Welcome to the v2.4.2 release of containerd!

The second patch release for containerd 2.4 contains various fixes
and updates including security patches.

Security Updates

• containerd
  • CVE-2026-95839
  • GHSA-8647-2jxj-p2rc
  • GHSA-hc94-p972-ch66

Highlights

Container Runtime Interface (CRI)

• Apply hardening to not follow symlinks for container log files (#14302)

Image Distribution

• Fix excessive memory usage during image pulls when registry downloads outpace content writes (#14342)
• Apply hardening to reject image references with ".." path components (#14282)

Runtime

• Apply hardening to allowlist socket domains in the default seccomp profile (#14247)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Maksym Pavlenko
• Sebastiaan van Stijn
• Derek McGowan
• LEI WANG
• Paweł Gronowski
• Phil Estes
• Wei Fu
• syed abdul khaliq

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.4.1

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.3.7 release of containerd!

The seventh patch release for containerd 2.3 contains various fixes
and updates including security patches.

Security Updates

• containerd
  • CVE-2026-95839
  • GHSA-5p7c-hggf-c748
  • GHSA-8647-2jxj-p2rc
  • GHSA-hc94-p972-ch66

Highlights

Container Runtime Interface (CRI)

• Apply hardening to not follow symlinks for container log files (#14301)

Image Distribution

• Apply hardening to reject image references with ".." path components (#14281)

Runtime

• Apply hardening to allowlist socket domains in the default seccomp profile (#14248)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14261)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Wei Fu
• Maksym Pavlenko
• Aysha Afrah Ziya
• Derek McGowan
• Sebastiaan van Stijn
• Akihiro Suda
• LEI WANG
• Paweł Gronowski
• Phil Estes
• Vishal Srinivasan
• syed abdul khaliq
• 申玥

Changes

Dependency Changes

• go.opentelemetry.io/otel v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/sdk v1.43.0 -> v1.44.0
• go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
• golang.org/x/crypto v0.53.0 -> v0.55.0
• golang.org/x/mod v0.36.0 -> v0.38.0
• golang.org/x/net v0.55.0 -> v0.58.0
• golang.org/x/oauth2 v0.35.0 -> v0.36.0
• golang.org/x/sync v0.21.0 -> v0.22.0
• golang.org/x/sys v0.46.0 -> v0.47.0
• golang.org/x/term v0.44.0 -> v0.45.0
• golang.org/x/text v0.38.0 -> v0.41.0
• google.golang.org/genproto/googleapis/api 9d38bb4040a9 -> 3dc84a4a5aaa
• google.golang.org/genproto/googleapis/rpc 6f92a3bedf2d -> 3dc84a4a5aaa
• google.golang.org/grpc v1.80.0 -> v1.83.2

Previous release can be found at v2.3.6

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.2.10 release of containerd!

The tenth patch release for containerd 2.2 contains various fixes
and updates including security patches.

Security Updates

• containerd
  • CVE-2026-95839
  • GHSA-5p7c-hggf-c748
  • GHSA-8647-2jxj-p2rc
  • GHSA-hc94-p972-ch66

Highlights

Container Runtime Interface (CRI)

• Apply hardening to not follow symlinks for container log files (#14300)

Image Distribution

• Avoid hang and data corruption during multipart image fetch (#14316)
• Apply hardening to reject image references with ".." path components (#14280)

Runtime

• Apply hardening to allowlist socket domains in the default seccomp profile (#14249)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14269)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Maksym Pavlenko
• Wei Fu
• Aysha Afrah Ziya
• Phil Estes
• Adrien Delorme
• LEI WANG
• Paweł Gronowski
• Sebastiaan van Stijn
• Shiming Zhang
• syed abdul khaliq
• 申玥

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.2.9

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.0.14 release of containerd!

The fourteenth patch release for containerd 2.0 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • GHSA-hc94-p972-ch66

Highlights

Container Runtime Interface (CRI)

• Apply hardening to not follow symlinks for container log files (#14299)

Runtime

• Apply hardening to allowlist socket domains in the default seccomp profile (#14251)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14270)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Wei Fu
• Maksym Pavlenko
• Aysha Afrah Ziya
• Paweł Gronowski
• Phil Estes
• Shiming Zhang
• ningmingxiao

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.13

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.4.1 release of containerd!

The first patch release for containerd 2.4 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where failed container start cleanup leaked tasks and prevented container removal (#14223)
• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14212)

Image Distribution

• Fix content upload failures when retrying fetch content after reaching EOF (#14197)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14200)

ctr development tool

• Fix bug where arguments following "-" were dropped in "ctr images export" (#14219)
• Fix bug where container command arguments were parsed as flags in "ctr run", "ctr containers create", "ctr tasks exec", and "containerd oci-hook" (#14215)
• Fix bug where comma-separated flag values were incorrectly split in ctr subcommands (#14188)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Aysha Afrah Ziya
• Chris Henzie
• CrazyMax
• Maksym Pavlenko
• Nan Liu
• Sebastiaan van Stijn

Changes

Dependency Changes

• github.com/fxamacker/cbor/v2 v2.9.1 -> v2.9.4

Previous release can be found at v2.4.0

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.3.6 release of containerd!

The sixth patch release for containerd 2.3 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14211)
• Enable mount manager for image mounts in CRI (#14147)

Image Storage

• Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14139)

Runtime

• Avoid unexpected mutation of mount options in mount helpers (#14192)
• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14144)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Paweł Gronowski
• Samuel Karp
• Chris Henzie
• Maksym Pavlenko
• Wei Fu
• Gao Xiang
• Nan Liu

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.3.5

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.2.9 release of containerd!

