# containerd changelog

> The industry-standard container runtime underneath Docker and Kubernetes.

- Vendor: CNCF
- Category: Developer Tools
- Official site: https://containerd.io
- Tracked by: What's New (https://whatsnew.fyi/product/containerd)
- Harvested from: GitHub (containerd/containerd)
- Entries below: 11 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

## Releases

### v2.4.0-beta.0 — containerd 2.4.0-beta.0

- Date: 2026-08-10
- Version: v2.4.0-beta.0
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.4.0-beta.0
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.4.0-beta.0
- Labels: Pre-release

- **added** — Include media type in content create event
- **added** — Support warm image cache for erofs snapshotter
- **added** — Add parent path to runc checkpoint options
- **added** — Introspect OCI runtime features for non-runc runtimes
- **changed** — Use klauspost/compress/gzip for decode
- **added** — Add forward References to the GC collection context
- **added** — Add max size label for snapshots
- **removed** — Remove restore in CreateContainer
- **fixed** — Fix sandbox task API endpoints for non-runc runtimes

Welcome to the v2.4.0-beta.0 release of containerd!
*This is a pre-release of containerd*

containerd 2.4 is a regular (non-LTS) release with a shorter support window,
intended for users who want to adopt new features sooner. As the release
following the 2.3 LTS, it is the point in the release cycle where previously
deprecated features may be removed, so this release may include breaking
changes; check the notes below and clear any deprecation warnings from your
current version before upgrading.

Users prioritizing stability and a longer support lifecycle should stay on the
2.3 LTS release.

This is a beta release and some functionality is still under development.

###### Highlights

* **Include media type in content create event** ([#13833](https://github.com/containerd/containerd/pull/13833))
* **Support warm image cache for erofs snapshotter** ([#13813](https://github.com/containerd/containerd/pull/13813))
* **Add parent path to runc checkpoint options** ([#13699](https://github.com/containerd/containerd/pull/13699))

###### Container Runtime Interface (CRI)

* **Introspect OCI runtime features for non-runc runtimes** ([#13504](https://github.com/containerd/containerd/pull/13504))

###### Image Distribution

* **Use klauspost/compress/gzip for decode** ([#13560](https://github.com/containerd/containerd/pull/13560))

###### Image Storage

* **Add forward References to the GC collection context** ([#13634](https://github.com/containerd/containerd/pull/13634))

###### Snapshotters

* **Add max size label for snapshots** ([#13520](https://github.com/containerd/containerd/pull/13520))

###### Breaking

* Remove restore in CreateContainer ([#13871](https://github.com/containerd/containerd/pull/13871))

###### Deprecations

* **Fix sandbox task API endpoints for non-runc runtimes** ([#13360](https://github.com/containerd/containerd/pull/13360))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Maksym Pavlenko
* Samuel Karp
* Akihiro Suda
* Derek McGowan
* Wei Fu
* Sebastiaan van Stijn
* Chris Henzie
* Paweł Gronowski
* Mike Brown
* Brian Goff
* Jordan Liggitt
* Austin Vazquez
* Kazuyoshi Kato
* Kir Kolyshkin
* Phil Estes
* Sergey Kanzhelev
* ningmingxiao
* Ahmet Alp Balkan
* Akhil Mohan
* Chris Ayoub
* Damien Grisonnet
* Esteban Ginez
* Laura Lorenz
* Maksim An
* Abhishek Bhunia
* Alan Grosskurth
* Albin Kerouanton
* Alex Lyn
* Aman Raj
* Amir Alavi
* Amit Barve
* Andrew Halaney
* AprilNEA
* Arjun Yogidas
* Ayato Tokubi
* Aysha Afrah Ziya
* Ben Cressey
* Bing Hongtao
* Chris Crone
* Craig Gumbley
* Daniel De Graaf
* Davanum Srinivas
* Dr. Jan-Philip Gehrcke
* Gao Xiang
* Harshal Patel
* Henry Wang
* Kohei Tokunaga
* Krisztian Litkey
* LEI WANG
* Mikhail Dmitrichenko
* Nikolaus Schuetz
* Paco Xu
* Philip Laine
* SaloniRathi
* Tianon Gravi
* ayush-panta
* crawfordxx
* cshung
* s3onghyun
* 归寂
* 徐晓伟

###### Dependency Changes

* **cyphar.com/go-pathrs**                                                         v0.2.1 -> v0.2.4
* **github.com/Microsoft/hcsshim**                                                 v0.15.0-rc.1 -> v0.15.0-rc.3
* **github.com/ProtonMail/go-crypto**                                              v1.4.1 **_new_**
* **github.com/cilium/ebpf**                                                       v0.16.0 -> v0.17.3
* **github.com/cloudflare/circl**                                                  v1.6.3 **_new_**
* **github.com/containerd/containerd/api**                                         v1.11.0 -> v1.12.0-beta.0
* **github.com/containerd/imgcrypt/v2**                                            v2.0.2 -> v2.0.3
* **github.com/containerd/nri**                                                    v0.12.0 -> v0.12.1
* **github.com/containerd/ttrpc**                                                  v1.2.8 -> v1.2.9
* **github.com/containerd/typeurl/v2**                                             v2.2.3 -> v2.3.0
* **github.com/cont

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.4.0-beta.0]_

### api/v1.12.0-beta.0 — containerd API 1.12.0-beta.0

- Date: 2026-08-05
- Version: api/v1.12.0-beta.0
- Original notes: https://github.com/containerd/containerd/releases/tag/api/v1.12.0-beta.0
- Permalink: https://whatsnew.fyi/product/containerd/releases/api-v1.12.0-beta.0
- Labels: Pre-release

- **added** — Include media type in content create event
- **added** — Add parent path to runc checkpoint options
- **deprecated** — Fix sandbox task API endpoints for non-runc runtimes

Welcome to the api/v1.12.0-beta.0 release of containerd!
*This is a pre-release of containerd*

The 13th release for the containerd 1.x API aligns with the containerd 2.4 release.

