RATATOSKRATATOSK
Sign in

CRI-O

v1.37.3Kubernetes Core
Nov 3, 2026

CHECK 1OTHER 10

A maintenance release focused on correctness fixes and changes to `conmon-rs` integration, along with dependency updates. No security changes are disclosed.

Check if affected (1)

  • breakingThe monitor_env environment scope for conmon-rs

    Applies if you do not set monitor_env.

    conmon-rs now receives the same environment as conmon through monitor_env, rather than the entire CRI-O environment. Variables set only on the CRI-O service, including OTEL_* or proxy settings, no longer reach conmon-rs and the OCI runtime unless they are added to monitor_env.

All 10 other recorded changesfixes 9 · value changes 1

fixes (9)

  • - Fixed exclusive CPU cleanup when cgroups disappear during container cleanup. (#10468, @bitoku)
  • - Attaching to stdin once containers with conmon-rs no longer loses the output after the client closes its stdin.
  • Attaching to a stdin once container through the conmon-rs streaming server now closes the container stdin when the client closes its stdin. (#10445, @openshift-cherrypick-robot)
  • - Fix userns-mode when combined with a Kubelet supporting user namespaces. (#10429, @openshift-cherrypick-robot)
  • - Fixed a possible crash and a panic of CRI-O with the pod runtime type (conmon-rs),
  • and a leaked conmon-rs server after removing a pod with pod events enabled. (#10505, @openshift-cherrypick-robot)
  • - When crio.service is restarted while containers are being created, an in-flight conmon process can still be killed and its crio-conmon-*.scope unit can still enter a failed state. That scope is now automatically garbage collected by systemd instead of persisting in systemctl --failed indefinitely. (#10451, @openshift-cherrypick-robot)
  • - Fixed CRI-O crash loops and stuck-Terminating pods caused by dead kata shims. (#10422, @openshift-cherrypick-robot)
  • - Fixed a leak of the seccomp notifier file descriptor into the container monitor, which left the kernel's seccomp notify listener attached with no reader after a CRI-O restart, causing process creation inside seccomp-notifier-armed containers to block indefinitely. (#10462, @openshift-cherrypick-robot)

value changes (1)

  • - With stream_websockets and conmon-rs v1.2.0 or later, conmon-rs also serves port forwarding and its streaming sessions end after stream_idle_timeout of inactivity. Older conmon-rs versions disable stream_websockets, and pods started by them keep using the CRI-O streaming server. A conmon-rs server which does not exit on pod removal gets killed. A negative stream_idle_timeout fails the config validation. With conmon-rs, log_to_journald also logs containers to the journal, and exec syncs which conmon-rs could not start fail instead of returning exit code -2 or -3. (#10481, @openshift-cherrypick-robot)
Add CRI-O to your stack

A weekly email arrives when a release needs action. Like the breaking changes in this release.

Add to stack →
Official release note ↗All CRI-O releases →