RATATOSKRATATOSK
Sign in

CRI-O

v1.37.0Kubernetes Core
Sep 15, 2026

ACTION 2CHECK 4OTHER 32

A substantial feature and compatibility release for operators, with changed defaults and interfaces alongside correctness and performance improvements. It also includes identified security fixes and refreshes a broad set of dependencies.

Action needed (2)

Check if affected (4)

  • breakingThe insecure_registries option and --insecure-registry flag, removed

    Applies if you configure insecure_registries or use --insecure-registry.

    The deprecated insecure_registries configuration option and --insecure-registry CLI flag are removed. Use the insecure option in registries.conf instead.

  • breakingThe container_level_enabled default, changed to checkpoint_only

    Applies if you do not configure container_level_enabled.

    The default for the checkpoint_restore configuration field container_level_enabled is now checkpoint_only, which disables restore by default.

  • breakingThe gRPC message size defaults, reduced to 16 MiB

    Applies if grpc_max_send_msg_size or grpc_max_recv_msg_size is not configured.

    CRI-O now defaults grpc_max_send_msg_size and grpc_max_recv_msg_size to 16 MiB, down from 80 MiB.

  • breakingThe name label on CRI metrics, removed

    Applies if you use CRI metrics.

    CRI-O removes the name label from CRI metrics.

All 32 other recorded changesfixes 14 · value changes 7 · additions 6 · constraints 3 · defaults 1 · renames 1

fixes (14)

  • CRI-O now keeps logging blocked syscalls detected by the seccomp notifier instead of only reporting the first event when the notifier action is not "stop".
  • Deduplicate concurrent image volume MountImage calls to avoid containers/storage lock serialization when many pods mount the same image volume simultaneously.
  • Fix CRI-O crash (nil pointer dereference) in ListPodSandboxStats when a container's cgroup is cleaned up during teardown.
  • Fix SELinux labeling so systemd/init containers receive container_init_t again instead of remaining container_t and failing to create cgroups.
  • Fix a bug in high performance hooks where an init container would continue to hold a cpuset that could be used by a regular container in the same pod.
  • Fix a latent crash in pinns caused by a missing zero terminator on the getopt_long long options array.
  • Fix artifact names from externally created OCI layouts (e.g. via skopeo) being incorrectly normalized to wrong docker references.
  • Fix network metrics collection to use the pod's network namespace.
  • Fixed a bug where ImageRef in container status changed from a repo@digest to a raw image ID hash after CRI-O restart.
  • Fixed privileged sandboxes inheriting generate.New()'s default-deny seccomp filter when privileged_seccomp_profile is unset, so they now run unconfined as intended.
  • NRI container lifecycle events now correctly include the container name and pod sandbox ID.
  • Reduced the verbosity of debug logs for List* RPC calls to improve performance
  • Restores pre-1.34 behavior handling envvar values containing non-utf8 data
  • Fix user namespace mappings persistence across CRI-O restarts

value changes (7)

  • Add conmon-rs v1.0.1 support, drop backward compatibility with previous versions.
  • Added namespace, pod, and container labels to CRI metrics
  • Optimized environment variable merging during container creation by eliminating redundant string operations, improving container startup performance.
  • Remove experimental markers from additional_artifact_stores configuration option.
  • Bumped go.podman.io/common to v0.68.0.
  • Because of this change, the Configuration File lookup behavior has changed.
  • Update gomaxprocs hook to ignore workload partitioning when considering whether to inject, as well as update the calculation to ensure containers get at least double the requested number of CPUs, to reduce potential go scheduler throttling.

additions (6)

  • Add enable_cni_status_monitoring config option (default false) and cni_status_grace_period (default 60s) to gate continuous CNI STATUS monitoring and tolerate brief plugin disruptions during upgrades.
  • Add a new config field to allow node admins to only allow checkpointing, and disallowing restore.
  • Added container memory metrics container_memory_active_anon_bytes and container_memory_inactive_anon_bytes (cgroup v1 and v2), and container_memory_anon_thp_bytes, container_memory_shmem_thp_bytes and container_memory_file_thp_bytes (cgroup v2 only).
  • CRI-O now reports runtimeFeatures.UserNamespacesHostNetwork as enabled on Linux and uses a recursively read-only /sys bind mount for containers running with both host network and user namespaces.
  • Support for encrypted container images in Confidential Containers use case: cri-o will now ignore the container image layers, allowing the underlying Confidential Container runtime to manage the image pull management.
  • Support gVisor containerd-shim-runsc-v1

constraints (3)

  • Add btrfs storage driver support to static builds
  • These are gated behind a new memoryExtra value for included_pod_metrics, separate from memory.
  • Added support for per-container targeting of cpu-load-balancing.crio.io, irq-load-balancing.crio.io, and cpu-quota.crio.io annotations.

defaults (1)

  • The default pause image is now registry.k8s.io/pause:3.10.2.

renames (1)

  • Renamed --checkpoint-restore-container-level-enabled flag to --checkpoint-restore-level
Add CRI-O to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All CRI-O releases →