Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: containerdClear ×

containerdv2.2.7Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 5View full analysis

A container runtime and CRI release that changes checkpoint-restore defaults and lifecycle, adds CRIU and Windows log-scrubbing configuration, and expands runtime support. It also includes fixes for CRI environment handling and mount-manager activation, plus dependency manifest updates that are not operator-facing.

Check if affected (3)

breakingThe enable_experimental_restore_via_create default
Applies if you use CreateContainer.
The CRI disables enable_experimental_restore_via_create by default in CreateContainer.
breakingThe ScrubLogs default on Windows
Applies if you run on Windows.
ScrubLogs is enabled by default for Windows.
breakingCheckpoint restore without CRIU
Applies if you do not have CRIU installed.
The checkpoint restore code path is disabled when CRIU is not installed.

Plan ahead (1)

deprecatedRestore in CreateContainer, deprecated
Applies if you use CreateContainer.
The CRI deprecates restore in CreateContainer.

Source ↗

containerdv2.3.4Kubernetes CoreAug 12, 2026

CHECK 3PLAN 1OTHER 11View full analysis

A container runtime release with changes to CRI behavior, checkpoint restore handling, and configuration. It also adds CRI capabilities and fixes runtime and snapshotter defects.

Check if affected (3)

breakingCheckpoint restore in CreateContainer disabled by default
Applies if you set enable_experimental_restore_via_create.
Checkpoint restore in CreateContainer is disabled by default. The enable_experimental_restore_via_create configuration option enables it.
breakingruntimeFeatures.UserNamespacesHostNetwork enabled by default
Applies if you run CRI.
CRI sets runtimeFeatures.UserNamespacesHostNetwork to true by default.
breakingLog scrubbing enabled by default on Windows
Applies if you run Windows.
Log scrubbing is enabled by default on Windows.

Plan ahead (1)

deprecatedCheckpoint restore in CreateContainer deprecated
Applies if you use CreateContainer.
Checkpoint restore through CreateContainer is deprecated.

Source ↗

containerdv2.3.3Kubernetes CoreJul 10, 2026

CHECK 2OTHER 7View full analysis

A maintenance release with an enforced CRI constraint, aligned erofs defaults, correctness and behavior fixes, and dependency updates. It contains no security advisories or explicitly described vulnerabilities.

Check if affected (2)

breakingThe CreateContainer constraint for stopped sandboxes
Applies if you use CreateContainer when the sandbox is not running.
CRI rejects CreateContainer when the sandbox is not running.
breakingThe erofs default mkfs block size
Applies if you use erofs across platforms.
The default erofs mkfs block size is aligned across platforms.

Source ↗

containerdv2.0.9Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1OTHER 7View full analysis

A maintenance release with a disclosed security fix, a narrower default socket policy, expanded compatibility for volatile mount options and AppArmor, and several correctness fixes. It also includes updates to container event handling, tar extraction, OCI USER validation, sandbox field forwarding, and event topics.

Action needed (1)

securityhighThe CVE-2026-46680 security fix
A security fix for CVE-2026-46680, also identified as GHSA-fqw6-gf59-qr4w, ships in this release.

Check if affected (1)

breakingThe default seccomp socket policy
Applies if you use seccomp.
The default socket policy blocks AF_ALG in this release.

Source ↗

containerdv2.3.1Kubernetes CoreMay 20, 2026

ACTION 1CHECK 1PLAN 1OTHER 8View full analysis

A maintenance release focused on runtime correctness and security, including fixes across snapshotter, storage, and server components. It also contains compatibility changes and updates to the API and Go toolchain.

Action needed (1)

securityhighCVE-2026-46680 correction
The fix for CVE-2026-46680 ships in this release.

Check if affected (1)

breakingThe overlayfs "rebase" capability, disabled in user namespaces
Applies if you use overlayfs and run in a user namespace.
The overlayfs "rebase" capability is disabled when running in a user namespace.

Plan ahead (1)

deprecatedTask fields in Runc options, deprecated
Applies if you configure task fields in Runc options.
Task fields in Runc options are deprecated in this release.

Source ↗

containerdapi/v1.11.0Kubernetes CoreApr 30, 2026

CHECK 1OTHER 6View full analysis

This release adds and changes API and runtime capabilities, removes a sandbox metadata field, and updates a dependency. No security advisories or vulnerabilities are disclosed.

Check if affected (1)

breakingThe Container sandbox metadata field, removed
Applies if you use Container in API specs.
The Container field is removed from sandbox metadata in API v1.11.0.

Source ↗

containerdv2.0.8Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 4View full analysis

containerd v2.0.8 is a maintenance release with security fixes, a CNI restart correction, and dependency and toolchain updates. The security changes concern spdystream and credential handling in CRI pod events.

Action needed (1)

securityhighThe spdystream update for CVE-2026-35469
The spdystream security update for CVE-2026-35469 ships in containerd v2.0.8.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if you use pod events through the Container Runtime Interface (CRI).
The Container Runtime Interface (CRI) path sanitizes errors before gRPC returns them, preventing credential leaks in pod events. The correction ships in containerd v2.0.8.

Source ↗

containerdv2.1.7Kubernetes CoreApr 14, 2026

ACTION 2CHECK 1OTHER 14View full analysis

A maintenance release with fixes across CRI, runtime, image distribution, and security-sensitive paths. It also updates dependencies and toolchains, including a spdystream security update and a fix for credential leakage.

Action needed (2)

securityhighCVE-2026-35469 and GHSA-pc3f-x583-g7j2
The release includes CVE-2026-35469 and GHSA-pc3f-x583-g7j2, related to the spdystream security fix.
securityhighgithub.com/moby/spdystream v0.5.1 update
The release updates github.com/moby/spdystream to v0.5.1. The update carries fixes associated with CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securityCredential sanitization before gRPC returns
Applies if pod events are used.
The release sanitizes errors before returning them over gRPC to prevent credential leakage in pod events.

Source ↗

containerdv1.7.31Kubernetes CoreApr 14, 2026

ACTION 1CHECK 1OTHER 9View full analysis

containerd v1.7.31 is a maintenance release with a disclosed security fix in spdystream, alongside dependency, toolchain, correctness, and behavior updates. The spdystream fix requires upgrading; the other changes matter when affected behaviors or versions are in use.

Action needed (1)

securityhighThe spdystream CVE-2026-35469 fix
containerd v1.7.31 includes the spdystream fix for CVE-2026-35469 and GHSA-pc3f-x583-g7j2.

Check if affected (1)

securitySanitized gRPC errors in pod events
Applies if you use pod events.
containerd v1.7.31 sanitizes errors before returning them through gRPC. The change addresses credential leakage in pod events.

Source ↗

Browse by month