containerd v2.0.12

Welcome to the v2.0.12 release of containerd!

The twelfth patch release for containerd 2.0 contains various fixes and updates including security patches.

Security Updates

• containerd
  • CVE-2026-53495
  • GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14045)
• Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13749)

Runtime

• Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#14100)
• Enable log scrubbing by default on Windows (#13884)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Maksym Pavlenko
• Oleh Konko
• Akihiro Suda
• Chris Henzie
• Maksim An
• Phil Estes
• Wei Fu
• XlabAI
• cshung

Changes

• d6a01e72a Prepare release notes for v2.0.12
• 2e964db90 Merge commit from fork
• eebea8c4c cri: cancel ExecSync IO drain on context cancellation
• d93c158a6 Merge commit from fork
• 6c060c952 archive: skip redundant opaque whiteout walks
• Set SystemTemp env var to config temp on Windows (#14100)
  • 56058341c Set SystemTemp env var to config temp on Windows
• docker fetcher: strip sensitive headers on descriptor URLs (#14045)
  • 88c95d56d core/remotes/docker: normalize descriptor URL origins
  • 7711c3d21 core/remotes/docker: strip sensitive headers on desc.urls fetch
• Use ScrubLogs by default on Windows (#13884)
  • 84c6caa67 ctr: add --scrub-logs flag for Windows
  • 5fcdfaab2 cri/config: use ScrubLogs by default on Windows
• ci: bound Go fuzzing by execution count (#13787)
  • b452f2856 ci: bound Go fuzzing by execution count
• CI: migrate Vagrant to Lima (#13756)
  • a15448870 CI: migrate Vagrant to Lima
• remotes: surface OCI error body on HEAD 403 via GET fallback (#13749)
  • 71a73c8a0 remotes: surface OCI error body on HEAD 403 via GET fallback

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.11

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.