What changed in containerd from 1 to 2

12 releases numbered after v1.7.35 up to and including v2.3.5, stable releases only. v1.7.35 and v2.3.5 are the newest stable releases of 1 and 2 we track; this page follows them as new ones ship.

74 changes across 12 releases · 33 landed on more than one version

Added 4

v2.2.7

  • Support non-UTF-8 binary environment variable values in CRIalso inv2.3.4
  • Add enable_criu configuration option and disable checkpoint restore codepaths when CRIU is not installedalso inv2.3.4
  • Enable OCI runtime feature introspection for non-runc runtimes in CRIalso inv2.3.4

v2.3.4

  • Normalize sandbox image references in CRI to resolve images without domain prefixes
Changed 23

v2.0.12

  • Strip sensitive authentication headers when fetching descriptor URLs
  • Surface OCI error bodies in registry 403 responses by falling back to GET requests
  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services
  • Enable log scrubbing by default on Windowsalso inv2.2.7v2.3.4
  • Skip redundant opaque whiteout walks in archive
  • Add --scrub-logs flag for Windows in ctr
  • Normalize descriptor URL origins in docker fetcher

v2.3.5

  • Update runc to v1.5.1
  • Update runhcs to v0.15.0-rc.4
  • Vendor github.com/containerd/platforms v1.0.0-rc.5

v2.2.7

  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enablealso inv2.3.4

v2.3.4

  • Set default runtimeFeatures.UserNamespacesHostNetwork to true in CRI

v2.1.9

v2.0.10

  • Update Go to 1.26.4 and 1.25.11

v2.3.2

  • Allow the last host to retry on transient network errors
  • Update golang.org/x/crypto to v0.53.0also inv2.2.5
  • Update golang.org/x/mod to v0.36.0also inv2.2.5
  • Update golang.org/x/net to v0.55.0also inv2.2.5
  • Update golang.org/x/sync to v0.21.0also inv2.2.5
  • Update golang.org/x/sys to v0.46.0also inv2.2.5
  • Update golang.org/x/term to v0.44.0also inv2.2.5

v2.2.5

  • Update golang.org/x/text to v0.38.0
Fixed 34

v2.0.12

  • Cancel ExecSync IO drain on context cancellation in CRI

v2.3.5

  • Avoid hangs and data races when streaming container standard I/O in CRI
  • Fix missing error messages in OpenTelemetry trace attributes
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/groupalso inv2.2.8
  • Fix configuration loading error when drop-in configuration files have a higher version than the root configuration
  • Avoid containerd startup hangs when loading shims
  • Add context to error when shim delete times out
  • Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC
  • Fix unpack failure for EROFS images containing the erofs OS feature

v2.2.8

  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM servicesalso inv2.3.3
  • Fix EROFS snapshot creation failure caused by concurrent snapshot removal
  • Cancel ExecSync IO drain on context cancellation

v2.2.7

  • Fix mount manager activation error when activation already exists

v2.3.4

  • Memory leak in OOM watcher map when stopping container monitoring
  • Avoid orphaning shims on transient errors when loading process IDs
  • Corruption of binary protobuf shim start responses caused by premature whitespace trimming
  • EROFS snapshotter dropping lower layers stacked above merged filesystem metadata

v2.3.3

  • Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exitalso inv2.2.6
  • Reject CreateContainer calls when the target sandbox is not runningalso inv2.2.6
  • Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaksalso inv2.2.6
  • Surface OCI error bodies in registry 403 responses by falling back to GET requests
  • Align default 4K mkfs block size for EROFS across all platforms

v2.2.6

  • Limit fallback to /blobs endpoint during ref resolution to prevent content store pollutionalso inv2.0.11

v2.1.9

  • Filter CDI annotations on checkpoint restore in cri
  • Do not re-tag restored checkpoints in cri
  • Make checkpoint restore robust to unexpected archive content in cri
  • Bound user-database file reads in openBoundedUserFilealso inv2.0.10
  • Do not propagate reserved labels from image configsalso inv2.0.10v2.3.2v2.2.5

