containerd/containerd v2.4.0 on GitHub

Welcome to the v2.4.0 release of containerd!

containerd 2.4 is a regular (non-LTS) release with a shorter support window,
intended for users who want to adopt new features sooner. As the release
following the 2.3 LTS, it is the point in the release cycle where previously
deprecated features may be removed, so this release may include breaking
changes; check the notes below and clear any deprecation warnings from your
current version before upgrading.

Users prioritizing stability and a longer support lifecycle should stay on the
2.3 LTS release.

Highlights

Container Runtime Interface (CRI)

Enable mount manager for image mounts in CRI (#13542)
Export sandbox image and CNI directory configuration in CRI plugin info (#13940)
Set default runtimeFeatures.UserNamespacesHostNetwork to true (#13162)
Support OCI runtime feature introspection for non-runc runtimes (#13504)

Image Distribution

Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#12889)
Support propagating HTTP 299 warning headers from registries to the resolver (#12698)
Use klauspost/compress for gzip layer decompression (#13560)

Image Storage

Add client options to fetch all layer content during unpack even when snapshots exist (#14126)
Include media type in content create events (#13833)
Add forward References to the GC collection context (#13634)

Node Resource Interface (NRI)

Expose container image name, digest, and config digest to NRI plugins (#13960)
Emit deprecation warnings for plugins using deprecated NRI interfaces (#13916)

Runtime

Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14090)
Add UpdateSandbox RPC to propagate sandbox controller updates to the shim (#14105)
Avoid immediately restarting containers with restart=always policy after they are explicitly stopped (#13993)
Pass tracing context from shim to runc and hooks (#14036)
Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13818)
Implement Windows named-pipe server and log streaming support in pkg/shim (#13948)
Enable log scrubbing by default on Windows (#13837)
Allow specifying parent checkpoint directory when checkpointing with runc (#13699)

Snapshotters

Add Prometheus metrics for EROFS snapshotter layer content cache (#13941)
Support warm image cache for erofs snapshotter (#13813)
Add max size label for snapshots (#13520)

Breaking

Remove deprecated CRI and tracing configuration options:
- Remove enable_cdi in CRI runtime configuration (CDI is now always enabled)
- Remove bin_dir in CRI CNI configuration (use bin_dirs)
- Remove endpoint, protocol, and insecure in OTLP tracing processor configuration (use standard OTLP environment variables)
- Remove service_name and sampling_ratio in internal tracing configuration (use standard OpenTelemetry environment variables) (#14166)
Remove restore in CreateContainer (#13871)

Deprecations

Deprecate containerd.io/runtime-allow-mounts shim annotation in favor of MountCapabilities bootstrap extension (#14002)
Remove deprecated shim.Command from pkg (#13991)
Deprecate task API address and version fields in runc options and move to CreateTaskRequest (#13360)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Sebastiaan van Stijn
Samuel Karp
Derek McGowan
Wei Fu
Akihiro Suda
Mike Brown
Paweł Gronowski
Chris Henzie
Phil Estes
Brian Goff
Austin Vazquez
ningmingxiao
Jordan Liggitt
Akhil Mohan
Eshaan Mathur
Krisztian Litkey
Chris Ayoub
Kazuyoshi Kato
Kir Kolyshkin
Sergey Kanzhelev
Ahmet Alp Balkan
Arpit Jain
Cindy Li
Damien Grisonnet
Esteban Ginez
Gao Xiang
Harsh Rawat
Laura Lorenz
Maksim An
Oleh Konko
Philip Laine
Abhishek Bhunia
Alan Grosskurth
Albin Kerouanton
Alex Lyn
Aman Raj
Amir Alavi
Amit Barve
Andrew Halaney
AprilNEA
Arjun Yogidas
Ayato Tokubi
Aysha Afrah Ziya
Ben Cressey
Bing Hongtao
Chris Crone
Craig Gumbley
Daniel De Graaf
Davanum Srinivas
Dr. Jan-Philip Gehrcke
Harshal Patel
Henry Wang
Hsiu-Chi Tsai
JP Phillips
Jing Chen
Kohei Tokunaga
LEI WANG
Martín Fernández
Mikhail Dmitrichenko
Nahum Litvin
Nikolaus Schuetz
Pablo Garcia Caceres
Paco Xu
Robert Cronin
SaloniRathi
Shambhavi Srivastava
Tianon Gravi
XlabAI
Yuanliang Zhang
ayush-panta
crawfordxx
cshung
match man
s3onghyun
归寂
徐晓伟

