Releases · containerd/containerd

Welcome to the v2.3.0-beta.2 release of containerd!
This is a pre-release of containerd

The third minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the third time-based release for containerd.

Starting with containerd 2.3, the project has moved to release cadence aligned with
the Kubernetes release schedule, with new minor releases about every 4 months. The
containerd 2.3 release is also the first annual LTS (Long Term Stable) release under
this new schedule, with support planned for at least two years. Direct upgrades
between sequential LTS releases (e.g., 1.7 to 2.3) will be tested and supported.

This is a beta release and some functionality is still under development.

Highlights

Add transfer types for container filesystem copy (#13165)
Introduce shim bootstrap protocol (#12786)
Add option to inject trace ID to logs (#13117)
Propagate OpenTelemetry traces in outgoing RPCs from plugin clients (#13113)
Update plugin config migration to run on load (#12608)
Detect vendor in cdi specs to generate device IDs for --gpus (#12839)
Update sandbox API to include spec field (#12840)

Container Runtime Interface (CRI)

Allow containers to use user namespaces with host networking (#12518)
Unpack images with per-layer labels for specific runtime (#12835)
Populate ImageId field in container status (#12787)
Set annotations parameter in CreateSandbox request (#12566)

Image Distribution

Support zstd-wrapped EROFS layers (#13185)
Add EROFS layer media type (#12567)

Image Storage

Use fsmount API to avoid PAGE_SIZE limit for erofs (#12783)

Node Resource Interface (NRI)

Pass container user (uid, gids) to plugins (#12769)
Pass seccomp policy to plugins (#12768)
Pass any POSIX rlimits to plugins (#12765)
Pass extended container status to NRI. (#12770)
Pass injected CDI devices to plugins (#12767)
Pass linux sysctl to plugins (#12766)

Runtime

Add configured socket directory to shim bootstrap protocol (#12785)
Fix binary logging driver not blocking container start on failure (#12595)
Use new filtered cgroups stats API (#12901)
Update OOMKilled event handling (#12714)

Snapshotters

Propagate parent chain ID and diff ID via labels during snapshot preparation (#13071)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Derek McGowan
Sebastiaan van Stijn
Krisztian Litkey
Wei Fu
Samuel Karp
Akihiro Suda
Phil Estes
Markus Lehtonen
Mike Brown
Davanum Srinivas
Gao Xiang
ChengyuZhu6
Akhil Mohan
Chris Henzie
Hudson Zhu
Kazuyoshi Kato
Sergey Kanzhelev
ningmingxiao
Aadhar Agarwal
Andrew Halaney
Apurv Barve
HirazawaUi
Michael Zappa
Paweł Gronowski
Brian Goff
Fabiano Fidêncio
Hasan Siddiqui
Jintao Zhang
Paulo Oliveira
Shiv Tyagi
Austin Vazquez
Avinesh Singh
Esteban Ginez
Henry Wang
Jin Dong
Jérôme Poulin
Luke Hinds
Sascha Grunert
majianhan
markdodgson
Adrien Delorme
Albin Kerouanton
Alex Chernyakhovsky
Andrey Noskov
Andrey Smirnov
Annie Cherkaev
Anuj Singh
Champ-Goblem
Chris Adeniyi-Jones
Cindia-blue
CrazyMax
Danny Canter
Evan Lezar
Fletcher Woodruff
Gaurav Ghildiyal
Harsh Rawat
Hayato Kiwata
Joseph Zhang
Justin Chadwell
Kal
Manuel de Brito Fontes
Neeraj Krishna Gopalakrishna
Pierluigi Lenoci
Ricardo Branco
Rob Murray
Rodrigo Campos
Shachar Tal
Shaobao Feng
Shiming Zhang
Tariq Ibrahim
Tim Windelschmidt
Tõnis Tiigi
Wade Simmons
Weixie Cui
Will Jordan
Yohei Yamamoto
You Binhao
Youfu Zhang
apurv15
bo.jiang
chris-henderson-alation
jinda.ljd
qiuxue

Changes

758 commits

Prepare v2.3.0-beta.2 release (#13239)
- 367937295 Update API to use latest beta tag
Parameterize K8s version in node-e2e workflow (#13234)
- 270916ad1 Parameterize K8s version in node-e2e workflow
Add check for status code for GET requests (#12262)
- bf5fe06f8 Use len for stripping http://
- 2e856be03 Check for error status code on response to a get request
Add support for conditional gc references in metadata (#12398)
- 046421ab7 Breakout arguments to sendLabelRefs in gc
- bd02dc1d7 Add support for conditional gc references in metadata
build(deps): bump actions/cache from 5.0.4 to 5.0.5 (#13227)
- 34884e99d build(deps): bump actions/cache from 5.0.4 to 5.0.5
Make shim socket directory use configured directory (#12785)
- e07a1aa49 Add configuration for socket directory to the shim manager
- 59c3464a0 Remove the unnecessary mkdir on the default state directory
- d806373fe Make shim socket directory use configured state
ctr: add EROFS image conversion support (#12555)
- 64a2e62b5 erofs: wire os.features into conversion and selection
- b320d3c85 ctr: add EROFS image conversion support
snapshotter/erofs: avoid using overlay if fsmerge is enabled and no upperdir (#13213)
- 3b357da49 snapshotter/erofs: avoid using overlay if fsmerge is enabled and no upperdir
build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0 (#13225)
- a9acbcaae build(deps): bump softprops/action-gh-release from 2.6.1 to 3.0.0
build(deps): bump github.com/erofs/go-erofs from 0.2.0 to 0.2.1 (#13232)
- a9e958070 build(deps): bump github.com/erofs/go-erofs from 0.2.0 to 0.2.1
build(deps): bump actions/github-script from 8.0.0 to 9.0.0 (#13226)
- 54bb41881 build(deps): bump actions/github-script from 8.0.0 to 9.0.0
build(deps): bump the golang-x group with 2 updates (#13228)
- ef692c986 build(deps): bump the golang-x group with 2 updates
update github.com/moby/spdystream v0.5.1 (#13215)
- d15a46927 update github.com/moby/spdystream v0.5.1
erofs-differ: support zstd-wrapped EROFS layers (#13185)
- b9445fb9e erofs-differ: support zstd-wrapped EROFS layers
core/remotes/docker: use SystemCertPool on Windows ([#13128](https://github.com/conta...