The ninth patch release for containerd 2.2 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14210)
• Enable mount manager for image mounts in CRI (#14148)

Image Storage

• Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14140)

Runtime

• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14182)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Chris Henzie
• Maksym Pavlenko
• Wei Fu
• Gao Xiang
• Nan Liu

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.2.8

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.0.13 release of containerd!

The thirteenth patch release for containerd 2.0 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Image Storage

• Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14141)

Runtime

• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14183)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Chris Henzie
• Maksym Pavlenko

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.12

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v1.7.36 release of containerd!

The thirty-sixth patch release for containerd 1.7 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Image Storage

• Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14142)

Runtime

• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14184)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Chris Henzie
• Derek McGowan

Changes

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.7.35

Welcome to the v2.4.0 release of containerd!

containerd 2.4 is a regular (non-LTS) release with a shorter support window,
intended for users who want to adopt new features sooner. As the release
following the 2.3 LTS, it is the point in the release cycle where previously
deprecated features may be removed, so this release may include breaking
changes; check the notes below and clear any deprecation warnings from your
current version before upgrading.

Users prioritizing stability and a longer support lifecycle should stay on the
2.3 LTS release.

Highlights

Container Runtime Interface (CRI)

• Enable mount manager for image mounts in CRI (#13542)
• Export sandbox image and CNI directory configuration in CRI plugin info (#13940)
• Set default runtimeFeatures.UserNamespacesHostNetwork to true (#13162)
• Support OCI runtime feature introspection for non-runc runtimes (#13504)

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#12889)
• Support propagating HTTP 299 warning headers from registries to the resolver (#12698)
• Use klauspost/compress for gzip layer decompression (#13560)

Image Storage

• Add client options to fetch all layer content during unpack even when snapshots exist (#14126)
• Include media type in content create events (#13833)
• Add forward References to the GC collection context (#13634)

Node Resource Interface (NRI)

• Expose container image name, digest, and config digest to NRI plugins (#13960)
• Emit deprecation warnings for plugins using deprecated NRI interfaces (#13916)

Runtime

• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14090)
• Add UpdateSandbox RPC to propagate sandbox controller updates to the shim (#14105)
• Avoid immediately restarting containers with restart=always policy after they are explicitly stopped (#13993)
• Pass tracing context from shim to runc and hooks (#14036)
• Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13818)
• Implement Windows named-pipe server and log streaming support in pkg/shim (#13948)
• Enable log scrubbing by default on Windows (#13837)
• Allow specifying parent checkpoint directory when checkpointing with runc (#13699)

Snapshotters

• Add Prometheus metrics for EROFS snapshotter layer content cache (#13941)
• Support warm image cache for erofs snapshotter (#13813)
• Add max size label for snapshots (#13520)

Breaking

• Remove deprecated CRI and tracing configuration options:
  • Remove enable_cdi in CRI runtime configuration (CDI is now always enabled)
  • Remove bin_dir in CRI CNI configuration (use bin_dirs)
  • Remove endpoint, protocol, and insecure in OTLP tracing processor configuration (use standard OTLP environment variables)
  • Remove service_name and sampling_ratio in internal tracing configuration (use standard OpenTelemetry environment variables) (#14166)
• Remove restore in CreateContainer (#13871)

Deprecations

• Deprecate containerd.io/runtime-allow-mounts shim annotation in favor of MountCapabilities bootstrap extension (#14002)
• Remove deprecated shim.Command from pkg (#13991)
• Deprecate task API address and version fields in runc options and move to CreateTaskRequest (#13360)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Sebastiaan van Stijn
• Samuel Karp
• Derek McGowan
• Wei Fu
• Akihiro Suda
• Mike Brown
• Paweł Gronowski
• Chris Henzie
• Phil Estes
• Brian Goff
• Austin Vazquez
• ningmingxiao
• Jordan Liggitt
• Akhil Mohan
• Eshaan Mathur
• Krisztian Litkey
• Chris Ayoub
• Kazuyoshi Kato
• Kir Kolyshkin
• Sergey Kanzhelev
• Ahmet Alp Balkan
• Arpit Jain
• Cindy Li
• Damien Grisonnet
• Esteban Ginez
• Gao Xiang
• Harsh Rawat
• Laura Lorenz
• Maksim An
• Oleh Konko
• Philip Laine
• Abhishek Bhunia
• Alan Grosskurth
• Albin Kerouanton
• Alex Lyn
• Aman Raj
• Amir Alavi
• Amit Barve
• Andrew Halaney
• AprilNEA
• Arjun Yogidas
• Ayato Tokubi
• Aysha Afrah Ziya
• Ben Cressey
• Bing Hongtao
• Chris Crone
• Craig Gumbley
• Daniel De Graaf
• Davanum Srinivas
• Dr. Jan-Philip Gehrcke
• Harshal Patel
• Henry Wang
• Hsiu-Chi Tsai
• JP Phillips
• Jing Chen
• Kohei Tokunaga
• LEI WANG
• Martín Fernández
• Mikhail Dmitrichenko
• Nahum Litvin
• Nikolaus Schuetz
• Pablo Garcia Caceres
• Paco Xu
• Robert Cronin
• SaloniRathi
• Shambhavi Srivastava
• Tianon Gravi
• XlabAI
• Yuanliang Zhang
• ayush-panta
• crawfordxx
• cshung
• match man
• s3onghyun
• 归寂
• 徐晓伟

Changes