containerd 2.3.5

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes
and updates including security patches.

Security Updates

• containerd
  • CVE-2026-53495
  • GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14030)

Runtime

• Avoid hangs and data races when streaming container standard I/O in CRI (#14094)
• Fix missing error messages in OpenTelemetry trace attributes (#14049)
• Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13999)
• Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#13995)
• Avoid containerd startup hangs when loading shims (#13983)
• Add context to error when shim delete times out (#13921)
• Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)

Snapshotters

• Fix unpack failure for EROFS images containing the erofs OS feature (#14062)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Phil Estes
• Samuel Karp
• Derek McGowan
• Sebastiaan van Stijn
• Akhil Mohan
• Maksym Pavlenko
• Wei Fu
• Oleh Konko
• Austin Vazquez
• Jing Chen
• Martín Fernández
• Paco Xu
• XlabAI
• Yuanliang Zhang

Changes

33 commits

• 934efa5e0 Prepare release notes for v2.3.5
• be419b070 Merge commit from fork
• 9ec55f024 cri: cancel ExecSync IO drain on context cancellation
• 84ea25bc1 Merge commit from fork
• c53577965 archive: skip redundant opaque whiteout walks
• Fix data races and a deadlock in the byte stream helpers (#14094)
  • 9f6be869c Fix data races and a deadlock in the byte stream helpers
• plugins: remove some stray logrus imports (#14063)
  • 6c59399bf plugins: remove some stray logrus imports
• snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#14062)
  • f65732115 snapshots/erofs: test the advertised erofs feature platform
  • 5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter
• update runc to v1.5.1 (#14059)
  • af445ea0a update runc to v1.5.1
  • c077e43bd update runc to v1.5.0
• vendor: github.com/containerd/platforms v1.0.0-rc.5 (#14048)
  • 676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5
• pkg/tracing: handle error and typed-nil Stringer attributes (#14049)
  • c7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes
• docker fetcher: strip sensitive headers on descriptor URLs (#14030)
  • 58fb846d5 core/remotes/docker: normalize descriptor URL origins
  • c7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch
• update runhcs to v0.15.0-rc.4 (#13990)
  • 6fbb92c33 update runhcs to v0.15.0-rc.4
• pkg/oci: resolve rootfs symlinks for user lookup (#13999)
  • 53bf030ea pkg/oci: resolve rootfs symlinks for user lookup
• Revert "add check on version of drop in configs" (#13995)
  • 7790c4c21 ensure that the final config version is the higest in the config list
  • 1125b053f Revert "add check on version of drop in configs"
• fix(runtime): apply load timeout to load shim (#13983)
  • 460c47b28 fix(runtime): bound shim loading with the load timeout
• Add more context to the shim delete error (#13921)
  • 7f97bc122 Add more context to the shim delete error

Changes from containerd/platforms

2 commits

• Fix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)
  • bacc690 Fix WS2022 compat on hosts past the latest LTSC

Dependency Changes

• github.com/containerd/platforms v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at v2.3.4

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

containerd 2.2.3

Welcome to the v2.2.3 release of containerd!

The third patch release for containerd 2.2 contains various fixes
and updates including a security patch.

Security Updates

• spdystream
  • CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

• Preserve cgroup mount options for privileged containers (#13120)
• Ensure UpdatePodSandbox returns Unimplemented instead of a generic error (#13023)

Go client

• Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 (#13015)

Image Distribution

• Enable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) (#13198)
• Apply hardening to prevent TOCTOU race during tar extraction (#12971)

Runtime

• Restore support for client-mounted roots in Windows containers using process isolation (#13195)
• Update runc to v1.3.5 (#13061)
• Apply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems (#13019)
• Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 (#13015)

Snapshotters

• Fix bug that caused whiteouts to be ignored when parallel unpack was used (#13125)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Sebastiaan van Stijn
• Maksym Pavlenko
• Chris Henzie
• Derek McGowan
• Paulo Oliveira
• Henry Wang
• Phil Estes
• Wei Fu
• Akihiro Suda
• Gao Xiang
• Ricardo Branco
• Shachar Tal