Changes

658 commits

647fafa847 Prepare release notes for v2.4.0
Prepare release notes for api/v1.12.0 (#14170)
- 5c4ea21de3 Prepare release notes for api/v1.12.0
Deprecations and removals for 2.4 (#14166)
- 531b3a37b9 tracing: remove deprecated tracing config options
- ca8579a334 tracing: add tests for otlp exporter and env vars
- ee024b7c99 tracing: remove deprecated otlp configs
- f7c654fb4f cri: remove deprecated cni bin_dir
- 4f7de25abb cri: remove enable_cdi config option
- 830b48d3fd cri: delay registry config removal to 2.7
Prepare release notes for v2.4.0-rc.0 (#14115)
- c02620e398 Prepare release notes for v2.4.0-rc.0
- 02c7c97f43 Update release doc for 2.4.0 release
- 484e5aba58 vendor: github.com/containerd/containerd/api v1.12.0-rc.1
- 67174d675c mailmap: add Paweł Gronowski
Update erofs snapshotter to record blob source (#14107)
- 697a7571a4 erofs: give a dm-verity device a name unique to its mount
- f75817eb3b erofs: record where a layer blob is
- d92088d822 erofs: refuse to apply into a read-only snapshot
- 8cc0b076a6 erofs: serve layer content cache on parented Prepare
build(deps): bump the golang-x group with 4 updates (#14150)
- 75138b3fda build(deps): bump the golang-x group with 4 updates
build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 (#14153)
- 353342cae6 build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0
pkg/oci: mask thermal interrupt info (#14090)
- c176f185b0 pkg/oci: mask thermal interrupt info
vendor: github.com/containerd/nri v0.12.3 (#14065)
- 69269c635b vendor: github.com/containerd/nri v0.12.3
cri: only unmount image volumes when mounting fails (#14143)
- d13064937e cri: only unmount image volumes when mounting fails
migrate to github.com/urfave/cli/v3 (#14095)
- f72829f36b migrate to github.com/urfave/cli/v3
shim-runc-v2: record exit status in bundle (#14113)
- 3264a09dff shim-runc-v2: record exit status in bundle
core/unpack: fetch layers of every config-sharing manifest (#13966)
- 3c5d9fefd8 core/unpack: fetch layers of every config-sharing manifest
time to update cri-tools to v1.37.0 (#14133)
- 5c957005ab adding container_threads metric emission for cgroups v1
- d038c4f1f9 time to update cri-tools to v1.37.0
update crun to v1.29.1 (#14136)
- 64d7857d2b update crun to v1.29.1
vendor: github.com/containerd/log main, use log.Level consts for log-levels (#14019)
- b178103a4f use log.Level consts for log-levels
- a77089ba8e vendor: github.com/containerd/log v0.2.0
- 0ca704384f vendor: github.com/containerd/log/otel v0.1.0
vendor: github.com/moby/sys/userns v0.2.1 (#14130)
- f30398314f vendor: github.com/moby/sys/userns v0.2.1
cri: enable mount manager for image mounts (#13542)
- 9224f17d7c cri: enable mount manager for image mounts
Fix input mutation in mount option helpers (#13433)
- 165abaf8fd core/mount: Keep lazy copy for filtered options
- 674c3a1acb core/mount: Return copied filtered mount options
- 79455dd4b0 mount: share lazy option filtering
- b73b82f2af mount: fix shallow copy of Options in RemoveVolatileOption and RemoveIDMapOption
- 70cfd7796a mount: fix input mutation in readonlyMounts
- 35e919f329 mount: replace copyMounts with slices.Clone
cmd: refactor in preparation of urfave/cli/v3 migration (#14103)
- 861dc7ed7a cmd: commands.NewClient: explicitly pass context
- 324866a884 cmd: commands.AppContext: explicitly pass context
- bd954e4e2c cmd: initialize CLI apps with struct literals
- ba71234151 cmd: rename cliContext -> cmd in preparation of v3 migration
- de193f2059 cmd: edit: pass editor name instead of cli.Context
- 2cc86cb07b cmd: rename some vars that shadowed
- e6be784a71 cmd: use urfave/cli RunContext
- 4d13856983 cmd: remove redundant empty slice flag values
- 211cde9039 cmd: remove uses of urfave/cli.Commands
- c52e77eccd cmd/ctr: remove unused pluginCmds
unpack: Add opt-in fetching for existing snapshots (#14126)
- 2b0302fd85 unpack: Add opt-in fetching for existing snapshots
integration/client: fix TestContainerExecLargeOutputWithTTY (#14120)
- 68f92da9fb integration/client: fix TestContainerExecLargeOutputWithTTY
vendor: github.com/go-jose/go-jose/v4 v4.1.5 (security) (#14116)
- 0c4981cc2e vendor: github.com/go-jose/go-jose/v4 v4.1.5
Revert "metadata: bound snapshotter Remove during garbage collection" (#14119)
- aeb095b175 Revert "metadata: bound snapshotter Remove during garbage collection"
build(deps): bump azure/login from 3.0.1 to 3.0.2 (#14114)
- 2bfdafac7b build(deps): bump azure/login from 3.0.1 to 3.0.2
pkg/tracing: deprecate Logrushook in favor of log/otel.Logrushook (#14023)
- 20fed5179a pkg/tracing: deprecate Logrushook in favor of log/otel.Logrushook
sandbox: wire Controller.Update through to the shim (#14105)
- b971bac19f docs: document optional sandbox updates
- 40f84371c6 vendor: update containerd api
- 2ea4ddb32f sandbox: add UpdateSandbox RPC and forward Controller.Update to the shim
vendor: golang.org/x/crypto v0.56.0 (#14093)
- 977cb4bb0a vendor: golang.org/x/crypto v0.56.0
- 8dd0970b3c Merge commit from fork
- ff39a97236 cri: cancel ExecSync IO drain on context cancellation
- 65dcc83dad Merge commit from fork
- e6ca378dcf archive: skip redundant opaque whiteout walks
vendor: tags.cncf.io/container-device-interface v1.1.1 (#14109)
- d1b8275dc2 vendor: tags.cncf.io/container-device-interface v1.1.1
vendor: bump go-cni v1.1.14 and containernetworking/cni v1.3.1 (#14104)
- 9ca93e5488 vendor: bump go-cni v1.1.14 and containernetworking/cni v1.3.1
Update Go 1.26.8 and 1.27.1 (#14087)
- db128f8955 Update to go1.27.1
- f257e6b98c Update go1.26 to go1.26.8
- 43f85c6b53 Update go1.26 to go1.26.7
gha: Update golangci-lint to v2.13.2 (#14089)
- 3c10e5f0be all: Address G702 command execution findings
- 7797833d8e gha: Update golangci-lint to v2.13.2
- 2e587fd358 ctr: Use context-aware pprof dialing
- a0ea6a138b runtime: Preserve context values in background goroutines
- 2c75374a2f all: Use slices.Backward for reverse iteration
- b7ae26eea7 all: Use errors.AsType
runtime: invoke shim.Delete when connection is closed (#13309)
- e49a475d4a runtime: invoke shim.Delete when connection is closed
Fix data races and a deadlock in the byte stream helpers (#14085)
- 3914a449d4 Fix data races and a deadlock in the byte stream helpers
erofs: enable fsview fallback for unsupported features (#14077)
- 9d804de10b erofs: enable fsview fallback for unsupported features
all: fix typos in code comments (#14082)
- 93b0eea04b all: fix typos in code comments
fix: fix incorrect restart=always restart logic (#13993)
- 452b4d99cc fix: fix incorrect restart=always restart logic
add additional tests for toCriSignal contract (#14073)
- 961764f6b2 test toCriSignal contract for metadata pre SIGNAL_ prefix
build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the docker-actions group (#14067)
- 6512b4caf1 build(deps): bump docker/setup-buildx-action in the docker-actions group
build(deps): bump azure/login from 3.0.0 to 3.0.1 (#13964)
- 59f415c7d6 build(deps): bump azure/login from 3.0.0 to 3.0.1
cri: trace image pull result attributes (#13959)
- 09997c13a4 cri: trace image pull result attributes
internal/cri/server: avoid debug log formatting for container spec (#13972)
- 30cd464708 internal/cri/server: avoid debug log formatting for container spec
build(deps): bump github.com/google/certtostore from 1.0.6 to 1.0.7 (#13919)
- f07b18490b build(deps): bump github.com/google/certtostore from 1.0.6 to 1.0.7
vendor: github.com/docker/go-events v0.1.0 (#14064)
- 5333ee0952 vendor: github.com/docker/go-events v0.1.0
chore(deps): go.opentelemetry.io/otel v1.46.0, contrib v0.71.0 (#14058)
- bfe115abe8 chore(deps): go.opentelemetry.io/otel v1.46.0, contrib v0.71.0
vendor: tags.cncf.io/container-device-interface 73444d1f71f2 (#14060)
- ea60594619 vendor: tags.cncf.io/container-device-interface 73444d1f71f2
plugins: remove some stray logrus imports (#14057)
- b845501327 plugins: remove some stray logrus imports
snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#14012)
