containerd 2.3.5

Welcome to the v2.3.5 release of containerd!

The fifth patch release for containerd 2.3 contains various fixes
and updates including security patches.

### Security Updates

* **containerd**
  * [**CVE-2026-53495**](GHSA-7jxh-36q5-gcqv)
  * [**GHSA-rp3h-jf77-q9p4**](GHSA-rp3h-jf77-q9p4)

### Highlights

#### Image Distribution

* Apply hardening to strip sensitive authentication headers when fetching descriptor URLs ([#14030](#14030))

#### Runtime

* Avoid hangs and data races when streaming container standard I/O in CRI ([#14094](#14094))
* Fix missing error messages in OpenTelemetry trace attributes ([#14049](#14049))
* Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ([#13999](#13999))
* Fix configuration loading error when drop-in configuration files have a higher version than the root configuration ([#13995](#13995))
* Avoid containerd startup hangs when loading shims ([#13983](#13983))
* Add context to error when shim delete times out ([#13921](#13921))
* Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC ([containerd/platforms#34](containerd/platforms#34))

#### Snapshotters

* Fix unpack failure for EROFS images containing the erofs OS feature ([#14062](#14062))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Phil Estes
* Samuel Karp
* Derek McGowan
* Sebastiaan van Stijn
* Akhil Mohan
* Maksym Pavlenko
* Wei Fu
* Oleh Konko
* Austin Vazquez
* Jing Chen
* Martín Fernández
* Paco Xu
* XlabAI
* Yuanliang Zhang

### Changes
<details><summary>33 commits</summary>
<p>

  * [`934efa5e0`](934efa5) Prepare release notes for v2.3.5
  * [`be419b070`](be419b0) Merge commit from fork
  * [`9ec55f024`](9ec55f0) cri: cancel ExecSync IO drain on context cancellation
  * [`84ea25bc1`](84ea25b) Merge commit from fork
  * [`c53577965`](c535779) archive: skip redundant opaque whiteout walks
* Fix data races and a deadlock in the byte stream helpers ([#14094](#14094))
  * [`9f6be869c`](9f6be86) Fix data races and a deadlock in the byte stream helpers
* plugins: remove some stray logrus imports ([#14063](#14063))
  * [`6c59399bf`](6c59399) plugins: remove some stray logrus imports
* snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin ([#14062](#14062))
  * [`f65732115`](f657321) snapshots/erofs: test the advertised erofs feature platform
  * [`5ffc2bbda`](5ffc2bb) erofs: advertise the erofs OS feature platform from the snapshotter
* update runc to v1.5.1 ([#14059](#14059))
  * [`af445ea0a`](af445ea) update runc to v1.5.1
  * [`c077e43bd`](c077e43) update runc to v1.5.0
* vendor: github.com/containerd/platforms v1.0.0-rc.5 ([#14048](#14048))
  * [`676a64cad`](676a64c) vendor: github.com/containerd/platforms v1.0.0-rc.5
* pkg/tracing: handle error and typed-nil Stringer attributes ([#14049](#14049))
  * [`c7ffd8b00`](c7ffd8b) pkg/tracing: handle error and typed-nil Stringer attributes
* docker fetcher: strip sensitive headers on descriptor URLs ([#14030](#14030))
  * [`58fb846d5`](58fb846) core/remotes/docker: normalize descriptor URL origins
  * [`c7625a1ff`](c7625a1) core/remotes/docker: strip sensitive headers on desc.urls fetch
* update runhcs to v0.15.0-rc.4 ([#13990](#13990))
  * [`6fbb92c33`](6fbb92c) update runhcs to v0.15.0-rc.4
* pkg/oci: resolve rootfs symlinks for user lookup ([#13999](#13999))
  * [`53bf030ea`](53bf030) pkg/oci: resolve rootfs symlinks for user lookup
* Revert "add check on version of drop in configs" ([#13995](#13995))
  * [`7790c4c21`](7790c4c) ensure that the final config version is the higest in the config list
  * [`1125b053f`](1125b05) Revert "add check on version of drop in configs"
* fix(runtime): apply load timeout to load shim ([#13983](#13983))
  * [`460c47b28`](460c47b) fix(runtime): bound shim loading with the load timeout
* Add more context to the shim delete error ([#13921](#13921))
  * [`7f97bc122`](7f97bc1) Add more context to the shim delete error
</p>
</details>

### Changes from containerd/platforms
<details><summary>2 commits</summary>
<p>

* Fix WS2022 compat on hosts past the latest LTSC ([containerd/platforms#34](containerd/platforms#34))
  * [`bacc690`](containerd/platforms@bacc690) Fix WS2022 compat on hosts past the latest LTSC
</p>
</details>

### Dependency Changes

* **github.com/containerd/platforms**  v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at [v2.3.4](https://github.com/containerd/containerd/releases/tag/v2.3.4)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 2.2.8

Welcome to the v2.2.8 release of containerd!

