v2.3.2
containerd 2.3.2
Changed 7
- Allow the last host to retry on transient network errors
- Update golang.org/x/crypto to v0.53.0
- Update golang.org/x/mod to v0.36.0
- Update golang.org/x/net to v0.55.0
- Update golang.org/x/sync to v0.21.0
- Update golang.org/x/sys to v0.46.0
- Update golang.org/x/term to v0.44.0
Fixed 7
- Fix data race when reading shim logs on Windows
- Fix container startup failures caused by concurrent task RPC timeouts during slow container creation
- Filter CDI annotations on checkpoint restore
- Do not re-tag restored checkpoints
- Make checkpoint restore robust to unexpected archive content
- Bound user-database file reads in openUserFile
- Do not propagate reserved labels from image configs
Security 5
- Fix CVE-2026-50195
- Fix CVE-2026-53488
- Fix CVE-2026-53492
- Fix CVE-2026-53489
- Fix CVE-2026-47262
Welcome to the v2.3.2 release of containerd!
The second patch release for containerd 2.3 contains various fixes and updates including security patches.
Security Updates
Highlights
- Fix a data race when reading shim logs on Windows (#13522)
Image Distribution
- Allow the last host to retry on transient network errors (#13591)
Runtime
- Fix container startup failures caused by concurrent task RPC timeouts during slow container creation (#13512)
Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.
Contributors
- Samuel Karp
- Chris Henzie
- Akihiro Suda
- Derek McGowan
- Akhil Mohan
- Austin Vazquez
- Ben Cressey
- Brian Goff
- Maksym Pavlenko
- Sebastiaan van Stijn
- Sergey Kanzhelev
Changes
- Prepare release notes for v2.3.2 (#13627)
fb8ca00b0Prepare release notes for v2.3.29c69960baMerge commit from fork0f6251520Merge commit from fork91d7471e2cri: filter CDI annotations on checkpoint restore7c2e086bfMerge commit from forkdae67765fcri: do not re-tag restored checkpoints94aa1e2c1Merge commit from fork09599078fcri: make checkpoint restore robust to unexpected archive contente1fdb8d22Merge commit from forkff1d116efBound user-database file reads in openUserFiled156e07cbMerge commit from forkf99aad54aDo not propagate reserved labels from image configs
- vendor: golang.org/x/crypto v0.53.0 (#13608)
0b9469501[release/2.3] vendor: golang.org/x/crypto v0.53.0
- resolver: retry on transient network errors (#13591)
983bbddc1resolver: retry on transient network errors
- update runc binary to v1.4.3 (#13601)
3f76f2dc1update runc binary to v1.4.3
- update go to 1.26.4 (#13580)
- Configure udevd children-max for root-test (#13568)
bfb8aebc0Configure udevd children-max for root-test
- core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read (#13522)
62ceafff0core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
- runc-shim: don't hold the service lock across runc create (#13512)
9b0c0dc58runc-shim: don't hold the service lock across runc create
- contrib/checkpoint: increase timeouts to 30s (#13459)
f588bc6fbcontrib/checkpoint: increase timeouts to 30s
Dependency Changes
- golang.org/x/crypto v0.49.0 -> v0.53.0
- golang.org/x/mod v0.35.0 -> v0.36.0
- golang.org/x/net v0.52.0 -> v0.55.0
- golang.org/x/sync v0.20.0 -> v0.21.0
- golang.org/x/sys v0.43.0 -> v0.46.0
- golang.org/x/term v0.41.0 -> v0.44.0
- golang.org/x/text v0.35.0 -> v0.38.0
Previous release can be found at v2.3.1
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.
In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.
See also the Getting Started documentation.