- 988f113ab7 snapshots/erofs: test the advertised erofs feature platform
- 5e083f8d43 erofs: advertise the erofs OS feature platform from the snapshotter
build(deps): bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 (#13883)
- 5e89a2c119 build(deps): bump github.com/prometheus/client_golang
Prepare api/v1.12.0-rc.0 release (#14047)
- d767f44b52 Prepare api/v1.12.0-rc.0 release
update kubernetes to v1.37.0 (#14051)
- 67336d701d modifies criSignalToOCIStopSignal to remove the extra cri SIGNAL_ prefixes
- 00ecad3d7a resolve lint issue upstreamcri.NewRemoteImageService() is deprecated
- ee09726316 fix for cri api Signal_ to Signal_SIGNAL_
- 52be09ef1c update kubernetes to v1.37.0
Pass tracing context from shim to runc and hooks (#14036)
- 0b4ed79573 integration: add e2e test to verify trace context propagation
- 5c25750dd5 shim: propagate trace context to runc and OCI hooks
- beb23bc68d vendor: add go.opentelemetry.io/contrib/propagators/envcar v0.70.0
runtime: make task.Delete API retriable (#14020)
- 24dc6900ec runtime: make task.Delete API retriable
vendor: google.golang.org/grpc v1.83.2 (#14042)
- 89ba8063e1 vendor: google.golang.org/grpc v1.83.2
vendor: tags.cncf.io/container-device-interface 04278701a635 (#14043)
- ab451b6de8 vendor: tags.cncf.io/container-device-interface 04278701a635
Shim mount handler protocol (#14002)
- fbd9f37c2d docs: document the transform suffix rule
- aedbd24669 docs: document the shim mount capability
- 1ff0c13859 runtime/v2: migrate early adopters of the deprecated annotation
- d3cc320650 runtime/v2: propagate shim mount capabilities to sandbox members
- e8963fc32b runtime/v2: negotiate mount capabilities from shim bootstrap
- 0b641f0099 mount: honor a claimed transform as a chain suffix
- 8ba69faf06 mount: extract activation planning
- 00967ecf03 mount: add WithAllowTransform activate option
- 6d9307f346 runtime/v2: decode the whole bootstrap result from JSON
- 65b4eb916e vendor: use local api module and update vendored api
- a72247425b api: add shim mount capabilities
- 329998caa9 runtime/v2: remove the runtime-allow-mounts annotation
vendor: github.com/docker/go-metrics v0.1.0 (#14041)
- b44bea515c vendor: github.com/docker/go-metrics v0.1.0
chore(api): update github.com/sirupsen/logrus v1.10.2 (#14037)
- a28910b14f chore(api): update github.com/sirupsen/logrus v1.10.2
Update CI to include Go 1.27 (#14033)
- 8d32443320 Update CI to include Go 1.27
vendor: github.com/containerd/go-runc v1.2.1 (#14038)
- 704ca21342 vendor: github.com/containerd/go-runc v1.2.1
erofs: instrument warm up cache (#13941)
- 81c272b28d erofs: instrument the layer content cache and applies
Remove shim.Command form pkg (#13991)
- 55c39f2516 Move shim.Command to runtime
pkg/tracing: handle error and typed-nil Stringer attributes (#14013)
- 442969ef0e pkg/tracing: handle error and typed-nil Stringer attributes
docker fetcher: strip sensitive headers on descriptor URLs (#12889)
- 51cf999e92 core/remotes/docker: normalize descriptor URL origins
- 5b3ce72589 core/remotes/docker: strip sensitive headers on desc.urls fetch
metadata: bound snapshotter Remove during garbage collection (#13799)
- a9d5caf7fc metadata: bound snapshotter Remove during garbage collection
build(deps): bump github.com/checkpoint-restore/checkpointctl from 1.5.0 to 1.6.0 (#14009)
- 64f05273e3 build(deps): bump github.com/checkpoint-restore/checkpointctl
build(deps): bump github.com/moby/sys/userns from 0.1.0 to 0.2.0 in the moby-sys group (#14008)
- 0880064dea build(deps): bump github.com/moby/sys/userns in the moby-sys group
build(deps): bump the k8s group across 1 directory with 2 updates (#14007)
- b86bc4be52 build(deps): bump the k8s group across 1 directory with 2 updates
Bump go-runc to 1.2.0 (#14006)
- 10cf7114e6 Bump go-runc to 1.2.0
vendor: tags.cncf.io/container-device-interface 05ae4b5bb730 (#14004)
- 1448bcd8f0 vendor: tags.cncf.io/container-device-interface 05ae4b5bb730
build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#13965)
- 0db88d7f83 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2
internal/cri/server: remove remaining uses of k8s.io/utils (#14003)
- 10e82fac8d internal/cri/server: remove remaining uses of k8s.io/utils
vendor: github.com/sirupsen/logrus v1.10.1 (#13294)
- f511928a11 vendor: github.com/sirupsen/logrus v1.10.1
vendor: github.com/containerd/platforms v1.0.0-rc.5 (#14001)
- 0d797891bb vendor: github.com/containerd/platforms v1.0.0-rc.5
vendor: github.com/stretchr/testify v1.12.1 (#13973)
- c351cf4682 vendor: github.com/stretchr/testify v1.12.1
internal/cri/server/events: use testing/synctest (#13997)
- f7e8f30a05 internal/cri/server/events: use testing/synctest
pkg/shim: Report bootstrap API mismatch on startup (#13910)
- 85385a4c33 pkg/shim: Report bootstrap API mismatch on startup
internal/cri/bandwidth: remove dead code (#13996)
- fcb54dc5fa internal/cri/bandwidth: remove dead code
pkg/oci: resolve rootfs symlinks for user lookup (#13818)
- a8fc3a0172 pkg/oci: resolve rootfs symlinks for user lookup
Revert "add check on version of drop in configs" (#13939)
- c8da81e49b ensure that the final config version is the higest in the config list
- a8ed546687 Revert "add check on version of drop in configs"
shim: use PublisherOpts when creating new publisher (#13989)
- 014e20a87f shim: apply PublisherOpts
script/setup: update critools to v1.36.0 (#13992)
- 920978fd61 script/setup: update critools to v1.36.0
build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#13962)
- da7420a420 build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2
update runhcs to v0.15.0-rc.4 (#13984)
- 4ad9d13181 update runhcs to v0.15.0-rc.4
vendor: github.com/Microsoft/hcsshim v0.15.0-rc.4 (#13985)
- 972ef71c84 vendor: github.com/Microsoft/hcsshim v0.15.0-rc.4
- 6e6518a155 vendor: go.opentelemetry.io/otel v1.45.0, go.opentelemetry.io/contrib v0.70.0
- 9023b7eb12 vendor: google.golang.org/protobuf v1.36.12
- ee2255275b vendor: google.golang.org/genproto/* 6ac0973c030d
- 389f75a955 vendor: google.golang.org/grpc v1.83.1
- 444ecd0be0 vendor: github.com/go-logr/logr v1.4.4
- 26c040fb40 vendor: github.com/felixge/httpsnoop v1.1.0
- d1df90fb51 vendor: golang.org/x/mod v0.40.0
- e994dd627a vendor: golang.org/x/net v0.58.0
- 4fb52e086c vendor: golang.org/x/crypto v0.55.0
- 99178d1e2e vendor: golang.org/x/text v0.41.0
- f6b36c43af vendor: golang.org/x/mod v0.39.0
cri, nri: record resolved image name and digest in container metadata (#13960)
- 203578e2eb cri,nri: record resolved image name and digest in container metadata
- 8c4ccd2984 build: bump github.com/containerd/nri
Export config in CRI plugin (#13940)
- 93f38adbca Export config in CRI plugin
runtime: invoke Shutdown after every task deletion (#13958)
- 402eb3166e runtime: invoke Shutdown after every task deletion
implement Windows support for the shim server (#13948)
- 3bb3d8b7c6 address copilot comments
- 983dcf4987 [pkg/shim] Implement Windows-specific unimplemented methods
fix(runtime): apply load timeout to load shim (#13954)
- fd29ff1073 fix(runtime): bound shim loading with the load timeout
Update Go to 1.26.6 (#13957)
- b665fde220 Update Go to 1.26.6
cri: add tracing spans for image pull and sandbox setup paths (#12628)
- 0d8883b6dc client: trace image pull stages
ctr: drain exec output before cleanup (#13931)
- 3778cc36f4 ctr: drain exec output before cleanup
snapshots/erofs: protect snapshot staging from cleanup (#13932)
- e940b5ac18 snapshots/erofs: protect snapshot staging from cleanup
build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the docker-actions group across 1 directory (#13886)
- 3dd83f6774 build(deps): bump docker/login-action
build(deps): bump the codeql-actions group with 3 updates (#13922)
- cd9113b9d5 build(deps): bump the codeql-actions group with 3 updates
build(deps): bump actions/stale from 10.4.0 to 11.0.0 (#13923)
- c013c7df4d build(deps): bump actions/stale from 10.4.0 to 11.0.0
nri,deprecation: record and emit warnings for NRI deprecations. (#13916)