Welcome to the api/v1.11.0-beta.2 release of containerd!
This is a pre-release of containerd

The 12th release for the containerd 1.x API aligns with the containerd 2.3 release.

Highlights

Add transfer types for container filesystem copy (#13165)
Introduce shim bootstrap protocol (#12786)
Update sandbox API to include spec field (#12840)

Runtime

Add configured socket directory to shim bootstrap protocol (#12785)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Derek McGowan
Wei Fu
Akihiro Suda
Gao Xiang
Sebastiaan van Stijn

Changes

43 commits

Make shim socket directory use configured directory (#12785)
- d806373fe Make shim socket directory use configured state
Update bootstrap API log level definition (#13208)
- 2c102c6cb Update bootstrap API log level definition
Add transfer types for container filesystem copy (#13165)
- 121f3a21e Add transfer types for container filesystem copy
Introduce shim bootstrap protocol (#12786)
- 16b7ce254 Address code review suggestions
- 9bf65dcf0 Use enums instead of strings for capabilities and log level
- 9dc864fd0 Switch to proto instead of json
- 3fbdb132b Fix module path
- 1852a4758 Remove testify dependency from api
- 0f55bdd49 Fix extensions API and update tests
- d957b1bf5 Use log level instead of debug flag
- 31d0bbbad Include containerd version when launching shim
- f71c2e421 Reformat and clean proto files
- 9e9a095fe Read spec annotations from file
- 3831fc806 Fix reading from stdin
- 5ea993b48 Pass runc options as a separate extension
- e72145b19 Update vendor
- 790b0ead7 Implement shim bootstrap protocol
Add os.features support for EROFS native container images (#13091)
- 146930e91 api: add os_features to api/types/platform.proto
build(deps): bump google.golang.org/grpc from 1.59.0 to 1.79.3 in /api (#13099)
- d323efc2b build(deps): bump google.golang.org/grpc from 1.59.0 to 1.79.3 in /api
Prepare release notes for api/v1.11.0-beta.0 (#13045)
- aac6b5348 Prepare release notes for api/v1.11.0-beta.0
api: regenerate and re-vendor protos (#12913)
- 4b4eb6715 api: regenerate and re-vendor protos
Remove Container field from sandbox metadata (#12840)
- 8ccf18724 Update sandbox API to include spec field
Use buf to format proto files (#12841)
- ca1c5b2d3 Reformat and revendor proto files
- 2a87c9d7d Add .editorconfig for proto files
Generate api/next.txtpb and name module (#12815)
- 472e0a8e7 Generate next.txtpb to replace next.pb.txt
- f58dbbda0 Add buf.build repository name for publishing API
Migrate from protobuild to buf (#12762)
- dac9721fa Drop outdated pb.txt files
- 6a6283193 Update pb files
- 57782b717 Move buf configuration under api/
- 39991b661 Use relative import intead of GOPATH style imports
- eb586b5ef Regenerate proto files

Dependency Changes

golang.org/x/net v0.38.0 -> v0.48.0
golang.org/x/sys v0.31.0 -> v0.39.0
golang.org/x/text v0.23.0 -> v0.32.0
google.golang.org/genproto/googleapis/rpc c3f982113cda -> ff82c1b0f217
google.golang.org/grpc v1.59.0 -> v1.79.3
google.golang.org/protobuf v1.33.0 -> v1.36.10

Previous release can be found at api/v1.10.0

Welcome to the v2.2.3 release of containerd!

The third patch release for containerd 2.2 contains various fixes
and updates including a security patch.

Security Updates

spdystream
- CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

Preserve cgroup mount options for privileged containers (#13120)
Ensure UpdatePodSandbox returns Unimplemented instead of a generic error (#13023)

Go client

Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 (#13015)

Image Distribution

Enable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) (#13198)
Apply hardening to prevent TOCTOU race during tar extraction (#12971)

Runtime

Restore support for client-mounted roots in Windows containers using process isolation (#13195)
Update runc to v1.3.5 (#13061)
Apply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems (#13019)
Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 (#13015)

Snapshotters

Fix bug that caused whiteouts to be ignored when parallel unpack was used (#13125)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Samuel Karp
Sebastiaan van Stijn
Maksym Pavlenko
Chris Henzie
Derek McGowan
Paulo Oliveira
Henry Wang
Phil Estes
Wei Fu
Akihiro Suda
Gao Xiang
Ricardo Branco
Shachar Tal

