containerd v2.3.5

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes and updates including security patches.

Security Updates

• containerd
  • CVE-2026-53495
  • GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14030)

Runtime

• Avoid hangs and data races when streaming container standard I/O in CRI (#14094)
• Fix missing error messages in OpenTelemetry trace attributes (#14049)
• Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13999)
• Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#13995)
• Avoid containerd startup hangs when loading shims (#13983)
• Add context to error when shim delete times out (#13921)
• Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)

Snapshotters

• Fix unpack failure for EROFS images containing the erofs OS feature (#14062)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Phil Estes
• Samuel Karp
• Derek McGowan
• Sebastiaan van Stijn
• Akhil Mohan
• Maksym Pavlenko
• Wei Fu
• Oleh Konko
• Austin Vazquez
• Jing Chen
• Martín Fernández
• Paco Xu
• XlabAI
• Yuanliang Zhang

Changes

• 934efa5e0 Prepare release notes for v2.3.5
• be419b070 Merge commit from fork
• 9ec55f024 cri: cancel ExecSync IO drain on context cancellation
• 84ea25bc1 Merge commit from fork
• c53577965 archive: skip redundant opaque whiteout walks
• Fix data races and a deadlock in the byte stream helpers (#14094)
  • 9f6be869c Fix data races and a deadlock in the byte stream helpers
• plugins: remove some stray logrus imports (#14063)
  • 6c59399bf plugins: remove some stray logrus imports
• snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#14062)
  • f65732115 snapshots/erofs: test the advertised erofs feature platform
  • 5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
• update runc to v1.5.1 (#14059)
  • af445ea0a update runc to v1.5.1
  • c077e43bd update runc to v1.5.0
• vendor: github.com/containerd/platforms v1.0.0-rc.5 (#14048)
  • 676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
• pkg/tracing: handle error and typed-nil Stringer attributes (#14049)
  • c7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
• docker fetcher: strip sensitive headers on descriptor URLs (#14030)
  • 58fb846d5 core/remotes/docker: normalize descriptor URL origins
  • c7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
• update runhcs to v0.15.0-rc.4 (#13990)
  • 6fbb92c33 update runhcs to v0.15.0-rc.4
• pkg/oci: resolve rootfs symlinks for user lookup (#13999)
  • 53bf030ea pkg/oci: resolve rootfs symlinks for user lookup
• Revert "add check on version of drop in configs" (#13995)
  • 7790c4c21 ensure that the final config version is the higest in the config list
  • 1125b053f Revert "add check on version of drop in configs"
• fix(runtime): apply load timeout to load shim (#13983)
  • 460c47b28 fix(runtime): bound shim loading with the load timeout
• Add more context to the shim delete error (#13921)
  • 7f97bc122 Add more context to the shim delete error

Changes from containerd/platforms

• Fix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)
  • bacc690 Fix WS2022 compat on hosts past the latest LTSC

Dependency Changes

• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at v2.3.4

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.