A Flatcar instance receives automatic updates from a specific release channel. The Stable channel is the default, and new major releases only appear there after passing through the Alpha and Beta channels. Each release channel always points to the latest release in that particular channel, linked as the current release. Each release has a version number and separate release notes. Learn more about updating and release channels in the channel docs. Click amd64 or arm64 to download images for the channel's current release from the channel overview below, or for a particular version from the release notes below that. Then, you will be able to choose from many images for various platforms. The installation docs have a quick start guide and information about public images directly available at each cloud provider.

Release Channels

Stable
4459.2.4
amd64 arm64
Release Date: Mar 9, 2026

The Stable channel is intended for use in production clusters. Versions of Flatcar Container Linux have been tested as they move through Alpha and Beta channels before being promoted to stable.

containerd - 2.0.7
docker - 28.0.4
ignition - 2.22.0
kernel - 6.12.74
systemd - 256
Beta
4593.1.0
amd64 arm64
Release Date: Mar 9, 2026

The Beta channel is where Flatcar Container Linux stability is solidified. We encourage including some beta machines in production clusters in order to catch any issues that may arise with your setup.

containerd - 2.1.5
docker - 28.0.4
ignition - 2.24.0
kernel - 6.12.74
systemd - 257
Alpha
4628.0.0
amd64 arm64
Release Date: Mar 9, 2026

The Alpha channel follows a more frequent release cadence and is where new updates are introduced. Users can try the new versions of the Linux kernel, systemd and other core packages.

containerd - 2.2.0
docker - 28.2.2
ignition - 2.24.0
kernel - 6.12.74
systemd - 258
LTS
4081.3.6
amd64 arm64
Release Date: Sep 15, 2025

LTS release streams will be maintained for an extended lifetime of 18 months. The yearly LTS streams have an overlap of 6 months.

containerd - 1.7.21
docker - 26.1.0
ignition - 2.19.0
kernel - 6.6.106
systemd - 255
ATOM feed (all releases) JSON feed (all releases)

Release Notes

⚠️ End of support for CGroupsV1 in Stable 4230.2.0 release ⚠️

With the Flatcar Container Linux 4230.2.0 Stable release, CGroups V1 backward compatibility has been removed. Enabling legacy CGroupsV1 during deployment is no longer supported, and nodes still using CGroupsV1 will fail to update. This change ensures your workloads are not unexpectedly disrupted. We encourage you to enable CGroupsV2 on legacy CGroupsV1 nodes to ensure successful updates. The LTS-2024 channel (major release series 4081) will continue supporting CGroupsV1. This channel will receive regular updates until early 2026, and hit EOL in mid-2026. If you have any questions, feel free to join our Matrix channel , or participate in our Office Hours / Developer Sync calls.

4459.2.4

Release Date: Mar 9, 2026  amd64 arm64

containerd - 2.0.7
docker - 28.0.4
ignition - 2.22.0
kernel - 6.12.74
systemd - 256

Changes since Stable 4459.2.3

Security fixes:

Updates:

4459.2.3

Release Date: Jan 27, 2026  amd64 arm64

containerd - 2.0.7
docker - 28.0.4
ignition - 2.22.0
kernel - 6.12.66
systemd - 256

Changes since Stable 4459.2.2

Security fixes:

Updates:

4459.2.2

Release Date: Dec 18, 2025  amd64 arm64

containerd - 2.0.7
docker - 28.0.4
ignition - 2.22.0
kernel - 6.12.61
systemd - 256

Changes since Stable 4459.2.1

Security fixes:

Updates:

4459.2.1

Release Date: Nov 27, 2025  amd64 arm64

containerd - 2.0.7
docker - 28.0.4
ignition - 2.22.0
kernel - 6.12.58
systemd - 256

Changes since Stable 4459.2.0

Security fixes:

Bug fixes:

  • Fixed the loading of kernel modules from system extensions via udev (e.g. at boot time). ( flatcar/scripts#3367 )

Changes:

Updates:

4459.2.0

Release Date: Nov 12, 2025  amd64 arm64

containerd - 2.0.7
docker - 28.0.4
ignition - 2.22.0
kernel - 6.12.54
systemd - 256

Changes since Stable 4230.2.4

Security fixes:

Bug fixes:

  • Enabled CONFIG_CPUSETS_V1 to mitigate cgroupsv1 removal (e.g JVM) ( Flatcar#1884 )
  • Enabled CONFIG_MEMCG_V1 to mitigate cgroupsv1 removal (e.g JVM) ( Flatcar#1884 )
  • Excluded TUN/TAP interfaces from the default DHCP network configuration to solve conflicts with the programs that created them ( Flatcar#1933 )
  • Fix non-conforming GPT partition table ( Flatcar#1651 )
  • Fixed Intel microcode updates which were broken in recent Alpha and Beta releases by switching back to built-in extra firmware instead of early cpio inclusion ( Flatcar#1909 )
  • Fixed a UID/GID mis-alignment for user/group messagebus between acct-user/acct-group and baselayout. ( baselayout#36 )
  • Fixed path handling in the QEMU .sh launcher scripts. Given paths now are relative to the current directory and absolute paths work as you would expect.
  • Fixed race condition in the script that grows the root partition to fill the disk. This bug sometimes caused the operation to not occur. ( init#132 )
  • Fixed that the needed Flatcar extensions don’t get removed on update which caused a re-download ( update_engine#51 )
  • Reenabled console support for DRM drivers, so that with the virtio graphics driver the interactive console is shown again after boot ( Flatcar#1834 )
  • azure: Fixed issue of wa-linux-agent overriding ssh public key from ignition configuration during provisioning ( flatcar/Flatcar#1661 )
  • sysext-podman: removed /etc/subuid and /etc/subgid generation for core user, before this change it partially overwrites the file and causes issues. ( Flatcar#1733 ) This could be created through initial provisioning. ( scripts#3043 )
  • update-ssh-keys: More intuitive –help text and the -n (no-replace) option has been fixed. ( flatcar/Flatcar#1554 )

Changes:

  • Added overlaybd system extension to support accelerated container images. Add overlaybd to /etc/flatcar/enabled-sysext.conf to check it out. The extension includes both overlaybd as well as accelerated-container-image tools.
  • Added changes for our secureboot signed images with our signed release process until the official shim signing ( scripts#2754 )
  • Added nftables-load.service and nftables-store.service services to load/store rules from/in /var/lib/nftables/rules-save ( Flatcar#900 )
  • Added support for podman in toolbox ( toolbox#11 )
  • Allow per-sysext USE flags and architecture-specific sysexts. ( scripts#2798 )
  • Always truncate hostnames on the first occurrence of . ( cloud-init#32 )
  • Azure OEM: add inotify-tools, python urllib3 ( flatcar/scripts#3116 )
  • Build Intel iGPU i915 driver as module ( scripts#2349 )
  • Compiled OS-dependent NVIDIA kernel module sysexts signed for secure boot. ( scripts#2798 )
  • Enabled CONFIG_INET_DIAG_DESTROY in kernel options ( flatcar/scripts#3176 )
  • Enabled EROFS module with XATTR support ( Flatcar#1659 )
  • Enabled virtiofs and fuse-dax modules in the kernel for advaned Qemu usecases. Thank you @aaronk6! ( Flatcar#2825 )
  • Ensured hostnames never exceeds 63 characters, regardless of the metadata provider ( cloud-init#31 )
  • Hyper-V images now use a systemd-sysext image for layering additional platform-specific software on top of /usr
  • Provided an Incus Flatcar extension as optional systemd-sysext image with the release. Write ‘incus’ to /etc/flatcar/enabled-sysext.conf through Ignition and the sysext will be installed during provisioning. ( scripts#1655 )
  • Scaleway: The Linux console is now attached to the correct console port. ( scripts#3383 )
  • Signed out-of-tree kernel modules using the ephemeral signing key so that ZFS and NVIDIA sysexts can work with secure boot. ( scripts#2636 )
  • The kernel image and its embedded initrd are now compressed with xz rather than zstd. This gives greater compression at the cost of decompression performance. Systems may therefore now be ever so slightly slower to boot, but this was necessary to avoid running out of space in the /boot partition. Further measures to address the space issue are planned, and perhaps we can switch back to zstd in a later release.
  • The qemu script (flatcar_production_qemu*.sh) received two new options. -D (or -image-disk-opts) can be used to add extra options to the virtio-blk-pci device for primary disk. -d (or -disk) can be used to add extra disks to the machine - this one takes a path to a raw or qcow2 image file and, after a comma, virtio-blk-pci options. To learn what disk options can be passed to -D or -d, call qemu-system-x86_64 -device virtio-blk-pci,help (qemu-system-aarch64 can be used too).
  • /boot is now only accessible by the root user for better security. ( Flatcar#296 )
  • ftrace syscalls also available in ARM64 builds. (Enables syscall tracepoints) ( flatcar/scripts#2600 )
  • sysext-incus: removed /etc/subuid and /etc/subgid generation for root user, it has to be created through initial provisioning. ( scripts#3028 )
  • systemd now uses OpenSSL instead of gcrypt for cryptography to reduce the size of the initrd. This change disables systemd-journal’s Forward Secure Sealing feature, but it is generally not useful for Flatcar.