Changes

40 commits

Prepare release notes for v2.2.3 (#13224)
- 8a0f4ed5d Prepare release notes for v2.2.3
update github.com/moby/spdystream v0.5.1 (#13217)
- 31bd34a06 update github.com/moby/spdystream v0.5.1
vendor: github.com/klauspost/compress v1.18.5 (#13197)
- 1336f6c45 vendor: github.com/klauspost/compress v1.18.5
diff/walking: enable mount manager (#13198)
- 409f75be8 diff/walking: enable mount manager
update runhcs to v0.14.1 (#13195)
- 3f33146c1 update runhcs to v0.14.1
vendor: github.com/Microsoft/hcsshim v0.14.1 (#13196)
- 8bd1b74e5 vendor: github.com/Microsoft/hcsshim v0.14.1
- c6b0be8e1 vendor: github.com/Microsoft/hcsshim v0.14.0
update to Go 1.25.9, 1.26.2 (#13190)
- 2ecde8cfe update to Go 1.25.9, 1.26.2
Skip TestExportAndImportMultiLayer on s390x (#13154)
- be554f478 Skip TestExportAndImportMultiLayer on s390x
Tweak mount info for overlayfs in case of parallel unpack (#13125)
- 660de195b Tweak mount info for overlayfs in case of parallel unpack
- bc9274a4b Add integration test for issue 13030
Preserve cgroup mount options for privileged containers (#13120)
- c387890b5 Add integration test for privileged container cgroup mounts
- 047a335a6 Forward RUNC_FLAVOR env var down to integration tests
- 9b2d72ee0 Preserve host cgroup mount options for privileged containers
- 5b66cd6a0 Move cgroup namespace placement higher in spec builder
update runc binary to v1.3.5 (#13061)
- 584205c2f [release/2.2] update runc binary to v1.3.5
Fix vagrant on CI (#13066)
- 77c6886df Ignore NOCHANGE error
Fix TOCTOU race bug in tar extraction (#12971)
- fbed68b8f Fix TOCTOU race bug in tar extraction
cri: UpdatePodSandbox should return Unimplemented (#13023)
- a83510103 cri: UpdatePodSandbox should return Unimplemented
fix(oci): apply absolute symlink resolution to /etc/group (#13019)
- ee4179e52 fix(oci): apply absolute symlink resolution to /etc/group
fix(oci): handle absolute symlinks in rootfs user lookup (#13015)
- fd061b848 test(oci): use fstest and mock fs for better symlink coverage
- 5d44d2c22 fix(oci): handle absolute symlinks in rootfs user lookup
update to go1.25.8, test go1.26.1 (#13011)
- 00c776f07 update to go1.25.8, test go1.26.1

Dependency Changes

github.com/Microsoft/hcsshim v0.14.0-rc.1 -> v0.14.1
github.com/klauspost/compress v1.18.1 -> v1.18.5
github.com/moby/spdystream v0.5.0 -> v0.5.1

Previous release can be found at v2.2.2

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v2.1.7 release of containerd!

The seventh patch release for containerd 2.1 contains various fixes
and updates including a security patch.

Security Updates

spdystream
- CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

Preserve host cgroup mount options for privileged containers (#13119)
Fix image volumes when using user namespaces in CRI (#12894)
Fix issue where CNI DEL was never executed after a restart (#12930)
Hardening: sanitize errors before returning via gRPC to prevent possible credential leaks in pod events (#12803)
Enable options for pulling encrypted images in CRI (#12713)

Image Distribution

Fix possible panic from WithMediaTypeKeyPrefix (#13135)

Runtime

Update runc binary to v1.3.5 (#13060)
Hardening: fix possible TOCTOU race bug in tar extraction (#12969)
Fix unintended dropping of mount flags for read-only bind-mounts in user namespaces (#12943)
Explicitly set AppArmor ABI to 3.0 (#12898)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

yashsingh74
Samuel Karp
Maksym Pavlenko
Phil Estes
Wei Fu
Akhil Mohan
Chris Henzie
Sebastiaan van Stijn
Akihiro Suda
Rodrigo Campos
user.email
Aadhar Agarwal
Alex Chernyakhovsky
Chris Adeniyi-Jones
Derek McGowan
Justin Alvarez
Michael Zappa
Ricardo Branco
Shachar Tal
Tõnis Tiigi
ningmingxiao

