containerd 2.3.3

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

### Highlights

* Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services ([containerd#13694](containerd#13694))

#### Container Runtime Interface (CRI)

* Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit ([containerd#13697](containerd#13697))
* Reject CreateContainer calls when the target sandbox is not running ([containerd#13668](containerd#13668))
* Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks ([containerd#13645](containerd#13645))

#### Image Distribution

* Surface OCI error bodies in registry 403 responses by falling back to GET requests ([containerd#13738](containerd#13738))

#### Snapshotters

* Align default 4K mkfs block size for EROFS across all platforms ([containerd#13632](containerd#13632))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Maksym Pavlenko
* Samuel Karp
* Chris Henzie
* Phil Estes
* Sebastiaan van Stijn
* Akihiro Suda
* Austin Vazquez
* Chris Crone
* Derek McGowan
* Maksim An
* crawfordxx
* cshung
* lauralorenz

### Changes
<details><summary>14 commits</summary>
<p>

* Prepare release notes for v2.3.3 ([containerd#13750](containerd#13750))
  * [`7f6cee02a`](containerd@7f6cee0) Prepare release notes for v2.3.3
* CI: migrate Vagrant to Lima ([containerd#13744](containerd#13744))
  * [`7316210ce`](containerd@7316210) CI: migrate Vagrant to Lima
* remotes: surface OCI error body in registry 4xx responses ([containerd#13738](containerd#13738))
  * [`457fba3a3`](containerd@457fba3) remotes: surface OCI error body on HEAD 403 via GET fallback
* Update go to 1.26.5 ([containerd#13732](containerd#13732))
  * [`dc2df934e`](containerd@dc2df93) Update go to 1.26.5
* ci: pin fog-json to resolve gem conflict ([containerd#13711](containerd#13711))
  * [`5be0495df`](containerd@5be0495) ci: pin fog-json to resolve gem conflict
* Fix nil pointer dereference in NRI GetIPs ([containerd#13697](containerd#13697))
  * [`36c713971`](containerd@36c7139) Fix nil pointer dereference in NRI GetIPs
* Set SystemTemp env var to config temp on Windows ([containerd#13694](containerd#13694))
  * [`26dce170d`](containerd@26dce17) Set SystemTemp env var to config temp on Windows
* update runhcs to v0.15.0-rc.3 ([containerd#13693](containerd#13693))
  * [`9bc2c2349`](containerd@9bc2c23) update runhcs to v0.15.0-rc.3
* Update to current setup-go version ([containerd#13686](containerd#13686))
  * [`3e97edeb7`](containerd@3e97ede) Update to current setup-go version
* cri: reject CreateContainer when sandbox is not running ([containerd#13668](containerd#13668))
  * [`8856b0f9c`](containerd@8856b0f) cri: reject CreateContainer when sandbox is not running
* update runhcs to v0.15.0-rc.2 ([containerd#13666](containerd#13666))
  * [`ae796cec5`](containerd@ae796ce) update runhcs to v0.15.0-rc.2
* test: fix flaky image timestamp check on coarse clocks ([containerd#13643](containerd#13643))
  * [`168d56783`](containerd@168d567) test: fix flaky image timestamp check on coarse clocks
* Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks ([containerd#13645](containerd#13645))
  * [`d1db61db8`](containerd@d1db61d) Add deferred call to ShutdownSandbox to avoid leaks
* erofs: align default mkfs block size across platforms ([containerd#13632](containerd#13632))
  * [`01b0f03f6`](containerd@01b0f03) erofs: align default mkfs block size across platforms
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.3.2](https://github.com/containerd/containerd/releases/tag/v2.3.2)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCgAdFiEE8pUpqU46woq5q3zpngYmHxHWwF4FAmpQNhAACgkQngYmHxHW
# wF6y5g/8CsJeg9HDw6SN4T7SgITmkLi0ErP1ybi4WwI8vQn1ZEJ9wAUSjzyx/9w3
# KT5NtrXwM95xuohtqhNmC3o/6Bt5LbcRYXf5xoIP5LvsMKaBtD9RWYyMOiRL54YN
# 4D5QgJkRLspXYUMt3cRgv2cB4uFbzmlbatN9GuH33+BMiFR7Y2/JrvlwCfL7Ah6E
# 2R+9pNr3aNU5zxZ94NKFcGtjMkJ7RxLw7Fe7aYtSxdn1Nb4A9MVrXNAnWYgIfNoN
# U5UhRF7roRW2mEAV5kJOgvDRXXEsc+JQYrGn7Guhqs/cAmfBT/XYv8egUiSZZb5B
# lwnDB0/KX3o+3K1/Y/0y7mNFMaoQbrefDPP9F3QXF1Yk303d9V6bhslXv9qSfgWz
# ci+B53L0LK282wjN9sDp9IIaB6M+N3i4s0avmcBmHPGJZt1HRd+0DZPW0IzWRqea
# Z+3JeOM+C+0MksJrVXuxGn26q4yLSYIZEBTD6oVKxw0uKShkVTdZ5N5QWgY3OdYz
# LtsWA94VZM+AOkmNOUxjJCOtz2EAbRHxFTNUkADz5e8TwnRrTnekxiZMxQQbSb3y
# 80hl839Y3fTWGdL79fpPe/EQ2g7B72GiDpR7B5gwCsoRBxzUSmmPoYhf+oICI1Om
# nGfP7TnVOiJ82pz38rUi/TMTICLX/sgYP1mV/47Ly7pp77/3UxI=
# =Lqxr
# -----END PGP SIGNATURE-----
# gpg: Signature made Thu Jul  9 20:00:16 2026 EDT
# gpg:                using RSA key F29529A94E3AC28AB9AB7CE99E06261F11D6C05E
# gpg: Can't check signature: No public key