Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: containerdClear ×

containerdv2.2.7Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

breakingThe enable_experimental_restore_via_create default
Applies if you use CreateContainer.
The CRI disables enable_experimental_restore_via_create by default in CreateContainer.
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
ScrubLogs is enabled by default for Windows.
breakingCheckpoint restore without CRIU
Applies if you do not have CRIU installed.
The checkpoint restore code path is disabled when CRIU is not installed.

Plan ahead (1)

deprecatedRestore in CreateContainer, deprecated
Applies if you use CreateContainer.
The CRI deprecates restore in CreateContainer.

Source ↗

containerdv2.3.4Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

breakingCheckpoint restore in CreateContainer disabled by default
Applies if you set enable_experimental_restore_via_create.
Checkpoint restore in CreateContainer is disabled by default. The enable_experimental_restore_via_create configuration option enables it.
breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default
Applies if you run CRI.
CRI sets runtimeFeatures.UserNamespacesHostNetwork to true by default.
breakingLog scrubbing enabled by default on Windows
Applies if you run Windows.
Log scrubbing is enabled by default on Windows.

Plan ahead (1)

deprecatedCheckpoint restore in CreateContainer deprecated
Applies if you use CreateContainer.
Checkpoint restore through CreateContainer is deprecated.

Source ↗

containerdv2.3.3Kubernetes CoreJul 10, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
CRI rejects CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.
The default erofs mkfs block size is aligned across platforms.

Source ↗

containerdv2.0.9Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

securityhighThe CVE-2026-46680 security fix
A security fix for CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, ships in this release.

Check if affected (1)

breakingThe default seccomp socket policy
Applies if you use seccomp.
The default socket policy blocks AF_ALG in this release.

Source ↗

containerdv2.3.1Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.
The overlayfs "rebase" capability is disabled when running in a user namespace.

Plan ahead (1)

deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.
Task fields in Runc options are deprecated in this release.

Source ↗

containerdapi/v1.11.0Kubernetes CoreApr 30, 2026

CHECK 1OTHER 6View full analysis

This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.

Check if affected (1)

breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.
The Container field is removed from sandbox metadata in API v1.11.0.

Source ↗

Browse by month