Changes

67 commits

Prepare release notes for v2.1.7 (#13223)
- 3a06b6847 Prepare release notes for v2.1.7
update github.com/moby/spdystream v0.5.1 (#13218)
- 82910b8c1 update github.com/moby/spdystream v0.5.1
update to Go 1.25.9, 1.26.2 (#13189)
- 295bdbbff update to Go 1.25.9, 1.26.2
Skip TestExportAndImportMultiLayer on s390x (#13153)
- 8d0c87494 Skip TestExportAndImportMultiLayer on s390x
Fix possible panic from WithMediaTypeKeyPrefix (#13135)
- fe316cc1f remotes: fix possible panic from WithMediaTypeKeyPrefix
Preserve cgroup mount options for privileged containers (#13119)
- c5ee417ab Add integration test for privileged container cgroup mounts
- a5d5a70ed Forward RUNC_FLAVOR env var down to integration tests
- 515c7f98d Preserve host cgroup mount options for privileged containers
- ffd9b61c9 Move cgroup namespace placement higher in spec builder
update runc binary to v1.3.5 (#13060)
- 2f025ff8e [release/2.1] update runc binary to v1.3.5
Fix vagrant on CI (#13065)
- f198b7f87 Ignore NOCHANGE error
Fix TOCTOU race bug in tar extraction (#12969)
- aecfb3dc6 Fix TOCTOU race bug in tar extraction
update to go1.25.8, test go1.26.1 (#13013)
- b71360b59 update to go1.25.8, test go1.26.1
- ec7320b8b update golangci-lint to v2.9.0 with go1.26 support
- 01606226e remove windows/arm from cross build
- e082c2e05 ci: build/test go1.26.0
update golangci-lint to v2.1.5 (#13012)
- f9528d2d9 build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.2.0
- de0d60a17 build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0
- 1b240d0e0 build(deps): bump golangci/golangci-lint-action from 6.5.2 to 8.0.0
- 67ec314fa ci: bump golangci from 6.5.2 to 7.0.0
- 7fe19a6b2 Disable ST1003: struct field Uid should be UID (staticcheck)
- 88470c519 Disable QF1003: could use tagged switch on base (staticcheck)
- 1ea353741 fix: Used nolint to ignore the static checks
- f6ddff11b fix: ST1001: should not use dot imports (staticcheck)
- 4ed50edce fix: ST1019: removed the duplicate imports
- 808c623d1 fix: QF1012: Use of fmt.Fprintln(...)
- e98bc32cd fix: QF1001: could apply De Morgan's law (staticcheck)
- cebb3583e fix: ST1005: error strings should not end with punctuation or newlines
- 1852b5d07 fix: QF1004: strings.ReplaceAll instead (staticcheck)
- 9b0b270cd fix: QF1002: could use tagged switch on host (staticcheck)
cri: Fix image volumes with user namespaces (#12894)
- 8d5351929 cri: Fix image volumes with user namespaces
ci: modprobe xt_comment on almalinux (#12958)
- 37a98b239 ci: modprobe xt_comment on almalinux
core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values (#12943)
- 74e575ce8 core/mount: add test for getUnprivilegedMountFlags
- c62466642 core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
Fix CNI issue where CNI DEL is never executed (#12930)
- 9710aed4a fix issue where cni del is never executed
apparmor: explicitly set abi/3.0 (#12898)
- 735fcb316 apparmor: explicitly set abi/3.0
integration: Fix TestImageLoad() failure on CI (#12907)
- 51a63212f integration: Fix TestImageLoad() failure on CI
update to go1.24.13, go1.25.7 (#12872)
- e13f28dbd update to go1.24.13, go1.25.7
  ...

Welcome to the v2.0.8 release of containerd!

The eighth patch release for containerd 2.0 includes various bug fixes and updates, including a security fix.

Security Updates

spdystream
- CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

Sanitize error before gRPC return to prevent possible credential leak in pod events (#13181)
Fix CNI issue where DEL is never executed after a restart (#13179)

Runtime

Update selinux to v1.13.1 (#13193)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Samuel Karp
Michael Zappa
Akhil Mohan
Laura Lorenz
Phil Estes
Aadhar Agarwal
Andrey Noskov
Chris Henzie
Davanum Srinivas
Maksym Pavlenko
Rodrigo Campos
Sebastiaan van Stijn
ningmingxiao
yashsingh74

Changes

32 commits

Prepare release notes for v2.0.8 (missed line) (#13235)
- c07b94f19 Prepare release notes for v2.0.8 (missed line)
Prepare release notes for v2.0.8 (#13222)
- c54b69f1a Prepare release notes for v2.0.8
update github.com/moby/spdystream v0.5.1 (#13219)
- fde1480df update github.com/moby/spdystream v0.5.1
update to Go 1.25.9, 1.26.2 (#13199)
- 5b2eee8a2 update to Go 1.25.9, 1.26.2
- c579db16e update golangci-lint to v2.9.0 with go1.26 support
- 185ddcfd0 remove windows/arm from cross build
- 8538158df Ignore warnings for golangci-lint bump
- 1cff32695 ci: bump golangci from 6.5.2 to 7.0.0
Updating selinux to v1.13.1 (#13193)
- 2e02b8bb3 Skip github.com/cyphar/filepath-securejoin license checks
- e71fc560b Updating selinux to v1.13.1
fix: sanitize error before gRPC return to prevent credential leak in pod events (#13181)
- 868869eb9 fix: sanitize error before gRPC return to prevent credential leak in pod events
- 40632e4f2 fix: redact all query parameters in CRI error logs
CODEOWNERS: mark Sam and Chris as owners for 2.0 (#13174)
- 85c3b2b02 CODEOWNERS: mark Sam and Chris as owners for 2.0
Update github.com/moby/spdystream v0.4.0->v0.5.0 (#13182)
- 902d804c9 Update github.com/moby/spdystream v0.4.0->v0.5.0
Fix CNI issue where CNI DEL is never executed (#13179)
- e92d7b131 make linter happy in release
- 12fc0e6ca add integration test for cni result nil
- 8d912c6a2 address comment
- 742f8b8f6 fix issue where cni del is never executed
Cherry-picks to fix CI (#13175)
- f24653597 Ignore NOCHANGE error
- 9c656fab4 ci: update CIFuzz actions to support Ubuntu 24.04
- c71c4a091 integration: Fix TestImageLoad() failure on CI
- bfee29999 ci: modprobe xt_comment on almalinux

Dependency Changes

github.com/cyphar/filepath-securejoin v0.5.1 new
github.com/moby/spdystream v0.4.0 -> v0.5.1
github.com/opencontainers/selinux v1.11.1 -> v1.13.1

Previous release can be found at v2.0.7

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

Welcome to the v1.7.31 release of containerd!

The thirty-first patch release for containerd 1.7 contains various fixes
and updates including a security patch.