- bf0111a9cc nri,deprecation: emit warnings for old NRI plugins.
Add more context to the shim delete error (#13912)
- 29058e6501 Add more context to the shim delete error
Remove dependency on github.com/opencontainers/runtime-tools (#13519)
- e01c004cc6 Remove dependency on github.com/opencontainers/runtime-tools
Set the default of runtimeFeatures.UserNamespacesHostNetwork to true (#13162)
- a909c305c4 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
docs: update erofs docs (#13907)
- 0d21db6bf5 docs: reflow the erofs tar index mode section
- a23e4a127a docs: document the erofs layer content cache
unpack: don't drop topHalf errors in parallel mode (#13902)
- a35da471f3 unpack: don't drop topHalf errors in parallel mode
cri: fix container_start_time_seconds unit conversion (#13897)
- 71bc89b288 cri: fix container_start_time_seconds unit conversion
remotes/docker: Propagate registry warnings to the resolver (#12698)
- 80975e2c75 remotes/docker: Propagate registry warnings to resolver
bump selinux to v1.15.1, use SetProcessKind (#13395)
- ba3a464b8d bump oc/selinux to v1.15.1, use SetProcessKind
- 4167499888 deps: bump oc/selinux to v1.14.1
erofs: allow multiple cache directories (#13900)
- 7df6bb0a67 erofs: allow multiple layer content cache directories
Update api version to v1.12.0-beta.0 (#13906)
- a272df5685 Update api version to v1.12.0-beta.0
build(deps): bump the codeql-actions group with 3 updates (#13885)
- 406c8dc44a build(deps): bump the codeql-actions group with 3 updates
Prepare release notes for api/v1.12.0-beta.0 (#13899)
- 0ff04dc3f7 Prepare release notes for api/v1.12.0-beta.0
erofs: enable parallel unpack with content cache (#13826)
- 257a5900b0 core/unpack: detect staged layers via read-only mounts
- 1e001e6dfe erofs: make the layer content cache work with parallel unpack
cri: skip failed container instead of dropping entire sandbox metrics (#13896)
- 34524e8a68 cri: skip failed container instead of dropping entire sandbox metrics
ctr: register EROFS fsview (#13891)
- 0d37ad2683 ctr: register EROFS fsview
Prepare release notes for v2.4.0-beta.0 (#13865)
- f46e608b9b Prepare release notes for v2.4.0-beta.0
cri: remove restore in CreateContainer (#13871)
- 91be73ba62 cri: remove restore in CreateContainer
integration: build the whiteout-test image locally (#13735)
- f418688f2c integration: build the whiteout-test image locally
docs/security: update security report triage criteria (#13873)
- fdf814c21a docs/security: update security report triage criteria
snapshots/erofs: keep lowers stacked above a merged fsmeta (#13860)
- 01f5087866 snapshots/erofs: keep lowers stacked above a merged fsmeta
build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3 (#13862)
- fbbe206722 build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3
workflows/stale: exempt priority and status labels (#13869)
- 565606decf workflows/stale: exempt priority and status labels
cri: deprecate restore in CreateContainer (#13838)
- a3f99ba690 cri: deprecate restore in CreateContainer
internal/oom: Fix memory leak by removing watcher from map on Stop (#13856)
- 7f9455628a internal/oom: Fix memory leak by removing watcher from map on Stop
build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#13861)
- 7fdc69ca0c build(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1
build(deps): bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#13863)
- af9ded8e88 build(deps): bump github.com/prometheus/client_golang
build(deps): bump the codeql-actions group with 3 updates (#13864)
- ef89efe0d0 build(deps): bump the codeql-actions group with 3 updates
ci: dependabot: group docker/* and codeql action updates (#13847)
- 069df6c325 ci: dependabot: group docker/* and codeql action updates
Use ScrubLogs by default on Windows (#13837)
- 18a01c0020 ctr: add --scrub-logs flag for Windows
- f4e7944625 cri/config: use ScrubLogs by default on Windows
pkg/epoch: reject negative SOURCE_DATE_EPOCH values (#13817)
- 41f6f0e877 pkg/epoch: reject negative SOURCE_DATE_EPOCH values
build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#13844)
- 4fa23707c8 build(deps): bump actions/checkout from 7.0.0 to 7.0.1
build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 (#13842)
- c8fdb63ea1 build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1
core/runtime/v2: Drop checkpointctl module dependency (#13839)
- 9c6b71c95c core/runtime/v2: Drop checkpointctl module dependency
Include media type in content create event (#13833)
- a452c2e230 Include media type in content create event
build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1 (#13343)
- b1085e19b7 build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1
cri: add streaming RPCs (#13187)
- 47c7085d22 cri: add streaming RPCs
Handle []byte envvar value for CRI (#13453)
- b824ddc0b5 Handle []byte envvar value
- 78abbfb7f7 update to v0.36.x kubernetes dependencies
build(deps): bump github.com/erofs/go-erofs from 0.3.0 to 0.3.1 (#13820)
- 6e4c6acc0d build(deps): bump github.com/erofs/go-erofs from 0.3.0 to 0.3.1
shim_load: Consider shim leaked only if we can't find pids (#13790)
- 54a5a606cb shim_load: Consider shim leaked only if we can't find pids
Fix flaky CI on windows (#13827)
- dd654ecca0 Fix does not contain \x00 on windows
- 5c620e984f Fix NET/network CI failure on Windows
build: bump github.com/containerd/nri (#13812)
- 5d35f9ef97 build: bump github.com/containerd/nri
build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api (#13819)
- 52c5f1f64e build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api
docs: correct default for [debug] address (#13821)
- 1a7d78e0b9 docs: correct default for [debug] address
Support warm image cache for erofs snapshotter (#13813)
- 82a47efe92 Support dmverity
- f52e748f16 ctr: add build-erofs-cache to populate the erofs layer cache
- 728093bdca snapshots/erofs: source pre-converted layers from a content cache
docs: add threat model and triage guide (#12942)
- 3a3eddcbf9 docs: add threat model and triage guide
build(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 in the golang-x group (#13806)
- 9ead7c087d build(deps): bump golang.org/x/mod in the golang-x group
build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1 (#13688)
- 43866c6a3f build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.1.1
fsmount: Fix selinux mount parameter parsing (#13754)
- dd2bcfc643 fsmount: Fix selinux mount parameter parsing
build(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.0 (#13810)
- 624c8e85bd build(deps): bump github/codeql-action/upload-sarif
build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0 (#13765)
- 51355849a7 build(deps): bump docker/setup-buildx-action from 4.1.0 to 4.2.0
build(deps): bump docker/login-action from 4.2.0 to 4.4.0 (#13772)
- a9bb893ecb build(deps): bump docker/login-action from 4.2.0 to 4.4.0
build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3 (#13807)
- 10e0d68a94 build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.2 to 2.4.3
build(deps): bump actions/stale from 10.3.0 to 10.4.0 (#13811)
- a4b1e9a44b build(deps): bump actions/stale from 10.3.0 to 10.4.0
README: remove Go Report Card badge (#13741)
- 5de7b675c6 README: remove Go Report Card badge
overlay: don't override a configured index mount option (#13805)
- 5e25f36e5e overlay: don't override a configured index mount option
core/mount/manager: improve TestMkdirHandler failure messages (#13800)
- 807fbc13dc core/mount/manager: improve TestMkdirHandler failure messages
core/runtime/v2: Preserve protobuf shim response bytes (#13801)
- dac4ea43f3 core/runtime/v2: Preserve protobuf shim response bytes
Run CI against dev branches (#13748)
- 6c438b0479 Run CI against dev branches
Raise stale bot limits (#13780)
- 12f6a4d585 Raise stale bot limits
pkg/archive: reject out-of-range device numbers in layer headers (#13792)
- 0205398ac2 pkg/archive: reject out-of-range device numbers in layer headers
blockcim config and plugin initialization changes (#13469)
