Skip to content

containerd 2.1.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Apr 14:08
· 1 commit to main since this release
v2.1.7
This tag was signed with the committer’s verified signature.
dmcgowan Derek McGowan
GPG key ID: F58C5D0A4405ACDB
Verified
Learn about vigilant mode.
07ad9c7
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Welcome to the v2.1.7 release of containerd!

The seventh patch release for containerd 2.1 contains various fixes
and updates including a security patch.

Security Updates

Highlights

Container Runtime Interface (CRI)

  • Preserve host cgroup mount options for privileged containers (#13119)
  • Fix image volumes when using user namespaces in CRI (#12894)
  • Fix issue where CNI DEL was never executed after a restart (#12930)
  • Hardening: sanitize errors before returning via gRPC to prevent possible credential leaks in pod events (#12803)
  • Enable options for pulling encrypted images in CRI (#12713)

Image Distribution

  • Fix possible panic from WithMediaTypeKeyPrefix (#13135)

Runtime

  • Update runc binary to v1.3.5 (#13060)
  • Hardening: fix possible TOCTOU race bug in tar extraction (#12969)
  • Fix unintended dropping of mount flags for read-only bind-mounts in user namespaces (#12943)
  • Explicitly set AppArmor ABI to 3.0 (#12898)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

  • yashsingh74
  • Samuel Karp
  • Maksym Pavlenko
  • Phil Estes
  • Wei Fu
  • Akhil Mohan
  • Chris Henzie
  • Sebastiaan van Stijn
  • Akihiro Suda
  • Rodrigo Campos
  • user.email
  • Aadhar Agarwal
  • Alex Chernyakhovsky
  • Chris Adeniyi-Jones
  • Derek McGowan
  • Justin Alvarez
  • Michael Zappa
  • Ricardo Branco
  • Shachar Tal
  • Tõnis Tiigi
  • ningmingxiao

Changes

67 commits

  • Prepare release notes for v2.1.7 (#13223)
  • update github.com/moby/spdystream v0.5.1 (#13218)
    • 82910b8c1 update github.com/moby/spdystream v0.5.1
  • update to Go 1.25.9, 1.26.2 (#13189)
  • Skip TestExportAndImportMultiLayer on s390x (#13153)
    • 8d0c87494 Skip TestExportAndImportMultiLayer on s390x
  • Fix possible panic from WithMediaTypeKeyPrefix (#13135)
    • fe316cc1f remotes: fix possible panic from WithMediaTypeKeyPrefix
  • Preserve cgroup mount options for privileged containers (#13119)
    • c5ee417ab Add integration test for privileged container cgroup mounts
    • a5d5a70ed Forward RUNC_FLAVOR env var down to integration tests
    • 515c7f98d Preserve host cgroup mount options for privileged containers
    • ffd9b61c9 Move cgroup namespace placement higher in spec builder
  • update runc binary to v1.3.5 (#13060)
    • 2f025ff8e [release/2.1] update runc binary to v1.3.5
  • Fix vagrant on CI (#13065)
  • Fix TOCTOU race bug in tar extraction (#12969)
    • aecfb3dc6 Fix TOCTOU race bug in tar extraction
  • update to go1.25.8, test go1.26.1 (#13013)
    • b71360b59 update to go1.25.8, test go1.26.1
    • ec7320b8b update golangci-lint to v2.9.0 with go1.26 support
    • 01606226e remove windows/arm from cross build
    • e082c2e05 ci: build/test go1.26.0
  • update golangci-lint to v2.1.5 (#13012)
    • f9528d2d9 build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.2.0
    • de0d60a17 build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0
    • 1b240d0e0 build(deps): bump golangci/golangci-lint-action from 6.5.2 to 8.0.0
    • 67ec314fa ci: bump golangci from 6.5.2 to 7.0.0
    • 7fe19a6b2 Disable ST1003: struct field Uid should be UID (staticcheck)
    • 88470c519 Disable QF1003: could use tagged switch on base (staticcheck)
    • 1ea353741 fix: Used nolint to ignore the static checks
    • f6ddff11b fix: ST1001: should not use dot imports (staticcheck)
    • 4ed50edce fix: ST1019: removed the duplicate imports
    • 808c623d1 fix: QF1012: Use of fmt.Fprintln(...)
    • e98bc32cd fix: QF1001: could apply De Morgan's law (staticcheck)
    • cebb3583e fix: ST1005: error strings should not end with punctuation or newlines
    • 1852b5d07 fix: QF1004: strings.ReplaceAll instead (staticcheck)
    • 9b0b270cd fix: QF1002: could use tagged switch on host (staticcheck)
  • cri: Fix image volumes with user namespaces (#12894)
    • 8d5351929 cri: Fix image volumes with user namespaces
  • ci: modprobe xt_comment on almalinux (#12958)
    • 37a98b239 ci: modprobe xt_comment on almalinux
  • core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values (#12943)
    • 74e575ce8 core/mount: add test for getUnprivilegedMountFlags
    • c62466642 core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
  • Fix CNI issue where CNI DEL is never executed (#12930)
    • 9710aed4a fix issue where cni del is never executed
  • apparmor: explicitly set abi/3.0 (#12898)
  • integration: Fix TestImageLoad() failure on CI (#12907)
    • 51a63212f integration: Fix TestImageLoad() failure on CI
  • update to go1.24.13, go1.25.7 (#12872)
  • fix: sanitize error before gRPC return to prevent credential leak in pod events (#12803)
    • b65f34e15 fix: sanitize error before gRPC return to prevent credential leak in pod events
  • build(deps): bump google.golang.org/grpc from 1.72.2 to 1.78.0 (#12750)
    • 2e5ab3f84 build(deps): bump google.golang.org/grpc from 1.72.2 to 1.78.0
  • cri: emit warning for concurrent CreateContainer (#12743)
    • 5ef24ddd2 cri: emit warning for concurrent CreateContainer
  • cri: move noisy CDI logs to debug level (#12716)
    • 6acd41e02 cri: move noisy CDI logs to debug level
  • Uncomment call to add options for pulling encrypted images (#12713)

Dependency Changes

  • github.com/go-jose/go-jose/v4 v4.0.5 -> v4.1.3
  • github.com/moby/spdystream v0.5.0 -> v0.5.1
  • github.com/stretchr/testify v1.10.0 -> v1.11.1
  • go.opentelemetry.io/auto/sdk v1.1.0 -> v1.2.1
  • go.opentelemetry.io/otel v1.35.0 -> v1.38.0
  • go.opentelemetry.io/otel/metric v1.35.0 -> v1.38.0
  • go.opentelemetry.io/otel/sdk v1.35.0 -> v1.38.0
  • go.opentelemetry.io/otel/trace v1.35.0 -> v1.38.0
  • golang.org/x/oauth2 v0.27.0 -> v0.32.0
  • google.golang.org/genproto/googleapis/api 56aae31c358a -> ab9386a59fda
  • google.golang.org/genproto/googleapis/rpc 56aae31c358a -> ab9386a59fda
  • google.golang.org/grpc v1.72.2 -> v1.78.0
  • google.golang.org/protobuf v1.36.7 -> v1.36.10

Previous release can be found at v2.1.6

Which file should I download?

  • containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
  • containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Assets 25
Loading