Security Updates

spdystream
- CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

Fix CNI issue where DEL is never executed after a restart (#12931)
Sanitize error before gRPC return to prevent possible credential leak in pod events (#12805)
Improve error message and add warning when concurrent container creation is detected (#12744)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Samuel Karp
Maksym Pavlenko
Akhil Mohan
Phil Estes
Sebastiaan van Stijn
Wei Fu
Akihiro Suda
Alex Chernyakhovsky
Chris Henzie
Michael Zappa
Ricardo Branco
Shachar Tal
ningmingxiao
yashsingh74

Changes

37 commits

Prepare release notes for v1.7.31 (#13221)
- 7d2662653 Prepare release notes for v1.7.31
update github.com/moby/spdystream v0.5.1 (#13220)
- 3f795c02a update github.com/moby/spdystream v0.5.1
update to Go 1.25.9, 1.26.2 (#13200)
- 7b1e1b17b update to Go 1.25.9, 1.26.2
- b673f2d42 update golangci-lint to v2.9.0 with go1.26 support
- d88d8513a remove windows/arm from cross build
- a763407b5 Ignore warnings for golangci-lint bump
- 03dcd8360 ci: bump golangci from 6.5.2 to 7.0.0
Update github.com/moby/spdystream v0.2.0->v0.5.0 (#13176)
- c08711218 Update github.com/moby/spdystream v0.2.0->v0.5.0
Skip TestExportAndImportMultiLayer on s390x (#13152)
- 043548f6d Skip TestExportAndImportMultiLayer on s390x
update runc binary to v1.3.5 (#13059)
- e99bd6050 [release/1.7] update runc binary to v1.3.5
CODEOWNERS: mark Sam and Chris as owners for 1.7 (#13069)
- 3a3103aaf CODEOWNERS: mark Sam and Chris as owners for 1.7
Fix vagrant on CI (#13064)
- 9b4cfa271 Ignore NOCHANGE error
ci: modprobe xt_comment on almalinux (#12959)
- 53e9e73f0 ci: modprobe xt_comment on almalinux
Fix TOCTOU race bug in tar extraction (#12970)
- 61c2733fd Fix TOCTOU race bug in tar extraction
Fix CNI issue where CNI DEL is never executed (#12931)
- f854c1890 fix issue where cni del is never executed
apparmor: explicitly set abi/3.0 (#12899)
- 5c091d92e apparmor: explicitly set abi/3.0
backport: integration: Fix TestImageLoad() failure on CI (#12908)
- 177ac10fe integration: Fix TestImageLoad() failure on CI
update to go1.24.13, go1.25.7 (#12873)
- 56da43d0f update to go1.24.13, go1.25.7
- 5cb3cb9ba ci: bump go 1.24.12, 1.25.6
fix: sanitize error before gRPC return to prevent credential leak in pod events (#12805)
- b1fa03843 fix: sanitize error before gRPC return to prevent credential leak in pod events
cri: emit warning for concurrent CreateContainer (#12744)
- e2c93a42c cri: emit warning for concurrent CreateContainer

Dependency Changes

github.com/moby/spdystream v0.2.0 -> v0.5.1

Previous release can be found at v1.7.30

Welcome to the v2.3.0-beta.1 release of containerd!
This is a pre-release of containerd

The third minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the third time-based release for containerd.

Starting with containerd 2.3, the project has moved to release cadence aligned with
the Kubernetes release schedule, with new minor releases about every 4 months. The
containerd 2.3 release is also the first annual LTS (Long Term Stable) release under
this new schedule, with support planned for at least two years. Direct upgrades
between sequential LTS releases (e.g., 1.7 to 2.3) will be tested and supported.

This is a beta release and some functionality is still under development.

Highlights

Add transfer types for container filesystem copy (#13165)
Introduce shim bootstrap protocol (#12786)
tracing: add option to inject trace ID into logrus fields (#13117)
Propagate OpenTelemetry traces in outgoing RPCs from plugin clients (#13113)
Update plugin config migration to run on load (#12608)
Detect vendor in cdi specs to generate device IDs for --gpus (#12839)
Update sandbox API to include spec field (#12840)

Container Runtime Interface (CRI)

feat: Allow containers to use both host network and user namespace (#12518)
Unpack images with per-layer labels for specific runtime (#12835)
Populate ImageId field in container status (#12787)
Set annotations parameter in CreateSandbox request (#12566)

Image Distribution

Add EROFS layer media type (#12567)

Image Storage

Use fsmount API to avoid PAGE_SIZE limit for erofs (#12783)

Node Resource Interface (NRI)

Pass container user (uid, gids) to plugins (#12769)
Pass seccomp policy to plugins (#12768)
Pass any POSIX rlimits to plugins (#12765)
Pass extended container status to NRI. (#12770)
Pass injected CDI devices to plugins (#12767)
Pass linux sysctl to plugins (#12766)

Runtime

Fix binary logging driver not blocking container start on failure (#12595)
Use new filtered cgroups stats API (#12901)
Update OOMKilled event handling (#12714)

Snapshotters

Propagate parent chain ID and diff ID via labels during snapshot preparation (#13071)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Sebastiaan van Stijn
Derek McGowan
Krisztian Litkey
Wei Fu
Phil Estes
Akihiro Suda
Samuel Karp
Markus Lehtonen
Mike Brown
Davanum Srinivas
Akhil Mohan
Gao Xiang
ChengyuZhu6
Hudson Zhu
Kazuyoshi Kato
Chris Henzie
Sergey Kanzhelev
ningmingxiao
Aadhar Agarwal
Andrew Halaney
HirazawaUi
Michael Zappa
Paweł Gronowski
Apurv Barve
Brian Goff
Fabiano Fidêncio
Hasan Siddiqui
Jintao Zhang
Paulo Oliveira
Shiv Tyagi
Austin Vazquez
Avinesh Singh
Esteban Ginez
Henry Wang
Jin Dong
Jérôme Poulin
Luke Hinds
Sascha Grunert
majianhan
Adrien Delorme
Albin Kerouanton
Alex Chernyakhovsky
Andrey Noskov
Andrey Smirnov
Annie Cherkaev
Anuj Singh
Champ-Goblem
Chris Adeniyi-Jones
Cindia-blue
CrazyMax
Danny Canter
Evan Lezar
Fletcher Woodruff
Gaurav Ghildiyal
Harsh Rawat
Hayato Kiwata
Joseph Zhang
Justin Chadwell
Kal
Manuel de Brito Fontes
Neeraj Krishna Gopalakrishna
Pierluigi Lenoci
Ricardo Branco
Rob Murray
Rodrigo Campos
Shachar Tal
Shaobao Feng
Shiming Zhang
Tariq Ibrahim
Tim Windelschmidt
Tõnis Tiigi
Wade Simmons
Weixie Cui
Will Jordan
Yohei Yamamoto
You Binhao
Youfu Zhang
bo.jiang
chris-henderson-alation
jinda.ljd
qiuxue

