containerd v2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

Highlights

• Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#13694)

Container Runtime Interface (CRI)

• Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#13697)
• Reject CreateContainer calls when the target sandbox is not running (#13668)
• Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#13645)

Image Distribution

• Surface OCI error bodies in registry 403 responses by falling back to GET requests (#13738)

Snapshotters

• Align default 4K mkfs block size for EROFS across all platforms (#13632)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Samuel Karp
• Chris Henzie
• Phil Estes
• Sebastiaan van Stijn
• Akihiro Suda
• Austin Vazquez
• Chris Crone
• Derek McGowan
• Maksim An
• crawfordxx
• cshung
• lauralorenz

Changes

• Prepare release notes for v2.3.3 (#13750)
  • 7f6cee02a Prepare release notes for v2.3.3
• CI: migrate Vagrant to Lima (#13744)
  • 7316210ce CI: migrate Vagrant to Lima
• remotes: surface OCI error body in registry 4xx responses (#13738)
  • 457fba3a3 remotes: surface OCI error body on HEAD 403 via GET fallback
• Update go to 1.26.5 (#13732)
  • dc2df934e Update go to 1.26.5
• ci: pin fog-json to resolve gem conflict (#13711)
  • 5be0495df ci: pin fog-json to resolve gem conflict
• Fix nil pointer dereference in NRI GetIPs (#13697)
  • 36c713971 Fix nil pointer dereference in NRI GetIPs
• Set SystemTemp env var to config temp on Windows (#13694)
  • 26dce170d Set SystemTemp env var to config temp on Windows
• update runhcs to v0.15.0-rc.3 (#13693)
  • 9bc2c2349 update runhcs to v0.15.0-rc.3
• Update to current setup-go version (#13686)
  • 3e97edeb7 Update to current setup-go version
• cri: reject CreateContainer when sandbox is not running (#13668)
  • 8856b0f9c cri: reject CreateContainer when sandbox is not running
• update runhcs to v0.15.0-rc.2 (#13666)
  • ae796cec5 update runhcs to v0.15.0-rc.2
• test: fix flaky image timestamp check on coarse clocks (#13643)
  • 168d56783 test: fix flaky image timestamp check on coarse clocks
• Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks (#13645)
  • d1db61db8 Add deferred call to ShutdownSandbox to avoid leaks
• erofs: align default mkfs block size across platforms (#13632)
  • 01b0f03f6 erofs: align default mkfs block size across platforms

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.3.2

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.