercri: tolerate wrapped ENOTSUP during relabel ()
other7fd198f858 cri: tolerate wrapped ENOTSUP during relabel
otherrelease: don't mark 2.3 releases as latest ()
other147edce99f release: don't mark 2.3 releases as latest
othercri: Backport image mount fixes 2.3 ()
otherc2c5164437 cri: only unmount image volumes when mounting fails
other74d0c79682 cri: enable mount manager for image mounts
othercore/unpack: fetch layers of every config-sharing manifest ()
other4a3a41d353 core/unpack: fetch layers of every config-sharing manifest
otherpkg/oci: mask thermal interrupt info ()
other9c6d7e9509 pkg/oci: mask thermal interrupt info
otherUpdate to go1.26.8 ()
otherac4464a399 Update to go1.26.8
otherf7f64ddc06 Update to go1.26.7
other902a7d5e6c Update to go1.26.6
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureAvoid hangs and data races when streaming container standard I/O in CRI ()
featureFix missing error messages in OpenTelemetry trace attributes ()
featureFix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ()
featureFix configuration loading error when drop-in configuration files have a higher version than the root configuration ()
featureAvoid containerd startup hangs when loading shims ()
featureAdd context to error when shim delete times out ()
featureFix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)
featureFix unpack failure for EROFS images containing the erofs OS feature ()
other934efa5e0 Prepare release notes for v2.3.5
otherbe419b070 Merge commit from fork
other9ec55f024 cri: cancel ExecSync IO drain on context cancellation
other84ea25bc1 Merge commit from fork
otherc53577965 archive: skip redundant opaque whiteout walks
fixFix data races and a deadlock in the byte stream helpers ()
other9f6be869c Fix data races and a deadlock in the byte stream helpers
breakingplugins: remove some stray logrus imports ()
breaking6c59399bf plugins: remove some stray logrus imports
othersnapshots/erofs: advertise the erofs OS feature from the snapshotter plugin ()
otherf65732115 snapshots/erofs: test the advertised erofs feature platform
other5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
otherupdate runc to v1.5.1 ()
otheraf445ea0a update runc to v1.5.1
otherc077e43bd update runc to v1.5.0
othervendor: github.com/containerd/platforms v1.0.0-rc.5 ()
other676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
otherpkg/tracing: handle error and typed-nil Stringer attributes ()
otherc7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other58fb846d5 core/remotes/docker: normalize descriptor URL origins
otherc7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
otherupdate runhcs to v0.15.0-rc.4 ()
featureRevert "add check on version of drop in configs" ()
feature1125b053f Revert "add check on version of drop in configs"
fixfix(runtime): apply load timeout to load shim ()
featureAdd more context to the shim delete error ()
feature7f97bc122 Add more context to the shim delete error
fixFix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)
+7 more items in the release notessecurityFixes CVE-2026-95837: containerd CRI plugin: Checkpoint restore bypasses destination security context
featureDisable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ()
featureSet default runtimeFeatures.UserNamespacesHostNetwork to true in CRI ()
featureDeprecate checkpoint restore in CreateContainer ()
featureSupport non-UTF-8 binary environment variable values in CRI ()
featureEnable OCI runtime feature introspection for non-runc runtimes in CRI ()
featureDisable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ()
featureNormalize sandbox image references in CRI to resolve images without domain prefixes ()
featureEmit deprecation warnings for plugins using deprecated NRI interfaces ()
featureEnable log scrubbing by default on Windows ()
featureFix memory leak in OOM watcher map when stopping container monitoring ()
featureAvoid orphaning shims on transient errors when loading process IDs ()
featureFix corruption of binary protobuf shim start responses caused by premature whitespace trimming ()
featureFix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata ()
otherc1f5360ef Prepare release notes for v2.3.4
othercri: disable restore in CreateContainer by default ()
other928c03c68 cri: disable restore in CreateContainer by default
deprecatednri,deprecation: record and emit warnings for NRI deprecations. ()
deprecated5966e2edb nri,deprecation: emit warnings for old NRI plugins.
otherSet the default of runtimeFeatures.UserNamespacesHostNetwork to true ()
otherab52c58f1 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
otherUse ScrubLogs by default on Windows ()
feature0c255158a ctr: add --scrub-logs flag for Windows
other1c2b13dc9 cri/config: use ScrubLogs by default on Windows
othersnapshots/erofs: keep lowers stacked above a merged fsmeta ()
other0c511e068 snapshots/erofs: keep lowers stacked above a merged fsmeta
deprecatedcri: deprecate restore in CreateContainer ()
deprecateddc98141df cri: deprecate restore in CreateContainer
fixinternal/oom: Fix memory leak by removing watcher from map on Stop ()
fix537d82d54 internal/oom: Fix memory leak by removing watcher from map on Stop
othershim_load: Consider shim leaked only if we can't find pids ()
otherdecf97a9c shim_load: Consider shim leaked only if we can't find pids
othercore/runtime/v2: Drop checkpointctl module dependency ()
other796f07dc8 core/runtime/v2: Drop checkpointctl module dependency
otherHandle []byte envvar value for CRI ()
other751fddddb Handle []byte envvar value
other0bce9060e update to v0.36.x kubernetes dependencies
fixfix(cri): introspect OCI runtime features for non-runc runtimes ()
featuredb03e3968 cri: add enable_criu configuration option
featurecri: auto-add prefix for pause image ()
+17 more items in the release notesfeatureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureFix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ()
featureReject CreateContainer calls when the target sandbox is not running ()
featureEnsure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ()
featureSurface OCI error bodies in registry 403 responses by falling back to GET requests ()
featureAlign default 4K mkfs block size for EROFS across all platforms ()
otherPrepare release notes for v2.3.3 ()
other7f6cee02a Prepare release notes for v2.3.3
otherCI: migrate Vagrant to Lima ()
other7316210ce CI: migrate Vagrant to Lima
otherremotes: surface OCI error body in registry 4xx responses ()
other457fba3a3 remotes: surface OCI error body on HEAD 403 via GET fallback
otherUpdate go to 1.26.5 ()
otherdc2df934e Update go to 1.26.5
otherci: pin fog-json to resolve gem conflict ()
other5be0495df ci: pin fog-json to resolve gem conflict
fixFix nil pointer dereference in NRI GetIPs ()
other36c713971 Fix nil pointer dereference in NRI GetIPs
otherSet SystemTemp env var to config temp on Windows ()
other26dce170d Set SystemTemp env var to config temp on Windows
otherupdate runhcs to v0.15.0-rc.3 ()
other9bc2c2349 update runhcs to v0.15.0-rc.3
otherUpdate to current setup-go version ()
other3e97edeb7 Update to current setup-go version
othercri: reject CreateContainer when sandbox is not running ()
other8856b0f9c cri: reject CreateContainer when sandbox is not running
otherupdate runhcs to v0.15.0-rc.2 ()
otherae796cec5 update runhcs to v0.15.0-rc.2
othertest: fix flaky image timestamp check on coarse clocks ()
fix168d56783 test: fix flaky image timestamp check on coarse clocks
featureAdd defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ()
featured1db61db8 Add deferred call to ShutdownSandbox to avoid leaks
othererofs: align default mkfs block size across platforms ()
other01b0f03f6 erofs: align default mkfs block size across platforms
securityCVE-2026-50195
securityCVE-2026-53488
securityCVE-2026-53492
securityCVE-2026-53489
securityCVE-2026-47262
featureFix a data race when reading shim logs on Windows ()
featureAllow the last host to retry on transient network errors ()
featureFix container startup failures caused by concurrent task RPC timeouts during slow container creation ()
otherPrepare release notes for v2.3.2 ()
otherfb8ca00b0 Prepare release notes for v2.3.2
other9c69960ba Merge commit from fork
other0f6251520 Merge commit from fork
other91d7471e2 cri: filter CDI annotations on checkpoint restore
other7c2e086bf Merge commit from fork
otherdae67765f cri: do not re-tag restored checkpoints
other94aa1e2c1 Merge commit from fork
other09599078f cri: make checkpoint restore robust to unexpected archive content
othere1fdb8d22 Merge commit from fork
otherff1d116ef Bound user-database file reads in openUserFile
otherd156e07cb Merge commit from fork
otherf99aad54a Do not propagate reserved labels from image configs
othervendor: golang.org/x/crypto v0.53.0 ()
other0b9469501 [release/2.3] vendor: golang.org/x/crypto v0.53.0
otherresolver: retry on transient network errors ()
other983bbddc1 resolver: retry on transient network errors
otherupdate runc binary to v1.4.3 ()
other3f76f2dc1 update runc binary to v1.4.3
otherupdate go to 1.26.4 ()
other8a49dfe85 update go to 1.26.4
other5aa6bb2b7 remove 1.26.2 from CI builds as it is not supported any longer due to the dependency
otherConfigure udevd children-max for root-test ()
otherbfb8aebc0 Configure udevd children-max for root-test
fixcore/runtime/v2: fix race on Windows deferredPipeConnection.c in Read ()
fix62ceafff0 core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
otherrunc-shim: don't hold the service lock across runc create ()
other9b0c0dc58 runc-shim: don't hold the service lock across runc create
othercontrib/checkpoint: increase timeouts to 30s ()
otherf588bc6fb contrib/checkpoint: increase timeouts to 30s
othergolang.org/x/crypto v0.49.0 -> v0.53.0
othergolang.org/x/mod v0.35.0 -> v0.36.0
+5 more items in the release notessecurityCVE-2026-46680
featureFix bug where failed gRPC plugins were not tolerated when starting listeners ()
featureEnsure metadata and mount plugin boltdb files are closed on server shutdown ()
featureFix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups ()
featureFix sandbox task API endpoints for non-runc runtimes and deprecate task fields in Runc options ()
featureApply hardening to default seccomp socket policy by blocking AF_ALG ()
featureDisable overlayfs "rebase" capability when running in user namespace ()
featureFix transfer plugin error when EROFS differ is configured but mkfs.erofs is unavailable ()
otherPrepare release notes for v2.3.1 ()
other58af96519 Prepare release notes for v2.3.1
other8f0b3ca83 Update api to v1.11.1
otheroci: return explicit error for out-of-range USER values ()
othera05ae7885 oci: return explicit error for out-of-range USER values
otherPrepare release notes for api/v1.11.1 ()
otherda7aef299 Prepare release notes for api/v1.11.1
fixFix sandbox task API endpoints for non-runc runtimes ()
other5282d4e09 Wire task address and version fields
othere44f5f9ec protos: include task API address to CreateTaskRequest
otherseccomp: Block AF_ALG in default socket policy ()
other4d80a31bf seccomp: Block AF_ALG in default socket policy
other2ed0d97b6 seccomp: Document socket rule scope and socketcall limitation
otherserver: tolerate failed gRPC plugins when starting listeners ()
other3a88fdde0 server: tolerate failed gRPC plugins when starting listeners
otheroverlay: disable "rebase" capability when running in UserNS ()
other2be0710b8 overlay: disable "rebase" capability when running in UserNS
otherUpdate Go to 1.26.3 ()
other3b199c22b Update Go to 1.26.3
fixfix: close boltdb on metadata and mount plugin close ()
other1d601271a fix: close boltdb on metadata and mount plugin close
fixFix optional EROFS differ setup in transfer plugin ()
otherd666d2e42 Refactor transfer unpack configuration setup
otherccc3bd7b9 Fix optional transfer differ setup
othergithub.com/containerd/containerd/api v1.11.0 -> v1.11.1
featureAdd transfer types for container filesystem copy ()
featureAdd option to inject trace ID to logs ()
featurePropagate OpenTelemetry traces in outgoing RPCs from plugin clients ()
featureUpdate plugin config migration to run on load ()
featureUpdate sandbox API to include spec field ()
featureAllow containers to use user namespaces with host networking ()
featureWire UpdatePodSandboxResources to Sandbox API ()
featureUnpack images with per-layer labels for specific runtime ()
featurePopulate ImageId field in container status ()
featureSet annotations parameter in CreateSandbox request ()
featureAdd background stats collector to calculate UsageNanoCores for containers and pod sandboxes ()
featureSupport zstd-wrapped EROFS layers ()
featureAdd os.features support for EROFS native container images ()
featureAdd EROFS layer media type ()
featureAdd dmverity support to the erofs snapshotter ()
featureUse fsmount API to avoid PAGE_SIZE limit for erofs ()
featurePass container user (uid, gids) to plugins ()
featurePass seccomp policy to plugins ()
featurePass any POSIX rlimits to plugins ()
featurePass extended container status to NRI. ()
featurePass injected CDI devices to plugins ()
featurePass linux sysctl to plugins ()
featureUse dedicated RPC calls for all pod and container life-cycle events via the NRI wire protocol (containerd/nri#274)
featureAdd basic metrics collection for the NRI framework (containerd/nri#277)
featureExchange NRI versions between plugins and the runtime during registration (containerd/nri#271)
featureEnable adjusting Linux memory policy from NRI plugins (containerd/nri#166)
featureClose plugins if initial synchronization fails to prevent unregistered connections (containerd/nri#279)
featureAccumulate owners for OCI hook adjustments, disallowing commas in plugin names (containerd/nri#264)
featureAdd nri_no_wasm build tag to allow disabling WASM support at compile time (containerd/nri#253)
featureSupport direct adjustment of the intelRdt container configuration (containerd/nri#215)
featureAllow setting kernel scheduling policy attributes via NRI (containerd/nri#160)
featureAllow adjusting Linux network devices via NRI (containerd/nri#157)
featureAdd support for sysctl adjustment via NRI (containerd/nri#248)
featureExpose container user, group, and supplemental group IDs to plugins (containerd/nri#230)
featureAdd configured socket directory to shim bootstrap protocol ()
featureIntroduce shim bootstrap protocol ()
featureFix binary logging driver not blocking container start on failure ()
featureUse new filtered cgroups stats API ()
featureUpdate OOMKilled event handling ()
deprecatedDeprecate shim.Command ()
+76 more items in the release notes