RATATOSKRATATOSK
Sign in

containerd

v2.4.0Kubernetes Core
Sep 16, 2026

ACTION 4CHECK 7PLAN 4OTHER 188

A feature-rich, non-LTS release that expands runtime, storage, CRI, platform, tracing, and Windows capabilities while changing defaults and removing or deprecating interfaces. It also includes correctness fixes, security hardening, and dependency updates, so compatibility and policy impacts matter when assessing an upgrade.

Action needed (4)

  • securityThe github.com/go-jose/go-jose/v4 dependency

    The vendored github.com/go-jose/go-jose/v4 dependency was updated to v4.1.5 for security.

  • breakingThe CreateContainer restore operation

    The restore operation was removed from CreateContainer.

  • breakingThe github.com/opencontainers/runtime-tools dependency

    The dependency on github.com/opencontainers/runtime-tools was removed.

  • breakingThe default seccomp AF_ALG policy

    The default seccomp socket policy blocks AF_ALG.

Check if affected (7)

  • breakingThe runtimeFeatures.UserNamespacesHostNetwork default

    Applies if you do not configure runtimeFeatures.UserNamespacesHostNetwork.

    The default for runtimeFeatures.UserNamespacesHostNetwork is now true.

  • breakingDefault masking of interrupt and CPU thermal throttle paths

    Applies if you run Linux containers.

    /proc/interrupts and CPU thermal throttle sysfs paths are masked by default in Linux containers.

  • breakingDefault Windows log scrubbing

    Applies if you run on Windows.

    Log scrubbing is enabled by default on Windows.

  • breakingRemoval of deprecated CRI and tracing configuration options

    Applies if you configure any of enable_cdi, bin_dir, endpoint, protocol, insecure, service_name, or sampling_ratio.

    The deprecated enable_cdi option was removed from CRI runtime configuration because CDI is always enabled. The deprecated bin_dir option was removed from CRI CNI configuration in favor of bin_dirs. The endpoint, protocol, and insecure OTLP tracing options, along with the internal tracing options service_name and sampling_ratio, were removed in favor of standard OpenTelemetry environment variables.

  • breakingThe Windows ScrubLogs default

    Applies if you run on Windows.

    ScrubLogs is used by default on Windows.

  • breakingThe CreateContainer sandbox state constraint

    Applies if the sandbox is not running.

    The CRI plugin rejects CreateContainer when the sandbox is not running.

  • breakingThe overlay rebase capability in UserNS

    Applies if you run in UserNS.

    The overlay capability rebase is disabled when running in UserNS.

Plan ahead (4)

  • deprecatedThe containerd.io/runtime-allow-mounts shim annotation

    Applies if you configure containerd.io/runtime-allow-mounts.

    The containerd.io/runtime-allow-mounts shim annotation is deprecated in favor of the MountCapabilities bootstrap extension.

  • deprecatedThe task API address and version fields in runc options

    Applies if you use the task API address and version fields.

    The task API address and version fields in runc options are deprecated and moved to CreateTaskRequest.

  • deprecatedThe pkg/tracing Logrushook

    Applies if you use Logrushook.

    Logrushook in pkg/tracing is deprecated in favor of log/otel.Logrushook.

  • deprecatedThe CRI image pulling throughput fields

    Applies if you configure image_pulling_throughput.

    The CRI plugin adds image_pulling_throughput_mibps and deprecates image_pulling_throughput.

All 188 other recorded changesvalue changes 108 · fixes 47 · additions 26 · constraints 5 · removals 2

value changes (108)