- 5ae5d993e6 use IsBlockCimWriteSupported for block CIM plugin init checks
- 8fbeab28d2 Fix incorrect default config value for block CIM snapshotter
update runc to v1.5.1 (#13791)
- 21efcf19a4 update runc to v1.5.1
ci: bound Go fuzzing by execution count (#13757)
- c1b9b78f47 ci: bound Go fuzzing by execution count
Introspect OCI runtime features for non-runc runtimes (#13504)
- fd7819bcb7 fix(cri): introspect OCI runtime features for non-runc runtimes
build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#13768)
- 61a70e7ef2 build(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0
build(deps): bump the golang-x group across 1 directory with 2 updates (#13766)
- d5657dbf64 build(deps): bump the golang-x group across 1 directory with 2 updates
build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 (#13767)
- bfae6f3513 build(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0
build(deps): bump github.com/containerd/ttrpc to v1.2.9 (#13740)
- 658a1c78b5 build(deps): bump github.com/containerd/ttrpc to v1.2.9
CI: migrate Vagrant to Lima (#13728)
- a42b09aaa6 CI: migrate Vagrant to Lima
RELEASES.md: mark 2.1 EOL and update latest 1.7/2.0/2.1/2.2/2.3 tags (#13739)
- 617944babe RELEASES.md: mark 2.1 EOL and update latest 1.7/2.0/2.1/2.2/2.3 tags
remotes: surface OCI error body in registry 4xx responses (#13547)
- 5c66703ee3 remotes: surface OCI error body on HEAD 403 via GET fallback
Disable checkpoint restore codepath when CRIU is not installed (#13664)
- 81350a5d9a github/workflows: install criu in node-e2e
- 06495733b2 cri: add enable_criu configuration option
- 186397511b cri: validate CRIU availability and version early
Update go to 1.26.5 (#13725)
- 2b017f12b5 Update go to 1.26.5
feat: add loong64 (LoongArch) build support (#13642)
- 48c841fe2d feat: add loong64 (LoongArch) build support
Add dockerfile for the whiteout-test test image (#13704)
- cb3c0f0665 Add dockerfile for the whiteout-test test image
build(deps): bump actions/cache from 5.0.5 to 6.1.0 (#13687)
- ee7e56cac7 build(deps): bump actions/cache from 5.0.5 to 6.1.0
*: disable bbolt stat usage (#13721)
- 0b7466980e *: disable bbolt stat usage
build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.1 to 2.4.2 (#13672)
- fb80dbbf94 build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.1 to 2.4.2
pkg/kernelversion: fix linting and sync with upstream (#13701)
- 296f917d5d pkg/kernelversion: update links to upstream source
- c45f911980 pkg/kernelversion: simplify code with sync.OnceValues
- 5e3e05aec7 pkg/kernelversion: fix minor linting issues
- 762b89ceeb pkg/kernelversion: use unix.ByteSliceToString for utsname fields
Update stale PR policy (#13716)
- 4f9bae6776 Update stale PR policy
ci: pin fog-json to resolve gem conflict (#13707)
- 84112c78c1 ci: pin fog-json to resolve gem conflict
cri: auto-add prefix for pause image (#13513)
- c7d4057d47 cri: auto-add prefix for pause image
gha: pin remaining actions and apply hardening from zizmor (#13597)
- 0f18307820 gha: quote some values
- 0274924d74 gha: remove uses of "read-all" permissions
- 072a34d648 gha: suppress zizmor warning for intentionally un-pinned workflows
- 9f0bb640ce gha: apply zizmor fixes
- 8722c46313 gha: buf-breaking: pin actions by sha
Add parent path to runc checkpoint options (#13699)
- ea0ed51e21 shim: allow specifying runc's --parent-path during checkpointing
Fix nil pointer dereference in NRI GetIPs (#13683)
- c2dae310af Fix nil pointer dereference in NRI GetIPs
Set SystemTemp env var to config temp on Windows (#13667)
- faff4d66ba Set SystemTemp env var to config temp on Windows
update runhcs to v0.15.0-rc.3 (#13691)
- 7c9c25d649 update runhcs to v0.15.0-rc.3
build(deps): bump github.com/Microsoft/hcsshim from 0.15.0-rc.1 to 0.15.0-rc.3 (#13690)
- d763407d4a build(deps): bump github.com/Microsoft/hcsshim
Use klauspost/compress/gzip for decode (#13560)
- d8f13bf4cc pkg/archive/compression: use klauspost/compress/gzip for decode
cri: route sandbox stats through Controller.Metrics (#13312)
- 749d8fbe45 Use metric timestamp for sandbox stats samples
- e8dbd24ac5 cri: route stats collector's sandbox path through Controller.Metrics
- 309aaba2a5 cri: route sandbox stats through Controller.Metrics
docs: point runtime to updated errdefs pkg (#13410)
- 668e0681a4 docs: point runtime to updated errdefs pkg
: increase fuzz test time to 60s (#13677)
- 2121a44ce7 Increase fuzz timeout to 60s
build(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 in the moby-sys group across 1 directory (#13670)
- 6079844dae build(deps): bump github.com/moby/sys/user
snapshots/devmapper: avoid nil status deref after mkfs failure (#13633)
- 5e38aadc53 snapshots/devmapper: avoid nil status deref after mkfs failure
pkg/archive: remove redundant github.com/moby/sys/sequential dependency (#13675)
- 35f753cc44 pkg/archive: remove redundant github.com/moby/sys/sequential dependency
pkg/oci: update TestOpenUserFileCapsReads to use newlined data (#13674)
- 7a7aebfcbf pkg/oci: update TestOpenUserFileCapsReads to use newlined data
cri: exclude cached layer bytes from image_pulling_throughput_mibps (#13245)
- 16ff70b861 cri: add image_pulling_throughput_mibps and deprecate image_pulling_throughput
- 1755053a78 cri: exclude cached layer bytes from image_pulling_throughput
RELEASES: document platform support policy (#13655)
- d0b3819495 RELEASES: document platform support policy
update runc to v1.5.0 (#13673)
- 8f2bbc77a4 update runc to v1.5.0
fix snapshotter variable check in ContainerWithCheckpoint (#13482)
- 57fca66a60 [Bugfix] fix snapshotter variable check in ContainerWithCheckpoint
build(deps): bump actions/checkout from 6 to 7 (#13648)
- 38aaa269c7 build(deps): bump actions/checkout from 6 to 7
cri: fix duplicated image env vars on checkpoint import (#13623)
- 6a677e0fd6 cri: fix duplicated image env vars on checkpoint import
cri: reject CreateContainer when sandbox is not running (#13654)
- ae30a5cad2 cri: reject CreateContainer when sandbox is not running
build(deps): bump github.com/mdlayher/vsock from 1.2.1 to 1.3.0 (#13493)
- 3fdb9abcab build(deps): bump github.com/mdlayher/vsock from 1.2.1 to 1.3.0
build(deps): bump github.com/intel/goresctrl from 0.12.0 to 0.13.0 (#13527)
- 787bb3da64 build(deps): bump github.com/intel/goresctrl from 0.12.0 to 0.13.0
oci: use path.Join to fill CgroupsPath (#13661)
- 51e3a8f4ab oci: use path.Join to fill CgroupsPath
build(deps): bump github.com/moby/sys/sequential from 0.6.0 to 0.7.0 in the moby-sys group across 1 directory (#13557)
- ef32a6c8ac build(deps): bump github.com/moby/sys/sequential
Register tracing log hook before signal handling (#13411)
- 125c15bcd0 Register tracing log hook before signal handling
content: handle sharing violations on Windows (#13329)
- a26143af1e content: handle sharing violations on Windows
update runhcs to v0.15.0-rc.2 (#13659)
- ceee91ff5a update runhcs to v0.15.0-rc.2
build(deps): bump go.etcd.io/bbolt from 1.4.3 to 1.5.0 (#13649)
- 7f3f8fffdd build(deps): bump go.etcd.io/bbolt from 1.4.3 to 1.5.0
cri: don't leak the new mount if mutateImageMount() fails (#13656)
- a88ce40fd1 cri: don't leak the new mount if mutateImageMount() fails
build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1 (#13650)
- d568ae9cb5 build(deps): bump softprops/action-gh-release from 3.0.0 to 3.0.1
build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.1 (#13651)
- f407302bab build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.1 to 2.4.1
docs: fix duplicated word in NRI guide (#13618)
- 59ccb0029b docs: fix duplicated word in NRI guide
Add forward References to the GC collection context (#13634)
- 4be39f13f4 core/metadata: add forward References to the GC collection context
integration: add http trace for debug (#13518)
- 3d80ce2881 integration: add http trace for debug
test: fix flaky image timestamp check on coarse clocks (#13588)
- e5e2190886 test: fix flaky image timestamp check on coarse clocks