The eighth patch release for containerd 2.2 contains various fixes
and updates including security patches.

### Security Updates

* **containerd**
  * [**CVE-2026-53495**](GHSA-7jxh-36q5-gcqv)
  * [**GHSA-rp3h-jf77-q9p4**](GHSA-rp3h-jf77-q9p4)

### Highlights

#### Image Distribution

* Apply hardening to strip sensitive authentication headers when fetching descriptor URLs ([#14044](#14044))

#### Runtime

* Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ([#14102](#14102))
* Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group ([#14005](#14005))

#### Snapshotters

* Fix EROFS snapshot creation failure caused by concurrent snapshot removal ([#13950](#13950))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Wei Fu
* Oleh Konko
* Chris Ayoub
* Maksim An
* XlabAI

### Changes
<details><summary>14 commits</summary>
<p>

  * [`4864b1814`](4864b18) Prepare release notes for v2.2.8
  * [`3458b7fd3`](3458b7f) Merge commit from fork
  * [`22ccf4314`](22ccf43) cri: cancel ExecSync IO drain on context cancellation
  * [`2bf01ce17`](2bf01ce) Merge commit from fork
  * [`45166eb82`](45166eb) archive: skip redundant opaque whiteout walks
* Set SystemTemp env var to config temp on Windows ([#14102](#14102))
  * [`2c722ad04`](2c722ad) Set SystemTemp env var to config temp on Windows
* pkg/oci: resolve rootfs symlinks for user lookup ([#14005](#14005))
  * [`196664bc0`](196664b) pkg/oci: resolve rootfs symlinks for user lookup
* docker fetcher: strip sensitive headers on descriptor URLs ([#14044](#14044))
  * [`6da9d9528`](6da9d95) core/remotes/docker: normalize descriptor URL origins
  * [`4f7851699`](4f78516) core/remotes/docker: strip sensitive headers on desc.urls fetch
* snapshots/erofs: protect snapshot staging from cleanup ([#13950](#13950))
  * [`f7075a224`](f7075a2) snapshots/erofs: protect snapshot staging from cleanup
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.2.7](https://github.com/containerd/containerd/releases/tag/v2.2.7)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 2.0.12

Welcome to the v2.0.12 release of containerd!

The twelfth patch release for containerd 2.0 contains various fixes
and updates including security patches.

### Security Updates

* **containerd**
  * [**CVE-2026-53495**](GHSA-7jxh-36q5-gcqv)
  * [**GHSA-rp3h-jf77-q9p4**](GHSA-rp3h-jf77-q9p4)

### Highlights

#### Image Distribution

* Apply hardening to strip sensitive authentication headers when fetching descriptor URLs ([#14045](#14045))
* Surface OCI error bodies in registry 403 responses by falling back to GET requests ([#13749](#13749))

#### Runtime

* Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ([#14100](#14100))
* Enable log scrubbing by default on Windows ([#13884](#13884))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Maksym Pavlenko
* Oleh Konko
* Akihiro Suda
* Chris Henzie
* Maksim An
* Phil Estes
* Wei Fu
* XlabAI
* cshung

### Changes
<details><summary>19 commits</summary>
<p>

  * [`d6a01e72a`](d6a01e7) Prepare release notes for v2.0.12
  * [`2e964db90`](2e964db) Merge commit from fork
  * [`eebea8c4c`](eebea8c) cri: cancel ExecSync IO drain on context cancellation
  * [`d93c158a6`](d93c158) Merge commit from fork
  * [`6c060c952`](6c060c9) archive: skip redundant opaque whiteout walks
* Set SystemTemp env var to config temp on Windows ([#14100](#14100))
  * [`56058341c`](5605834) Set SystemTemp env var to config temp on Windows
* docker fetcher: strip sensitive headers on descriptor URLs ([#14045](#14045))
  * [`88c95d56d`](88c95d5) core/remotes/docker: normalize descriptor URL origins
  * [`7711c3d21`](7711c3d) core/remotes/docker: strip sensitive headers on desc.urls fetch
* Use ScrubLogs by default on Windows ([#13884](#13884))
  * [`84c6caa67`](84c6caa) ctr: add --scrub-logs flag for Windows
  * [`5fcdfaab2`](5fcdfaa) cri/config: use ScrubLogs by default on Windows
* ci: bound Go fuzzing by execution count ([#13787](#13787))
  * [`b452f2856`](b452f28) ci: bound Go fuzzing by execution count
* CI: migrate Vagrant to Lima ([#13756](#13756))
  * [`a15448870`](a154488) CI: migrate Vagrant to Lima
* remotes: surface OCI error body on HEAD 403 via GET fallback ([#13749](#13749))
  * [`71a73c8a0`](71a73c8) remotes: surface OCI error body on HEAD 403 via GET fallback
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.0.11](https://github.com/containerd/containerd/releases/tag/v2.0.11)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 1.7.35

Welcome to the v1.7.35 release of containerd!