Dependency Changes

cyphar.com/go-pathrs v0.2.1 new
github.com/Microsoft/go-winio v0.6.2 -> ad3df93bed29
github.com/Microsoft/hcsshim v0.14.0-rc.1 -> v0.15.0-rc.1
github.com/cenkalti/backoff/v5 v5.0.3 new
github.com/checkpoint-restore/checkpointctl v1.4.0 -> v1.5.0
github.com/containerd/cgroups/v3 v3.1.0 -> v3.1.3
github.com/containerd/containerd/api v1.10.0 -> v1.11.0-beta.1
github.com/containerd/go-dmverity e097b6cc4a33 new
github.com/containerd/imgcrypt/v2 v2.0.1 -> v2.0.2
github.com/containerd/nri v0.10.0 -> v0.11.0
github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
github.com/containerd/ttrpc v1.2.7 -> v1.2.8
github.com/containerd/zfs/v2 v2.0.0-rc.0 -> v2.0.0
github.com/containernetworking/plugins v1.8.0 -> v1.9.1
github.com/coreos/go-systemd/v22 v22.6.0 -> v22.7.0
github.com/cyphar/filepath-securejoin v0.6.0 new
github.com/davecgh/go-spew v1.1.1 -> d8f796af33cc
github.com/erofs/go-erofs v0.2.0 new
github.com/go-jose/go-jose/v4 v4.1.2 -> v4.1.3
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 -> v2.28.0
github.com/intel/goresctrl v0.10.0 -> v0.12.0
github.com/klauspost/compress v1.18.1 -> v1.18.5
github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
github.com/opencontainers/runtime-tools 0ea5ed0382a2 -> edf4cb3d2116
github.com/opencontainers/selinux v1.12.0 -> v1.13.1
github.com/pelletier/go-toml/v2 v2.2.4 -> v2.3.0
github.com/pmezard/go-difflib v1.0.0 -> 5d4384ee4fb2
github.com/prometheus/procfs v0.16.1 -> v0.17.0
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
github.com/tetratelabs/wazero v1.9.0 -> v1.10.1
go.opentelemetry.io/auto/sdk v1.1.0 -> v1.2.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 -> v0.67.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 -> v0.67.0
go.opentelemetry.io/otel v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 -> v1.43.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 -> v1.43.0
go.opentelemetry.io/otel/metric v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/sdk v1.37.0 -> v1.43.0
go.opentelemetry.io/otel/trace v1.37.0 -> v1.43.0
go.opentelemetry.io/proto/otlp v1.5.0 -> v1.10.0
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
golang.org/x/crypto v0.41.0 -> v0.49.0
golang.org/x/mod v0.29.0 -> v0.34.0
golang.org/x/net v0.43.0 -> v0.52.0
golang.org/x/oauth2 v0.30.0 -> v0.35.0
golang.org/x/sync v0.17.0 -> v0.20.0
golang.org/x/sys v0.37.0 -> v0.42.0
golang.org/x/term v0.34.0 -> v0.41.0
**gola...

Welcome to the api/v1.11.0-beta.1 release of containerd!
This is a pre-release of containerd

The 12th release for the containerd 1.x API aligns with the containerd 2.3 release.

Highlights

Add transfer types for container filesystem copy (#13165)
Introduce shim bootstrap protocol (#12786)
Update sandbox API to include spec field (#12840)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Derek McGowan
Wei Fu
Gao Xiang
Sebastiaan van Stijn

Changes

41 commits

Update bootstrap API log level definition (#13208)
- 2c102c6cb Update bootstrap API log level definition
Add transfer types for container filesystem copy (#13165)
- 121f3a21e Add transfer types for container filesystem copy
Introduce shim bootstrap protocol (#12786)
- 16b7ce254 Address code review suggestions
- 9bf65dcf0 Use enums instead of strings for capabilities and log level
- 9dc864fd0 Switch to proto instead of json
- 3fbdb132b Fix module path
- 1852a4758 Remove testify dependency from api
- 0f55bdd49 Fix extensions API and update tests
- d957b1bf5 Use log level instead of debug flag
- 31d0bbbad Include containerd version when launching shim
- f71c2e421 Reformat and clean proto files
- 9e9a095fe Read spec annotations from file
- 3831fc806 Fix reading from stdin
- 5ea993b48 Pass runc options as a separate extension
- e72145b19 Update vendor
- 790b0ead7 Implement shim bootstrap protocol
Add os.features support for EROFS native container images (#13091)
- 146930e91 api: add os_features to api/types/platform.proto
build(deps): bump google.golang.org/grpc from 1.59.0 to 1.79.3 in /api (#13099)
- d323efc2b build(deps): bump google.golang.org/grpc from 1.59.0 to 1.79.3 in /api
Prepare release notes for api/v1.11.0-beta.0 (#13045)
- aac6b5348 Prepare release notes for api/v1.11.0-beta.0
api: regenerate and re-vendor protos (#12913)
- 4b4eb6715 api: regenerate and re-vendor protos
Remove Container field from sandbox metadata (#12840)
- 8ccf18724 Update sandbox API to include spec field
Use buf to format proto files (#12841)
- ca1c5b2d3 Reformat and revendor proto files
- 2a87c9d7d Add .editorconfig for proto files
Generate api/next.txtpb and name module (#12815)
- 472e0a8e7 Generate next.txtpb to replace next.pb.txt
- f58dbbda0 Add buf.build repository name for publishing API
Migrate from protobuild to buf (#12762)
- dac9721fa Drop outdated pb.txt files
- 6a6283193 Update pb files
- 57782b717 Move buf configuration under api/
- 39991b661 Use relative import intead of GOPATH style imports
- eb586b5ef Regenerate proto files

