containerd v2.2.8

v2.2.8

containerd 2.2.8

Fixed 4
  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group
  • Fix EROFS snapshot creation failure caused by concurrent snapshot removal
  • Cancel ExecSync IO drain on context cancellation
Security 3
  • Address CVE-2026-53495
  • Address GHSA-rp3h-jf77-q9p4
  • Strip sensitive authentication headers when fetching descriptor URLs

From containerd

Welcome to the v2.2.8 release of containerd!

The eighth patch release for containerd 2.2 contains various fixes and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14044)
Runtime
  • Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#14102)
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#14005)
Snapshotters
  • Fix EROFS snapshot creation failure caused by concurrent snapshot removal (#13950)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Wei Fu
  • Oleh Konko
  • Chris Ayoub
  • Maksim An
  • XlabAI
Changes
  • 4864b1814 Prepare release notes for v2.2.8
  • 3458b7fd3 Merge commit from fork
  • 22ccf4314 cri: cancel ExecSync IO drain on context cancellation
  • 2bf01ce17 Merge commit from fork
  • 45166eb82 archive: skip redundant opaque whiteout walks
  • Set SystemTemp env var to config temp on Windows (#14102)
    • 2c722ad04 Set SystemTemp env var to config temp on Windows
  • pkg/oci: resolve rootfs symlinks for user lookup (#14005)
    • 196664bc0 pkg/oci: resolve rootfs symlinks for user lookup
  • docker fetcher: strip sensitive headers on descriptor URLs (#14044)
    • 6da9d9528 core/remotes/docker: normalize descriptor URL origins
    • 4f7851699 core/remotes/docker: strip sensitive headers on desc.urls fetch
  • snapshots/erofs: protect snapshot staging from cleanup (#13950)
    • f7075a224 snapshots/erofs: protect snapshot staging from cleanup
Dependency Changes

This release has no dependency changes

Previous release can be found at v2.2.7

Which file should I download?
  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

View original

Upgraded? How did it go?

Discussion