The thirty-fifth patch release for containerd 1.7 contains various fixes
and updates including security patches.

### Security Updates

* **containerd**
  * [**CVE-2026-53495**](GHSA-7jxh-36q5-gcqv)
  * [**GHSA-rp3h-jf77-q9p4**](GHSA-rp3h-jf77-q9p4)

### Highlights

#### Image Distribution

* Apply hardening to strip sensitive authentication headers when fetching descriptor URLs ([#14046](#14046))

#### Runtime

* Enable log scrubbing by default on Windows ([#13889](#13889))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Oleh Konko
* Chris Henzie
* Maksym Pavlenko
* Phil Estes
* XlabAI

### Changes
<details><summary>13 commits</summary>
<p>

  * [`05aa78da3`](05aa78d) Prepare release notes for v1.7.35
  * [`3bd79bb36`](3bd79bb) Merge commit from fork
  * [`5a2a3a759`](5a2a3a7) cri: cancel ExecSync IO drain on context cancellation
  * [`323e148f2`](323e148) Merge commit from fork
  * [`9205b1903`](9205b19) archive: skip redundant opaque whiteout walks
* docker fetcher: strip sensitive headers on descriptor URLs ([#14046](#14046))
  * [`b01d66349`](b01d663) core/remotes/docker: normalize descriptor URL origins
  * [`b5d936dca`](b5d936d) core/remotes/docker: strip sensitive headers on desc.urls fetch
* Use ScrubLogs by default on Windows ([#13889](#13889))
  * [`cff94ea40`](cff94ea) ctr: add --scrub-logs flag for Windows
  * [`544e4657d`](544e465) cri/config: use ScrubLogs by default on Windows
* ci: bound Go fuzzing by execution count ([#13788](#13788))
  * [`71e00ba9c`](71e00ba) ci: bound Go fuzzing by execution count
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v1.7.34](https://github.com/containerd/containerd/releases/tag/v1.7.34)

containerd api/v1.12.0-rc.0

Welcome to the api/v1.12.0-rc.0 release of containerd!
*This is a pre-release of containerd*

The 13th release for the containerd 1.x API aligns with the containerd 2.4 release.

### Highlights

* **Include media type in content create event** ([#13833](#13833))
* **Add parent path to runc checkpoint options** ([#13699](#13699))

#### Deprecations

* **Deprecate "allow mount handlers" in shim info and replace with mount capability extension** ([#14002](#14002))
* **Fix sandbox task API endpoints for non-runc runtimes** ([#13360](#13360))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Maksym Pavlenko
* Wei Fu
* Jordan Liggitt
* Samuel Karp
* Kohei Tokunaga
* Philip Laine
* Sebastiaan van Stijn
* Sergey Kanzhelev

### Changes
<details><summary>22 commits</summary>
<p>

* Prepare api/v1.12.0-rc.0 release ([#14047](#14047))
  * [`d767f44b5`](d767f44) Prepare api/v1.12.0-rc.0 release
* Shim mount handler protocol ([#14002](#14002))
  * [`a72247425`](a722474) api: add shim mount capabilities
* chore(api): update github.com/sirupsen/logrus v1.10.2 ([#14037](#14037))
  * [`a28910b14`](a28910b) chore(api): update github.com/sirupsen/logrus v1.10.2
* Prepare release notes for api/v1.12.0-beta.0 ([#13899](#13899))
  * [`0ff04dc3f`](0ff04dc) Prepare release notes for api/v1.12.0-beta.0
* Include media type in content create event ([#13833](#13833))
  * [`a452c2e23`](a452c2e) Include media type in content create event
* build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api ([#13819](#13819))
  * [`52c5f1f64`](52c5f1f) build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api
* build(deps): bump github.com/containerd/ttrpc to v1.2.9 ([#13740](#13740))
  * [`658a1c78b`](658a1c7) build(deps): bump github.com/containerd/ttrpc to v1.2.9
* Add parent path to runc checkpoint options ([#13699](#13699))
  * [`ea0ed51e2`](ea0ed51) shim: allow specifying runc's --parent-path during checkpointing
* Update typeurl/v2 to v2.3.0 to drop gogo dependency ([#13490](#13490))
  * [`ce3914324`](ce39143) Update typeurl/v2 to v2.3.0 to drop gogo dependency
* do not hide linitng errors ([#13423](#13423))
  * [`7f10e9eb5`](7f10e9e) do not hide linitng errors
* Fix sandbox task API endpoints for non-runc runtimes ([#13360](#13360))
  * [`ac01ae5c2`](ac01ae5) protos: include task API address to CreateTaskRequest
</p>
</details>

### Dependency Changes

* **github.com/containerd/ttrpc**                v1.2.5 -> v1.2.9
* **github.com/containerd/typeurl/v2**           v2.1.1 -> v2.3.0
* **github.com/sirupsen/logrus**                 v1.9.3 -> v1.10.2
* **golang.org/x/net**                           v0.48.0 -> v0.55.0
* **golang.org/x/sys**                           v0.39.0 -> v0.46.0
* **golang.org/x/text**                          v0.32.0 -> v0.37.0
* **google.golang.org/genproto/googleapis/rpc**  ff82c1b0f217 -> a57be14db171
* **google.golang.org/grpc**                     v1.79.3 -> v1.81.1
* **google.golang.org/protobuf**                 v1.36.10 -> v1.36.11

Previous release can be found at [api/v1.11.0](https://github.com/containerd/containerd/releases/tag/api/v1.11.0)

containerd 2.3.4

Welcome to the v2.3.4 release of containerd!

The fourth patch release for containerd 2.3 contains various fixes and updates.

### Highlights

#### Container Runtime Interface (CRI)

* Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13913](#13913))
* Set default runtimeFeatures.UserNamespacesHostNetwork to true in CRI ([#13914](#13914))
* Deprecate checkpoint restore in CreateContainer ([#13868](#13868))
* Support non-UTF-8 binary environment variable values in CRI ([#13454](#13454))
* Enable OCI runtime feature introspection for non-runc runtimes in CRI ([#13778](#13778))
* Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ([#13734](#13734))
* Normalize sandbox image references in CRI to resolve images without domain prefixes ([#13759](#13759))

#### Node Resource Interface (NRI)

* Emit deprecation warnings for plugins using deprecated NRI interfaces ([#13935](#13935))

#### Runtime

* Enable log scrubbing by default on Windows ([#13904](#13904))
* Fix memory leak in OOM watcher map when stopping container monitoring ([#13870](#13870))
* Avoid orphaning shims on transient errors when loading process IDs ([#13857](#13857))
* Fix corruption of binary protobuf shim start responses caused by premature whitespace trimming ([#13803](#13803))

#### Snapshotters

* Fix EROFS snapshotter dropping lower layers stacked above merged filesystem metadata ([#13876](#13876))

#### Breaking

* Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13913](#13913))

#### Deprecations

* Deprecate checkpoint restore in CreateContainer ([#13868](#13868))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Maksym Pavlenko
* Mike Brown
* Akihiro Suda
* Derek McGowan
* Jordan Liggitt
* Paweł Gronowski
* Amir Alavi
* Andrew Halaney
* Bing Hongtao
* Chris Henzie
* Harshal Patel
* Krisztian Litkey
* Phil Estes
* Wei Fu
* ningmingxiao

### Changes
<details><summary>35 commits</summary>
<p>

  * [`c1f5360ef`](c1f5360) Prepare release notes for v2.3.4
* cri: disable restore in CreateContainer by default ([#13913](#13913))
  * [`928c03c68`](928c03c) cri: disable restore in CreateContainer by default
* nri,deprecation: record and emit warnings for NRI deprecations. ([#13935](#13935))
  * [`5966e2edb`](5966e2e) nri,deprecation: emit warnings for old NRI plugins.
* Set the default of runtimeFeatures.UserNamespacesHostNetwork to true ([#13914](#13914))
  * [`ab52c58f1`](ab52c58) Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
* Use ScrubLogs by default on Windows ([#13904](#13904))
  * [`0c255158a`](0c25515) ctr: add --scrub-logs flag for Windows
  * [`1c2b13dc9`](1c2b13d) cri/config: use ScrubLogs by default on Windows
* snapshots/erofs: keep lowers stacked above a merged fsmeta ([#13876](#13876))
  * [`0c511e068`](0c511e0) snapshots/erofs: keep lowers stacked above a merged fsmeta
* cri: deprecate restore in CreateContainer ([#13868](#13868))
  * [`dc98141df`](dc98141) cri: deprecate restore in CreateContainer
* internal/oom: Fix memory leak by removing watcher from map on Stop ([#13870](#13870))
  * [`537d82d54`](537d82d) internal/oom: Fix memory leak by removing watcher from map on Stop
* shim_load: Consider shim leaked only if we can't find pids ([#13857](#13857))
  * [`decf97a9c`](decf97a) shim_load: Consider shim leaked only if we can't find pids
* core/runtime/v2: Drop checkpointctl module dependency ([#13840](#13840))
  * [`796f07dc8`](796f07d) core/runtime/v2: Drop checkpointctl module dependency
* Handle []byte envvar value for CRI ([#13454](#13454))
  * [`751fddddb`](751fddd) Handle []byte envvar value
  * [`0bce9060e`](0bce906) update to v0.36.x kubernetes dependencies
* fix(cri): introspect OCI runtime features for non-runc runtimes ([#13778](#13778))
  * [`61a8f6f45`](61a8f6f) fix(cri): introspect OCI runtime features for non-runc runtimes
* core/runtime/v2: Preserve protobuf shim response bytes ([#13803](#13803))
  * [`1d28017be`](1d28017) core/runtime/v2: Preserve protobuf shim response bytes
* Disable checkpoint restore codepath when CRIU is not installed ([#13734](#13734))
  * [`374091d67`](374091d) github/workflows: install criu in node-e2e
  * [`db03e3968`](db03e39) cri: add enable_criu configuration option
  * [`dacd4c7d0`](dacd4c7) cri: validate CRIU availability and version early
* ci: bound Go fuzzing by execution count ([#13785](#13785))
  * [`890a9c86c`](890a9c8) ci: bound Go fuzzing by execution count
* cri: auto-add prefix for pause image ([#13759](#13759))
  * [`0b2f1d078`](0b2f1d0) cri: auto-add prefix for pause image
</p>
</details>