v2.3.2

  • Fix data race when reading shim logs on Windows
  • Fix container startup failures caused by concurrent task RPC timeouts during slow container creation
  • Filter CDI annotations on checkpoint restorealso inv2.2.5
  • Do not re-tag restored checkpointsalso inv2.2.5
  • Make checkpoint restore robust to unexpected archive contentalso inv2.2.5
  • Bound user-database file reads in openUserFilealso inv2.2.5
Deprecated 3

v2.2.7

  • Deprecate checkpoint restore in CreateContainer

v2.3.4

  • Checkpoint restore in CreateContainer
  • Emit deprecation warnings for plugins using deprecated NRI interfaces
Security 10

v2.0.12

  • Fix CVE-2026-53495
  • Fix GHSA-rp3h-jf77-q9p4

v2.3.5

  • Address CVE-2026-53495also inv2.2.8
  • Address GHSA-rp3h-jf77-q9p4also inv2.2.8
  • Strip sensitive authentication headers when fetching descriptor URLsalso inv2.2.8

v2.1.9

Original release notes, newest first

The list above is our reading of these notes; the originals from CNCF are here, one fold per release.

v2.0.12containerd 2.0.12

Welcome to the v2.0.12 release of containerd!

The twelfth patch release for containerd 2.0 contains various fixes and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14045)
  • Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13749)
Runtime
  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#14100)
  • Enable log scrubbing by default on Windows (#13884)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Maksym Pavlenko
  • Oleh Konko
  • Akihiro Suda
  • Chris Henzie
  • Maksim An
  • Phil Estes
  • Wei Fu
  • XlabAI
  • cshung
Changes
  • d6a01e72a Prepare release notes for v2.0.12
  • 2e964db90 Merge commit from fork
  • eebea8c4c cri: cancel ExecSync IO drain on context cancellation
  • d93c158a6 Merge commit from fork
  • 6c060c952 archive: skip redundant opaque whiteout walks
  • Set SystemTemp env var to config temp on Windows (#14100)
    • 56058341c Set SystemTemp env var to config temp on Windows
  • docker fetcher: strip sensitive headers on descriptor URLs (#14045)
    • 88c95d56d core/remotes/docker: normalize descriptor URL origins
    • 7711c3d21 core/remotes/docker: strip sensitive headers on desc.urls fetch
  • Use ScrubLogs by default on Windows (#13884)
    • 84c6caa67 ctr: add --scrub-logs flag for Windows
    • 5fcdfaab2 cri/config: use ScrubLogs by default on Windows
  • ci: bound Go fuzzing by execution count (#13787)
    • b452f2856 ci: bound Go fuzzing by execution count
  • CI: migrate Vagrant to Lima (#13756)
  • remotes: surface OCI error body on HEAD 403 via GET fallback (#13749)
    • 71a73c8a0 remotes: surface OCI error body on HEAD 403 via GET fallback
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.11

