Survey
Please take the Kata Containers survey:
This will help the Kata Containers community understand:
- how you use Kata Containers
- what features and improvements you would like to see in Kata Containers
Libseccomp Notices
The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.
The kata-agent uses the libseccomp v2.6.0 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.
Kata Containers builder images
- agent (on all its different flavours): quay.io/kata-containers/builders:agent-086d5ee82-7632ffd8a-1.96-x86_64
- Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-4d1e78da2-x86_64
- OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-fc8df7157-x86_64
- QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-ebdd40446-x86_64
- shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.26.7-rust-1.96-a7a273435-x86_64
- tools: quay.io/kata-containers/builders:tools-go-1.26.7-rust-1.96-086d5ee82-e65da2623-19e723786-16688b22a-7632ffd8a-x86_64
- virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-21e278c42-x86_64
Installation
Follow the Kata installation instructions.
What's Changed
- rootfs: Bump to Ubuntu 26.04 all over the place by @fidencio in #13584
- ci: require OpenVMM k8s tests by @sprt in #13675
- kata-deploy: switch to external k8s-job-dispatcher by @fidencio in #13685
- tests: run the kata-deploy tests on a kubeadm deployed cluster by @fidencio in #13686
- csi-kata-directvolume: fix nil-deref panic in CreateVolume error branch by @pamanseau in #13444
- runtime-rs/QEMU: pass block sources by fd by @manuelh-dev in #13546
- versions: bump golang to 1.26.7 by @stevenhorsman in #13688
- versions: Rust 1.96 bump by @stevenhorsman in #13687
- packaging: verify virtiofsd release archive checksum by @charliermarsh in #13657
- release: fix the libseccomp asset published with a release by @fidencio in #13684
- tests: wait for the kata-monitor pods to exist before checking them by @fidencio in #13696
- required-tests: Make the kata-deploy tests not-required by @fidencio in #13701
- tools: Take the toolchains into account for the tools builder image by @fidencio in #13700
- runtime-rs: ch: cold-plug block devices requested before boot by @Redent0r in #13668
- kata-deploy: load required host modules in job mode by @fidencio in #13712
- kata-deploy: remove the in-tree job dispatcher by @fidencio in #13720
- gatekeeper: Make SEV-SNP CI non-required by @fidencio in #13725
- dragonball: Fix broken symlinks by @fidencio in #13704
- doc: Migrate contributing guide by @stevenhorsman in #13722
- runtime-rs: fix VM console logging by @pmores in #13437
- tests: let kubectl do the waiting for kata-monitor's pods by @fidencio in #13711
- build: Fix pcilibs-rs dep by @gkurz in #13723
- runtime-rs/QEMU: pass VFIO devices by fd by @manuelh-dev in #13548
- doc: Contributing AI policy by @stevenhorsman in #13727
- kata-deploy: install the nodes that join after the release by @fidencio in #13718
- tests: increase CPU hotplug retry timeout in k8s-cpu-ns by @vvoronko in #13413
- ci.ocp: Fix selinux handling by @ldoktor in #13636
- gatekeeper: Mark the NVIDIA GPU CI as non-required by @fidencio in #13737
- ci: tests: Rely on the cached VCEK certificates on the SNP nodes by @fidencio in #13729
- ci: tests: Get the vanilla k8s deployment working with kubeadm 1.37 by @fidencio in #13739
- gatekeeper: Mark genpolicy tests as non-required by @fidencio in #13740
- tests: don't fail the CI if an AKS cluster deletion fails by @fidencio in #13741
- tests: nvidia: Avoid hitting NGC on every PR by @fidencio in #13726
- nvidia: ship dcgm-exporter in the GPU images by @fidencio in #13719
- packaging: tie the NVIDIA guest images to the kernel they are signed for by @fidencio in #13728
- tests: add retry logic to genpolicy generate tests by @manuelh-dev in #13715
- tests: remove workarounds for k8s-policy-pod.yaml by @manuelh-dev in #13714
- kata-deploy: Switch to the Job deployment mode by default by @fidencio in #13468
- runtime-rs: remove unsupported disable_block_device_use by @sprt in #13682