Changes

40 commits

• Prepare release notes for v2.2.3 (#13224)
  • 8a0f4ed5d Prepare release notes for v2.2.3
• update github.com/moby/spdystream v0.5.1 (#13217)
  • 31bd34a06 update github.com/moby/spdystream v0.5.1
• vendor: github.com/klauspost/compress v1.18.5 (#13197)
  • 1336f6c45 vendor: github.com/klauspost/compress v1.18.5
• diff/walking: enable mount manager (#13198)
  • 409f75be8 diff/walking: enable mount manager
• update runhcs to v0.14.1 (#13195)
  • 3f33146c1 update runhcs to v0.14.1
• vendor: github.com/Microsoft/hcsshim v0.14.1 (#13196)
  • 8bd1b74e5 vendor: github.com/Microsoft/hcsshim v0.14.1
  • c6b0be8e1 vendor: github.com/Microsoft/hcsshim v0.14.0
• update to Go 1.25.9, 1.26.2 (#13190)
  • 2ecde8cfe update to Go 1.25.9, 1.26.2
• Skip TestExportAndImportMultiLayer on s390x (#13154)
  • be554f478 Skip TestExportAndImportMultiLayer on s390x
• Tweak mount info for overlayfs in case of parallel unpack (#13125)
  • 660de195b Tweak mount info for overlayfs in case of parallel unpack
  • bc9274a4b Add integration test for issue 13030
• Preserve cgroup mount options for privileged containers (#13120)
  • c387890b5 Add integration test for privileged container cgroup mounts
  • 047a335a6 Forward RUNC_FLAVOR env var down to integration tests
  • 9b2d72ee0 Preserve host cgroup mount options for privileged containers
  • 5b66cd6a0 Move cgroup namespace placement higher in spec builder
• update runc binary to v1.3.5 (#13061)
  • 584205c2f [release/2.2] update runc binary to v1.3.5
• Fix vagrant on CI (#13066)
  • 77c6886df Ignore NOCHANGE error
• Fix TOCTOU race bug in tar extraction (#12971)
  • fbed68b8f Fix TOCTOU race bug in tar extraction
• cri: UpdatePodSandbox should return Unimplemented (#13023)
  • a83510103 cri: UpdatePodSandbox should return Unimplemented
• fix(oci): apply absolute symlink resolution to /etc/group (#13019)
  • ee4179e52 fix(oci): apply absolute symlink resolution to /etc/group
• fix(oci): handle absolute symlinks in rootfs user lookup (#13015)
  • fd061b848 test(oci): use fstest and mock fs for better symlink coverage
  • 5d44d2c22 fix(oci): handle absolute symlinks in rootfs user lookup
• update to go1.25.8, test go1.26.1 (#13011)
  • 00c776f07 update to go1.25.8, test go1.26.1

Dependency Changes

• github.com/Microsoft/hcsshim v0.14.0-rc.1 -> v0.14.1
• github.com/klauspost/compress v1.18.1 -> v1.18.5
• github.com/moby/spdystream v0.5.0 -> v0.5.1

Previous release can be found at v2.2.2

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

containerd 2.1.7

Welcome to the v2.1.7 release of containerd!

The seventh patch release for containerd 2.1 contains various fixes
and updates including a security patch.

Security Updates

• spdystream
  • CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

• Preserve host cgroup mount options for privileged containers (#13119)
• Fix image volumes when using user namespaces in CRI (#12894)
• Fix issue where CNI DEL was never executed after a restart (#12930)
• Hardening: sanitize errors before returning via gRPC to prevent possible credential leaks in pod events (#12803)
• Enable options for pulling encrypted images in CRI (#12713)

Image Distribution

• Fix possible panic from WithMediaTypeKeyPrefix (#13135)

Runtime

• Update runc binary to v1.3.5 (#13060)
• Hardening: fix possible TOCTOU race bug in tar extraction (#12969)
• Fix unintended dropping of mount flags for read-only bind-mounts in user namespaces (#12943)
• Explicitly set AppArmor ABI to 3.0 (#12898)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• yashsingh74
• Samuel Karp
• Maksym Pavlenko
• Phil Estes
• Wei Fu
• Akhil Mohan
• Chris Henzie
• Sebastiaan van Stijn
• Akihiro Suda
• Rodrigo Campos
• user.email
• Aadhar Agarwal
• Alex Chernyakhovsky
• Chris Adeniyi-Jones
• Derek McGowan
• Justin Alvarez
• Michael Zappa
• Ricardo Branco
• Shachar Tal
• Tõnis Tiigi
• ningmingxiao