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.3.5containerd 2.3.5

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14030)
Runtime
  • Avoid hangs and data races when streaming container standard I/O in CRI (#14094)
  • Fix missing error messages in OpenTelemetry trace attributes (#14049)
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13999)
  • Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#13995)
  • Avoid containerd startup hangs when loading shims (#13983)
  • Add context to error when shim delete times out (#13921)
  • Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)
Snapshotters
  • Fix unpack failure for EROFS images containing the erofs OS feature (#14062)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Phil Estes
  • Samuel Karp
  • Derek McGowan
  • Sebastiaan van Stijn
  • Akhil Mohan
  • Maksym Pavlenko
  • Wei Fu
  • Oleh Konko
  • Austin Vazquez
  • Jing Chen
  • Martín Fernández
  • Paco Xu
  • XlabAI
  • Yuanliang Zhang
Changes
  • 934efa5e0 Prepare release notes for v2.3.5
  • be419b070 Merge commit from fork
  • 9ec55f024 cri: cancel ExecSync IO drain on context cancellation
  • 84ea25bc1 Merge commit from fork
  • c53577965 archive: skip redundant opaque whiteout walks
  • Fix data races and a deadlock in the byte stream helpers (#14094)
    • 9f6be869c Fix data races and a deadlock in the byte stream helpers
  • plugins: remove some stray logrus imports (#14063)
    • 6c59399bf plugins: remove some stray logrus imports
  • snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#14062)
    • f65732115 snapshots/erofs: test the advertised erofs feature platform
    • 5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
  • update runc to v1.5.1 (#14059)
  • vendor: github.com/containerd/platforms v1.0.0-rc.5 (#14048)
    • 676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
  • pkg/tracing: handle error and typed-nil Stringer attributes (#14049)
    • c7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
  • docker fetcher: strip sensitive headers on descriptor URLs (#14030)
    • 58fb846d5 core/remotes/docker: normalize descriptor URL origins
    • c7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
  • update runhcs to v0.15.0-rc.4 (#13990)
  • pkg/oci: resolve rootfs symlinks for user lookup (#13999)
    • 53bf030ea pkg/oci: resolve rootfs symlinks for user lookup
  • Revert "add check on version of drop in configs" (#13995)
    • 7790c4c21 ensure that the final config version is the higest in the config list
    • 1125b053f Revert "add check on version of drop in configs"
  • fix(runtime): apply load timeout to load shim (#13983)
    • 460c47b28 fix(runtime): bound shim loading with the load timeout
  • Add more context to the shim delete error (#13921)
    • 7f97bc122 Add more context to the shim delete error
Changes from containerd/platforms
Dependency Changes
  • github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at v2.3.4

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.2.8containerd 2.2.8

Welcome to the v2.2.8 release of containerd!

The eighth patch release for containerd 2.2 contains various fixes and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14044)
Runtime
  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#14102)
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#14005)
Snapshotters
  • Fix EROFS snapshot creation failure caused by concurrent snapshot removal (#13950)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Wei Fu
  • Oleh Konko
  • Chris Ayoub
  • Maksim An
  • XlabAI
Changes
  • 4864b1814 Prepare release notes for v2.2.8
  • 3458b7fd3 Merge commit from fork
  • 22ccf4314 cri: cancel ExecSync IO drain on context cancellation
  • 2bf01ce17 Merge commit from fork
  • 45166eb82 archive: skip redundant opaque whiteout walks
  • Set SystemTemp env var to config temp on Windows (#14102)
    • 2c722ad04 Set SystemTemp env var to config temp on Windows
  • pkg/oci: resolve rootfs symlinks for user lookup (#14005)
    • 196664bc0 pkg/oci: resolve rootfs symlinks for user lookup
  • docker fetcher: strip sensitive headers on descriptor URLs (#14044)
    • 6da9d9528 core/remotes/docker: normalize descriptor URL origins
    • 4f7851699 core/remotes/docker: strip sensitive headers on desc.urls fetch
  • snapshots/erofs: protect snapshot staging from cleanup (#13950)
    • f7075a224 snapshots/erofs: protect snapshot staging from cleanup
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.2.7

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.2.7containerd 2.2.7

Welcome to the v2.2.7 release of containerd!

The seventh patch release for containerd 2.2 contains various fixes and updates.