### Dependency Changes

* **k8s.io/api**                            v0.36.0 -> v0.36.3
* **k8s.io/apimachinery**                   v0.36.0 -> v0.36.3
* **k8s.io/client-go**                      v0.36.0 -> v0.36.3
* **k8s.io/component-base**                 v0.36.0 -> v0.36.3
* **k8s.io/cri-api**                        v0.36.0 -> v0.36.3
* **k8s.io/cri-client**                     v0.36.0 -> v0.36.3
* **k8s.io/cri-streaming**                  v0.36.0 -> v0.36.3
* **sigs.k8s.io/structured-merge-diff/v6**  v6.3.2 -> v6.3.3

Previous release can be found at [v2.3.3](https://github.com/containerd/containerd/releases/tag/v2.3.3)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 2.2.7

Welcome to the v2.2.7 release of containerd!

The seventh patch release for containerd 2.2 contains various fixes and updates.

### Highlights

#### Container Runtime Interface (CRI)

* Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13937](#13937))
* Deprecate checkpoint restore in CreateContainer ([#13872](#13872))
* Support non-UTF-8 binary environment variable values in CRI ([#13455](#13455))
* Disable checkpoint restore codepaths when CRIU is not installed and add enable_criu configuration option ([#13795](#13795))
* Enable OCI runtime feature introspection for non-runc runtimes in CRI ([#13779](#13779))

#### Runtime

* Enable log scrubbing by default on Windows ([#13882](#13882))
* Fix mount manager activation error when activation already exists ([#13823](#13823))

#### Breaking

* Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13937](#13937))

#### Deprecations

* Deprecate checkpoint restore in CreateContainer ([#13872](#13872))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Jordan Liggitt
* Akihiro Suda
* Amir Alavi
* Chris Henzie
* Derek McGowan
* Maksym Pavlenko
* Mike Brown
* Phil Estes

### Changes
<details><summary>21 commits</summary>
<p>

  * [`43f299db6`](43f299d) Prepare release notes for v2.2.7
* cri: disable restore in CreateContainer by default ([#13937](#13937))
  * [`5c3a47036`](5c3a470) cri: disable restore in CreateContainer by default
* Use ScrubLogs by default on Windows ([#13882](#13882))
  * [`4c93ae6d5`](4c93ae6) ctr: add --scrub-logs flag for Windows
  * [`a124c7e35`](a124c7e) cri/config: use ScrubLogs by default on Windows
* cri: deprecate restore in CreateContainer ([#13872](#13872))
  * [`c59d041d8`](c59d041) cri: deprecate restore in CreateContainer
* Handle []byte envvar value for CRI ([#13455](#13455))
  * [`6cdc2ddce`](6cdc2dd) Handle []byte envvar value
  * [`a60898833`](a608988) update to v0.34.x kubernetes dependencies
* Fix mount manager activation error when already exists ([#13823](#13823))
  * [`54ecff6ca`](54ecff6) core/mount: Fix mount manager activation error when already exists
* Disable checkpoint restore codepath when CRIU is not installed ([#13795](#13795))
  * [`fd966ba29`](fd966ba) github/workflows: install criu in node-e2e
  * [`7d41b25c9`](7d41b25) cri: add enable_criu configuration option
  * [`48116fa59`](48116fa) cri: validate CRIU availability and version early
* fix(cri): introspect OCI runtime features for non-runc runtimes ([#13779](#13779))
  * [`6a3d14e8a`](6a3d14e) fix(cri): introspect OCI runtime features for non-runc runtimes
* ci: bound Go fuzzing by execution count ([#13786](#13786))
  * [`424b714f0`](424b714) ci: bound Go fuzzing by execution count
</p>
</details>

