RATATOSKRATATOSK
로그인

CRI-O

v1.37.0Kubernetes Core
2026년 9월 15일

ACTION 2CHECK 4OTHER 32

운영자를 위한 기능 및 호환성 변경과 함께 기본값과 인터페이스가 조정되고, 정확성과 성능 개선이 포함된 릴리스입니다. 명시된 보안 취약점을 수정했으며 관련 의존성도 갱신하고 유지했습니다.

조치 필요 (2)

  • securityhighCVE-2026-15809 우회 취약점 수정

    HOME 환경 변수에 줄바꿈 문자를 넣어 /etc/passwd에 값을 주입하면서 CVE-2022-4318 수정 사항을 우회할 수 있던 문제를 CVE-2026-15809 수정으로 해결했습니다.

  • securityhighGo 도구 모음 업데이트 및 보안 취약점 수정

    Go toolchain을 1.26.4로 올려 CVE-2026-27145, CVE-2026-42504, CVE-2026-42507을 수정했습니다.

영향 확인 (4)

  • breaking비보안 레지스트리 설정 방식 변경

    insecure_registries를 설정했거나 --insecure-registry를 사용하는 경우에 해당합니다.

    지원이 중단된 insecure_registries 설정 옵션과 --insecure-registry 명령줄 플래그를 제거했습니다. 대신 registries.conf에서 insecure 옵션을 사용합니다.

  • breaking체크포인트 복원 기본값 변경

    container_level_enabled를 설정하지 않은 경우에 해당합니다.

    checkpoint_restore의 container_level_enabled 기본값을 checkpoint_only로 변경해 기본 상태에서는 복원이 비활성화됩니다.

  • breakinggRPC 메시지 크기 기본값 조정

    grpc_max_send_msg_size 또는 grpc_max_recv_msg_size를 설정하지 않은 경우에 해당합니다.

    grpc_max_send_msg_size와 grpc_max_recv_msg_size의 기본값을 기존 80 MiB에서 16 MiB로 낮췄습니다.

  • breakingCRI 메트릭의 name 레이블 제거

    CRI 메트릭을 사용하는 경우에 해당합니다.

    CRI 메트릭에서 name 레이블을 제거했습니다.

그 외 기록된 변경 32건 전체fixes 14 · value changes 7 · additions 6 · constraints 3 · defaults 1 · renames 1

fixes (14)

  • CRI-O now keeps logging blocked syscalls detected by the seccomp notifier instead of only reporting the first event when the notifier action is not "stop".
  • Deduplicate concurrent image volume MountImage calls to avoid containers/storage lock serialization when many pods mount the same image volume simultaneously.
  • Fix CRI-O crash (nil pointer dereference) in ListPodSandboxStats when a container's cgroup is cleaned up during teardown.
  • Fix SELinux labeling so systemd/init containers receive container_init_t again instead of remaining container_t and failing to create cgroups.
  • Fix a bug in high performance hooks where an init container would continue to hold a cpuset that could be used by a regular container in the same pod.
  • Fix a latent crash in pinns caused by a missing zero terminator on the getopt_long long options array.
  • Fix artifact names from externally created OCI layouts (e.g. via skopeo) being incorrectly normalized to wrong docker references.
  • Fix network metrics collection to use the pod's network namespace.
  • Fixed a bug where ImageRef in container status changed from a repo@digest to a raw image ID hash after CRI-O restart.
  • Fixed privileged sandboxes inheriting generate.New()'s default-deny seccomp filter when privileged_seccomp_profile is unset, so they now run unconfined as intended.
  • NRI container lifecycle events now correctly include the container name and pod sandbox ID.
  • Reduced the verbosity of debug logs for List* RPC calls to improve performance
  • Restores pre-1.34 behavior handling envvar values containing non-utf8 data
  • Fix user namespace mappings persistence across CRI-O restarts

value changes (7)

  • Add conmon-rs v1.0.1 support, drop backward compatibility with previous versions.
  • Added namespace, pod, and container labels to CRI metrics
  • Optimized environment variable merging during container creation by eliminating redundant string operations, improving container startup performance.
  • Remove experimental markers from additional_artifact_stores configuration option.
  • Bumped go.podman.io/common to v0.68.0.
  • Because of this change, the Configuration File lookup behavior has changed.
  • Update gomaxprocs hook to ignore workload partitioning when considering whether to inject, as well as update the calculation to ensure containers get at least double the requested number of CPUs, to reduce potential go scheduler throttling.

additions (6)

  • Add enable_cni_status_monitoring config option (default false) and cni_status_grace_period (default 60s) to gate continuous CNI STATUS monitoring and tolerate brief plugin disruptions during upgrades.
  • Add a new config field to allow node admins to only allow checkpointing, and disallowing restore.
  • Added container memory metrics container_memory_active_anon_bytes and container_memory_inactive_anon_bytes (cgroup v1 and v2), and container_memory_anon_thp_bytes, container_memory_shmem_thp_bytes and container_memory_file_thp_bytes (cgroup v2 only).
  • CRI-O now reports runtimeFeatures.UserNamespacesHostNetwork as enabled on Linux and uses a recursively read-only /sys bind mount for containers running with both host network and user namespaces.
  • Support for encrypted container images in Confidential Containers use case: cri-o will now ignore the container image layers, allowing the underlying Confidential Container runtime to manage the image pull management.
  • Support gVisor containerd-shim-runsc-v1

constraints (3)

  • Add btrfs storage driver support to static builds
  • These are gated behind a new memoryExtra value for included_pod_metrics, separate from memory.
  • Added support for per-container targeting of cpu-load-balancing.crio.io, irq-load-balancing.crio.io, and cpu-quota.crio.io annotations.

defaults (1)

  • The default pause image is now registry.k8s.io/pause:3.10.2.

renames (1)

  • Renamed --checkpoint-restore-container-level-enabled flag to --checkpoint-restore-level
CRI-O 스택에 추가

조치가 필요한 릴리스가 나왔을 때 주간 메일로 알려드립니다. 이번 릴리스의 보안 패치와 브레이킹 체인지 같은 것들입니다.

스택에 추가 →
공식 릴리스 노트 ↗CRI-O 릴리스 전체 →