Highlights
Container Runtime Interface (CRI)
  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#13937)
  • Deprecate checkpoint restore in CreateContainer (#13872)
  • Support non-UTF-8 binary environment variable values in CRI (#13455)
  • Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option (#13795)
  • Enable OCI runtime feature introspection for non-runc runtimes in CRI (#13779)
Runtime
  • Enable log scrubbing by default on Windows (#13882)
  • Fix mount manager activation error when activation already exists (#13823)
Breaking
  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#13937)
Deprecations
  • Deprecate checkpoint restore in CreateContainer (#13872)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Jordan Liggitt
  • Akihiro Suda
  • Amir Alavi
  • Chris Henzie
  • Derek McGowan
  • Maksym Pavlenko
  • Mike Brown
  • Phil Estes
Changes
  • 43f299db6 Prepare release notes for v2.2.7
  • cri: disable restore in CreateContainer by default (#13937)
    • 5c3a47036 cri: disable restore in CreateContainer by default
  • Use ScrubLogs by default on Windows (#13882)
    • 4c93ae6d5 ctr: add --scrub-logs flag for Windows
    • a124c7e35 cri/config: use ScrubLogs by default on Windows
  • cri: deprecate restore in CreateContainer (#13872)
    • c59d041d8 cri: deprecate restore in CreateContainer
  • Handle []byte envvar value for CRI (#13455)
    • 6cdc2ddce Handle []byte envvar value
    • a60898833 update to v0.34.x kubernetes dependencies
  • Fix mount manager activation error when already exists (#13823)
    • 54ecff6ca core/mount: Fix mount manager activation error when already exists
  • Disable checkpoint restore codepath when CRIU is not installed (#13795)
    • fd966ba29 github/workflows: install criu in node-e2e
    • 7d41b25c9 cri: add enable_criu configuration option
    • 48116fa59 cri: validate CRIU availability and version early
  • fix(cri): introspect OCI runtime features for non-runc runtimes (#13779)
    • 6a3d14e8a fix(cri): introspect OCI runtime features for non-runc runtimes
  • ci: bound Go fuzzing by execution count (#13786)
    • 424b714f0 ci: bound Go fuzzing by execution count
Dependency Changes
  • go.opentelemetry.io/otel v1.38.0 -> v1.41.0
  • go.opentelemetry.io/otel/metric v1.38.0 -> v1.41.0
  • go.opentelemetry.io/otel/trace v1.38.0 -> v1.41.0
  • google.golang.org/protobuf v1.36.10 -> f2248ac996af
  • k8s.io/api v0.34.1 -> v0.34.10
  • k8s.io/apimachinery v0.34.1 -> v0.34.10
  • k8s.io/client-go v0.34.1 -> v0.34.10
  • k8s.io/cri-api v0.34.1 -> v0.34.10

Previous release can be found at v2.2.6

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.3.4containerd 2.3.4

Welcome to the v2.3.4 release of containerd!

The fourth patch release for containerd 2.3 contains various fixes and updates.