Changes

67 commits

• Prepare release notes for v2.1.7 (#13223)
  • 3a06b6847 Prepare release notes for v2.1.7
• update github.com/moby/spdystream v0.5.1 (#13218)
  • 82910b8c1 update github.com/moby/spdystream v0.5.1
• update to Go 1.25.9, 1.26.2 (#13189)
  • 295bdbbff update to Go 1.25.9, 1.26.2
• Skip TestExportAndImportMultiLayer on s390x (#13153)
  • 8d0c87494 Skip TestExportAndImportMultiLayer on s390x
• Fix possible panic from WithMediaTypeKeyPrefix (#13135)
  • fe316cc1f remotes: fix possible panic from WithMediaTypeKeyPrefix
• Preserve cgroup mount options for privileged containers (#13119)
  • c5ee417ab Add integration test for privileged container cgroup mounts
  • a5d5a70ed Forward RUNC_FLAVOR env var down to integration tests
  • 515c7f98d Preserve host cgroup mount options for privileged containers
  • ffd9b61c9 Move cgroup namespace placement higher in spec builder
• update runc binary to v1.3.5 (#13060)
  • 2f025ff8e [release/2.1] update runc binary to v1.3.5
• Fix vagrant on CI (#13065)
  • f198b7f87 Ignore NOCHANGE error
• Fix TOCTOU race bug in tar extraction (#12969)
  • aecfb3dc6 Fix TOCTOU race bug in tar extraction
• update to go1.25.8, test go1.26.1 (#13013)
  • b71360b59 update to go1.25.8, test go1.26.1
  • ec7320b8b update golangci-lint to v2.9.0 with go1.26 support
  • 01606226e remove windows/arm from cross build
  • e082c2e05 ci: build/test go1.26.0
• update golangci-lint to v2.1.5 (#13012)
  • f9528d2d9 build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.2.0
  • de0d60a17 build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0
  • 1b240d0e0 build(deps): bump golangci/golangci-lint-action from 6.5.2 to 8.0.0
  • 67ec314fa ci: bump golangci from 6.5.2 to 7.0.0
  • 7fe19a6b2 Disable ST1003: struct field Uid should be UID (staticcheck)
  • 88470c519 Disable QF1003: could use tagged switch on base (staticcheck)
  • 1ea353741 fix: Used nolint to ignore the static checks
  • f6ddff11b fix: ST1001: should not use dot imports (staticcheck)
  • 4ed50edce fix: ST1019: removed the duplicate imports
  • 808c623d1 fix: QF1012: Use of fmt.Fprintln(...)
  • e98bc32cd fix: QF1001: could apply De Morgan's law (staticcheck)
  • cebb3583e fix: ST1005: error strings should not end with punctuation or newlines
  • 1852b5d07 fix: QF1004: strings.ReplaceAll instead (staticcheck)
  • 9b0b270cd fix: QF1002: could use tagged switch on host (staticcheck)
• cri: Fix image volumes with user namespaces (#12894)
  • 8d5351929 cri: Fix image volumes with user namespaces
• ci: modprobe xt_comment on almalinux (#12958)
  • 37a98b239 ci: modprobe xt_comment on almalinux
• core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values (#12943)
  • 74e575ce8 core/mount: add test for getUnprivilegedMountFlags
  • c62466642 core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
• Fix CNI issue where CNI DEL is never executed (#12930)
  • 9710aed4a fix issue where cni del is never executed
• apparmor: explicitly set abi/3.0 (#12898)
  • 735fcb316 apparmor: explicitly set abi/3.0
• integration: Fix TestImageLoad() failure on CI (#12907)
  • 51a63212f integration: Fix TestImageLoad() failure on CI
• update to go1.24.13, go1.25.7 (#12872)
  • e13f28dbd update to go1.24.13, go1.25.7
    ...

containerd 2.1.5

Welcome to the v2.1.5 release of containerd!

The fifth patch release for containerd 2.1 contains various fixes and updates.