Dependency Changes

golang.org/x/net v0.38.0 -> v0.48.0
golang.org/x/sys v0.31.0 -> v0.39.0
golang.org/x/text v0.23.0 -> v0.32.0
google.golang.org/genproto/googleapis/rpc c3f982113cda -> ff82c1b0f217
google.golang.org/grpc v1.59.0 -> v1.79.3
google.golang.org/protobuf v1.33.0 -> v1.36.10

Previous release can be found at api/v1.10.0

Welcome to the v2.3.0-beta.0 release of containerd!
This is a pre-release of containerd

The third minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the third time-based release for containerd.

Starting with containerd 2.3, the project has moved to release cadence aligned with
the Kubernetes release schedule, with new minor releases about every 4 months. The
containerd 2.3 release is also the first annual LTS (Long Term Stable) release under
this new schedule, with support planned for at least two years. Direct upgrades
between sequential LTS releases (e.g., 1.7 to 2.3) will be tested and supported.

This is a beta release and some functionality is still under development.

Highlights

Update plugin config migration to run on load (#12608)
Detect vendor in cdi specs to generate device IDs for --gpus (#12839)
Update sandbox API to include spec field (#12840)

Container Runtime Interface (CRI)

Unpack images with per-layer labels for specific runtime (#12835)
Populate ImageId field in container status (#12787)
Set annotations parameter in CreateSandbox request (#12566)

Image Distribution

Add EROFS layer media type (#12567)

Image Storage

Use fsmount API to avoid PAGE_SIZE limit for erofs (#12783)

Node Resource Interface (NRI)

Pass container user (uid, gids) to plugins (#12769)
Pass seccomp policy to plugins (#12768)
Pass any POSIX rlimits to plugins (#12765)
Pass extended container status to NRI. (#12770)
Pass injected CDI devices to plugins (#12767)
Pass linux sysctl to plugins (#12766)

Runtime

Use new filtered cgroups stats API (#12901)
Update OOMKilled event handling (#12714)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Sebastiaan van Stijn
Krisztian Litkey
Wei Fu
Derek McGowan
Phil Estes
Akihiro Suda
Markus Lehtonen
Mike Brown
Samuel Karp
Akhil Mohan
Davanum Srinivas
Kazuyoshi Kato
ningmingxiao
Aadhar Agarwal
Andrew Halaney
Gao Xiang
Michael Zappa
Paweł Gronowski
Fabiano Fidêncio
Paulo Oliveira
Shiv Tyagi
Austin Vazquez
Avinesh Singh
ChengyuZhu6
Chris Henzie
Jin Dong
Jérôme Poulin
Luke Hinds
Sascha Grunert
majianhan
Adrien Delorme
Albin Kerouanton
Alex Chernyakhovsky
Andrey Noskov
Anuj Singh
Apurv Barve
Brian Goff
Champ-Goblem
Chris Adeniyi-Jones
Cindia-blue
CrazyMax
Danny Canter
Evan Lezar
Gaurav Ghildiyal
Harsh Rawat
Hayato Kiwata
Kal
Manuel de Brito Fontes
Neeraj Krishna Gopalakrishna
Rodrigo Campos
Shachar Tal
Shaobao Feng
Shiming Zhang
Tariq Ibrahim
Tim Windelschmidt
Tõnis Tiigi
Wade Simmons
Yohei Yamamoto
You Binhao
Youfu Zhang
bo.jiang
chris-henderson-alation
jinda.ljd
qiuxue