  • containerd 2.4 is a regular (non-LTS) release with a shorter support window
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs
  • Support propagating HTTP 299 warning headers from registries to the resolver
  • Use klauspost/compress for gzip layer decompression
  • Include media type in content create events
  • Expose container image name, digest, and config digest to NRI plugins
  • Emit deprecation warnings for plugins using deprecated NRI interfaces
  • erofs: refuse to apply into a read-only snapshot
  • build(deps): bump the golang-x group with 4 updates
  • build(deps): bump github.com/klauspost/compress from … to …×4
  • shim-runc-v2: record exit status in bundle
  • core/unpack: fetch layers of every config-sharing manifest
  • time to update cri-tools to v1.37.0
  • update crun to v1.29.1
  • vendor: github.com/containerd/log main, use log.Level consts for log-levels
  • vendor: github.com/moby/sys/userns v0.2.1
  • Revert "metadata: bound snapshotter Remove during garbage collection"
  • vendor: golang.org/x/crypto …×3
  • vendor: tags.cncf.io/container-device-interface …×4
  • vendor: bump go-cni v1.1.14 and containernetworking/cni v1.3.1
  • Update Go 1.26.8 and 1.27.1
  • runtime: invoke shim.Delete when connection is closed
  • cri: trace image pull result attributes
  • internal/cri/server: avoid debug log formatting for container spec
  • build(deps): bump github.com/google/certtostore from 1.0.6 to 1.0.7
  • vendor: github.com/docker/go-events v0.1.0
  • chore(deps): go.opentelemetry.io/otel v1.46.0, contrib v0.71.0
  • snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin
  • build(deps): bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1
  • update kubernetes to v1.37.0
  • vendor: google.golang.org/grpc …×2
  • vendor: github.com/docker/go-metrics v0.1.0
  • chore(api): update github.com/sirupsen/logrus v1.10.2
  • vendor: github.com/containerd/go-runc v1.2.1
  • pkg/tracing: handle error and typed-nil Stringer attributes
  • metadata: bound snapshotter Remove during garbage collection
  • build(deps): bump github.com/checkpoint-restore/checkpointctl from 1.5.0 to 1.6.0
  • build(deps): bump github.com/moby/sys/userns from 0.1.0 to 0.2.0 in the moby-sys group
  • build(deps): bump the k8s group across 1 directory with 2 updates
  • Bump go-runc to 1.2.0
  • vendor: github.com/sirupsen/logrus v1.10.1
  • vendor: github.com/containerd/platforms v1.0.0-rc.5
  • script/setup: update critools to v1.36.0
  • update runhcs to …×3
  • vendor: github.com/Microsoft/hcsshim v0.15.0-rc.4
  • vendor: go.opentelemetry.io/otel v1.45.0, go.opentelemetry.io/contrib v0.70.0
  • vendor: google.golang.org/protobuf v1.36.12
  • vendor: google.golang.org/genproto/* 6ac0973c030d
  • vendor: github.com/go-logr/logr v1.4.4
  • vendor: github.com/felixge/httpsnoop v1.1.0
  • vendor: golang.org/x/mod v0.40.0
  • vendor: golang.org/x/net v0.58.0
  • vendor: golang.org/x/text v0.41.0
  • cri, nri: record resolved image name and digest in container metadata
  • Update Go to …×2
  • remotes/docker: Propagate registry warnings to the resolver
  • bump selinux to v1.15.1, use SetProcessKind
  • Update api version to v1.12.0-beta.0
  • build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3
  • Include media type in content create event
  • build(deps): bump github.com/fsnotify/fsnotify from 1.9.0 to 1.10.1
  • build(deps): bump github.com/erofs/go-erofs from 0.3.0 to 0.3.1
  • build: bump github.com/containerd/nri
  • build(deps): bump golang.org/x/net from 0.51.0 to 0.55.0 in /api
  • update runc to …×2
  • build(deps): bump the golang-x group across 1 directory with 2 updates
  • build(deps): bump google.golang.org/grpc from … to …×3
  • build(deps): bump github.com/containerd/ttrpc to v1.2.9
  • remotes: surface OCI error body in registry 4xx responses
  • Update go to 1.26.5
  • build(deps): bump github.com/pelletier/go-toml/v2 from 2.4.1 to 2.4.2
  • cri: auto-add prefix for pause image
  • Set SystemTemp env var to config temp on Windows
  • build(deps): bump github.com/Microsoft/hcsshim from 0.15.0-rc.1 to 0.15.0-rc.3
  • Use klauspost/compress/gzip for decode
  • cri: route sandbox stats through Controller.Metrics
  • build(deps): bump github.com/moby/sys/user from 0.4.0 to 0.4.1 in the moby-sys group across 1 directory
  • cri: exclude cached layer bytes from image_pulling_throughput_mibps
  • build(deps): bump github.com/mdlayher/vsock from 1.2.1 to 1.3.0
  • build(deps): bump github.com/intel/goresctrl from 0.12.0 to 0.13.0
  • build(deps): bump github.com/moby/sys/sequential from 0.6.0 to 0.7.0 in the moby-sys group across 1 directory
  • build(deps): bump go.etcd.io/bbolt from 1.4.3 to 1.5.0
  • erofs: align default mkfs block size across platforms
  • update runc binary to v1.4.3
  • build(deps): bump the golang-x group with 3 updates
  • update go to 1.26.4
  • remotes: close fetch reader immediately on EOF
  • cri: reset pull progress timer on idle→active transition
  • runc-shim: don't hold the service lock across runc create
  • build(deps): bump the otel group across 1 directory with 8 updates
  • Update typeurl/v2 to v2.3.0 to drop gogo dependency
  • cri: skip pause image pull for shim sandboxer
  • server: tolerate failed gRPC plugins when starting listeners

fixes (47)