Highlights
Container Runtime Interface (CRI)
  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#13913)
  • Set default runtimeFeatures.UserNamespacesHostNetwork to true in CRI (#13914)
  • Deprecate checkpoint restore in CreateContainer (#13868)
  • Support non-UTF-8 binary environment variable values in CRI (#13454)
  • Enable OCI runtime feature introspection for non-runc runtimes in CRI (#13778)
  • Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option (#13734)
  • Normalize sandbox image references in CRI to resolve images without domain prefixes (#13759)
Node Resource Interface (NRI)
  • Emit deprecation warnings for plugins using deprecated NRI interfaces (#13935)
Runtime
  • Enable log scrubbing by default on Windows (#13904)
  • Fix memory leak in OOM watcher map when stopping container monitoring (#13870)
  • Avoid orphaning shims on transient errors when loading process IDs (#13857)
  • Fix corruption of binary protobuf shim start responses caused by premature whitespace trimming (#13803)
Snapshotters
  • Fix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata (#13876)
Breaking
  • Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#13913)
Deprecations
  • Deprecate checkpoint restore in CreateContainer (#13868)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Maksym Pavlenko
  • Mike Brown
  • Akihiro Suda
  • Derek McGowan
  • Jordan Liggitt
  • Paweł Gronowski
  • Amir Alavi
  • Andrew Halaney
  • Bing Hongtao
  • Chris Henzie
  • Harshal Patel
  • Krisztian Litkey
  • Phil Estes
  • Wei Fu
  • ningmingxiao
Changes
  • c1f5360ef Prepare release notes for v2.3.4
  • cri: disable restore in CreateContainer by default (#13913)
    • 928c03c68 cri: disable restore in CreateContainer by default
  • nri,deprecation: record and emit warnings for NRI deprecations. (#13935)
    • 5966e2edb nri,deprecation: emit warnings for old NRI plugins.
  • Set the default of runtimeFeatures.UserNamespacesHostNetwork to true (#13914)
    • ab52c58f1 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
  • Use ScrubLogs by default on Windows (#13904)
    • 0c255158a ctr: add --scrub-logs flag for Windows
    • 1c2b13dc9 cri/config: use ScrubLogs by default on Windows
  • snapshots/erofs: keep lowers stacked above a merged fsmeta (#13876)
    • 0c511e068 snapshots/erofs: keep lowers stacked above a merged fsmeta
  • cri: deprecate restore in CreateContainer (#13868)
    • dc98141df cri: deprecate restore in CreateContainer
  • internal/oom: Fix memory leak by removing watcher from map on Stop (#13870)
    • 537d82d54 internal/oom: Fix memory leak by removing watcher from map on Stop
  • shim_load: Consider shim leaked only if we can't find pids (#13857)
    • decf97a9c shim_load: Consider shim leaked only if we can't find pids
  • core/runtime/v2: Drop checkpointctl module dependency (#13840)
    • 796f07dc8 core/runtime/v2: Drop checkpointctl module dependency
  • Handle []byte envvar value for CRI (#13454)
    • 751fddddb Handle []byte envvar value
    • 0bce9060e update to v0.36.x kubernetes dependencies
  • fix(cri): introspect OCI runtime features for non-runc runtimes (#13778)
    • 61a8f6f45 fix(cri): introspect OCI runtime features for non-runc runtimes
  • core/runtime/v2: Preserve protobuf shim response bytes (#13803)
    • 1d28017be core/runtime/v2: Preserve protobuf shim response bytes
  • Disable checkpoint restore codepath when CRIU is not installed (#13734)
    • 374091d67 github/workflows: install criu in node-e2e
    • db03e3968 cri: add enable_criu configuration option
    • dacd4c7d0 cri: validate CRIU availability and version early
  • ci: bound Go fuzzing by execution count (#13785)
    • 890a9c86c ci: bound Go fuzzing by execution count
  • cri: auto-add prefix for pause image (#13759)
    • 0b2f1d078 cri: auto-add prefix for pause image
Dependency Changes
  • k8s.io/api v0.36.0 -> v0.36.3
  • k8s.io/apimachinery v0.36.0 -> v0.36.3
  • k8s.io/client-go v0.36.0 -> v0.36.3
  • k8s.io/component-base v0.36.0 -> v0.36.3
  • k8s.io/cri-api v0.36.0 -> v0.36.3
  • k8s.io/cri-client v0.36.0 -> v0.36.3
  • k8s.io/cri-streaming v0.36.0 -> v0.36.3
  • sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.3.3

Previous release can be found at v2.3.3

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.3.3containerd 2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

Highlights
  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#13694)
Container Runtime Interface (CRI)
  • Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#13697)
  • Reject CreateContainer calls when the target sandbox is not running (#13668)
  • Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#13645)
Image Distribution
  • Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13738)
Snapshotters
  • Align default 4K mkfs block size for EROFS across all platforms (#13632)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Maksym Pavlenko
  • Samuel Karp
  • Chris Henzie
  • Phil Estes
  • Sebastiaan van Stijn
  • Akihiro Suda
  • Austin Vazquez
  • Chris Crone
  • Derek McGowan
  • Maksim An
  • crawfordxx
  • cshung
  • lauralorenz
Changes
  • Prepare release notes for v2.3.3 (#13750)
  • CI: migrate Vagrant to Lima (#13744)
  • remotes: surface OCI error body in registry 4xx responses (#13738)
    • 457fba3a3 remotes: surface OCI error body on HEAD 403 via GET fallback
  • Update go to 1.26.5 (#13732)
  • ci: pin fog-json to resolve gem conflict (#13711)
    • 5be0495df ci: pin fog-json to resolve gem conflict
  • Fix nil pointer dereference in NRI GetIPs (#13697)
    • 36c713971 Fix nil pointer dereference in NRI GetIPs
  • Set SystemTemp env var to config temp on Windows (#13694)
    • 26dce170d Set SystemTemp env var to config temp on Windows
  • update runhcs to v0.15.0-rc.3 (#13693)
  • Update to current setup-go version (#13686)
    • 3e97edeb7 Update to current setup-go version
  • cri: reject CreateContainer when sandbox is not running (#13668)
    • 8856b0f9c cri: reject CreateContainer when sandbox is not running
  • update runhcs to v0.15.0-rc.2 (#13666)
  • test: fix flaky image timestamp check on coarse clocks (#13643)
    • 168d56783 test: fix flaky image timestamp check on coarse clocks
  • Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks (#13645)
    • d1db61db8 Add deferred call to ShutdownSandbox to avoid leaks
  • erofs: align default mkfs block size across platforms (#13632)
    • 01b0f03f6 erofs: align default mkfs block size across platforms
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.3.2

