Kata Containers 4.3.0

🚨 Security fixes

This release contains two security fixes:

• Unintended host and guest changes due to permissive annotation allowlist (CVSS 7.9) (requires review of existing installations and their configuration!)
• dragonball: guest-to-host escape through out-of-bounds memory access in several virtio drivers (CVSS 6.4)

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are
statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.6.0 which is not modified from the upstream version.
However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-086d5ee82-7632ffd8a-1.97-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-4d1e78da2-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-fc8df7157-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-ebdd40446-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.26.9-rust-1.97-a7a273435-x86_64
• tools: quay.io/kata-containers/builders:tools-go-1.26.9-rust-1.97-086d5ee82-a28ed9dcc-2fd61fc33-10153c043-7632ffd8a-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-21e278c42-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• kata-deploy: make job the default deployment mode again by @fidencio in #13841
• tests: nvidia: fix NVIDIA NIM bats test in nightly CI by @manuelh-dev in #13812
• genpolicy/agent/runtime(-rs): remove image_guest_pull driver_options metadata by @manuelh-dev in #13692
• webhook: add ability to enforce min memory limit by @Redent0r in #12652
• agent, runtime: contain blocking guest metrics collection by @PiotrProkop in #13491
• ci.ocp: Fixes to peer-pods pipeline by @ldoktor in #13821
• kata-deploy: re-prefix the paths the shim's own config sets by @fidencio in #13842
• kata-deploy: mount runtime-rs sandbox storage in kata-monitor by @mjnagel in #13855
• ci: Introduce taplo to check Cargo.toml files by @RuoqingHe in #11131
• genpolicy: use request bases in policy fixtures by @manuelh-dev in #13773
• runtime-rs: keep QEMU firmware QEMU-specific by @manrueda in #13734
• kata-deploy: undo what a redeploy drops from containerd's config by @fidencio in #13843
• versions: bump containerd minimum / latest versions by @fidencio in #13869
• build: Bump pcilibs-rs to f6831fa8 by @fidencio in #13868
• kernel: Bump the guest kernel to 6.18.52 and drop the upstreamed patch by @ahauserv in #13861
• agent: Report cgroup v2 CPU throttling time by @M-Phansa in #13852
• kata-deploy: give each installation its own containerd user drop-in by @fidencio in #13844
• hypervisor/qemu: ppc64le: omit kernel_irqchip=on for pseries by @kishen-v in #13848
• kata-deploy: let the reconcile uninstall hook watch what it waits for by @fidencio in #13845
• runtime(-rs): resolve symlinked mount paths by @manuelh-dev in #13755
• packaging: update OVMF for Intel TDX by @mythi in #13717
• workflow: ubuntu 22.04 runner bump by @stevenhorsman in #13831
• runtime-rs: intel gpu fixes by @mythi in #13593
• kata-deploy: honor imagePullSecrets on the kubectl-image hook Jobs by @david-long1 in #13878
• ci: retry AKS cluster deletion on failure by @sprt in #13747
• agent: unseal sealed secret env vars during exec requests by @esposem in #13859
• genpolicy: add the default PATH when the image env lacks one by @david-long1 in #13879
• kata-deploy: docs: say which installations kata-deploy detects by @fidencio in #13846
• agent: improve policy logging by @danmihai1 in #13887
• docs: update release target date to first Tuesday after the 15th by @stevenhorsman in #13900
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 in /src/runtime by @dependabot[bot] in #13871
• genpolicy: name the missing Secret or ConfigMap when an env source is absent by @david-long1 in #13893
• kata-deploy: docs: erofs and nydus require a node that has not used them before by @fidencio in #13905
• kata-deploy: detect external NFD by label by @fidencio in #13906
• kata-deploy: restrict containerd pod_annotations to the configuration by @fidencio in #13857
• build(deps): bump github.com/containerd/containerd from 1.7.35 to 1.7.36 in /src/runtime by @dependabot[bot] in #13914
• kata-webhook: take Go version from root versions.yaml by @Redent0r in #13866
• tests: Improve VFIO-AP test environment by @BbolroC in #13917
• genpolicy: type IntOrString fields as Kubernetes does by @david-long1 in #13892
• nvgpu: support a dedicated driver userspace repository by @zvonkok in #13863
• runtime-rs: Reseed guest RNG and sync time after VM template restore by @realsdx in #13912
• docs: nvidia: correct GPU and NUMA guidance by @manuelh-dev in #13836
• agent: fall back to fsmount when overlay options exceed 4K by @ChengyuZhu6 in #13670
• versions: Update Cloud Hypervisor to v53.0 by @noeljackson in #13279
• kata-deploy: provision host devices for rootless VMMs by @fidencio in #13908
• nvgpu: accept a complete driver source tarball as driver.url by @zvonkok in #13862
• Rust crate updates 30 sept 2026 by @stevenhorsman in #13929
• agent/genpolicy: policy state clean-up by @danmihai1 in #13891
• genpolicy: verify guest-pulled image references by @manuelh-dev in #13902
• nvgpu: build and ship every component the GPU runtime classes require by @zvonkok in #13849
• build: keep NVIDIA bundle verity hashes aligned by @manuelh-dev in #13926
• runtime-rs: fix the sandbox teardown racing the shim exit by @fidencio in #13674
• doc: fix small typos in CONTRIBUTING.md by @Redent0r in #13937
• guest-extensions: Expand support to other VMMs by @fidencio in #13931
• runtime-rs: only unmount rootfs sources mounted by the shim by @fidencio in #13939
• versions: Update to rust 1.97 by @stevenhorsman in #13934
• workflows: Stale ok-to-test label when external contributors re-push code changes by @stevenhorsman in #13980
• runtime-rs: release volumes after container setup fails by @fidencio in #13964
• runtime-rs: log errors from the fresh Delete process by @fidencio in #13973
• kata-ctl: delimit devkit uploads without terminal EOF by @fidencio in #13940
• runtime-rs: remove empty container share directories by @fidencio in #13966
• docs: point to correct link for containerd2-v2 commands by @mfrw in #13928
• runtime-rs: clean up containers deleted before Start by @fidencio in #13961
• runtime-rs: remove Kata-created network namespaces by @fidencio in #13971
• doc: update CVE assignment in SECURITY.md by @burgerdev in #13983
• versions: bump golang to 1.26.8 by @stevenhorsman in #13987
• runtime-rs: keep sandbox state outside the VMM runtime directory by @fidencio in #13985
• runtime-rs: Refactor block format by @Apokleos in #13882
• runtime-rs: spawn a single exit waiter per container by @fidencio in #13938
• runtime-rs: detach shared mounts before removing the tree by @fidencio in #13958
• runtime-rs: register config plugins before recovery by @fidencio in #13968
• runtime-rs/QEMU: enable rootless SEV-SNP/TDX by @manuelh-dev in #13556
• nvidia: pin the whole DCGM package family, not only -core by @fidencio in #14002
• nvidia: allow testing NVRC pull requests, but never merging them by @fidencio in #13994
• runtime-rs: format Sandbox API DNS for the agent by @manuelh-dev in #13921
• dragonball: validate full guest buffer range in vsock and balloon async I/O by @lifupan in #13661
• ci: Temporarily disable NVIDIA GPU tests by @fidencio in #14012
• tests: genpolicy: nvidia.com/pgpu -> nvidia.com/gpu by @fidencio in #14011
• tests(vfio-ap): Use unique container ID per test run by @BbolroC in #14015
• ci: stability tests install containerd via CONTAINERD_VERSION by @stevenhorsman in #13996
• Revert "ci: Temporarily disable NVIDIA GPU tests" by @fidencio in #14018
• tests: Add new NVIDIA runner for arm64 + a100 by @fidencio in #14020
• runtime-rs: wait for cgroup populated 0 before removal by @fidencio in #13969
• kernel: bump the guest kernel to 6.18.56 and drop the upstreamed dax patch by @mythi in #14007
• versions: Bump go 1.26.9 by @stevenhorsman in #14038
• build: install ORAS without sudo in root build containers by @EricMountain in #14027
• tests: use retained images in pull-pinning tests by @manuelh-dev in #14039
• deps: Bump quinn-proto to 0.11.18 by @stevenhorsman in #14041
• agent, docs: remove unused devmode parameter and KATA_DEV_MODE reference by @manuelh-dev in #14044
• build(deps): bump cairosvg from 2.9.0 to 2.9.1 in /docs by @dependabot[bot] in #14013
• build(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 in /src/runtime by @dependabot[bot] in #14004
• runtime: preserve no_new_privileges in exec requests by @wdsun1008 in #14025
• runtime-rs: wait for containers killed before Start by @fidencio in #13965
• kata-deploy: move TEE / remote / firecracker / NVIDIA shims out of the default values.yaml by @fidencio in #13672
• runtime-rs: Stop mapping discard_unmap to the CH disk sparse flag by @Camelron in #14032
• versions: bump Cloud Hypervisor to v54.0 by @fidencio in #14054
• tests: skip installing suitable existing Bats by @fidencio in #14058
• kernel: add XT_MATCH_SOCKET by @egernst in #14049
• runtime: set shared_fs=none for Firecracker by @hlhl040 in #14051
• dragonball: Validate complete virtio-blk request ranges by @denverdino in #14029
• runtime-rs: don't set TimeoutStopUSec when restoring a systemd scope by @amitbloomberg7 in #14042
• runtime-rs: avoid panics on unsupported hypervisor metrics by @manrueda in #13707
• runtime-rs: remove the host share dir when cleaning up a restored sandbox by @amitbloomberg7 in #14060
• kata-deploy: restore VERSION installation on host nodes by @fidencio in #14067
• tests: nvidia: clean up rootless NVIDIA GPU pods by @manuelh-dev in #14059
• versions: Upgrade Firecracker to v1.17.0 by @LandonTClipp in #14016
• runtime-rs: apply VM SELinux labels only to child processes by @fidencio in #14053
• runtime-rs: make resource cleanup safe to retry by @fidencio in #13959
• runtime-rs: Supports coping file to guest by chunk by @dongbeiouba in #13569
• runtime-rs: fix rootless virtiofsd socket path and delete after a removed bundle by @fidencio in #14056
• kata-deploy: allow cleanup after invalid DCGM configuration by @coder-glenn in #14064
• runtime-rs: unify runtime configuration loading by @realsdx in #13594
• runtime-rs: report and retry failed container cleanup by @fidencio in #13960
• deps: Bump rustls to 0.23.46 by @stevenhorsman in #14086
• runtime-rs: cap CLH network queue pairs at boot vCPUs by @SaveTheRbtz in #13809
• gpu: Bump NVIDIA driver to 615.71.09 by @zvonkok in #14093
• runtime, runtime-rs: share one iommufd across VFIO devices by @fidencio in #14096
• agent: PCIDEVICE_* env mapping fixes by @mythi in #13935
• runtime-rs: rely on /sys/class/iommu alone to find the IOMMU on by @fivetime in #14099
• release: prepare Kata Containers 4.3.0 by @fidencio in #14097
• workflows: release: set RELEASE=yes when building kata-deploy by @fidencio in #14100

New Contributors

• @mjnagel made their first contribution in #13855
• @manrueda made their first contribution in #13734
• @ahauserv made their first contribution in #13861
• @kishen-v made their first contribution in #13848
• @david-long1 made their first contribution in #13878
• @esposem made their first contribution in #13859
• @noeljackson made their first contribution in #13279
• @mfrw made their first contribution in #13928
• @EricMountain made their first contribution in #14027
• @wdsun1008 made their first contribution in #14025
• @hlhl040 made their first contribution in #14051
• @denverdino made their first contribution in #14029
• @amitbloomberg7 made their first contribution in #14042
• @dongbeiouba made their first contribution in #13569
• @coder-glenn made their first contribution in #14064
• @fivetime made their first contribution in #14099

Full Changelog: 4.2.0...4.3.0