### Dependency Changes

* **go.opentelemetry.io/otel**         v1.38.0 -> v1.41.0
* **go.opentelemetry.io/otel/metric**  v1.38.0 -> v1.41.0
* **go.opentelemetry.io/otel/trace**   v1.38.0 -> v1.41.0
* **google.golang.org/protobuf**       v1.36.10 -> f2248ac996af
* **k8s.io/api**                       v0.34.1 -> v0.34.10
* **k8s.io/apimachinery**              v0.34.1 -> v0.34.10
* **k8s.io/client-go**                 v0.34.1 -> v0.34.10
* **k8s.io/cri-api**                   v0.34.1 -> v0.34.10

Previous release can be found at [v2.2.6](https://github.com/containerd/containerd/releases/tag/v2.2.6)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 2.4.0-beta.0

Welcome to the v2.4.0-beta.0 release of containerd!
*This is a pre-release of containerd*

containerd 2.4 is a regular (non-LTS) release with a shorter support window,
intended for users who want to adopt new features sooner. As the release
following the 2.3 LTS, it is the point in the release cycle where previously
deprecated features may be removed, so this release may include breaking
changes; check the notes below and clear any deprecation warnings from your
current version before upgrading.

Users prioritizing stability and a longer support lifecycle should stay on the
2.3 LTS release.

This is a beta release and some functionality is still under development.

### Highlights

* **Include media type in content create event** ([#13833](#13833))
* **Support warm image cache for erofs snapshotter** ([#13813](#13813))
* **Add parent path to runc checkpoint options** ([#13699](#13699))

#### Container Runtime Interface (CRI)

* **Introspect OCI runtime features for non-runc runtimes** ([#13504](#13504))

#### Image Distribution

* **Use klauspost/compress/gzip for decode** ([#13560](#13560))

#### Image Storage

* **Add forward References to the GC collection context** ([#13634](#13634))

#### Snapshotters

* **Add max size label for snapshots** ([#13520](#13520))

#### Breaking

* Remove restore in CreateContainer ([#13871](#13871))

#### Deprecations

* **Fix sandbox task API endpoints for non-runc runtimes** ([#13360](#13360))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Maksym Pavlenko
* Samuel Karp
* Akihiro Suda
* Derek McGowan
* Wei Fu
* Sebastiaan van Stijn
* Chris Henzie
* Paweł Gronowski
* Mike Brown
* Brian Goff
* Jordan Liggitt
* Austin Vazquez
* Kazuyoshi Kato
* Kir Kolyshkin
* Phil Estes
* Sergey Kanzhelev
* ningmingxiao
* Ahmet Alp Balkan
* Akhil Mohan
* Chris Ayoub
* Damien Grisonnet
* Esteban Ginez
* Laura Lorenz
* Maksim An
* Abhishek Bhunia
* Alan Grosskurth
* Albin Kerouanton
* Alex Lyn
* Aman Raj
* Amir Alavi
* Amit Barve
* Andrew Halaney
* AprilNEA
* Arjun Yogidas
* Ayato Tokubi
* Aysha Afrah Ziya
* Ben Cressey
* Bing Hongtao
* Chris Crone
* Craig Gumbley
* Daniel De Graaf
* Davanum Srinivas
* Dr. Jan-Philip Gehrcke
* Gao Xiang
* Harshal Patel
* Henry Wang
* Kohei Tokunaga
* Krisztian Litkey
* LEI WANG
* Mikhail Dmitrichenko
* Nikolaus Schuetz
* Paco Xu
* Philip Laine
* SaloniRathi
* Tianon Gravi
* ayush-panta
* crawfordxx
* cshung
* s3onghyun
* 归寂
* 徐晓伟