Updates:

Changes since Beta 4459.1.0

Security fixes:

Bug fixes:

  • Enabled CONFIG_MEMCG_V1 to mitigate cgroupsv1 removal (e.g JVM) ( Flatcar#1884 )
  • Excluded TUN/TAP interfaces from the default DHCP network configuration to solve conflicts with the programs that created them ( Flatcar#1933 )
  • Fixed Intel microcode updates which were broken in recent Alpha and Beta releases by switching back to built-in extra firmware instead of early cpio inclusion ( Flatcar#1909 )
  • Fixed that the needed Flatcar extensions don’t get removed on update which caused a re-download ( update_engine#51 )

Changes:

  • Scaleway: The Linux console is now attached to the correct console port. ( scripts#3383 )

Updates:

4230.2.4

Release Date: Oct 14, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.3.1
ignition - 2.20.0
kernel - 6.6.110
systemd - 256

Changes since Stable 4230.2.3

Security fixes:

Bug fixes:

  • Fixed the QEMU launcher script to include HVF acceleration on arm64-based Macs for faster performance ( Flatcar#1901 )

Changes:

  • Scaleway: SSH keys are now fetched via Afterburn ( scripts#3277 )
  • Scaleway: The hostname is now set via Afterburn ( scripts#3277 )

Updates:

4230.2.3

Release Date: Sep 15, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.3.1
ignition - 2.20.0
kernel - 6.6.106
systemd - 256

Changes since Stable 4230.2.2

Security fixes:

Updates:

4230.2.2

Release Date: Aug 19, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.3.1
ignition - 2.20.0
kernel - 6.6.100
systemd - 256

Changes since Stable 4230.2.1

Updates:

4230.2.1

Release Date: Jul 8, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.3.1
ignition - 2.20.0
kernel - 6.6.95
systemd - 256

Changes since Stable 4230.2.0

Security fixes:

Changes:

Updates:

4230.2.0

Release Date: Jun 24, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.3.1
ignition - 2.20.0
kernel - 6.6.94
systemd - 256

Changes since Stable 4152.2.3

Security fixes:

Bug fixes:

  • Fixed PXE boot failures that arose since upgrading to systemd v256. Users were dumped to an emergency shell. ( flatcar/bootengine#103 )
  • Fixed creating netdev arguments to correctly include commas when no port forwards are passed ( flatcar/scripts#2581 )
  • The kernel module build directory now contains native binaries in arm64 images instead of the previous amd64 binaries ( scripts#2694 )
  • Nvidia driver installer service now supports the 570 driver branch by forcing the use of the proprietary kernel module. The 570 branch defaults to the kernel-open driver which requires loading firmware, which is not yet supported on Flatcar. ( scripts#2694 )
  • Added back some BCC tools ( scripts#2900 )