  • Avoid immediately restarting containers with restart=always policy after they are explicitly stopped
  • Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group
  • cri: only unmount image volumes when mounting fails
  • Fix input mutation in mount option helpers
  • Fix data races and a deadlock in the byte stream helpers
  • pkg/shim: Report bootstrap API mismatch on startup
  • pkg/oci: resolve rootfs symlinks for user lookup
  • ensure that the final config version is the higest in the config list
  • runtime: invoke Shutdown after every task deletion
  • fix(runtime): apply load timeout to load shim
  • ctr: drain exec output before cleanup
  • snapshots/erofs: protect snapshot staging from cleanup
  • Add more context to the shim delete error
  • unpack: don't drop topHalf errors in parallel mode
  • cri: fix container_start_time_seconds unit conversion
  • cri: skip failed container instead of dropping entire sandbox metrics
  • snapshots/erofs: keep lowers stacked above a merged fsmeta
  • shim_load: Consider shim leaked only if we can't find pids
  • fsmount: Fix selinux mount parameter parsing
  • overlay: don't override a configured index mount option
  • core/runtime/v2: Preserve protobuf shim response bytes
  • pkg/archive: reject out-of-range device numbers in layer headers
  • Fix incorrect default config value for block CIM snapshotter
  • cri: validate CRIU availability and version early
  • Fix nil pointer dereference in NRI GetIPs
  • snapshots/devmapper: avoid nil status deref after mkfs failure
  • [Bugfix] fix snapshotter variable check in ContainerWithCheckpoint
  • cri: fix duplicated image env vars on checkpoint import
  • oci: use path.Join to fill CgroupsPath
  • content: handle sharing violations on Windows
  • cri: don't leak the new mount if mutateImageMount() fails
  • core/content/proxy: Convert reader errors to native errdefs
  • cri: filter CDI annotations on checkpoint restore
  • cri: do not re-tag restored checkpoints
  • cri: make checkpoint restore robust to unexpected archive content
  • Do not propagate reserved labels from image configs
  • fix(shim/windows): retry on winio.ErrTimeout in awaitPipeReady
  • core/proxy: Convert stream proxy errors to native errdefs
  • resolver: retry on transient network errors
  • Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks
  • fix race on Windows deferredPipeConnection.c in Read
  • Fix flaky e2e test
  • oci: return explicit error for out-of-range USER values
  • Fix sandbox task API endpoints for non-runc runtimes
  • fix(erofs): set TMPDIR for mkfs.erofs on Windows
  • fix: close boltdb on metadata and mount plugin close
  • Fix optional EROFS differ setup in transfer plugin

additions (26)

  • Enable mount manager for image mounts in CRI
  • Export sandbox image and CNI directory configuration in CRI plugin info
  • Add client options to fetch all layer content during unpack even when snapshots exist
  • Add forward References to the GC collection context
  • Add UpdateSandbox RPC to propagate sandbox controller updates to the shim
  • Pass tracing context from shim to runc and hooks
  • Implement Windows named-pipe server and log streaming support in pkg/shim
  • Allow specifying parent checkpoint directory when checkpointing with runc
  • Add Prometheus metrics for EROFS snapshotter layer content cache
  • Support warm image cache for erofs snapshotter×2
  • Add max size label for snapshots×2
  • erofs: enable fsview fallback for unsupported features
  • Export config in CRI plugin
  • implement Windows support for the shim server
  • cri: add tracing spans for image pull and sandbox setup paths
  • nri,deprecation: record and emit warnings for NRI deprecations.
  • erofs: enable parallel unpack with content cache
  • ctr: register EROFS fsview
  • cri: add streaming RPCs
  • Introspect OCI runtime features for non-runc runtimes
  • cri: add enable_criu configuration option
  • feat: add loong64 (LoongArch) build support
  • Add parent path to runc checkpoint options
  • core/metadata: add forward References to the GC collection context

constraints (5)

  • Support OCI runtime feature introspection for non-runc runtimes
  • runtime: make task.Delete API retriable
  • erofs: allow multiple cache directories
  • Handle []byte envvar value for CRI
  • Bound user-database file reads in openUserFile

removals (2)

  • *: disable bbolt stat usage
  • pkg/archive: remove redundant github.com/moby/sys/sequential dependency
Add containerd to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All containerd releases →