containerd 2.2.7 → 2.2.10
3 releases · 1 breaking change · 7 security fixes · 7 advisories fixed
7security1breaking0deprecated15feature2fix
Vulnerabilities fixed by this upgrade
- medium GHSA-8647-2jxj-p2rc containerd: daemon crash when pulling an image with a crafted Content-Length header
- medium CVE-2026-95839 containerd: daemon crash when processing an image manifest with a malformed digest
- medium GHSA-hc94-p972-ch66 containerd: host disk exhaustion when pulling an image with an unbounded layer stream
- medium GHSA-5p7c-hggf-c748 containerd CRI plugin: mount and snapshot leak when container checkpoint restore fails
- medium CVE-2026-53493 Image-pull DoS via crafted OCI index graph amplification
- medium CVE-2026-95838 Unpack DoS via repeated opaque whiteouts
- medium CVE-2026-53495 containerd CRI plugin: Unbounded I/O draining in ExecSync causes node-level denial of service
Breaking changes
- breaking 1c0d72890 Makefile: remove go mod download from integration in 2.2.10
Security changes
- security CVE-2026-95839 in 2.2.10
- security GHSA-5p7c-hggf-c748 in 2.2.10
- security GHSA-8647-2jxj-p2rc in 2.2.10
- security GHSA-hc94-p972-ch66 in 2.2.10
- security CVE-2026-53493 in 2.2.9
- security CVE-2026-53495 in 2.2.8
- security GHSA-rp3h-jf77-q9p4 in 2.2.8
Every release in between
securityCVE-2026-95839
securityGHSA-5p7c-hggf-c748
securityGHSA-8647-2jxj-p2rc
securityGHSA-hc94-p972-ch66
featureApply hardening to not follow symlinks for container log files ()
featureAvoid hang and data corruption during multipart image fetch ()
featureApply hardening to reject image references with ".." path components ()
featureApply hardening to allowlist socket domains in the default seccomp profile ()
featureApply hardening to filter ID-mapping labels from image annotations during unpack ()
otherPrepare release notes for v2.2.10 ()
other27d59fe59 Prepare release notes for v2.2.10
otherUpdate to go1.26.9 ()
othercb4648a80 Update to go1.26.9, remove go1.25.12
other6fe70e5cc Merge commit from fork
other70c8ae49e remotes/docker: bound parallel fetch readers
otheraff52a508 Merge commit from fork
other2455fec2f images: skip malformed digests when computing referrer labels
other32fc74497 Merge commit from fork
other5f8c507a2 content, remotes: bound reads to expected size
other14da554b2 Merge commit from fork
otherc3b7534ed cri: unmount checkpoint view on every CRImportCheckpoint return path
otherSkip critest OOMKilled testcase for systemd cgroup ()
othera47da7e9b script/critest.sh: always skip OOMKilled on systemd cgroup
other32c566557 *: skip critest OOMKilled testcase for systemd cgroup
othermultipart fetch stability fixes ()
other5dde40350 multipart fetch stability fixes
fixintegration/client: fix TestContainerExecLargeOutputWithTTY ()
fix7dff2d997 integration/client: fix TestContainerExecLargeOutputWithTTY
othercri: should not follow log file ()
othera5e41909a cri: should not follow log file
otherreference: reject .. path components that rewrite the host ()
other4f71fd9b0 reference: reject .. path components that rewrite the host
othercore/unpack: don't honor id-mapping labels from image annotations ()
other4b3494a8d core/unpack: tighten comments around id-mapping label filtering
other076598878 core/unpack: don't honor id-mapping labels from image annotations
featureseccomp: Use an allow-list for socket domains ()
feature5ba51c0f2 seccomp: Use an allow-list for socket domains
otherConditional actions ()
otherfa5e5452e [CI] Prevents triggering of an inactive issue/PR check for forked repository.
breaking1c0d72890 Makefile: remove go mod download from integration
+2 more items in the release notessecurityCVE-2026-53493
featureFix bug where container creation failed when SELinux relabeling was unsupported by the filesystem ()
featureEnable mount manager for image mounts in CRI ()
featureEnsure all layers are fetched when multiple manifests in an index share a config descriptor ()
featureMask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default ()
other60acf78bc5 Prepare release notes for v2.2.9
other253f9cc140 Merge commit from fork
other053c0cc412 Bound Walk references
otherefd11fc9c2 Bound Dispatch concurrency and references
othercri: tolerate wrapped ENOTSUP during relabel ()
other39d0dd4b43 cri: tolerate wrapped ENOTSUP during relabel
otherpkg/oci: mask thermal interrupt info ()
otherbaffef9669 pkg/oci: mask thermal interrupt info
othercore/unpack: fetch layers of every config-sharing manifest ()
other9e1ae6a9e9 core/unpack: fetch layers of every config-sharing manifest
othercri: Backport image mount fixes 2.2 ()
other2cdf8d80cc cri: only unmount image volumes when mounting fails
other2e1dcc5da0 cri: enable mount manager for image mounts
securityCVE-2026-53495
securityGHSA-rp3h-jf77-q9p4
featureApply hardening to strip sensitive authentication headers when fetching descriptor URLs ()
featureSet SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ()
featureFix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ()
featureFix EROFS snapshot creation failure caused by concurrent snapshot removal ()
other4864b1814 Prepare release notes for v2.2.8
other3458b7fd3 Merge commit from fork
other22ccf4314 cri: cancel ExecSync IO drain on context cancellation
other2bf01ce17 Merge commit from fork
other45166eb82 archive: skip redundant opaque whiteout walks
otherSet SystemTemp env var to config temp on Windows ()
other2c722ad04 Set SystemTemp env var to config temp on Windows
otherpkg/oci: resolve rootfs symlinks for user lookup ()
other196664bc0 pkg/oci: resolve rootfs symlinks for user lookup
otherdocker fetcher: strip sensitive headers on descriptor URLs ()
other6da9d9528 core/remotes/docker: normalize descriptor URL origins
other4f7851699 core/remotes/docker: strip sensitive headers on desc.urls fetch
othersnapshots/erofs: protect snapshot staging from cleanup ()
otherf7075a224 snapshots/erofs: protect snapshot staging from cleanup