Changes:

  • Added support for ARM64 architecture in the NVIDIA driver installer service ( scripts#2694 )
  • Added support for multiple port forwarding parameters in the QEMU startup script. Users can now specify multiple port forwards using the -f option. ( flatcar/scripts#2575 )
  • Additional GRUB modules are no longer installed for UEFI platforms to save space and also because they cannot be loaded with Secure Boot enabled. This does not affect existing installations.
  • The GRUB modules on non-UEFI platforms are now compressed with xz rather than gzip to save even more space. This does not affect existing installations.
  • The VFIO kernel modules are now also available in ARM64 builds. ( flatcar/scripts#2484 )
  • Enabled the gtp kernel module. This is the GPRS Tunneling Protocol datapath for usage in telecoms scenarios. ( flatcar/scripts#2504 )

Updates:

Changes since Beta 4230.1.1

Security fixes:

Bug fixes:

Updates:

4152.2.3

Release Date: May 6, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.2.1
ignition - 2.20.0
kernel - 6.6.88
systemd - 255

Changes since Stable 4152.2.2

Security fixes:

Updates:

4152.2.2

Release Date: Mar 20, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.2.1
ignition - 2.20.0
kernel - 6.6.83
systemd - 255

Changes since Stable 4152.2.1

Security fixes:

Bug fixes:

  • azure: Fix issue of wa-linux-agent overriding ssh public key from ignition configuration during provisioning ( flatcar/Flatcar#1661 )
  • Fix update-ca-certificates behavior when concatenating certificates with missing trailing newlines. ( flatcar/scripts#2667 )

Changes:

  • Added new image signing pub key to flatcar-install, needed for download verification of releases built from March 2025 onwards, if you have copies of flatcar-install or the image signing pub key, you need to update them as well ( init#129 )

Updates:

4152.2.1

Release Date: Feb 18, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.2.1
ignition - 2.20.0
kernel - 6.6.74
systemd - 255

Changes since Stable 4152.2.0

Security fixes:

Updates:

  • openssh(9.8_p1-r4)
4152.2.0

Release Date: Jan 30, 2025  amd64 arm64

containerd - 1.7.23
docker - 27.2.1
ignition - 2.20.0
kernel - 6.6.74
systemd - 255

Changes since Stable 4081.2.1

Security fixes:

Changes:

  • Added Proxmox Virtual Environment images ( scripts#1783 )
  • Kernel lockdown in integrity mode is now enabled when secure boot is enabled. This prevents loading unsigned kernel modules and matches the behavior of all major distros. ( scripts#2299 )
  • The UEFI firmware has changed from raw (.fd) format to QCOW2 format. In addition, the amd64 firmware variables are now held in a 4MB image rather than a 2MB image. Note that this firmware is only intended for testing with QEMU. Do not use it in production. ( scripts#2434 )
  • The /usr/sbin directory is now merged into /usr/bin, so the former became a symlink to the latter. The SDK now has the same base layout as the generic images. ( flatcar/scripts#2068 )
  • The arm64 UEFI firmware now supports Secure Boot. Be aware that this is not considered secure due to the lack of an SMM implementation, which is needed to protect the variable store. As above, this firmware should not be used in production anyway. ( scripts#2434 )
  • grub 2.12-flatcar3: GRUB now includes many patches from Red Hat to support Secure Boot, as well as Flatcar’s own patches. The version string includes a numbered “flatcar” suffix to track changes to these additional patches. This string can be seen in the GRUB menu. ( scripts#2431 )

Updates:

Changes since Beta 4152.1.0

Security fixes:

Updates:

4081.2.1

Release Date: Dec 16, 2024  amd64 arm64

containerd - 1.7.21
docker - 26.1.0
ignition - 2.19.0
kernel - 6.6.65
systemd - 255