###### Highlights

* **Include media type in content create event** ([#13833](https://github.com/containerd/containerd/pull/13833))
* **Add parent path to runc checkpoint options** ([#13699](https://github.com/containerd/containerd/pull/13699))

###### Deprecations

* **Fix sandbox task API endpoints for non-runc runtimes** ([#13360](https://github.com/containerd/containerd/pull/13360))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Maksym Pavlenko
* Derek McGowan
* Jordan Liggitt
* Samuel Karp
* Wei Fu
* Kohei Tokunaga
* Philip Laine
* Sergey Kanzhelev

###### Changes
<details><summary>16 commits</summary>
<p>

* Prepare release notes for api/v1.12.0-beta.0 ([#13899](https://github.com/containerd/containerd/pull/13899))
  * [`0ff04dc3f`](https://github.com/containerd/containerd/commit/0ff04dc3f7934523f6a2001e67d9572d4a9d4885) Prepare release notes for api/v1.12.0-beta.0
* Include media type in content create event ([#13833](https://github.com/containerd/containerd/pull/13833))
  * [`a452c2e23`](https://github.com/containerd/containerd/commit/a452c2e2304d43f48299ed2663ed82673b25be81) Include media type in content create event
* build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api ([#13819](https://github.com/containerd/containerd/pull/13819))
  * [`52c5f1f64`](https://github.com/containerd/containerd/commit/52c5f1f64e2184af56f3550940db29ccdb94e576) build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api
* build(deps): bump github.com/containerd/ttrpc to v1.2.9 ([#13740](https://github.com/containerd/containerd/pull/13740))
  * [`658a1c78b`](https://github.com/containerd/containerd/commit/658a1c78b52e25002c9c26a504055c8d3af09ea3) build(deps): bump github.com/containerd/ttrpc to v1.2.9
* Add parent path to runc checkpoint options ([#13699](https://github.com/containerd/containerd/pull/13699))
  * [`ea0ed51e2`](https://github.com/containerd/containerd/commit/ea0ed51e2101448874215c0de945197a1cafdea4) shim: allow specifying runc's --parent-path during checkpointing
* Update typeurl/v2 to v2.3.0 to drop gogo dependency ([#13490](https://github.com/containerd/containerd/pull/13490))
  * [`ce3914324`](https://github.com/containerd/containerd/commit/ce39143249b595d2b275e47c279c129f67e3a2a9) Update typeurl/v2 to v2.3.0 to drop gogo dependency
* do not hide linitng errors ([#13423](https://github.com/containerd/containerd/pull/13423))
  * [`7f10e9eb5`](https://github.com/containerd/containerd/commit/7f10e9eb5fe3b6e89438fd4806f75bcddfbf576e) do not hide linitng errors
* Fix sandbox task API endpoints for non-runc runtimes ([#13360](https://github.com/containerd/containerd/pull/13360))
  * [`ac01ae5c2`](https://github.com/containerd/containerd/commit/ac01ae5c2766961c3592523ab679dc06ca73c331) protos: include task API address to CreateTaskRequest
</p>
</details>

###### Dependency Changes

* **github.com/containerd/ttrpc**                v1.2.5 -> v1.2.9
* **github.com/containerd/typeurl/v2**           v2.1.1 -> v2.3.0
* **golang.org/x/net**                           v0.48.0 -> v0.55.0
* **golang.org/x/sys**                           v0.39.0 -> v0.46.0
* **golang.org/x/text**                          v0.32.0 -> v0.37.0
* **google.golang.org/genproto/googleapis/rpc**  ff82c1b0f217 -> a57be14db171
* **google.golang.org/grpc**                     v1.79.3 -> v1.81.1
* **google.golang.org/protobuf**                 v1.36.10 -> v1.36.11

Previous release can be found at [api/v1.11.0](https://github.com/containerd/containerd/releases/tag/api/v1.11.0)

### v2.3.3 — containerd 2.3.3

- Date: 2026-07-10
- Version: v2.3.3
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.3.3
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.3.3

- **fixed** — Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services
- **fixed** — Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit
- **fixed** — Reject CreateContainer calls when the target sandbox is not running
- **fixed** — Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks
- **fixed** — Surface OCI error bodies in registry 403 responses by falling back to GET requests
- **fixed** — Align default 4K mkfs block size for EROFS across all platforms

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

###### Highlights

* Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ([#13694](https://github.com/containerd/containerd/pull/13694))

###### Container Runtime Interface (CRI)

* Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ([#13697](https://github.com/containerd/containerd/pull/13697))
* Reject CreateContainer calls when the target sandbox is not running ([#13668](https://github.com/containerd/containerd/pull/13668))
* Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ([#13645](https://github.com/containerd/containerd/pull/13645))

###### Image Distribution

* Surface OCI error bodies in registry 403 responses by falling back to GET requests ([#13738](https://github.com/containerd/containerd/pull/13738))

###### Snapshotters

* Align default 4K mkfs block size for EROFS across all platforms ([#13632](https://github.com/containerd/containerd/pull/13632))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Maksym Pavlenko
* Samuel Karp
* Chris Henzie
* Phil Estes
* Sebastiaan van Stijn
* Akihiro Suda
* Austin Vazquez
* Chris Crone
* Derek McGowan
* Maksim An
* crawfordxx
* cshung
* lauralorenz