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.2.6containerd 2.2.6

Welcome to the v2.2.6 release of containerd!

The sixth patch release for containerd 2.2 contains various fixes and updates.

Highlights
Container Runtime Interface (CRI)
  • Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#13696)
  • Reject CreateContainer calls when the target sandbox is not running (#13669)
  • Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#13644)
Image Distribution
  • Limit fallback to /blobs endpoint during ref resolution to prevent content store pollution (#13620)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Chris Henzie
  • Phil Estes
  • Akihiro Suda
  • Joseph Zhang
  • Maksym Pavlenko
  • crawfordxx
  • lauralorenz
Changes
  • Prepare release notes for v2.2.6 (#13751)
  • CI: migrate Vagrant to Lima (#13745)
  • Update go to 1.26.5/1.25.12 (#13726)
  • ci: pin fog-json to resolve gem conflict (#13714)
    • 8f123e4f7 ci: pin fog-json to resolve gem conflict
  • Fix nil pointer dereference in NRI GetIPs (#13696)
    • d3e1a2be9 Fix nil pointer dereference in NRI GetIPs
  • cri: reject CreateContainer when sandbox is not running (#13669)
    • 872a9502e cri: reject CreateContainer when sandbox is not running
  • Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks (#13644)
    • ba7605ee7 Add deferred call to ShutdownSandbox to avoid leaks
  • fix: avoid content storage pollution by limiting the fallback on ref resolution (#13620)
    • 36c4275ee fix:avoid content storage pollution by limiting the fallback on ref resolution
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.2.5

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.0.11containerd 2.0.11

Welcome to the v2.0.11 release of containerd!

The eleventh patch release for containerd 2.0 contains various fixes and updates.

Highlights
Image Distribution
  • Limit fallback to /blobs endpoint during ref resolution to prevent content store pollution (#13622)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Chris Henzie
  • Joseph Zhang
  • Phil Estes
Changes
  • Prepare release notes for v2.0.11 (#13752)
    • 24a2ac9db Prepare release notes for v2.0.11
  • Update go to 1.26.5/1.25.12 (#13730)
  • ci: pin fog-json to resolve gem conflict (#13713)
    • f89266ecb ci: pin fog-json to resolve gem conflict
  • fix: avoid content storage pollution by limiting the fallback on ref resolution (#13622)
    • 179b642d6 fix:avoid content storage pollution by limiting the fallback on ref resolution
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.10

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.1.9containerd 2.1.9

Welcome to the v2.1.9 release of containerd!

The ninth patch release for containerd 2.1 contains various fixes and updates including security patches.

Security Updates

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Chris Henzie
  • Samuel Karp
  • Akihiro Suda
  • Wei Fu
  • Akhil Mohan
  • Ben Cressey
  • Brian Goff
  • Davanum Srinivas
  • Derek McGowan
  • Jared Ledvina
Changes
  • Prepare release notes for v2.1.9 (#13629)
    • b8b3a86e9 Prepare release notes for v2.1.9
    • ee965da63 Merge commit from fork
    • b5e0c4733 Merge commit from fork
    • 02045fd46 cri: filter CDI annotations on checkpoint restore
    • e9c26cf3c Merge commit from fork
    • 2e4583a9f cri: do not re-tag restored checkpoints
    • 6e4ec908a Merge commit from fork
    • 570e69884 cri: make checkpoint restore robust to unexpected archive content
    • 3788b4b9e Merge commit from fork
    • 290420fa7 Bound user-database file reads in openBoundedUserFile
    • bc5014f45 Merge commit from fork
    • 429bcb924 Do not propagate reserved labels from image configs
  • update runc binary to v1.3.6 (#13616)
  • update go to 1.26.4/1.25.11 (#13578)
  • Configure udevd children-max for root-test (#13566)
    • 22515b56f Configure udevd children-max for root-test
  • Clean up disk space in node e2e workflow (#13554)
    • af88d4f60 Clean up disk space in node e2e workflow
  • [github-action] release - Empty allowedSignersFile (#13517)
    • 06df49576 release - Empty allowedSignersFile
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.1.8

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.0.10containerd 2.0.10

Welcome to the v2.0.10 release of containerd!

The tenth patch release for containerd 2.0 includes various bug fixes and updates including security patches.

Security Updates

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Chris Henzie
  • Akhil Mohan
  • Akihiro Suda
  • Ben Cressey
  • Davanum Srinivas
  • Paweł Gronowski
  • Sebastiaan van Stijn
Changes
  • Prepare release notes for v2.0.10 (#13630)
    • cbbd21672 Prepare release notes for v2.0.10
    • 200a4005f Merge commit from fork
    • da4098647 Merge commit from fork
    • 03a19324f Bound user-database file reads in openBoundedUserFile
    • 126177ea4 Merge commit from fork
    • bbf4a2b8e Do not propagate reserved labels from image configs
  • update runc binary to v1.3.6 (#13619)
    • a15e98122 update runc binary to v1.3.6
    • ba2ed2a5e [release/2.2] update runc binary to v1.3.5
    • 474184497 runc: Update runc binary to v1.3.4
  • update go to 1.26.4/1.25.11 (#13581)
  • Configure udevd children-max for root-test (#13565)
    • 55bdc8bc5 Configure udevd children-max for root-test
  • Clean up disk space in node e2e workflow (#13553)
    • 6d81e8867 Clean up disk space in node e2e workflow
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.9

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.3.2containerd 2.3.2

Welcome to the v2.3.2 release of containerd!

The second patch release for containerd 2.3 contains various fixes and updates including security patches.