core/content/proxy: Convert reader errors to native errdefs (#13585)
- d58c2c1aa4 core/content/proxy: Convert reader errors to native errdefs
Patches (#13626)
- a0086cfcee Merge commit from fork
- 861ffc1097 cri: filter CDI annotations on checkpoint restore
- 432a7af299 Merge commit from fork
- 0c0918fa8f cri: do not re-tag restored checkpoints
- 3977106b53 Merge commit from fork
- 8196411f24 cri: make checkpoint restore robust to unexpected archive content
- 5a91c99584 Merge commit from fork
- 7b05ec421d Bound user-database file reads in openUserFile
- a834385de9 Merge commit from fork
- 0ec1af4cae Do not propagate reserved labels from image configs
erofs: align default mkfs block size across platforms (#13624)
- 773d3517dd erofs: align default mkfs block size across platforms
fix(shim/windows): retry on winio.ErrTimeout in awaitPipeReady (#13536)
- be3fcf33e8 fix(shim/windows): retry on winio.ErrTimeout in awaitPipeReady
vendor: golang.org/x/crypto v0.53.0 (#13600)
- 9838a323ed vendor: golang.org/x/crypto v0.53.0
update runc binary to v1.4.3 (#13590)
- ebef5893cc update runc binary to v1.4.3
core/proxy: Convert stream proxy errors to native errdefs (#13586)
- d3c143e8b4 core/proxy: Convert stream proxy errors to native errdefs
build(deps): bump the golang-x group with 3 updates (#13556)
- 719088fbaa build(deps): bump the golang-x group with 3 updates
resolver: retry on transient network errors (#13323)
- 20af2e324a resolver: retry on transient network errors
update go to 1.26.4 (#13575)
- 3c37ceee46 update go to 1.26.4
Update to current setup-go version (#13516)
- 80b3fe5c78 Update to current setup-go version
build(deps): bump github/codeql-action from 4.36.0 to 4.36.2 (#13555)
- dfb00c4770 build(deps): bump github/codeql-action from 4.36.0 to 4.36.2
Configure udevd children-max for root-test (#13562)
- 4adafdf7e1 Configure udevd children-max for root-test
Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks (#13399)
- 2b2b80f558 Add deferred call to ShutdownSandbox to avoid leaks
Upload crash artifacts from go test -fuzz when failed (#13503)
- 0ffe456f1e github: upload crash artifacts from go test -fuzz
Use intermediate env variables for bash script runners in github workflows (#13434)
- d5b1a69dae Use intermediate env variables for bash script runners
Add max size label for snapshots (#13520)
- f2b7791b23 Add max size label for snapshots
CI: update Fedora to 44 (#13525)
- e37dfad050 CI: update Fedora to 44
remotes: close fetch reader immediately on EOF (#13438)
- 45cc0c578e integration: use streaming Read in test mirror limiter
- a989093a9c remotes: close fetch reader immediately on EOF
cri: reset pull progress timer on idle→active transition (#13304)
- 6c396d050d cri: reset pull progress timer on idle→active transition
runc-shim: don't hold the service lock across runc create (#13483)
- dbcaa504c6 runc-shim: don't hold the service lock across runc create
integration: deflake TestFailFastWhenConnectShim (#13471)
- a9fba66231 integration: deflake TestFailFastWhenConnectShim
Resurrect 2.1 branch for a short period (#13498)
- 660e411a3a Resurrect 2.1 branch for a short period
build(deps): bump the otel group across 1 directory with 8 updates (#13495)
- de9dcf6aa6 build(deps): bump the otel group across 1 directory with 8 updates
Update typeurl/v2 to v2.3.0 to drop gogo dependency (#13490)
- ce39143249 Update typeurl/v2 to v2.3.0 to drop gogo dependency
build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 (#13428)
- 8f3c916a76 build(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1
cri: skip pause image pull for shim sandboxer (#13424)
- 8f7c7fb447 cri: skip pause image pull for non-podsandbox sandboxers
Vagrantfile: update DNF cache (#13487)
- 8ef3b6a12b Vagrantfile: update DNF cache
build(deps): bump docker/login-action from 4.1.0 to 4.2.0 (#13476)
- 4939e073d5 build(deps): bump docker/login-action from 4.1.0 to 4.2.0
core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read (#13462)
- 88af11e081 core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
build(deps): bump the k8s group across 1 directory with 6 updates (#13427)
- f19f84cfe0 build(deps): bump the k8s group across 1 directory with 6 updates
build(deps): bump actions/stale from 10.2.0 to 10.3.0 (#13473)
- 8baa17cced build(deps): bump actions/stale from 10.2.0 to 10.3.0
build(deps): bump golang.org/x/sys from 0.44.0 to 0.45.0 in the golang-x group (#13474)
- be9c7a8571 build(deps): bump golang.org/x/sys in the golang-x group
build(deps): bump github/codeql-action from 4.35.2 to 4.36.0 (#13475)
- 032232ac0b build(deps): bump github/codeql-action from 4.35.2 to 4.36.0
build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (#13477)
- 95ccda2f23 build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0 (#13478)
- db807068a7 build(deps): bump docker/setup-buildx-action from 4.0.0 to 4.1.0
pkg/oci: WithUser: remove redundant isErrRange utility (#13480)
- 633a5be1c9 pkg/oci: WithUser: remove redundant isErrRange utility
Fix flaky e2e test (#13470)
- 8e0713454f cri: use per-metric timestamp in background stats collector
Fix: TestCgroupNamespace failure on cgroups v1 hosts (#13240)
- 970b5d46bc Fix TestCgroupNamespace failure on cgroups v1 hosts
do not hide linitng errors (#13423)
- 7f10e9eb5f do not hide linitng errors
contrib/checkpoint: increase timeouts to 30s (#13436)
- 7515c32ea4 contrib/checkpoint: increase timeouts to 30s
oci: return explicit error for out-of-range USER values (#13446)
- 9439355c2b oci: return explicit error for out-of-range USER values
use local go toolchain in CI to confirm that build actually uses requ… (#13102)
- 6a80f19a1c use local go toolchain in CI to confirm that build actually uses requested toolchain
Fix sandbox task API endpoints for non-runc runtimes (#13360)
- b88ab5af4f Wire task address and version fields
- ac01ae5c27 protos: include task API address to CreateTaskRequest
remove 1.26.2 from CI builds as it is not supported any longer due to… (#13419)
- d7a8346600 remove 1.26.2 from CI builds as it is not supported any longer due to the dependency
ci: skip advisory jobs in merge queue (#13404)
- 342edf84ab ci: skip advisory jobs in merge queue
cleanup the systemd debug notification logging (#13400)
- 7b1604739f cleanup the systemd debug notification logging
RELEASES.md: 2.1 EOL (2026-05-05) (#13376)
- bef924dcb7 RELEASES.md: 2.1 EOL (2026-05-05)
build(deps): bump the golang-x group with 2 updates (#13384)
- 8c2e686ffb build(deps): bump the golang-x group with 2 updates
build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1 (#13345)
- 67121b9ab6 build(deps): bump github.com/pelletier/go-toml/v2 from 2.3.0 to 2.3.1
pkg: remove unused nolint annotations (#13391)
- 899dee1f59 pkg: remove unused nolint annotations
seccomp: Block AF_ALG in default socket policy (#13327)
- 0c23e946a7 seccomp: Block AF_ALG in default socket policy
- ed061a08de seccomp: Document socket rule scope and socketcall limitation
overlay: disable "rebase" capability when running in UserNS (#13389)
- 65d75e997b overlay: disable "rebase" capability when running in UserNS
build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6 (#13344)
- d30223f09f build(deps): bump github.com/klauspost/compress from 1.18.5 to 1.18.6
server: tolerate failed gRPC plugins when starting listeners (#13363)
- ef985f8628 server: tolerate failed gRPC plugins when starting listeners
fix(erofs): set TMPDIR for mkfs.erofs on Windows (#13008)
- 1a6bd7020a fix(erofs): set TMPDIR for mkfs.erofs on Windows
Update Go to 1.26.3 (#13361)
- c4275193b6 Update Go to 1.26.3
build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0 (#13342)
- f698202ed8 build(deps): bump google.golang.org/grpc from 1.80.0 to 1.81.0
fix: close boltdb on metadata and mount plugin close (#13348)
- 3bc019ea3d fix: close boltdb on metadata and mount plugin close
Fix optional EROFS differ setup in transfer plugin (#13328)
- f8a5f8d2c0 Refactor transfer unpack configuration setup
- 5860534c35 Fix optional transfer differ setup