###### Changes
<details><summary>14 commits</summary>
<p>

* Prepare release notes for v2.3.3 ([#13750](https://github.com/containerd/containerd/pull/13750))
  * [`7f6cee02a`](https://github.com/containerd/containerd/commit/7f6cee02ad5afc5f3244ec36937d8eed61f7057d) Prepare release notes for v2.3.3
* CI: migrate Vagrant to Lima ([#13744](https://github.com/containerd/containerd/pull/13744))
  * [`7316210ce`](https://github.com/containerd/containerd/commit/7316210ce6bd95e8afd2856e256b5d9855385d01) CI: migrate Vagrant to Lima
* remotes: surface OCI error body in registry 4xx responses ([#13738](https://github.com/containerd/containerd/pull/13738))
  * [`457fba3a3`](https://github.com/containerd/containerd/commit/457fba3a380dab10ef7e9334352352f72caf8423) remotes: surface OCI error body on HEAD 403 via GET fallback
* Update go to 1.26.5 ([#13732](https://github.com/containerd/containerd/pull/13732))
  * [`dc2df934e`](https://github.com/containerd/containerd/commit/dc2df934efebc78523d6821c2520f538ff65986d) Update go to 1.26.5
* ci: pin fog-json to resolve gem conflict ([#13711](https://github.com/containerd/containerd/pull/13711))
  * [`5be0495df`](https://github.com/containerd/containerd/commit/5be0495dff529910a85b6ca1b2a1a35ea220da59) ci: pin fog-json to resolve gem conflict
* Fix nil pointer dereference in NRI GetIPs ([#13697](https://github.com/containerd/containerd/pull/13697))
  * [`36c713971`](https://github.com/containerd/containerd/commit/36c7139715fee7ff2f87f78a8b3d6fea4e2e7b35) Fix nil pointer dereference in NRI GetIPs
* Set SystemTemp env var to config temp on Windows ([#13694](https://github.com/containerd/containerd/pull/13694))
  * [`26dce170d`](https://github.com/containerd/containerd/commit/26dce170df24e227aeb5ccd1cec1e5c91b307595) Set SystemTemp env var to config temp on Windows
* update runhcs to v0.15.0-rc.3 ([#13693](https://github.com/containerd/containerd/pull/13693))
  * [`9bc2c2349`](https://github.com/containerd/containerd/commit/9bc2c23496073c3b48b083f6bede9e82d879a7d4) update runhcs to v0.15.0-rc.3
* Update to current setup-go version ([#13686](https://github.com/containerd/containerd/pull/13686))
  * [`3e97edeb7`](https://github.com/containerd/containerd/commit/3e97edeb7d3dfcee903c37ab531b1fdfe0a49ae4) Update to current setup-go version
* cri: reject CreateContainer when sandbox is not running ([#13668](https://github.com/containerd/containerd/pull/13668))
  * [`8856b0f9c`](https://github.com/containerd/containerd/commit/8856b0f9c3ae50efe6f2a84ab7337953faeb129f) cri: reject CreateContainer wh

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.3.3]_

### v2.2.6 — containerd 2.2.6

- Date: 2026-07-09
- Version: v2.2.6
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.2.6
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.2.6

- **fixed** — Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit
- **fixed** — Reject CreateContainer calls when the target sandbox is not running
- **fixed** — Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks
- **fixed** — Limit fallback to /blobs endpoint during ref resolution to prevent content store pollution

Welcome to the v2.2.6 release of containerd!

The sixth patch release for containerd 2.2 contains various fixes and updates.

###### Highlights

###### Container Runtime Interface (CRI)

* Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ([#13696](https://github.com/containerd/containerd/pull/13696))
* Reject CreateContainer calls when the target sandbox is not running ([#13669](https://github.com/containerd/containerd/pull/13669))
* Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ([#13644](https://github.com/containerd/containerd/pull/13644))

###### Image Distribution

* Limit fallback to /blobs endpoint during ref resolution to prevent content store pollution ([#13620](https://github.com/containerd/containerd/pull/13620))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Phil Estes
* Akihiro Suda
* Joseph Zhang
* Maksym Pavlenko
* crawfordxx
* lauralorenz

###### Changes
<details><summary>8 commits</summary>
<p>

* Prepare release notes for v2.2.6 ([#13751](https://github.com/containerd/containerd/pull/13751))
  * [`701734d2f`](https://github.com/containerd/containerd/commit/701734d2f96b150769ef2f0b7be2e1e39e67f2fb) Prepare release notes for v2.2.6
* CI: migrate Vagrant to Lima ([#13745](https://github.com/containerd/containerd/pull/13745))
  * [`672ea355f`](https://github.com/containerd/containerd/commit/672ea355f5a7134160fc66a1a800cd9f89176f40) CI: migrate Vagrant to Lima
* Update go to 1.26.5/1.25.12 ([#13726](https://github.com/containerd/containerd/pull/13726))
  * [`d7eba3f42`](https://github.com/containerd/containerd/commit/d7eba3f429449d19e9ea1f4e5f017a8893d49281) Update go to 1.26.5/1.25.12
* ci: pin fog-json to resolve gem conflict ([#13714](https://github.com/containerd/containerd/pull/13714))
  * [`8f123e4f7`](https://github.com/containerd/containerd/commit/8f123e4f7fbe59cf9ca86999f65cc8f2021dafd6) ci: pin fog-json to resolve gem conflict
* Fix nil pointer dereference in NRI GetIPs ([#13696](https://github.com/containerd/containerd/pull/13696))
  * [`d3e1a2be9`](https://github.com/containerd/containerd/commit/d3e1a2be92e527bf40ea4746b616bd782e108380) Fix nil pointer dereference in NRI GetIPs
* cri: reject CreateContainer when sandbox is not running ([#13669](https://github.com/containerd/containerd/pull/13669))
  * [`872a9502e`](https://github.com/containerd/containerd/commit/872a9502eebee41d58005a8a2eb11c7194025fb1) cri: reject CreateContainer when sandbox is not running
* Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ([#13644](https://github.com/containerd/containerd/pull/13644))
  * [`ba7605ee7`](https://github.com/containerd/containerd/commit/ba7605ee7eb74493c464018055b43f0fed5e9289) Add deferred call to ShutdownSandbox to avoid leaks
* fix: avoid content storage pollution by limiting the fallback on ref resolution ([#13620](https://github.com/containerd/containerd/pull/13620))
  * [`36c4275ee`](https://github.com/containerd/containerd/commit/36c4275eed174bdf40df60a5dea2c32191a1e946) fix:avoid content storage pollution by limiting the fallback on ref resolution
</p>
</details>

###### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.2.5](https://github.com/containerd/containerd/releases/tag/v2.2.5)
###### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See als

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.2.6]_

### v2.0.11 — containerd 2.0.11

- Date: 2026-07-09
- Version: v2.0.11
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.0.11
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.0.11

- **fixed** — Limit fallback to /blobs endpoint during ref resolution to prevent content store pollution

Welcome to the v2.0.11 release of containerd!

The eleventh patch release for containerd 2.0 contains various fixes and updates.

###### Highlights

###### Image Distribution

* Limit fallback to /blobs endpoint during ref resolution to prevent content store pollution ([#13622](https://github.com/containerd/containerd/pull/13622))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Joseph Zhang
* Phil Estes

###### Changes
<details><summary>4 commits</summary>
<p>

* Prepare release notes for v2.0.11 ([#13752](https://github.com/containerd/containerd/pull/13752))
  * [`24a2ac9db`](https://github.com/containerd/containerd/commit/24a2ac9db44440a5c23314bbbe265a0be5330d30) Prepare release notes for v2.0.11
* Update go to 1.26.5/1.25.12 ([#13730](https://github.com/containerd/containerd/pull/13730))
  * [`8f0774f1a`](https://github.com/containerd/containerd/commit/8f0774f1a0c7b07fc4cd8ae8a7fdefdc212ea620) Update go to 1.26.5/1.25.12
* ci: pin fog-json to resolve gem conflict ([#13713](https://github.com/containerd/containerd/pull/13713))
  * [`f89266ecb`](https://github.com/containerd/containerd/commit/f89266ecb9d2bcb7b8677ddabda09d6dc4e21aca) ci: pin fog-json to resolve gem conflict
* fix: avoid content storage pollution by limiting the fallback on ref resolution ([#13622](https://github.com/containerd/containerd/pull/13622))
  * [`179b642d6`](https://github.com/containerd/containerd/commit/179b642d662ddbaeebe57214164a399ceaed5fbd) fix:avoid content storage pollution by limiting the fallback on ref resolution
</p>
</details>

###### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.0.10](https://github.com/containerd/containerd/releases/tag/v2.0.10)
###### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

### v1.7.34 — containerd 1.7.34

- Date: 2026-07-09
- Version: v1.7.34
- Original notes: https://github.com/containerd/containerd/releases/tag/v1.7.34
- Permalink: https://whatsnew.fyi/product/containerd/releases/v1.7.34

- **fixed** — Fix lost container exit events when events arrive before container info is cached

Welcome to the v1.7.34 release of containerd!

The thirty-fourth patch release for containerd 1.7 contains various fixes and updates.

###### Highlights

###### Container Runtime Interface (CRI)

* Fix lost container exit events when events arrive before container info is cached ([#11634](https://github.com/containerd/containerd/pull/11634))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Chris Henzie
* Samuel Karp
* Akihiro Suda
* Maksym Pavlenko
* Phil Estes
* Sopho Merkviladze
* ningmingxiao

###### Changes
<details><summary>5 commits</summary>
<p>

* Prepare release notes for v1.7.34 ([#13753](https://github.com/containerd/containerd/pull/13753))
  * [`7db112471`](https://github.com/containerd/containerd/commit/7db112471b99935b1deea31bcac9070ce2ccb4de) Prepare release notes for v1.7.34
* Update go to 1.26.5/1.25.12 ([#13731](https://github.com/containerd/containerd/pull/13731))
  * [`c06144c85`](https://github.com/containerd/containerd/commit/c06144c8516ccd2fb632e0db4290a7cb5909cdb6) Update go to 1.26.5/1.25.12
* ci: pin fog-json to resolve gem conflict ([#13712](https://github.com/containerd/containerd/pull/13712))
  * [`b84460e50`](https://github.com/containerd/containerd/commit/b84460e50769d336bf62dca976eb23f984f7d10b) ci: pin fog-json to resolve gem conflict
* cri:fix lost container exit events if they arrive before info is cached ([#11634](https://github.com/containerd/containerd/pull/11634))
  * [`2fe076ea7`](https://github.com/containerd/containerd/commit/2fe076ea7ebaac58d3e731bcb6dcde84d3fe5719) cri:fix lost container exit events if they arrive before info is cached
* build(deps): bump golang.org/x/* dependencies ([#13502](https://github.com/containerd/containerd/pull/13502))
  * [`862057716`](https://github.com/containerd/containerd/commit/862057716f66750c93fade0c0bc1cff4a8169039) bump golang.org/x/* dependencies
</p>
</details>

###### Dependency Changes

* **golang.org/x/crypto**  v0.45.0 -> v0.52.0
* **golang.org/x/mod**     v0.29.0 -> v0.35.0
* **golang.org/x/net**     v0.47.0 -> v0.55.0
* **golang.org/x/sync**    v0.18.0 -> v0.20.0
* **golang.org/x/sys**     v0.38.0 -> v0.45.0
* **golang.org/x/term**    v0.37.0 -> v0.43.0
* **golang.org/x/text**    v0.31.0 -> v0.37.0

Previous release can be found at [v1.7.33](https://github.com/containerd/containerd/releases/tag/v1.7.33)

### v2.1.9 — containerd 2.1.9

- Date: 2026-06-18
- Version: v2.1.9
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.1.9
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.1.9

- **security** — Fix CVE-2026-50195
- **security** — Fix CVE-2026-53488
- **security** — Fix CVE-2026-53492
- **security** — Fix CVE-2026-53489
- **security** — Fix CVE-2026-47262
- **fixed** — Filter CDI annotations on checkpoint restore in cri
- **fixed** — Do not re-tag restored checkpoints in cri
- **fixed** — Make checkpoint restore robust to unexpected archive content in cri
- **fixed** — Bound user-database file reads in openBoundedUserFile
- **fixed** — Do not propagate reserved labels from image configs
- **changed** — Update runc binary to v1.3.6
- **changed** — Update Go to 1.26.4/1.25.11

Welcome to the v2.1.9 release of containerd!