Changes since Stable 4081.2.0

Security fixes:

Bug fixes:

Updates:

4081.2.0

Release Date: Nov 13, 2024  amd64 arm64

containerd - 1.7.21
docker - 26.1.0
ignition - 2.19.0
kernel - 6.6.60
systemd - 255

Changes since Stable 3975.2.2

Security fixes:

Bug fixes:

  • CloudSigma: Disabled the new DHCP RapidCommit feature which is enabled by default since systemd 255. CloudSigma provides an incompatible implementation which results in cloud-init not being applied as no IP is issued. See: ( flatcar/scripts#2016 )
  • Fixed bad usage of gpg that prevented flatcar-install from being used with custom signing keys ( Flatcar#1471 )
  • Fixed the initrd option in the QEMU launcher script. It was -R, but this was already taken by the read-only pflash option, so use -r instead. ( scripts#2239 )

Changes:

  • As part of the update to Catalyst 4 (used to build the SDK), the coreos package repository has been renamed to coreos-overlay to match its directory name. This will be reflected in package listings and package manager output. ( flatcar/scripts#2115 )
  • Provided a Python Flatcar extension as optional systemd-sysext image with the release. Write ‘python’ to /etc/flatcar/enabled-sysext.conf through Ignition and the sysext will be installed during provisioning ( scripts#1979 )
  • Added Akamai / Linode images ( flatcar/scripts#1806 )
  • Removed unused grub executable duplicate files and removed grub modules that are already assembled in the grub executable ( flatcar/scripts#1955 ).
  • Replace nmap netcat with openbsd variant. The license didn’t get an exception from CNCF. Something about the definition of “derivative works” being too broad.
  • The docker build command will now use buildx as its backend as the old one became deprecated and a loud “DEPRECATED” information is printed every time it’s used.
  • The kernel security module Landlock is now enabled for programs to sandbox themselves ( flatcar/scripts#2158 )
  • libcrypt is now provided by the libxcrypt library instead of glibc. Glibc libcrypt was deprecated long time ago.
  • Disable CONFIG_NFS_V4_2_READ_PLUS kernel config to fix nfs-ganesha ( flatcar/scripts#2390 )

Updates:

Changes since Beta 4081.1.0

Security fixes:

Changes:

Updates:

3975.2.2

Release Date: Oct 10, 2024  amd64 arm64

containerd - 1.7.17
docker - 24.0.9
ignition - 2.18.0
kernel - 6.6.54
systemd - 255

Changes since Stable 3975.2.1

Security fixes:

Bug fixes:

  • Equinix Metal: fixed race condition on ‘mount’ Ignition stage ( scripts#2308 )
  • Fixed slow boots PXE and ISO boots caused by the decrypt-root.service. ( Flatcar#1514 )

Changes:

  • Azure, HyperV: Added daemons kvp, vss, and fcopy for better HyperV hypervisor integration with Flatcar guests ( scripts#2309 ).
  • Enable mpi3mr kernel module for Broadcom Storage/RAID-Controllers ( flatcar/scripts#2355 )

Updates:

3975.2.1

Release Date: Sep 5, 2024  amd64 arm64

containerd - 1.7.17
docker - 24.0.9
ignition - 2.18.0
kernel - 6.6.48
systemd - 255

Changes since Stable 3975.2.0

Security fixes:

Bug fixes:

Updates:

3975.2.0

Release Date: Aug 7, 2024  amd64 arm64

containerd - 1.7.17
docker - 24.0.9
ignition - 2.18.0
kernel - 6.6.43
systemd - 255

Changes since Stable 3815.2.5

Security fixes:

Bug fixes:

  • Fixed issue file generation from ‘/etc/issue.d’ ( scripts#2018 )
  • Fixed the handling of OEM update payloads in a Nebraska response with self-hosted packages ( ue-rs#49 )
  • Fixes kubevirt vm creation by ensuring that /dev/vhost-net exists ( Flatcar#1336 )
  • Hetzner: Fixed duplicated prefix in the Afterburn metadata ( scripts#2141 )
  • Removed custom CloudSigma coreos-cloudinit service configuration since it will be called with the cloudsigma oem anyway. The restart of the service can also cause the serial port to be stuck in an nondeterministic state which breaks future runs.
  • Resolved kmod static nodes creation in bootengine ( bootengine#85 )

Changes:

  • Added zram-generator package to the image ( scripts#1772 )
  • A new format qemu_uefi_secure is introduced to test Flatcar for SecureBoot-enabled features. The format will be later merged into qemu_uefi.
  • Added Intel igc driver to support I225/I226 family NICs. ( flatcar/scripts#1786 )
  • Added Hetzner images ( flatcar/scripts#1880 )
  • Added Hyper-V VHDX image ( flatcar/scripts#1791 )
  • Added Ignition Clevis support for encrypted disks unlocked with a TPM2 device or a Tang server ( scripts#1560 )
  • Added KubeVirt qcow2 image for amd64/arm64 ( flatcar/scripts#1962 )
  • Added Scaleway images ( flatcar/scripts#1683 )
  • Added support for unlocking the rootfs with a TPM set up by systemd-cryptenroll ( bootengine#93 )
  • Backported systemd-sysext mutable overlays functionality from yet-unreleased systemd v256. ( flatcar/scripts#1753 )
  • Enabled amd-pstate,amd-pstate-epp cpufreq drivers for some AMD CPUs in the kernel. ( flatcar/scripts#1770 )
  • Enabled ntpd by default on AWS & GCP, enabled chronyd by default on Azure. The native time sync source is used on each cloud. ( scripts#1792 )
  • Enabled the GRUB TPM2 module to measure the boot code path and files into PCR 8+9 in UEFI ( scripts#1861 )
  • Enabled the ptp_vmw module in the kernel.
  • Hetzner: Added COREOS_HETZNER_PRIVATE_IPV4_0 Afterburn attribute for Hetzner private IPs ( scripts#2141 )
  • Hyper-V images, both .vhd and .vhdx files are available as zip compressed, switching from bzip2 to a built-in available Windows compression - zip ( scripts#1878 )
  • OpenStack, Brightbox: Added the flatcar.autologin kernel cmdline parameter by default as the hypervisor manages access to the console ( scripts#1866 )
  • Provided a Podman Flatcar extension as optional systemd-sysext image with the release. Write ‘podman’ to /etc/flatcar/enabled-sysext.conf through Ignition and the sysext will be installed during provisioning ( scripts#1964 )
  • OpenStack: Changed metadata hostname source order. The service first tries with the config drive then fallback on the metadata service. ( bootengine#96 )
  • Provided a ZFS-2.2.2 Flatcar extension as optional systemd-sysext image with the release. Write ‘zfs’ to /etc/flatcar/enabled-sysext.conf through Ignition and the sysext will be installed during provisioning. ZFS support is experimental and ZFS is not supported for the root partition. ( flatcar/scripts#1742 )
  • Removed Linux drivers for Mellanox Technologies Switch ASICs family and Spectrum/Spectrum-2/Spectrum-3/Spectrum-4 Ethernet Switch ASICs to reduce the initrd size on AMD64 by ~5MB ( flatcar/scripts#1734 ). This change is part of the effort to reduce the initrd size ( Flatcar#1381 ).
  • Removed actool from the image and acbuild from the SDK as these tools are deprecated and not used ( scripts#1817 )
  • Scaleway: images are now provided directly as .qcow2 to ease the import on Scaleway ( scripts#1953 )
  • Switched ptp_kvm from kernel builtin to module.
  • The default VM memory was bumped to 2 GB in the Qemu script and for VMware OVFs
  • Update generation SLSA provenance info from v0.2 to v1.0.
  • Removed coreos-cloudinit support for automatic keys conversion (e.g reboot-strategy -> reboot_strategy) ( scripts#1687 )

Updates: