[release/2.3] Prepare release notes for v2.3.2 #13627
Merged
Merged
Conversation
openUserFile now stats the opened file, refuses anything that is not a regular file, and wraps the returned fs.File so reads are capped at maxUserFileBytes (10 MiB). All callers of openUserFile read either etc/passwd or etc/group; both are regular files on real systems, well under the cap. The cap and the regular-file check together bound parser memory use when reading user-database files of unexpected shape or size. Adds tests for the cap and for the non-regular file rejection. The cap test covers three boundary points: a small pad (trailing entry parsed), a pad placing the entry's last byte exactly on the cap (still parsed), and a pad past the cap (read returns an "exceeds" error). Assisted-by: Antigravity Signed-off-by: Chris Henzie <[email protected]> (cherry picked from commit 7b05ec4) Signed-off-by: Chris Henzie <[email protected]>
Google-Bug-Id: 508657842 Signed-off-by: Samuel Karp <[email protected]> (cherry picked from commit 0c0918f) Signed-off-by: Samuel Karp <[email protected]>
Image config labels are copied onto the container by both the CRI plugin (BuildLabels) and the client's WithImageConfigLabels option used by `ctr run`. Labels in the containerd.io/* namespace are interpreted by containerd itself and labels in the io.cri-containerd* namespace are interpreted by the CRI plugin. An image config is not a trusted source for labels in either namespace. Skip labels in both reserved namespaces when copying labels from an image config to a container, and warn about each label skipped: an image that tries to set them may be attempting to alter containerd behavior. Oversized image labels are already skipped this way by the CRI plugin. Labels set explicitly by clients, for example via `ctr run --label` or in the CRI request, are unaffected. Verified with the CRI plugin and with `ctr run` against an image whose config carries labels like these: the labels are no longer present on the created container and a warning is logged for each. Assisted-by: Claude Code Signed-off-by: Ben Cressey <[email protected]> Signed-off-by: Samuel Karp <[email protected]> (cherry picked from commit 0ec1af4) Signed-off-by: Akihiro Suda <[email protected]> Signed-off-by: Samuel Karp <[email protected]>
Filter out any annotations on the checkpointed container matching `cdi.k8s.io/` or exactly `cdi.k8s.io` during restore to prevent unauthorized device restoration. When an annotation is denied, a warning log is generated. Tested by: * Unit tests for exact matching, prefix boundaries, and metadata merging * Complete CRI integration and checkpoint restore suite Assisted-by: Antigravity Signed-off-by: Samuel Karp <[email protected]> (cherry picked from commit 861ffc1) Signed-off-by: Chris Henzie <[email protected]>
The CRI checkpoint restore path unpacked checkpoint archive/OCI image content directly into the container's persistent state directory and read files such as container.log back from it with a symlink-following copy. Checkpoint content is externally provided, so make restore more defensive about what it unpacks and how it reads those files back. Behavior changes: - Only unpack regular files and directories from the checkpoint archive. - Unpack checkpoint content into a dedicated <state>/ctrd-restore subdirectory created fresh rather than into the state dir itself, so checkpoint content cannot collide with containerd's own files (e.g. the "status" blob). Restore and cleanup operate on that subdir; cleanup is now a single RemoveAll of it. Signed-off-by: Brian Goff <[email protected]> (cherry picked from commit 8196411) Signed-off-by: Brian Goff <[email protected]>
Signed-off-by: Samuel Karp <[email protected]>
|
Adding label DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
cpuguy83
approved these changes
Jun 18, 2026
estesp
approved these changes
Jun 18, 2026
github-project-automation
Bot
moved this from Needs Triage
to Review In Progress
in Pull Request Review
chrishenzie
approved these changes
Jun 18, 2026
dmcgowan
approved these changes
Jun 18, 2026
dims
approved these changes
Jun 18, 2026
github-project-automation
Bot
moved this from Review In Progress
to Done
in Pull Request Review
jaredledvina
added a commit
to DataDog/containerd
that referenced
this pull request
Jul 7, 2026