Security Updates

• containerd

  • GHSA-pwhc-rpq9-4c8w
  • GHSA-m6hq-p25p-ffr2

• runc

  • GHSA-qw9x-cqr3-wc7r
  • GHSA-cgrx-mc8f-2prm
  • GHSA-9493-h29p-rfm2

Highlights

Container Runtime Interface (CRI)

• Disable event subscriber during task cleanup (#12410)
• Add SystemdCgroup to default runtime options (#12253)
• Fix userns with container image VOLUME mounts that need copy (#12242)

Image Distribution

• Ensure errContentRangeIgnored error when range-get request is ignored (#12312)

Runtime

• Update runc binary to v1.3.3 (#12478)

Deprecations

• Postpone v2.2 deprecation items to v2.3 (#12431)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Phil Estes
• Akihiro Suda
• Derek McGowan
• Austin Vazquez
• Rodrigo Campos
• Maksym Pavlenko
• Wei Fu
• ningmingxiao
• Akhil Mohan
• Henry Wang
• Andrew Halaney
• Divya Rani
• Jose Fernandez
• Swagat Bora
• wheat2018

Changes

58 commits

• Prepare release notes for v2.1.5 (#12483)
  • fc5bdfeac Prepare release notes for v2.1.5
  • c578c26bf Update mailmap
  • 46a4a03fb Merge commit from fork
  • 232786c90 Fix directory permissions
  • 239ab877d Merge commit from fork
  • 0766796e8 fix goroutine leak of container Attach
• Update runc binary to v1.3.3 (#12478)
  • 3d713d3d0 runc: Update runc binary to v1.3.3
• Update GHA runners to use latest images for basic binaries build (#12470)
  • de4221cb7 Update GHA runners to use latest images for basic binaries build
• ci: bump Go 1.24.9, 1.25.3 (#12467)
  • 2045b1920 ci: bump Go 1.24.9, 1.25.3
• Update GHA runners to use latest image for most jobs (#12468)
  • 21ec7cc7d Update GHA runners to use latest image for most jobs
• CI: update Fedora to 43 (#12449)
  • 893b5f92e CI: update Fedora to 43
• Postpone v2.2 deprecation items to v2.3 (#12431)
  • 6374a8f9d Postpone v2.2 deprecation items to v2.3
• CI: skip ubuntu-24.04-arm on private repos (#12427)
  • 98e0e73de CI: skip ubuntu-24.04-arm on private repos
• Disable event subscriber during task cleanup (#12410)
  • a3770cf83 cri/server/podsandbox: disable event subscriber
• Fix lost container logs from quickly closing io (#12377)
  • 7d9f09ba0 bugfix:fix container logs lost because io close too quickly
• ci: bump Go 1.24.8 (#12360)
  • d1cab3cc5 ci: bump Go 1.24.8
• Prevent goroutine hangs during ProgressTracker shutdown (#12336)
  • 9b57a4d35 Prevent goroutine hangs during ProgressTracker shutdown
• Ensure errContentRangeIgnored error when range-get request is ignored (#12312)
  • ca3de4fe7 Ensure errContentRangeIgnored error when range-get request is ignored by registry
• Remove additional fuzzers from instrumentation repo (#12313)
  • dfffe3d9c Remove additional fuzzers from CI
• update release builds to 1.24.7 and add 1.25.1 to CI (#12258)
  • c54585ba7 update release builds to 1.24.7 and add 1.25.1 to CI
• runc:Update runc binary to v1.3.1 (#12277)
  • f0a48ce38 runc:Update runc binary to v1.3.1
• Add SystemdCgroup to default runtime options (#12253)
  • f13f8c431 add SystemdCgroup to default runtime options
• install-runhcs-shim: fetch target commit instead of tags (#12256)
  • 42bb71e1e install-runhcs-shim: fetch target commit instead of tags
• Fix userns with container image VOLUME mounts that need copy (#12242)
  • 10944e19f integration: Add test for directives with userns
  • 41d74aee2 cri: Fix userns with Dockerfile VOLUME mounts that need copy
• Fix overlayfs issues related to user namespace (#12222)
  • f40bfc46b core/mount: Retry unmounting idmapped directories
  • 1f51d2dea core/mount: Test cleanup of DoPrepareIDMappedOverlay()
  • 8fbf8c503 core/mount: Properly cleanup on doPrepareIDMappedOverlay errors
  • b9d678e15 core/mount: Don't call nil function on errors
  • 583fe2d24 core/mount: Only idmap once per overlayfs, not per layer
• Add documentation for cgroup_writable field (#12229)
  • 4832b4d15 Add documentation for cgroup_writable field
• fix: create bootstrap.json with 0644 permission (#12183)
  • 3c174cf64 fix: create bootstrap.json with 0644 permission
• ci: bump Go 1.23.12, 1.24.6 (#12186)
  • 74b0505eb ci: bump Go 1.23.12, 1.24.6
• sys: fix pidfd leak in UnshareAfterEnterUserns (#12179)
  • 5ef6ea747 sys: fix pidfd leak in UnshareAfterEnterUserns

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.1.4

Which file should I download?

