# containerd v2.0.14

> Kubernetes Core · 2026-10-13

A security-focused maintenance release hardens runtime behavior, image unpacking, and content reads. It bounds content reads to the expected size and adds no operator-facing configuration handles.

## Action needed
- **[security]** `GHSA-hc94-p972-ch66` advisory
  - The release includes advisory `GHSA-hc94-p972-ch66`.
- **[breaking]** `cri` log file following behavior
  - `cri` no longer follows log files.
- **[breaking]** `id-mapping` label handling in `core/unpack`
  - `core/unpack` no longer honors `id-mapping` labels from image annotations.
- **[breaking]** `seccomp` socket domain allow-list
  - `seccomp` uses an allow-list for socket domains.

## Other recorded changes
- 1 (value_changed 1)

[Full analysis](https://ratatosk.io/en/releases/containerd/v2.0.14)

[Original release notes](https://github.com/containerd/containerd/releases/tag/v2.0.14)