Kata Containers 3.31.0

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.6.0 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-3840e64e3-e407c7ee9-1.93-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-91d6c39f0-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-a708316c0-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-d78579752-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.25.10-rust-1.93-b44e56d3d-x86_64
• tools: quay.io/kata-containers/builders:tools-6ee43475c-357921df6-1a4074ab2-67e33c3cd-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-1c23f6ec0-x86_64

Installation

Follow the Kata installation instructions.

Key Security Fixes

• CVE-2026-44210 via ffa59ce
• CVE-2026-47243 via 555b773

What's Changed

• runtime-rs: qemu: add CCW network hotplug & retry update_interface by @fidencio in #12947
• kata-deploy: configure_mariner: update test configs by @Redent0r in #12960
• ci: nvidia: Disable NVRC trace logging on nightly runs by @fidencio in #12975
• ci: tdx: Remove ITA key usage and run qemu-tdx-runtime-rs on nightly by @fidencio in #12974
• build(deps): bump streetsidesoftware/cspell-action from 8.3.0 to 8.4.0 by @dependabot[bot] in #12966
• build(deps): bump editorconfig-checker/action-editorconfig-checker from 2.1.0 to 2.2.0 by @dependabot[bot] in #12964
• build(deps): bump actions/checkout from 4.2.2 to 6.0.2 by @dependabot[bot] in #12965
• doc update for Nvidia use case by @rajatchopra in #12968
• ci: mariner: use OCI version 1.2.1 by @danmihai1 in #12980
• kata-deploy: add HTTP health probes (healthz/readyz) by @fidencio in #12943
• kernel: bump kernel versions other than dragonball by @alextibbles in #12977
• tests: k8s-cron-job: set runtimeClassName to kata by @fidencio in #12983
• genpolicy: support empty environment variables by @danmihai1 in #12978
• osbuilder: install yq in container without GOPATH volume by @manuelh-dev in #12952
• genpolicy: Fix matching of .. in paths by @gkurz in #12991
• Lean code vendoring by @gkurz in #12873
• build(deps): bump openssl from 0.10.78 to 0.10.79 by @dependabot[bot] in #12993
• genpolicy: ignore additional irrelevant fields by @danmihai1 in #12989
• build: remove gha-adjust-to-use-prebuilt-components.sh by @zvonkok in #12954
• runtime-rs: coldplug GPU support by @fidencio in #12857
• kata-deploy: reduce memory consumption by @fidencio in #12981
• gatekeeper: Unrequire NVIDIA GPU test (temporary) by @manuelh-dev in #13002
• runtime-rs: network: use provided name for virt interface lookup by @fidencio in #12984
• runtime-rs: Fix warnings in rust runtime by @Apokleos in #13011
• tests: nvidia: Wait for NIM operator pod and print by @manuelh-dev in #13007
• version: Bump to latest 6.18 kernel by @stevenhorsman in #13015
• runtime-rs: filter VFIO devices only in guest-kernel mode by @BbolroC in #13013
• tests: nvidia: place NIM service into namespace by @manuelh-dev in #13020
• kata-deploy: Fix containerd debug level path for config schema v4 by @fidencio in #13021
• ci: correct environment variable syntax in stale issues workflow by @stevenhorsman in #13026
• tests: nvidia: avoid NIM journal dumps on success by @manuelh-dev in #13023
• nvidia: rootfs: (try to) use erofs for the image instead of ext4 by @fidencio in #13019
• agent-ctl: Swap rootfs bundle pull implementation by @stevenhorsman in #12996
• genpolicy: support env variable values sourced from metadata.labels values by @danmihai1 in #13010
• runtime-rs: align virtiofsd args on runtime-go by @sprt in #13032
• Go 1.25.10 bump by @stevenhorsman in #13030
• gha: move static checks to self hosted runners for ppc64le by @Amulyam24 in #13034
• fix: add click 8.3.3 to docs requirements by @pavithiran34 in #13037
• ci.ocp: Remove workaround and update docs by @ldoktor in #12797
• rootfs: cdh: Update CDH to new version by @manuelh-dev in #13006
• runtime-rs: static resources: always set maxvcpus equal to vcpus by @Redent0r in #13033
• runtime: allow loopback devices when sandbox_cgroup_only is enabled by @PiotrProkop in #13027
• build(deps): bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 in /tools/testing/kata-webhook by @dependabot[bot] in #12854
• build(deps): bump github.com/sirupsen/logrus from 1.9.3 to 1.9.4 in /src/runtime by @dependabot[bot] in #12853
• Bump guest components and Trustee for CoCo v0.21.0 by @fitzthum in #13046
• runtime-rs: ephemeral storage port by @fidencio in #13040
• tests: generate guest-pull image pull agent security policies by @manuelh-dev in #13025
• agent: wait for logs before aborting by @burgerdev in #13052
• runtime-rs: use proper temp dirs in initdata tests by @burgerdev in #13061
• tests: export target_branch="${branch}" by @danmihai1 in #13058
• gha: k8s: reject unsupported KATA_HYPERVISOR values by @danmihai1 in #13057
• Revert "gatekeeper: Unrequire NVIDIA GPU test" by @manuelh-dev in #13054
• runtime-rs: don't modify initdata from annotation by @burgerdev in #13051
• dragonball: Allow guest VM to load tdshim firmware for booting by @RainaYL in #12932
• genpolicy: include test binaries in make target build by @burgerdev in #12970
• runtime-rs: preserve ccw address for modern block devices by @fidencio in #13059
• test: skip CDH resource test for qemu-se without reference values by @BbolroC in #13062
• ci: Move measure-rootfs to run on TEE PRs by @stevenhorsman in #13038
• ci: remove docs URL alive check workflow by @stevenhorsman in #13035
• agent-ctl: Move into root workspace by @stevenhorsman in #12939
• runtime-rs: Extract block device storage source info logic by @BbolroC in #13070
• runtime-rs: mask systemd-networkd.socket by @burgerdev in #13050
• dragonball: fix typo in VsockEpollListener doc comment by @SAY-5 in #13024
• helm-chart: add priorityClassName to prevent kata-deploy eviction by @fidencio in #13069
• runtime-rs: Add cdh_api_timeout configuration parameter by @stevenhorsman in #12882
• kata-ctl: Fix failures when kata-ctl exec with short id by @Apokleos in #12437
• osbuilder: Remove tests by @stevenhorsman in #13005
• Fix #13008: runtime/fc track real firecracker PID instead of jailer PID by @sebwolf-de in #13009
• runtime-rs/virtiofsd: read queue size from config by @sprt in #12967
• shim: Add backoff retry to ingress qdisc creation to avoid potential race condition by @zaymat in #12959
• agent-ctl: CLH virtio fs queue size fix by @stevenhorsman in #13073
• release: Bump version to 3.31.0 by @stevenhorsman in #13065
• release: correct .cargo/config.toml reference in generate_vendor.sh by @stevenhorsman in #13076

New Contributors

• @rajatchopra made their first contribution in #12968
• @SAY-5 made their first contribution in #13024
• @sebwolf-de made their first contribution in #13009
• @zaymat made their first contribution in #12959

Full Changelog: 3.30.0...3.31.0