Changes from containerd/go-cni

7 commits

feat: Instrument CNI interface with OpenTelemetry tracing (containerd/go-cni#132)
- 72f1253 Document cni.Setup span
- 868ee13 Instrument CNI interface with OpenTelemetry tracing
Bump github.com/sirupsen/logrus from 1.7.0 to 1.8.3 in /integration (containerd/go-cni#134)
- c3cfd3d Bump github.com/sirupsen/logrus from 1.7.0 to 1.8.3 in /integration
ci: declare least-privilege workflow-level contents: read (containerd/go-cni#138)
- 871cf73 ci: declare workflow-level contents: read on 1 workflow

Changes from containerd/go-runc

30 commits

chore(deps): update containerd/console to v1.0.5 (containerd/go-runc#119)
- d6ff02d chore(deps): update containerd/console to v1.0.5
io: skip chowning pipes on non-Linux platforms (containerd/go-runc#117)
- 2df5488 io: skip chowning pipes on non-Linux platforms
README: cleanup and fix links (containerd/go-runc#122)
- c08ca30 README: cleanup and fix links
ci: update actions, golangci-lint, and test against oldest (go.mod), oldstable, and stable (containerd/go-runc#120)
- 87f213c ci: test against oldest (go.mod), oldstable, and stable Go versions
- 1ef7086 ci: remove custom working-directories and GOPATH
- af126fb ci: apply zizmor fixes, ping actions by sha
- c665434 ci: update actions and golangci-lint
- 4b025f9 fix linting
deprecate ErrParseRuncVersion (containerd/go-runc#118)
- e039ef4 deprecate ErrParseRuncVersion
Add support for runc's --pidfd-socket (containerd/go-runc#115)
- 13e8412 Add support for runc's --pidfd-socket
Add WithExtraEnv to set the environment per invocation (containerd/go-runc#116)
- 7a33975 Add WithExtraEnv to set the environment per invocation
Add Go 1.22 to CI (containerd/go-runc#107)
- 41244b9 Add Go 1.22 to CI
Wire WorkDir into runc command invocation (containerd/go-runc#114)
- a43614f Add WorkDir option to set the runc process working directory
crun features command is added (containerd/go-runc#103)
- 21dc3de crun features command is added
exec:support to set custom log path (containerd/go-runc#112)
- df61552 exec:support to set custom log path
go.mod: bump up (containerd/go-runc#98)
- 8f10d5c go.mod: bump up
Updating go-runc Stats to be compliant with OCI runc.Stats (containerd/go-runc#102)
- 2642b42 Updating go-runc Stats to be compliant be OCI runc.Stats

Changes from containerd/nri

51 commits

update plugins to current NRI version (containerd/nri#315)
- 420e081 update plugins to current NRI version
examples: update for current NRI and cgroups versions (containerd/nri#314)
- 492ff6c examples: update for current NRI and cgroups versions
chore(deps): plugins/differ bump github.com/r3labs/diff/v3 v3.0.2, github.com/goccy/go-yaml v1.13.7 (containerd/nri#313)
- d02a067 chore(deps): plugins/differ bump github.com/goccy/go-yaml v1.13.7
- b0ac9aa chore(deps): plugins/differ bump github.com/r3labs/diff/v3 v3.0.2
chore(deps): bump google.golang.org/grpc v1.65.1 (containerd/nri#312)
- 8db1158 chore(deps): bump google.golang.org/grpc v1.65.1
chore(deps): bump sigs.k8s.io/yaml v1.5.0 (containerd/nri#311)
- 98d54e5 chore(deps): bump sigs.k8s.io/yaml v1.5.0
rewrite tests without ginkgo (containerd/nri#309)
- 6ed16f8 pkg/net/multiplex: rewrite tests without ginkgo
- 5e53b31 pkg/adaptation: rewrite tests without ginkgo
- f0edf67 pkg/runtime-tools/generate: rewrite tests without ginkgo
fix(adaptation): record sysctl removal markers in Linux.Sysctl (containerd/nri#300)
- f02bd69 fix(adaptation): record sysctl removal markers in Linux.Sysctl
ci: update actions, pin actions by sha, and apply zizmor fixes, and update to ubuntu 26.04 (containerd/nri#306)
- d952523 ci: update to ubuntu-26.04
- d58850c ci: pin all actions by sha
- 8d07299 ci: set default permissions, concurrency, and fix zizmor linting
- b54c44f ci: update codespell-project/actions-codespell@v2.2
- c2b379f ci: update github/codeql-action v4.37.7
- de3aa56 ci: update sigstore/cosign-installer@v4.1.2
- 6597f73 ci: update golangci/golangci-lint-action@v9.3.0
- 3d0359b ci: update docker actions
- ebdebf6 ci: update actions/setup-go@v7.0.0
- 2a66ab2 ci: update actions/checkout@v7.0.1
- 3bfe8b2 ci: use reusable install-go action
chore(deps): go.yaml.in/yaml/v3 v3.0.5, testify v1.12.1, logrus v1.9.4 (containerd/nri#308)
- 9120181 chore(deps): github.com/sirupsen/logrus v1.9.4
- 081b62d chore(deps): github.com/stretchr/testify v1.12.1
- 1a657cf chore(deps): go.yaml.in/yaml/v3 v3.0.5
ci: declare contents: read on ci.yml and codespell.yml (containerd/nri#296)
- 925060e ci: declare contents: read on ci.yml and codespell.yml
docs: add context to nri image keys (containerd/nri#307)
- 03cfa9c docs: add context to nri image keys
api,adaptation: add container image info (containerd/nri#302)
- 6327012 api,adaptation: add container image info
Remove dependency on github.com/opencontainers/runtime-tools (containerd/nri#305)
- 6113b94 Remove dependency on github.com/opencontainers/runtime-tools
- a673378 fix linting
replace uses of deprecated gopkg.in/yaml.v3 module (containerd/nri#293)
- 8c90b09 replace uses of deprecated gopkg.in/yaml.v3 module
adaptation: avoid holding lock across runtime update callback (containerd/nri#301)
- 55afaa2 adaptation: avoid holding lock across runtime update callback
docs: Fix typo in containerd config for default validator. (containerd/nri#297)
- b7e479f docs: Fix typo in containerd config for default validator.
Fix .gitignore (containerd/nri#290)
- 0d37892 fix .gitignore to include info/none
- 0a92ac9 delete manually-added none file

Changes from containerd/platforms

2 commits

Fix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)
- bacc690 Fix WS2022 compat on hosts past the latest LTSC

Changes from containerd/ttrpc

25 commits

build(deps): bump golang.org/x/sys from 0.42.0 to 0.46.0 in the golang-x group across 1 directory (containerd/ttrpc#215)
- 093db7f build(deps): bump golang.org/x/sys
build(deps): bump google.golang.org/grpc from 1.69.2 to 1.81.1 (containerd/ttrpc#237)
- 651f052 build(deps): bump google.golang.org/grpc from 1.69.2 to 1.81.1
build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 (containerd/ttrpc#238)
- ae8cc36 build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1
build(deps): bump actions/checkout from 6.0.2 to 6.0.3 (containerd/ttrpc#240)
- abdb054 build(deps): bump actions/checkout from 6.0.2 to 6.0.3
Remove gogo vanity command and gogo dependency (containerd/ttrpc#239)
- 5909255 Remove gogo vanity command
Fix deadlock when stream is not consumed (containerd/ttrpc#229)
- cc8699e Bump minimum go version to 1.23 for immediate GC of timers
- 61715d2 Add deadlock fix when stream is not consumed
- 25b19dd Add unit test to check for deadlock on unconsumed stream
server: cancel per-stream context when handler returns (containerd/ttrpc#231)
- acefd00 server: cancel per-stream context when handler returns
Set buf version from file and match dev version (containerd/ttrpc#233)
- 02f1a13 Set buf version from file and match dev version
Fix proto generation (containerd/ttrpc#232)
- 45d5a6c Fix proto generation
build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (containerd/ttrpc#228)
- f0dc2d5 build(deps): bump actions/setup-go from 6.3.0 to 6.4.0
Migrate from protobuild to buf (containerd/ttrpc#226)
- 056f619 Update CI workflow to use buf instead of protobuild
- 4308a4e Migrate from protobuild to buf

Dependency Changes

cyphar.com/go-pathrs v0.2.1 -> v0.2.5
github.com/Microsoft/hcsshim v0.15.0-rc.1 -> v0.15.0-rc.4
github.com/ProtonMail/go-crypto v1.4.1 new
github.com/StackExchange/wmi cbe66965904d -> v1.2.1
github.com/checkpoint-restore/checkpointctl v1.5.0 -> v1.6.0
github.com/cilium/ebpf v0.16.0 -> v0.17.3
github.com/cloudflare/circl v1.6.3 new
github.com/containerd/containerd/api v1.11.0 -> v1.12.0
github.com/containerd/go-cni v1.1.13 -> v1.1.14
github.com/containerd/go-runc v1.1.0 -> v1.2.1
github.com/containerd/imgcrypt/v2 v2.0.2 -> v2.0.3
github.com/containerd/log/otel v0.1.0 new
github.com/containerd/nri v0.12.0 -> v0.12.3
github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5
github.com/containerd/ttrpc v1.2.8 -> v1.2.9
github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
github.com/containernetworking/cni v1.3.0 -> v1.3.1
github.com/containers/ocicrypt v1.2.1 -> v1.3.2
github.com/cyphar/filepath-securejoin v0.6.0 -> v0.7.0
github.com/docker/go-events e31b211e4f1c -> v0.1.0
github.com/docker/go-metrics v0.0.1 -> v0.1.0
github.com/erofs/go-erofs v0.3.0 -> v0.3.1
github.com/felixge/httpsnoop v1.0.4 -> v1.1.0
github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
github.com/fxamacker/cbor/v2 v2.9.0 -> v2.9.1
github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.5
github.com/go-logr/logr v1.4.3 -> v1.4.4
github.com/go-ole/go-ole v1.2.6 -> v1.3.0
github.com/google/certtostore v1.0.6 -> v1.0.7
github.com/google/deck 105ad94aa8ae -> v1.1.0
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 -> v2.30.0
github.com/intel/goresctrl v0.12.0 -> v0.13.0
github.com/klauspost/compress v1.18.5 -> v1.20.0
github.com/mdlayher/socket v0.5.1 -> v0.6.0
github.com/mdlayher/vsock v1.2.1 -> v1.3.0
github.com/miekg/pkcs11 v1.1.1 -> v1.1.2
github.com/moby/sys/user v0.4.0 -> v0.4.1
github.com/moby/sys/userns v0.1.0 -> v0.2.1
github.com/opencontainers/selinux v1.13.1 -> v1.15.1
github.com/pelletier/go-toml/v2 v2.3.0 -> v2.4.3
github.com/prometheus/client_golang v1.23.2 -> v1.24.1
github.com/prometheus/common v0.67.5 -> v0.70.1
github.com/prometheus/procfs v0.19.2 -> v0.21.1
github.com/sirupsen/logrus v1.9.4 -> v1.10.2
github.com/smallstep/pkcs7 v0.1.1 -> v0.2.1
github.com/stretchr/testify v1.11.1 -> v1.12.1
github.com/urfave/cli-docs/v3 v3.1.0 new
github.com/urfave/cli/v3 v3.11.0 new
go.etcd.io/bbolt v1.4.3 -> v1.5.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 -> v0.71.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 -> v0.71.0
go.opentelemetry.io/contrib/propagators/envcar v0.71.0 new
go.opentelemetry.io/otel v1.43.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 -> v1.46.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 -> v1.46.0
go.opentelemetry.io/otel/metric v1.43.0 -> v1.46.0
go.opentelemetry.io/otel/sdk v1.43.0 -> v1.46.0
go.opentelemetry.io/otel/trace v1.43.0 -> v1.46.0
go.opentelemetry.io/proto/otlp v1.10.0 -> v1.11.0
go.yaml.in/yaml/v2 v2.4.3 -> v2.4.4
go.yaml.in/yaml/v3 v3.0.5 new
golang.org/x/crypto v0.49.0 -> v0.56.0
golang.org/x/mod v0.35.0 -> v0.41.0
golang.org/x/net v0.52.0 -> v0.58.0
golang.org/x/oauth2 v0.35.0 -> v0.36.0
golang.org/x/sync v0.20.0 -> v0.23.0
golang.org/x/sys v0.43.0 -> v0.48.0
golang.org/x/term v0.41.0 -> v0.45.0
golang.org/x/text v0.35.0 -> v0.41.0
golang.org/x/time v0.15.0 -> v0.16.0
google.golang.org/genproto/googleapis/api 9d38bb4040a9 -> da73d73af1c5
google.golang.org/genproto/googleapis/rpc 6f92a3bedf2d -> da73d73af1c5
google.golang.org/grpc v1.80.0 -> v1.83.2
google.golang.org/protobuf f2248ac996af -> v1.36.12
k8s.io/api v0.36.0 -> v0.37.0
k8s.io/apimachinery v0.36.0 -> v0.37.0
k8s.io/client-go v0.36.0 -> v0.37.0
k8s.io/component-base v0.36.0 -> v0.37.0
k8s.io/cri-api v0.36.0 -> v0.37.0
k8s.io/cri-client v0.36.0 -> v0.37.0
k8s.io/cri-streaming v0.36.0 -> v0.37.0
k8s.io/kube-openapi 5883c5ee87b9 -> d427ff9ee9ad
k8s.io/streaming v0.36.0 -> v0.37.0
k8s.io/utils 28399d86e0b5 -> be93311217bd
sigs.k8s.io/structured-merge-diff/v6 v6.3.2 -> v6.4.2
tags.cncf.io/container-device-interface v1.1.0 -> v1.1.1
tags.cncf.io/container-device-interface/specs-go v1.1.0 -> v1.1.1

Previous release can be found at v2.3.0

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/m

containerd/containerd v2.4.0 containerd 2.4.0 on GitHub