The ninth patch release for containerd 2.1 contains various fixes
and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-50195**](https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)
  * [**CVE-2026-53488**](https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
  * [**CVE-2026-53492**](https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)
  * [**CVE-2026-53489**](https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)
  * [**CVE-2026-47262**](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Chris Henzie
* Samuel Karp
* Akihiro Suda
* Wei Fu
* Akhil Mohan
* Ben Cressey
* Brian Goff
* Davanum Srinivas
* Derek McGowan
* Jared Ledvina

###### Changes
<details><summary>23 commits</summary>
<p>

* Prepare release notes for v2.1.9 ([#13629](https://github.com/containerd/containerd/pull/13629))
  * [`b8b3a86e9`](https://github.com/containerd/containerd/commit/b8b3a86e9e5c240943379f9f89c56943688003c8) Prepare release notes for v2.1.9
  * [`ee965da63`](https://github.com/containerd/containerd/commit/ee965da639fa919559b9cf3717c6647567da9181) Merge commit from fork
  * [`b5e0c4733`](https://github.com/containerd/containerd/commit/b5e0c473300aa973730c90c2117010821640790d) Merge commit from fork
  * [`02045fd46`](https://github.com/containerd/containerd/commit/02045fd4696d21db11767226ff14576522809066) cri: filter CDI annotations on checkpoint restore
  * [`e9c26cf3c`](https://github.com/containerd/containerd/commit/e9c26cf3c8635232ab14956c5e9b788439b0fbc2) Merge commit from fork
  * [`2e4583a9f`](https://github.com/containerd/containerd/commit/2e4583a9f7934961f47a5c4bba6ea779dce95635) cri: do not re-tag restored checkpoints
  * [`6e4ec908a`](https://github.com/containerd/containerd/commit/6e4ec908add52a98cd39137beb3a5a1f3c50232b) Merge commit from fork
  * [`570e69884`](https://github.com/containerd/containerd/commit/570e69884650eb6b0bcee19edd812428adbac8c2) cri: make checkpoint restore robust to unexpected archive content
  * [`3788b4b9e`](https://github.com/containerd/containerd/commit/3788b4b9e0555e0967d4aebd9562a8312fca135f) Merge commit from fork
  * [`290420fa7`](https://github.com/containerd/containerd/commit/290420fa7bbe3c77f5b8e96f6a7946ec3d6cb188) Bound user-database file reads in openBoundedUserFile
  * [`bc5014f45`](https://github.com/containerd/containerd/commit/bc5014f451157074562015677d2bf9633de7fb6a) Merge commit from fork
  * [`429bcb924`](https://github.com/containerd/containerd/commit/429bcb924c278571f3d135933f562a87af1b6a53) Do not propagate reserved labels from image configs
* update runc binary to v1.3.6 ([#13616](https://github.com/containerd/containerd/pull/13616))
  * [`698f2fd66`](https://github.com/containerd/containerd/commit/698f2fd664b09497f7b2c4d63b21ba97debd2f5b) update runc binary to v1.3.6
* update go to 1.26.4/1.25.11 ([#13578](https://github.com/containerd/containerd/pull/13578))
  * [`b8b75a90e`](https://github.com/containerd/containerd/commit/b8b75a90ef06d91f96dbea5d56fcabe00ad376bf) update go to 1.26.4/1.25.11
* Configure udevd children-max for root-test ([#13566](https://github.com/containerd/containerd/pull/13566))
  * [`22515b56f`](https://github.com/containerd/containerd/commit/22515b56fb7c242cf5629f7a9d53537dc77ae42b) Configure udevd children-max for root-test
* Clean up disk space in node e2e workflow ([#13554](https://github.com/containerd/containerd/pull/13554))
  * [`af88d4f60`](https://github.com/containerd/containerd/commit/af88d4f604da9b62dbf61dac72e5835e51ebf474) Clean up disk space in node e2e workflow
* [github-action] release - Empty allowedSignersFile ([#13517](https://github.com/containerd/containerd/pull/13517))
  * [`06d

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.1.9]_

### v1.7.33 — containerd 1.7.33

- Date: 2026-06-18
- Version: v1.7.33
- Original notes: https://github.com/containerd/containerd/releases/tag/v1.7.33
- Permalink: https://whatsnew.fyi/product/containerd/releases/v1.7.33

- **security** — Address CVE-2026-53488 in containerd
- **security** — Address CVE-2026-47262 in containerd
- **security** — Address CVE-2026-34986 in go-jose by bumping go-jose/go-jose/v3 to v3.0.5
- **fixed** — Bound user-database file reads in openBoundedUserFile
- **fixed** — Do not propagate reserved labels from image configs
- **changed** — Update runc binary to v1.3.6
- **changed** — Update Go to 1.26.4 and 1.25.11

Welcome to the v1.7.33 release of containerd!