• `co...

containerd 2.1.0-beta.0

Welcome to the v2.1.0-beta.0 release of containerd!
This is a pre-release of containerd

The 2.1 beta series is here, see the 2.1 milestone to track
ongoing efforts. Please try out the beta and report any issues!

The first minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the first time-based released for containerd.
Most the feature set and core functionality has long been stable and harderened in production
environments, so now we transition to a balance of timely delivery of new functionality
with the same high confidence in stability and performance.

Highlights

• Erofs snapshotter and differ (#10705)
• Fix race between serve and immediate shutdown on the server (containerd/ttrpc#175)

Container Runtime Interface (CRI)

• Add OCI/Image Volume Source support (#10579)
• Enable Writable cgroups for unprivileged containers (#11131)
• Fix recursive RLock() mutex acquisition (containerd/go-cni#126)
• Support CNI STATUS Verb (containerd/go-cni#123)

Image Distribution

• Add dial timeout field to hosts toml configuration (#11106)

Node Resource Interface (NRI)

• Expose Pod assigned IPs to NRI plugins (#10921)

Runtime

• Support multiple uid/gid mappings (#10722)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Akihiro Suda
• Derek McGowan
• Phil Estes
• Maksym Pavlenko
• Jin Dong
• Sebastiaan van Stijn
• Wei Fu
• Samuel Karp
• Austin Vazquez
• Kazuyoshi Kato
• Henry Wang
• Mike Brown
• Akhil Mohan
• Gao Xiang
• Archit Kulkarni
• Krisztian Litkey
• ningmingxiao
• Alexey Lunev
• Antonio Ojea
• Chris Henzie
• Davanum Srinivas
• Marat Radchenko
• Michael Zappa
• Paweł Gronowski
• Adrien Delorme
• Amit Barve
• Andrey Smirnov
• Divya
• Etienne Champetier
• Kirtana Ashok
• fengwei0328
• zounengren
• Adrian Reber
• Alfred Wingate
• Amal Thundiyil
• Athos Ribeiro
• Brian Goff
• ChengyuZhu6
• Chongyi Zheng
• Craig Ingram
• David Son
• Fupan Li
• Jing Xu
• Jonathan A. Sternberg
• Jose Fernandez
• Kaita Nakamura
• Lei Liu
• Mike Baynton
• Philip Laine
• Qiyuan Liang
• Sameer
• Shiming Zhang
• Vered Rosen
• alingse
• bo.jiang
• chriskery
• luchenhan
• mahmut