### Dependency Changes

* **cyphar.com/go-pathrs**                                                         v0.2.1 -> v0.2.4
* **github.com/Microsoft/hcsshim**                                                 v0.15.0-rc.1 -> v0.15.0-rc.3
* **github.com/ProtonMail/go-crypto**                                              v1.4.1 **_new_**
* **github.com/cilium/ebpf**                                                       v0.16.0 -> v0.17.3
* **github.com/cloudflare/circl**                                                  v1.6.3 **_new_**
* **github.com/containerd/containerd/api**                                         v1.11.0 -> v1.12.0-beta.0
* **github.com/containerd/imgcrypt/v2**                                            v2.0.2 -> v2.0.3
* **github.com/containerd/nri**                                                    v0.12.0 -> v0.12.1
* **github.com/containerd/ttrpc**                                                  v1.2.8 -> v1.2.9
* **github.com/containerd/typeurl/v2**                                             v2.2.3 -> v2.3.0
* **github.com/containers/ocicrypt**                                               v1.2.1 -> v1.3.2
* **github.com/cyphar/filepath-securejoin**                                        v0.6.0 -> v0.6.1
* **github.com/erofs/go-erofs**                                                    v0.3.0 -> v0.3.1
* **github.com/fsnotify/fsnotify**                                                 v1.9.0 -> v1.10.1
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.28.0 -> v2.29.0
* **github.com/intel/goresctrl**                                                   v0.12.0 -> v0.13.0
* **github.com/klauspost/compress**                                                v1.18.5 -> v1.19.1
* **github.com/mdlayher/socket**                                                   v0.5.1 -> v0.6.0
* **github.com/mdlayher/vsock**                                                    v1.2.1 -> v1.3.0
* **github.com/miekg/pkcs11**                                                      v1.1.1 -> v1.1.2
* **github.com/moby/sys/user**                                                     v0.4.0 -> v0.4.1
* **github.com/opencontainers/selinux**                                            v1.13.1 -> v1.15.1
* **github.com/pelletier/go-toml/v2**                                              v2.3.0 -> v2.4.3
* **github.com/prometheus/client_golang**                                          v1.23.2 -> v1.24.0
* **github.com/prometheus/common**                                                 v0.67.5 -> v0.70.0
* **github.com/prometheus/procfs**                                                 v0.19.2 -> v0.21.1
* **github.com/smallstep/pkcs7**                                                   v0.1.1 -> v0.2.1
* **go.etcd.io/bbolt**                                                             v1.4.3 -> v1.5.0
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.68.0 -> v0.69.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.68.0 -> v0.69.0
* **go.opentelemetry.io/otel**                                                     v1.43.0 -> v1.44.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.43.0 -> v1.44.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.43.0 -> v1.44.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.43.0 -> v1.44.0
* **go.opentelemetry.io/otel/metric**                                              v1.43.0 -> v1.44.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.43.0 -> v1.44.0
* **go.opentelemetry.io/otel/trace**                                               v1.43.0 -> v1.44.0
* **go.yaml.in/yaml/v2**                                                           v2.4.3 -> v2.4.4
* **go.yaml.in/yaml/v3**                                                           v3.0.4 **_new_**
* **golang.org/x/crypto**                                                          v0.49.0 -> v0.53.0
* **golang.org/x/mod**                                                             v0.35.0 -> v0.38.0
* **golang.org/x/net**                                                             v0.52.0 -> v0.56.0
* **golang.org/x/oauth2**                                                          v0.35.0 -> v0.36.0
* **golang.org/x/sync**                                                            v0.20.0 -> v0.22.0
* **golang.org/x/sys**                                                             v0.43.0 -> v0.47.0
* **golang.org/x/term**                                                            v0.41.0 -> v0.44.0
* **golang.org/x/text**                                                            v0.35.0 -> v0.38.0
* **google.golang.org/genproto/googleapis/api**                                    9d38bb4040a9 -> 3dc84a4a5aaa
* **google.golang.org/genproto/googleapis/rpc**                                    6f92a3bedf2d -> 3dc84a4a5aaa
* **google.golang.org/grpc**                                                       v1.80.0 -> v1.82.1
* **k8s.io/api**                                                                   v0.36.0 -> v0.36.3
* **k8s.io/apimachinery**                                                          v0.36.0 -> v0.36.3
* **k8s.io/client-go**                                                             v0.36.0 -> v0.36.3
* **k8s.io/component-base**                                                        v0.36.0 -> v0.36.3
* **k8s.io/cri-api**                                                               v0.36.0 -> v0.36.3
* **k8s.io/cri-client**                                                            v0.36.0 -> v0.36.3
* **k8s.io/cri-streaming**                                                         v0.36.0 -> v0.36.3
* **sigs.k8s.io/structured-merge-diff/v6**                                         v6.3.2 -> v6.3.3
* **tags.cncf.io/container-device-interface**                                      v1.1.0 -> 49ac08dcf160

Previous release can be found at [v2.3.0](https://github.com/containerd/containerd/releases/tag/v2.3.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd api/v1.12.0-beta.0

Welcome to the api/v1.12.0-beta.0 release of containerd!
*This is a pre-release of containerd*

The 13th release for the containerd 1.x API aligns with the containerd 2.4 release.

### Highlights

* **Include media type in content create event** ([#13833](#13833))
* **Add parent path to runc checkpoint options** ([#13699](#13699))

#### Deprecations

* **Fix sandbox task API endpoints for non-runc runtimes** ([#13360](#13360))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Maksym Pavlenko
* Derek McGowan
* Jordan Liggitt
* Samuel Karp
* Wei Fu
* Kohei Tokunaga
* Philip Laine
* Sergey Kanzhelev