The thirty-third patch release for containerd 1.7 contains various fixes
and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-53488**](https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
  * [**CVE-2026-47262**](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

* **go-jose**
  * [**CVE-2026-34986**](https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Akihiro Suda
* Akhil Mohan
* Ben Cressey
* Davanum Srinivas
* Sopho Merkviladze

###### Changes
<details><summary>17 commits</summary>
<p>

* Prepare release notes for v1.7.33 ([#13631](https://github.com/containerd/containerd/pull/13631))
  * [`7517e6737`](https://github.com/containerd/containerd/commit/7517e6737a6077dbdb5d403e693169cb8163549d) Prepare release notes for v1.7.33
  * [`ab306518a`](https://github.com/containerd/containerd/commit/ab306518a326fe7e4c27f64a8cf62b7a0fb3e9c6) Merge commit from fork
  * [`d34cdafda`](https://github.com/containerd/containerd/commit/d34cdafdaf51e1db435f1e0898f16d0da5038557) Merge commit from fork
  * [`9ab2b7a89`](https://github.com/containerd/containerd/commit/9ab2b7a894d15738f8323f69def272c29277b57f) Bound user-database file reads in openBoundedUserFile
  * [`1e9806f90`](https://github.com/containerd/containerd/commit/1e9806f90d934f2e0180c279fa9f0019537f2704) Merge commit from fork
  * [`4d8ba4d23`](https://github.com/containerd/containerd/commit/4d8ba4d23561c9ec21b0113ddcfc22f41792b25e) Do not propagate reserved labels from image configs
* update runc binary to v1.3.6 ([#13615](https://github.com/containerd/containerd/pull/13615))
  * [`74c728c13`](https://github.com/containerd/containerd/commit/74c728c13487844c43620b14cc66dc05dca96836) update runc binary to v1.3.6
* update go to 1.26.4/1.25.11 ([#13579](https://github.com/containerd/containerd/pull/13579))
  * [`947caa4b7`](https://github.com/containerd/containerd/commit/947caa4b7469fd3b71ee62d0f7410b00252f5842) update go to 1.26.4/1.25.11
* Configure udevd children-max for root-test ([#13564](https://github.com/containerd/containerd/pull/13564))
  * [`e884e964e`](https://github.com/containerd/containerd/commit/e884e964e31c4fb61fcdc376a2fa3151ac245a65) Configure udevd children-max for root-test
* Clean up disk space in node e2e workflow ([#13552](https://github.com/containerd/containerd/pull/13552))
  * [`b9e756888`](https://github.com/containerd/containerd/commit/b9e7568888325736b12c9f50271045bc618dc9b9) Clean up disk space in node e2e workflow
* Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 ([#13467](https://github.com/containerd/containerd/pull/13467))
  * [`4dfc1844e`](https://github.com/containerd/containerd/commit/4dfc1844e8cb46a6c04a8c57211ab50e1412ccc1) Bump go-jose to v3.0.5 to address CVE-2026-34986
</p>
</details>

###### Dependency Changes

* **github.com/go-jose/go-jose/v3**  v3.0.4 -> v3.0.5

Previous release can be found at [v1.7.32](https://github.com/containerd/containerd/releases/tag/v1.7.32)

### v2.0.10 — containerd 2.0.10

- Date: 2026-06-18
- Version: v2.0.10
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.0.10
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.0.10

- **security** — Fix CVE-2026-53488
- **security** — Fix CVE-2026-47262
- **fixed** — Bound user-database file reads in openBoundedUserFile
- **fixed** — Do not propagate reserved labels from image configs
- **changed** — Update runc binary to v1.3.6
- **changed** — Update Go to 1.26.4 and 1.25.11

Welcome to the v2.0.10 release of containerd!

The tenth patch release for containerd 2.0 includes various bug fixes and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-53488**](https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
  * [**CVE-2026-47262**](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Akhil Mohan
* Akihiro Suda
* Ben Cressey
* Davanum Srinivas
* Paweł Gronowski
* Sebastiaan van Stijn

###### Changes
<details><summary>17 commits</summary>
<p>

* Prepare release notes for v2.0.10 ([#13630](https://github.com/containerd/containerd/pull/13630))
  * [`cbbd21672`](https://github.com/containerd/containerd/commit/cbbd21672287cdb7f1a01c7af414ac73637f14ca) Prepare release notes for v2.0.10
  * [`200a4005f`](https://github.com/containerd/containerd/commit/200a4005fc5d64e9e0dc1bb5f2991f160f7263ed) Merge commit from fork
  * [`da4098647`](https://github.com/containerd/containerd/commit/da40986474287efcd4c6a39ac03bc098c25ef0a9) Merge commit from fork
  * [`03a19324f`](https://github.com/containerd/containerd/commit/03a19324f9903a12805cab5df83b38313603d542) Bound user-database file reads in openBoundedUserFile
  * [`126177ea4`](https://github.com/containerd/containerd/commit/126177ea411500d7a73da1def31e53a74660c44d) Merge commit from fork
  * [`bbf4a2b8e`](https://github.com/containerd/containerd/commit/bbf4a2b8e6c89483ff1b631f5814197fc8d99a0c) Do not propagate reserved labels from image configs
* update runc binary to v1.3.6 ([#13619](https://github.com/containerd/containerd/pull/13619))
  * [`a15e98122`](https://github.com/containerd/containerd/commit/a15e98122d2551af8af379106a72372aff9ba0b9) update runc binary to v1.3.6
  * [`ba2ed2a5e`](https://github.com/containerd/containerd/commit/ba2ed2a5e5b5a5c8d8111c56a607a53a0423b5cf) [release/2.2] update runc binary to v1.3.5
  * [`474184497`](https://github.com/containerd/containerd/commit/474184497e5bc61256e530a4210eda2d8e03e100) runc: Update runc binary to v1.3.4
* update go to 1.26.4/1.25.11 ([#13581](https://github.com/containerd/containerd/pull/13581))
  * [`becbb802e`](https://github.com/containerd/containerd/commit/becbb802ec9a1453f21262102d4cc12298c3c740) update go to 1.26.4/1.25.11
* Configure udevd children-max for root-test ([#13565](https://github.com/containerd/containerd/pull/13565))
  * [`55bdc8bc5`](https://github.com/containerd/containerd/commit/55bdc8bc5b0de8b975c7f5328f609dc5ad79b3b7) Configure udevd children-max for root-test
* Clean up disk space in node e2e workflow ([#13553](https://github.com/containerd/containerd/pull/13553))
  * [`6d81e8867`](https://github.com/containerd/containerd/commit/6d81e88679f88daaa0612849edb5c8afd96a3432) Clean up disk space in node e2e workflow
</p>
</details>

###### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.0.9](https://github.com/containerd/containerd/releases/tag/v2.0.9)
###### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

### v2.3.2 — containerd 2.3.2

- Date: 2026-06-18
- Version: v2.3.2
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.3.2
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.3.2

- **security** — Fix CVE-2026-50195
- **security** — Fix CVE-2026-53488
- **security** — Fix CVE-2026-53492
- **security** — Fix CVE-2026-53489
- **security** — Fix CVE-2026-47262
- **fixed** — Fix data race when reading shim logs on Windows
- **changed** — Allow the last host to retry on transient network errors
- **fixed** — Fix container startup failures caused by concurrent task RPC timeouts during slow container creation
- **fixed** — Filter CDI annotations on checkpoint restore
- **fixed** — Do not re-tag restored checkpoints
- **fixed** — Make checkpoint restore robust to unexpected archive content
- **fixed** — Bound user-database file reads in openUserFile
- **fixed** — Do not propagate reserved labels from image configs
- **changed** — Update golang.org/x/crypto to v0.53.0
- **changed** — Update golang.org/x/mod to v0.36.0
- **changed** — Update golang.org/x/net to v0.55.0
- **changed** — Update golang.org/x/sync to v0.21.0
- **changed** — Update golang.org/x/sys to v0.46.0
- **changed** — Update golang.org/x/term to v0.44.0

Welcome to the v2.3.2 release of containerd!

The second patch release for containerd 2.3 contains various fixes
and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-50195**](https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)
  * [**CVE-2026-53488**](https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
  * [**CVE-2026-53492**](https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)
  * [**CVE-2026-53489**](https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)
  * [**CVE-2026-47262**](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

###### Highlights

* Fix a data race when reading shim logs on Windows ([#13522](https://github.com/containerd/containerd/pull/13522))

###### Image Distribution

* Allow the last host to retry on transient network errors ([#13591](https://github.com/containerd/containerd/pull/13591))

###### Runtime

* Fix container startup failures caused by concurrent task RPC timeouts during slow container creation ([#13512](https://github.com/containerd/containerd/pull/13512))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Akihiro Suda
* Derek McGowan
* Akhil Mohan
* Austin Vazquez
* Ben Cressey
* Brian Goff
* Maksym Pavlenko
* Sebastiaan van Stijn
* Sergey Kanzhelev

###### Changes
<details><summary>30 commits</summary>
<p>

* Prepare release notes for v2.3.2 ([#13627](https://github.com/containerd/containerd/pull/13627))
  * [`fb8ca00b0`](https://github.com/containerd/containerd/commit/fb8ca00b051fa9a9187502b16620fdb46595f1b7) Prepare release notes for v2.3.2
  * [`9c69960ba`](https://github.com/containerd/containerd/commit/9c69960ba495c0aa08797be3f17b3c7712d17a22) Merge commit from fork
  * [`0f6251520`](https://github.com/containerd/containerd/commit/0f6251520569a25f0b52158a97d035726e6af9d2) Merge commit from fork
  * [`91d7471e2`](https://github.com/containerd/containerd/commit/91d7471e2cc7113c31dbcc62007756ba88f8cf9f) cri: filter CDI annotations on checkpoint restore
  * [`7c2e086bf`](https://github.com/containerd/containerd/commit/7c2e086bf31a4402cc19817df3b05ffd74d454e6) Merge commit from fork
  * [`dae67765f`](https://github.com/containerd/containerd/commit/dae67765f2d51ca3e67190c26e51edf496dd4cf4) cri: do not re-tag restored checkpoints
  * [`94aa1e2c1`](https://github.com/containerd/containerd/commit/94aa1e2c1a6ebadf2578fabe85ba7845e1e553c0) Merge commit from fork
  * [`09599078f`](https://github.com/containerd/containerd/commit/09599078f66bb98f6e83087893e3f2349b019fe7) cri: make checkpoint restore robust to unexpected archive content
  * [`e1fdb8d22`](https://github.com/containerd/containerd/commit/e1fdb8d221a27ce017264875e3658d021511ba0c) Merge commit from fork
  * [`ff1d116ef`](https://github.com/containerd/containerd/commit/ff1d116ef9c2d7505306d7d367ef46ff0756460b) Bound user-database file reads in openUserFile
  * [`d156e07cb`](https://github.com/containerd/containerd/commit/d156e07cbe61331f77b72e3603d8b6d67dda59e5) Merge commit from fork
  * [`f99aad54a`](https://github.com/containerd/containerd/commit/f99aad54af507168a1393dfae1559fde4cae9b2c) Do not propagate reserved labels from image configs
* vendor: golang.org/x/crypto v0.53.0 ([#13608](https://github.com/containerd/containerd/pull/13608))
  * [`0b9469501`](https://github.com/containerd/containerd/commit/0b9469501257584fc8ff32c8160dbda3501e99cc) [release/2.3] vendor: golang.org/x/crypto v0.53.0
* resolver: retry on transient network errors ([#13591](https://github.com/containerd/containerd/pull/13591))
  * [`983bbddc1`](https://github.com/containerd/containerd/commit/983bbddc139c607700259a2bec519e7026018c6f) resolver: retry on transient network errors
* update runc binary to v1.4.3 ([#13601](https://github.com/containerd/containerd/pu