Dependency Changes

cyphar.com/go-pathrs v0.2.1 new
github.com/cenkalti/backoff/v5 v5.0.3 new
github.com/checkpoint-restore/checkpointctl v1.4.0 -> v1.5.0
github.com/containerd/cgroups/v3 v3.1.0 -> v3.1.3
github.com/containerd/containerd/api v1.10.0 -> v1.11.0-beta.0
github.com/containerd/imgcrypt/v2 v2.0.1 -> v2.0.2
github.com/containerd/nri v0.10.0 -> v0.11.0
github.com/containerd/ttrpc v1.2.7 -> v1.2.8
github.com/containerd/zfs/v2 v2.0.0-rc.0 -> v2.0.0
github.com/containernetworking/plugins v1.8.0 -> v1.9.1
github.com/coreos/go-systemd/v22 v22.6.0 -> v22.7.0
github.com/cyphar/filepath-securejoin v0.6.0 new
github.com/go-jose/go-jose/v4 v4.1.2 -> v4.1.3
github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.1 -> v2.28.0
github.com/intel/goresctrl v0.10.0 -> v0.12.0
github.com/klauspost/compress v1.18.1 -> v1.18.4
github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
github.com/opencontainers/runtime-tools 0ea5ed0382a2 -> edf4cb3d2116
github.com/opencontainers/selinux v1.12.0 -> v1.13.1
github.com/pmezard/go-difflib v1.0.0 -> 5d4384ee4fb2
github.com/prometheus/procfs v0.16.1 -> v0.17.0
github.com/sirupsen/logrus v1.9.3 -> v1.9.4
github.com/tetratelabs/wazero v1.9.0 -> v1.10.1
go.opentelemetry.io/auto/sdk v1.1.0 -> v1.2.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 -> v0.64.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 -> v0.64.0
go.opentelemetry.io/otel v1.37.0 -> v1.42.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 -> v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 -> v1.39.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 -> v1.39.0
go.opentelemetry.io/otel/metric v1.37.0 -> v1.42.0
go.opentelemetry.io/otel/sdk v1.37.0 -> v1.42.0
go.opentelemetry.io/otel/trace v1.37.0 -> v1.42.0
go.opentelemetry.io/proto/otlp v1.5.0 -> v1.9.0
go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
golang.org/x/crypto v0.41.0 -> v0.48.0
golang.org/x/mod v0.29.0 -> v0.34.0
golang.org/x/net v0.43.0 -> v0.51.0
golang.org/x/oauth2 v0.30.0 -> v0.35.0
golang.org/x/sync v0.17.0 -> v0.20.0
golang.org/x/sys v0.37.0 -> v0.42.0
golang.org/x/term v0.34.0 -> v0.40.0
golang.org/x/text v0.28.0 -> v0.34.0
golang.org/x/time v0.14.0 -> v0.15.0
google.golang.org/genproto/googleapis/api a7a43d27e69b -> 4cfbd4190f57
google.golang.org/genproto/googleapis/rpc a7a43d27e69b -> 4cfbd4190f57
google.golang.org/grpc v1.76.0 -> v1.79.2
google.golang.org/protobuf v1.36.10 -> v1.36.11
k8s.io/api v0.34.1 -> v0.35.2
k8s.io/apimachinery v0.34.1 -> v0.35.2
k8s.io/client-go v0.34.1 -> v0.35.2
k8s.io/cri-api v0.34.1 -> v0.35.2
k8s.io/klog/v2 v2.130.1 -> v2.140.0
k8s.io/kube-openapi 589584f1c912 new
k8s.io/utils 4c0f3b243397 -> bc988d571ff4
sigs.k8s.io/json cfa47c3a1cc8 -> 2d320260d730
tags.cncf.io/container-device-interface v1.0.1 -> v1.1.0
tags.cncf.io/container-device-interface/specs-go v1.0.0 -> v1.1.0

Previous release can be found at v2.2.0

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (U...

Welcome to the api/v1.11.0-beta.0 release of containerd!
This is a pre-release of containerd

The 12th release for the containerd 1.x API aligns with the containerd 2.3 release.

Highlights

Update sandbox API to include spec field (#12840)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

Maksym Pavlenko
Derek McGowan
Sebastiaan van Stijn
Wei Fu

Changes

18 commits

Prepare release notes for api/v1.11.0-beta.0 (#13045)
- aac6b5348 Prepare release notes for api/v1.11.0-beta.0
api: regenerate and re-vendor protos (#12913)
- 4b4eb6715 api: regenerate and re-vendor protos
Remove Container field from sandbox metadata (#12840)
- 8ccf18724 Update sandbox API to include spec field
Use buf to format proto files (#12841)
- ca1c5b2d3 Reformat and revendor proto files
- 2a87c9d7d Add .editorconfig for proto files
Generate api/next.txtpb and name module (#12815)
- 472e0a8e7 Generate next.txtpb to replace next.pb.txt
- f58dbbda0 Add buf.build repository name for publishing API
Migrate from protobuild to buf (#12762)
- dac9721fa Drop outdated pb.txt files
- 6a6283193 Update pb files
- 57782b717 Move buf configuration under api/
- 39991b661 Use relative import intead of GOPATH style imports
- eb586b5ef Regenerate proto files

Dependency Changes

This release has no dependency changes

Previous release can be found at api/v1.10.0

Releases: containerd/containerd

containerd 2.3.0-beta.2

Highlights

Container Runtime Interface (CRI)

Image Distribution

Image Storage

Node Resource Interface (NRI)

Runtime

Snapshotters

Contributors

Changes

Uh oh!

containerd API 1.11.0-beta.2

Highlights

Runtime

Contributors

Changes

Dependency Changes

Uh oh!

containerd 2.2.3

Security Updates

Highlights

Container Runtime Interface (CRI)

Go client

Image Distribution

Runtime

Snapshotters

Contributors

Changes

Dependency Changes

Which file should I download?

Uh oh!

containerd 2.1.7

Security Updates

Highlights

Container Runtime Interface (CRI)

Image Distribution

Runtime

Contributors

Changes

Uh oh!

containerd 2.0.8

Security Updates

Highlights

Container Runtime Interface (CRI)

Runtime

Contributors

Changes

Dependency Changes

Which file should I download?

Uh oh!

containerd 1.7.31

Security Updates

Highlights

Container Runtime Interface (CRI)

Contributors

Changes

Dependency Changes

Uh oh!

containerd 2.3.0-beta.1

Highlights

Container Runtime Interface (CRI)

Image Distribution

Image Storage

Node Resource Interface (NRI)

Runtime

Snapshotters

Contributors

Dependency Changes

Uh oh!

containerd API 1.11.0-beta.1

Highlights

Contributors

Changes

Dependency Changes

Uh oh!

containerd 2.3.0-beta.0

Highlights

Container Runtime Interface (CRI)

Image Distribution