### Changes
<details><summary>16 commits</summary>
<p>

* Prepare release notes for api/v1.12.0-beta.0 ([#13899](#13899))
  * [`0ff04dc3f`](0ff04dc) Prepare release notes for api/v1.12.0-beta.0
* Include media type in content create event ([#13833](#13833))
  * [`a452c2e23`](a452c2e) Include media type in content create event
* build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api ([#13819](#13819))
  * [`52c5f1f64`](52c5f1f) build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api
* build(deps): bump github.com/containerd/ttrpc to v1.2.9 ([#13740](#13740))
  * [`658a1c78b`](658a1c7) build(deps): bump github.com/containerd/ttrpc to v1.2.9
* Add parent path to runc checkpoint options ([#13699](#13699))
  * [`ea0ed51e2`](ea0ed51) shim: allow specifying runc's --parent-path during checkpointing
* Update typeurl/v2 to v2.3.0 to drop gogo dependency ([#13490](#13490))
  * [`ce3914324`](ce39143) Update typeurl/v2 to v2.3.0 to drop gogo dependency
* do not hide linitng errors ([#13423](#13423))
  * [`7f10e9eb5`](7f10e9e) do not hide linitng errors
* Fix sandbox task API endpoints for non-runc runtimes ([#13360](#13360))
  * [`ac01ae5c2`](ac01ae5) protos: include task API address to CreateTaskRequest
</p>
</details>

### Dependency Changes

* **github.com/containerd/ttrpc**                v1.2.5 -> v1.2.9
* **github.com/containerd/typeurl/v2**           v2.1.1 -> v2.3.0
* **golang.org/x/net**                           v0.48.0 -> v0.55.0
* **golang.org/x/sys**                           v0.39.0 -> v0.46.0
* **golang.org/x/text**                          v0.32.0 -> v0.37.0
* **google.golang.org/genproto/googleapis/rpc**  ff82c1b0f217 -> a57be14db171
* **google.golang.org/grpc**                     v1.79.3 -> v1.81.1
* **google.golang.org/protobuf**                 v1.36.10 -> v1.36.11

Previous release can be found at [api/v1.11.0](https://github.com/containerd/containerd/releases/tag/api/v1.11.0)

containerd 2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

### Highlights

* Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ([#13694](#13694))

#### Container Runtime Interface (CRI)

* Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ([#13697](#13697))
* Reject CreateContainer calls when the target sandbox is not running ([#13668](#13668))
* Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ([#13645](#13645))

#### Image Distribution

* Surface OCI error bodies in registry 403 responses by falling back to GET requests ([#13738](#13738))

#### Snapshotters

* Align default 4K mkfs block size for EROFS across all platforms ([#13632](#13632))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Maksym Pavlenko
* Samuel Karp
* Chris Henzie
* Phil Estes
* Sebastiaan van Stijn
* Akihiro Suda
* Austin Vazquez
* Chris Crone
* Derek McGowan
* Maksim An
* crawfordxx
* cshung
* lauralorenz

### Changes
<details><summary>14 commits</summary>
<p>

* Prepare release notes for v2.3.3 ([#13750](#13750))
  * [`7f6cee02a`](7f6cee0) Prepare release notes for v2.3.3
* CI: migrate Vagrant to Lima ([#13744](#13744))
  * [`7316210ce`](7316210) CI: migrate Vagrant to Lima
* remotes: surface OCI error body in registry 4xx responses ([#13738](#13738))
  * [`457fba3a3`](457fba3) remotes: surface OCI error body on HEAD 403 via GET fallback
* Update go to 1.26.5 ([#13732](#13732))
  * [`dc2df934e`](dc2df93) Update go to 1.26.5
* ci: pin fog-json to resolve gem conflict ([#13711](#13711))
  * [`5be0495df`](5be0495) ci: pin fog-json to resolve gem conflict
* Fix nil pointer dereference in NRI GetIPs ([#13697](#13697))
  * [`36c713971`](36c7139) Fix nil pointer dereference in NRI GetIPs
* Set SystemTemp env var to config temp on Windows ([#13694](#13694))
  * [`26dce170d`](26dce17) Set SystemTemp env var to config temp on Windows
* update runhcs to v0.15.0-rc.3 ([#13693](#13693))
  * [`9bc2c2349`](9bc2c23) update runhcs to v0.15.0-rc.3
* Update to current setup-go version ([#13686](#13686))
  * [`3e97edeb7`](3e97ede) Update to current setup-go version
* cri: reject CreateContainer when sandbox is not running ([#13668](#13668))
  * [`8856b0f9c`](8856b0f) cri: reject CreateContainer when sandbox is not running
* update runhcs to v0.15.0-rc.2 ([#13666](#13666))
  * [`ae796cec5`](ae796ce) update runhcs to v0.15.0-rc.2
* test: fix flaky image timestamp check on coarse clocks ([#13643](#13643))
  * [`168d56783`](168d567) test: fix flaky image timestamp check on coarse clocks
* Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ([#13645](#13645))
  * [`d1db61db8`](d1db61d) Add deferred call to ShutdownSandbox to avoid leaks
* erofs: align default mkfs block size across platforms ([#13632](#13632))
  * [`01b0f03f6`](01b0f03) erofs: align default mkfs block size across platforms
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.3.2](https://github.com/containerd/containerd/releases/tag/v2.3.2)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.