containerd 2.3.2 Welcome to the v2.3.2 release of containerd! The second patch release for containerd 2.3 contains various fixes and updates including security patches. * **containerd** * [**CVE-2026-50195**](GHSA-cvxm-645q-p574) * [**CVE-2026-53488**](GHSA-xhf5-7wjv-pqxp) * [**CVE-2026-53492**](GHSA-33vj-92qq-66hc) * [**CVE-2026-53489**](GHSA-rgh6-rfwx-v388) * [**CVE-2026-47262**](GHSA-jpcc-p29g-p8mq) * Fix a data race when reading shim logs on Windows ([containerd#13522](containerd#13522)) * Allow the last host to retry on transient network errors ([containerd#13591](containerd#13591)) * Fix container startup failures caused by concurrent task RPC timeouts during slow container creation ([containerd#13512](containerd#13512)) Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues. * Samuel Karp * Chris Henzie * Akihiro Suda * Derek McGowan * Akhil Mohan * Austin Vazquez * Ben Cressey * Brian Goff * Maksym Pavlenko * Sebastiaan van Stijn * Sergey Kanzhelev <details><summary>30 commits</summary> <p> * Prepare release notes for v2.3.2 ([containerd#13627](containerd#13627)) * [`fb8ca00b0`](containerd@fb8ca00) Prepare release notes for v2.3.2 * [`9c69960ba`](containerd@9c69960) Merge commit from fork * [`0f6251520`](containerd@0f62515) Merge commit from fork * [`91d7471e2`](containerd@91d7471) cri: filter CDI annotations on checkpoint restore * [`7c2e086bf`](containerd@7c2e086) Merge commit from fork * [`dae67765f`](containerd@dae6776) cri: do not re-tag restored checkpoints * [`94aa1e2c1`](containerd@94aa1e2) Merge commit from fork * [`09599078f`](containerd@0959907) cri: make checkpoint restore robust to unexpected archive content * [`e1fdb8d22`](containerd@e1fdb8d) Merge commit from fork * [`ff1d116ef`](containerd@ff1d116) Bound user-database file reads in openUserFile * [`d156e07cb`](containerd@d156e07) Merge commit from fork * [`f99aad54a`](containerd@f99aad5) Do not propagate reserved labels from image configs * vendor: golang.org/x/crypto v0.53.0 ([containerd#13608](containerd#13608)) * [`0b9469501`](containerd@0b94695) [release/2.3] vendor: golang.org/x/crypto v0.53.0 * resolver: retry on transient network errors ([containerd#13591](containerd#13591)) * [`983bbddc1`](containerd@983bbdd) resolver: retry on transient network errors * update runc binary to v1.4.3 ([containerd#13601](containerd#13601)) * [`3f76f2dc1`](containerd@3f76f2d) update runc binary to v1.4.3 * update go to 1.26.4 ([containerd#13580](containerd#13580)) * [`8a49dfe85`](containerd@8a49dfe) update go to 1.26.4 * [`5aa6bb2b7`](containerd@5aa6bb2) remove 1.26.2 from CI builds as it is not supported any longer due to the dependency * Configure udevd children-max for root-test ([containerd#13568](containerd#13568)) * [`bfb8aebc0`](containerd@bfb8aeb) Configure udevd children-max for root-test * core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read ([containerd#13522](containerd#13522)) * [`62ceafff0`](containerd@62ceaff) core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read * runc-shim: don't hold the service lock across runc create ([containerd#13512](containerd#13512)) * [`9b0c0dc58`](containerd@9b0c0dc) runc-shim: don't hold the service lock across runc create * contrib/checkpoint: increase timeouts to 30s ([containerd#13459](containerd#13459)) * [`f588bc6fb`](containerd@f588bc6) contrib/checkpoint: increase timeouts to 30s </p> </details> * **golang.org/x/crypto** v0.49.0 -> v0.53.0 * **golang.org/x/mod** v0.35.0 -> v0.36.0 * **golang.org/x/net** v0.52.0 -> v0.55.0 * **golang.org/x/sync** v0.20.0 -> v0.21.0 * **golang.org/x/sys** v0.43.0 -> v0.46.0 * **golang.org/x/term** v0.41.0 -> v0.44.0 * **golang.org/x/text** v0.35.0 -> v0.38.0 Previous release can be found at [v2.3.1](https://github.com/containerd/containerd/releases/tag/v2.3.1) * `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04). * `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent. In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases) and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too. See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
containerd 2.3.2
Welcome to the v2.3.2 release of containerd!
The second patch release for containerd 2.3 contains various fixes
and updates including security patches.
Security Updates
Highlights
Image Distribution
Runtime
Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.
Contributors
Changes
29 commits
fb8ca00b0Prepare release notes for v2.3.29c69960baMerge commit from fork0f6251520Merge commit from fork91d7471e2cri: filter CDI annotations on checkpoint restore7c2e086bfMerge commit from forkdae67765fcri: do not re-tag restored checkpoints94aa1e2c1Merge commit from fork09599078fcri: make checkpoint restore robust to unexpected archive contente1fdb8d22Merge commit from forkff1d116efBound user-database file reads in openUserFiled156e07cbMerge commit from forkf99aad54aDo not propagate reserved labels from image configs0b9469501[release/2.3] vendor: golang.org/x/crypto v0.53.0983bbddc1resolver: retry on transient network errors3f76f2dc1update runc binary to v1.4.38a49dfe85update go to 1.26.45aa6bb2b7remove 1.26.2 from CI builds as it is not supported any longer due to the dependencybfb8aebc0Configure udevd children-max for root-test62ceafff0core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read9b0c0dc58runc-shim: don't hold the service lock across runc createf588bc6fbcontrib/checkpoint: increase timeouts to 30sDependency Changes
Previous release can be found at v2.3.1
Which file should I download?
containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.
See also the Getting Started documentation.