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.3.2]_

### v2.2.5 — containerd 2.2.5

- Date: 2026-06-18
- Version: v2.2.5
- Original notes: https://github.com/containerd/containerd/releases/tag/v2.2.5
- Permalink: https://whatsnew.fyi/product/containerd/releases/v2.2.5

- **security** — Fix CVE-2026-50195
- **security** — Fix CVE-2026-53488
- **security** — Fix CVE-2026-53492
- **security** — Fix CVE-2026-53489
- **security** — Fix CVE-2026-47262
- **fixed** — Filter CDI annotations on checkpoint restore
- **fixed** — Do not re-tag restored checkpoints
- **fixed** — Make checkpoint restore robust to unexpected archive content
- **fixed** — Bound user-database file reads in openUserFile
- **fixed** — Do not propagate reserved labels from image configs
- **changed** — Update golang.org/x/crypto to v0.53.0
- **changed** — Update golang.org/x/mod to v0.36.0
- **changed** — Update golang.org/x/net to v0.55.0
- **changed** — Update golang.org/x/sync to v0.21.0
- **changed** — Update golang.org/x/sys to v0.46.0
- **changed** — Update golang.org/x/term to v0.44.0
- **changed** — Update golang.org/x/text to v0.38.0
- **changed** — Update runc binary to v1.3.6
- **changed** — Update Go to 1.26.4/1.25.11

Welcome to the v2.2.5 release of containerd!

The fifth patch release for containerd 2.2 contains various fixes
and updates including security patches.

###### Security Updates

* **containerd**
  * [**CVE-2026-50195**](https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574)
  * [**CVE-2026-53488**](https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp)
  * [**CVE-2026-53492**](https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc)
  * [**CVE-2026-53489**](https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388)
  * [**CVE-2026-47262**](https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

###### Contributors

* Samuel Karp
* Chris Henzie
* Akihiro Suda
* Derek McGowan
* Maksym Pavlenko
* Akhil Mohan
* Ben Cressey
* Brian Goff
* Davanum Srinivas
* Sebastiaan van Stijn

###### Changes
<details><summary>27 commits</summary>
<p>

* Prepare release notes for v2.2.5 ([#13628](https://github.com/containerd/containerd/pull/13628))
  * [`269031099`](https://github.com/containerd/containerd/commit/269031099e51bd875bc8097b79a41fd00af08a28) Prepare release notes for v2.2.5
  * [`ad59aa564`](https://github.com/containerd/containerd/commit/ad59aa5647ac505a97965f521e21fcd4f9403631) Merge commit from fork
  * [`0b4d23690`](https://github.com/containerd/containerd/commit/0b4d23690ead6f34fb990155e1cc19d27f906370) Merge commit from fork
  * [`be8460656`](https://github.com/containerd/containerd/commit/be8460656b84c4a1a4b244a03801e9fff1e914d3) cri: filter CDI annotations on checkpoint restore
  * [`347240f72`](https://github.com/containerd/containerd/commit/347240f72479246a801ea4ec4304e180ac45b85e) Merge commit from fork
  * [`cff578841`](https://github.com/containerd/containerd/commit/cff57884176a1e6ba0857a417753d799958e0f46) cri: do not re-tag restored checkpoints
  * [`668cf2c2f`](https://github.com/containerd/containerd/commit/668cf2c2fd0d9c6394f2aa95c44c4735c353d380) Merge commit from fork
  * [`357652293`](https://github.com/containerd/containerd/commit/357652293053d0cd3ed565f718b0050aa662ae1a) cri: make checkpoint restore robust to unexpected archive content
  * [`d43da05af`](https://github.com/containerd/containerd/commit/d43da05af9b515b89740889a84a91c8ed27a73f0) Merge commit from fork
  * [`30708e8d1`](https://github.com/containerd/containerd/commit/30708e8d1142287e9c6bb839f1b3f84c71ca4485) Bound user-database file reads in openUserFile
  * [`028647ea2`](https://github.com/containerd/containerd/commit/028647ea2597eb3f7add39c6171b62768e0be74c) Merge commit from fork
  * [`b6072a49f`](https://github.com/containerd/containerd/commit/b6072a49f8d3f6efc5ac9895efbb1852b16a2602) Do not propagate reserved labels from image configs
* vendor: golang.org/x/crypto v0.53.0 ([#13607](https://github.com/containerd/containerd/pull/13607))
  * [`cfea2c141`](https://github.com/containerd/containerd/commit/cfea2c1413a55243e5d8db9def5ed5e3e595894e) [release/2.2] vendor: golang.org/x/crypto v0.53.0
* update runc binary to v1.3.6 ([#13606](https://github.com/containerd/containerd/pull/13606))
  * [`fc96ea6b3`](https://github.com/containerd/containerd/commit/fc96ea6b3fbcd8fb467914a3fe5f977a5705efff) update runc binary to v1.3.6
* update go to 1.26.4/1.25.11 ([#13577](https://github.com/containerd/containerd/pull/13577))
  * [`5a125fd66`](https://github.com/containerd/containerd/commit/5a125fd66a384f1d5b2221d3e1b9cfb92d99fd58) update go to 1.26.4/1.25.11
* Configure udevd children-max for root-test ([#13567](https://github.com/containerd/containerd/pull/13567))
  * [`2b7dfbd7f`](https://github.com/containerd/containerd/commit/2b7dfbd7ff229288f8b94ef73c1a26d71df39f51) Configure udevd children-max for root-test
* Clean up disk space in node e2e workflow ([#13548](https://github.com/containerd/containerd/pull/13548))
  * [`

_[Truncated at 4000 characters — full notes: https://github.com/containerd/containerd/releases/tag/v2.2.5]_