containerd v2.3.4

Welcome to the v2.3.4 release of containerd!

The fourth patch release for containerd 2.3 contains various fixes and updates.

Highlights

Container Runtime Interface (CRI)

• Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#13913)
• Set default runtimeFeatures.UserNamespacesHostNetwork to true in CRI (#13914)
• Deprecate checkpoint restore in CreateContainer (#13868)
• Support non-UTF-8 binary environment variable values in CRI (#13454)
• Enable OCI runtime feature introspection for non-runc runtimes in CRI (#13778)
• Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option (#13734)
• Normalize sandbox image references in CRI to resolve images without domain prefixes (#13759)

Node Resource Interface (NRI)

• Emit deprecation warnings for plugins using deprecated NRI interfaces (#13935)

Runtime

• Enable log scrubbing by default on Windows (#13904)
• Fix memory leak in OOM watcher map when stopping container monitoring (#13870)
• Avoid orphaning shims on transient errors when loading process IDs (#13857)
• Fix corruption of binary protobuf shim start responses caused by premature whitespace trimming (#13803)

Snapshotters

• Fix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata (#13876)

Breaking

• Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable (#13913)

Deprecations

• Deprecate checkpoint restore in CreateContainer (#13868)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Maksym Pavlenko
• Mike Brown
• Akihiro Suda
• Derek McGowan
• Jordan Liggitt
• Paweł Gronowski
• Amir Alavi
• Andrew Halaney
• Bing Hongtao
• Chris Henzie
• Harshal Patel
• Krisztian Litkey
• Phil Estes
• Wei Fu
• ningmingxiao

Changes

• c1f5360ef Prepare release notes for v2.3.4
• cri: disable restore in CreateContainer by default (#13913)
  • 928c03c68 cri: disable restore in CreateContainer by default
• nri,deprecation: record and emit warnings for NRI deprecations. (#13935)
  • 5966e2edb nri,deprecation: emit warnings for old NRI plugins.
• Set the default of runtimeFeatures.UserNamespacesHostNetwork to true (#13914)
  • ab52c58f1 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
• Use ScrubLogs by default on Windows (#13904)
  • 0c255158a ctr: add --scrub-logs flag for Windows
  • 1c2b13dc9 cri/config: use ScrubLogs by default on Windows
• snapshots/erofs: keep lowers stacked above a merged fsmeta (#13876)
  • 0c511e068 snapshots/erofs: keep lowers stacked above a merged fsmeta
• cri: deprecate restore in CreateContainer (#13868)
  • dc98141df cri: deprecate restore in CreateContainer
• internal/oom: Fix memory leak by removing watcher from map on Stop (#13870)
  • 537d82d54 internal/oom: Fix memory leak by removing watcher from map on Stop
• shim_load: Consider shim leaked only if we can't find pids (#13857)
  • decf97a9c shim_load: Consider shim leaked only if we can't find pids
• core/runtime/v2: Drop checkpointctl module dependency (#13840)
  • 796f07dc8 core/runtime/v2: Drop checkpointctl module dependency
• Handle []byte envvar value for CRI (#13454)
  • 751fddddb Handle []byte envvar value
  • 0bce9060e update to v0.36.x kubernetes dependencies
• fix(cri): introspect OCI runtime features for non-runc runtimes (#13778)
  • 61a8f6f45 fix(cri): introspect OCI runtime features for non-runc runtimes
• core/runtime/v2: Preserve protobuf shim response bytes (#13803)
  • 1d28017be core/runtime/v2: Preserve protobuf shim response bytes
• Disable checkpoint restore codepath when CRIU is not installed (#13734)
  • 374091d67 github/workflows: install criu in node-e2e
  • db03e3968 cri: add enable_criu configuration option
  • dacd4c7d0 cri: validate CRIU availability and version early
• ci: bound Go fuzzing by execution count (#13785)
  • 890a9c86c ci: bound Go fuzzing by execution count
• cri: auto-add prefix for pause image (#13759)
  • 0b2f1d078 cri: auto-add prefix for pause image

Dependency Changes

• k8s.io/api v0.36.0 -> v0.36.3
• k8s.io/apimachinery v0.36.0 -> v0.36.3
• k8s.io/client-go v0.36.0 -> v0.36.3
• k8s.io/component-base v0.36.0 -> v0.36.3
• k8s.io/cri-api v0.36.0 -> v0.36.3
• k8s.io/cri-client v0.36.0 -> v0.36.3
• k8s.io/cri-streaming v0.36.0 -> v0.36.3
• sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.3.3

Previous release can be found at v2.3.3

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.