- packaging: drop unused guest-components source build by @Xynnn007 in #13658
- Deps/cves/28 aug 26 by @stevenhorsman in #13750
- genpolicy: enforce image_guest_pull storage cardinality by @manuelh-dev in #13689
- docs: add a method for finding baremetal or nested by @ngopalak-redhat in #13765
- runtime-rs: enable QEMU sandbox for NVIDIA configs by @manuelh-dev in #13673
- dragonball: Optimize snapshot restore and remove boot-source dependency by @xavier-niu in #13758
- runtime-rs/tests: share rootless VMM credentials logic between CLH and QEMU, and generalize the rootless bats test by @manuelh-dev in #13628
- kata-deploy: install erofs-utils from a container image by @fidencio in #13762
- build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /src/runtime by @dependabot[bot] in #13774
- gha: move build checks to nightly workflow for ppc64le by @Amulyam24 in #13771
- kata-monitor: add TLS support by @thejasn in #13257
- gha: Give every job a timeout-minutes by @fidencio in #13743
- ci: stop govulncheck from sharing its caller's concurrency group by @fidencio in #13744
- release: helm: Upload the try-*.values files as part of the release by @fidencio in #13780
- build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 in /src/tools/csi-kata-directvolume by @dependabot[bot] in #13776
- kata-deploy: enable NFD in the NVIDIA presets by @fidencio in #13781
- genpolicy: add host-pull policy tests by @manuelh-dev in #13690
- genpolicy: add image_guest_pull storage tests by @manuelh-dev in #13691
- Bump pcilibs-rs to 28308229 by @gkurz in #13794
- gha: move agent and runtime build checks to non-cloud runners for ppc64le by @Amulyam24 in #13792
- kata-deploy: onboard SELinux enforced tests by @fidencio in #13804
- Restore the CRI-O test infrastructure by @balintTobik in #13559
- agent: fix wrong binaries in iptables-restore path constants by @dcoppa in #13789
- kata-deploy: report why a node failed, in job mode by @fidencio in #13796
- tests: set sev-snp, qemu-snp and qemu-snp-runtime-rs as required tests by @hgowda-amd in #13806
- agent: keep EROFS backing mounts outside container bundles by @jind-oai in #13756
- build(deps): bump github.com/containerd/containerd from 1.7.33 to 1.7.35 in /src/runtime by @dependabot[bot] in #13813
- build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /src/runtime by @dependabot[bot] in #13807
- build(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /src/tools/csi-kata-directvolume by @dependabot[bot] in #13808
- build(deps): bump github.com/cilium/ebpf from 0.17.3 to 0.22.0 in /src/runtime by @dependabot[bot] in #13655
- dragonball: Restore vCPU MSRs after the LAPIC by @xavier-niu in #13798
- runtime: allow disabling CLH nested virtualization by @SaveTheRbtz in #13805
- runtime-rs: remove cpu_nested_config override by @SaveTheRbtz in #13815
- kata-deploy: postpone the switch to the job deploymentMode as default to 4.3.0 by @fidencio in #13814
- deps: Bump netlink versions by @stevenhorsman in #13785
- runtime: capture early guest console logs by @mythi in #13819
- dragonball: Add virtio-rng entropy device by @xavier-niu in #13380
- kata-deploy: Add SELinux policy by @fidencio in #13777
- nvidia: Bump UPX and DCGM by @fidencio in #13832
- coco: Bump Trustee and guest-components to their latest main by @fidencio in #13830
- versions: Bump NVRC to v0.1.7 by @fidencio in #13835
- tests: stop a wedged helm release from failing every later job by @fidencio in #13834
- docs: add release notes for 4.2.0 by @fidencio in #13840
- release: Bump version to 4.2.0 by @stevenhorsman in #13833
New Contributors
- @pamanseau made their first contribution in #13444
- @charliermarsh made their first contribution in #13657
- @vvoronko made their first contribution in #13413
- @ngopalak-redhat made their first contribution in #13765
- @dcoppa made their first contribution in #13789
- @jind-oai made their first contribution in #13756
- @SaveTheRbtz made their first contribution in #13805
Full Changelog: 4.1.0...4.2.0