Changes

433 commits

• b430e5ac3 Merge commit from fork
• de1341c20 validate uid/gid
• Bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#11544)
  • 8028a1d08 Bump github.com/go-jose/go-jose/v4 from v4.0.4 to v4.0.5
  • ce055b530 Bump golang.org/x/text from 0.22.0 to 0.23.0
  • e0aaed012 Bump golang.org/x/term from 0.29.0 to 0.30.0
• fix: repeat args from sub-func call (#11512)
  • b947e0566 fix: repeat args from sub-func call
• build(deps): bump github.com/prometheus/client_golang from 1.20.5 to 1.21.1 (#11525)
  • 75252f975 build(deps): bump github.com/prometheus/client_golang
• integration: update TestUpgrade for 2.1 (#11519)
  • 06daffb4d integration: update TestUpgrade for 2.1
• config:fix config migrate lost timeout config (#11532)
  • 531adbf06 config:fix config migrate lost timeout config
• Add dial timeout field to hosts toml configuration (#11106)
  • c4982bffc Add dial timeout field to hosts toml configuration
• Prepare release notes for v2.1.0-beta.0 (#11510)
  • 12762891d Remove test for issue 10467
  • 93cc1e6eb Fix upgrade test runtime config
  • 833d6bc8e Update release status for 2.1 to beta
  • 71cfe00ee Prepare release notes for v2.1.0-beta.n
  • be8fe50f4 Update the upgrade test to handle 2.1
• build(deps): bump the otel group with 8 updates (#11521)
  • 94dd70f4f build(deps): bump the otel group with 8 updates
• client: Respect client.WithTimeout option (#11508)
  • ee574e76e client: Respect client.WithTimeout option
• build(deps): bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6 (#11523)
  • 700b98415 build(deps): bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
• build(deps): bump the golang-x group with 3 updates (#11520)
  • 85c04ab0e build(deps): bump the golang-x group with 3 updates
• add k8s 1.32 to support table and as tested containerd supported branches at the time of release (#11534)
  • 5bbd3ed1b add k8s 1.32 and as tested containerd supported branches at the time of release
• build(deps): bump google.golang.org/grpc from 1.70.0 to 1.71.0 (#11524)
  • c37e48b07 build(deps): bump google.golang.org/grpc from 1.70.0 to 1.71.0
• Support container restore through CRI/Kubernetes (#10365)
  • 9e6beafd5 Support container restore through CRI/Kubernetes
• build(deps): bump actions/attest-build-provenance from 2.2.2 to 2.2.3 (#11526)
  • d7de182dd build(deps): bump actions/attest-build-provenance from 2.2.2 to 2.2.3
• build(deps): bump github/codeql-action from 3.28.10 to 3.28.11 (#11527)
  • 9f885ea4f build(deps): bump github/codeql-action from 3.28.10 to 3.28.11
• build(deps): bump containerd/project-checks from 1.2.1 to 1.2.2 (#11528)
  • 88faaac97 build(deps): bump containerd/project-checks from 1.2.1 to 1.2.2
• add name in package version (#11518)
  • 405a952c6 add name in package version
• update to go1.23.7 / go1.24.1 (#11513)
  • 4f090fe77 update to go1.23.7 / go1.24.1
• Don't produce unnecessary logs when encountering attestations (#11327)
  • 3cdfc1003 core/remotes: Handle attestations in MakeRefKey
  • e751b6bb1 core/images: Ignore attestations when traversing children
• perf(applyNaive): avoid walking the tree for each file in the same directory (#11337)
  • d8063c30d perf(applyNaive): ...

containerd 2.0.4

Welcome to the v2.0.4 release of containerd!

The fourth patch release for containerd 2.0 includes various bug fixes and updates.

Highlights

• Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
• Respect client.WithTimeout option on connect (#11536)
• Update image type checks to avoid unnecessary logs for attestations (#11537)

Node Resource Interface (NRI)

• Fix incorrect runtime name being passed to NRI (#11529)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Derek McGowan
• Akihiro Suda
• Paweł Gronowski
• Akhil Mohan
• Phil Estes
• Samuel Karp
• Craig Ingram
• ningmingxiao

Changes

19 commits

• 1a43cb6a1 Merge commit from fork
• 07a0b5419 (cherry picked from commit de1341c)
• Prepare release notes for v2.0.4 (#11541)
  • 06a886a8e Prepare release notes for v2.0.4
• Respect client.WithTimeout option on connect (#11536)
  • 6b5efba83 client: Respect client.WithTimeout option
• Update image type checks to avoid unnecessary logs for attestations (#11537)
  • 916d48722 core/remotes: Handle attestations in MakeRefKey
  • df4d905a6 core/images: Ignore attestations when traversing children
• Fix incorrect runtime name being passed to NRI (#11529)
  • 4f037050c add name in package version
• update build to go1.23.7, test go1.24.1 (#11514)
  • e5ad0d0a0 update build to go1.23.7, test go1.24.1
• docs: include note about unprivileged sysctls (#11506)
  • a39f1146b docs: include note about unprivileged sysctls
• e2e: use the shim bundled with containerd artifact (#11503)
  • 81b3384a0 e2e: use the shim bundled with containerd artifact
• build(deps): bump containerd/project-checks from 1.1.0 to 1.2.1 (#11497)
  • 7215a7d2c build(deps): bump containerd/project-checks from 1.1.0 to 1.2.1

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.3

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.