Security Updates
Highlights
  • Fix a data race when reading shim logs on Windows (#13522)
Image Distribution
  • Allow the last host to retry on transient network errors (#13591)
Runtime
  • Fix container startup failures caused by concurrent task RPC timeouts during slow container creation (#13512)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Chris Henzie
  • Akihiro Suda
  • Derek McGowan
  • Akhil Mohan
  • Austin Vazquez
  • Ben Cressey
  • Brian Goff
  • Maksym Pavlenko
  • Sebastiaan van Stijn
  • Sergey Kanzhelev
Changes
  • Prepare release notes for v2.3.2 (#13627)
    • fb8ca00b0 Prepare release notes for v2.3.2
    • 9c69960ba Merge commit from fork
    • 0f6251520 Merge commit from fork
    • 91d7471e2 cri: filter CDI annotations on checkpoint restore
    • 7c2e086bf Merge commit from fork
    • dae67765f cri: do not re-tag restored checkpoints
    • 94aa1e2c1 Merge commit from fork
    • 09599078f cri: make checkpoint restore robust to unexpected archive content
    • e1fdb8d22 Merge commit from fork
    • ff1d116ef Bound user-database file reads in openUserFile
    • d156e07cb Merge commit from fork
    • f99aad54a Do not propagate reserved labels from image configs
  • vendor: golang.org/x/crypto v0.53.0 (#13608)
    • 0b9469501 [release/2.3] vendor: golang.org/x/crypto v0.53.0
  • resolver: retry on transient network errors (#13591)
    • 983bbddc1 resolver: retry on transient network errors
  • update runc binary to v1.4.3 (#13601)
  • update go to 1.26.4 (#13580)
    • 8a49dfe85 update go to 1.26.4
    • 5aa6bb2b7 remove 1.26.2 from CI builds as it is not supported any longer due to the dependency
  • Configure udevd children-max for root-test (#13568)
    • bfb8aebc0 Configure udevd children-max for root-test
  • core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read (#13522)
    • 62ceafff0 core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
  • runc-shim: don't hold the service lock across runc create (#13512)
    • 9b0c0dc58 runc-shim: don't hold the service lock across runc create
  • contrib/checkpoint: increase timeouts to 30s (#13459)
    • f588bc6fb contrib/checkpoint: increase timeouts to 30s
Dependency Changes
  • golang.org/x/crypto v0.49.0 -> v0.53.0
  • golang.org/x/mod v0.35.0 -> v0.36.0
  • golang.org/x/net v0.52.0 -> v0.55.0
  • golang.org/x/sync v0.20.0 -> v0.21.0
  • golang.org/x/sys v0.43.0 -> v0.46.0
  • golang.org/x/term v0.41.0 -> v0.44.0
  • golang.org/x/text v0.35.0 -> v0.38.0

Previous release can be found at v2.3.1

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink

v2.2.5containerd 2.2.5

Welcome to the v2.2.5 release of containerd!

The fifth patch release for containerd 2.2 contains various fixes and updates including security patches.

Security Updates

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Chris Henzie
  • Akihiro Suda
  • Derek McGowan
  • Maksym Pavlenko
  • Akhil Mohan
  • Ben Cressey
  • Brian Goff
  • Davanum Srinivas
  • Sebastiaan van Stijn
Changes
  • Prepare release notes for v2.2.5 (#13628)
    • 269031099 Prepare release notes for v2.2.5
    • ad59aa564 Merge commit from fork
    • 0b4d23690 Merge commit from fork
    • be8460656 cri: filter CDI annotations on checkpoint restore
    • 347240f72 Merge commit from fork
    • cff578841 cri: do not re-tag restored checkpoints
    • 668cf2c2f Merge commit from fork
    • 357652293 cri: make checkpoint restore robust to unexpected archive content
    • d43da05af Merge commit from fork
    • 30708e8d1 Bound user-database file reads in openUserFile
    • 028647ea2 Merge commit from fork
    • b6072a49f Do not propagate reserved labels from image configs
  • vendor: golang.org/x/crypto v0.53.0 (#13607)
    • cfea2c141 [release/2.2] vendor: golang.org/x/crypto v0.53.0
  • update runc binary to v1.3.6 (#13606)
  • update go to 1.26.4/1.25.11 (#13577)
  • Configure udevd children-max for root-test (#13567)
    • 2b7dfbd7f Configure udevd children-max for root-test
  • Clean up disk space in node e2e workflow (#13548)
    • 1500e586f Clean up disk space in node e2e workflow
  • contrib/checkpoint: increase timeouts to 30s (#13460)
    • 9991e944e contrib/checkpoint: increase timeouts to 30s
  • release: don't mark 2.2 releases as latest (#13458)
    • 55a1f85d5 release: don't mark 2.2 releases as latest
Dependency Changes
  • golang.org/x/crypto v0.45.0 -> v0.53.0
  • golang.org/x/mod v0.29.0 -> v0.36.0
  • golang.org/x/net v0.47.0 -> v0.55.0
  • golang.org/x/sync v0.18.0 -> v0.21.0
  • golang.org/x/sys v0.38.0 -> v0.46.0
  • golang.org/x/term v0.37.0 -> v0.44.0
  • golang.org/x/text v0.31.0 -> v0.38.0

Previous release can be found at v2.2.4

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View originalPermalink