# containerd v2.4.0

> Kubernetes Core · 2026-09-16

A feature-rich, non-LTS release that expands runtime, storage, CRI, platform, tracing, and Windows capabilities while changing defaults and removing or deprecating interfaces. It also includes correctness fixes, security hardening, and dependency updates, so compatibility and policy impacts matter when assessing an upgrade.

## Action needed
- **[security]** The `github.com/go-jose/go-jose/v4` dependency
  - The vendored `github.com/go-jose/go-jose/v4` dependency was updated to v4.1.5 for security.
- **[breaking]** The `CreateContainer` restore operation
  - The `restore` operation was removed from `CreateContainer`.
- **[breaking]** The `github.com/opencontainers/runtime-tools` dependency
  - The dependency on `github.com/opencontainers/runtime-tools` was removed.
- **[breaking]** The default seccomp `AF_ALG` policy
  - The default seccomp socket policy blocks `AF_ALG`.

## Check if affected
- **[breaking]** The `runtimeFeatures.UserNamespacesHostNetwork` default
  - Applies if you do not configure `runtimeFeatures.UserNamespacesHostNetwork`.
  - The default for `runtimeFeatures.UserNamespacesHostNetwork` is now true.
- **[breaking]** Default masking of interrupt and CPU thermal throttle paths
  - Applies if you run Linux containers.
  - `/proc/interrupts` and CPU thermal throttle sysfs paths are masked by default in Linux containers.
- **[breaking]** Default `Windows` log scrubbing
  - Applies if you run on `Windows`.
  - Log scrubbing is enabled by default on `Windows`.
- **[breaking]** Removal of deprecated CRI and tracing configuration options
  - Applies if you configure any of `enable_cdi`, `bin_dir`, `endpoint`, `protocol`, `insecure`, `service_name`, or `sampling_ratio`.
  - The deprecated `enable_cdi` option was removed from CRI runtime configuration because CDI is always enabled. The deprecated `bin_dir` option was removed from CRI CNI configuration in favor of `bin_dirs`. The `endpoint`, `protocol`, and `insecure` OTLP tracing options, along with the internal tracing options `service_name` and `sampling_ratio`, were removed in favor of standard OpenTelemetry environment variables.
- **[breaking]** The Windows `ScrubLogs` default
  - Applies if you run on Windows.
  - `ScrubLogs` is used by default on Windows.
- **[breaking]** The `CreateContainer` sandbox state constraint
  - Applies if the sandbox is not running.
  - The CRI plugin rejects `CreateContainer` when the sandbox is not running.
- **[breaking]** The `overlay` `rebase` capability in UserNS
  - Applies if you run in UserNS.
  - The `overlay` capability `rebase` is disabled when running in UserNS.

## Plan ahead
- **[deprecated]** The `containerd.io/runtime-allow-mounts` shim annotation
  - Applies if you configure `containerd.io/runtime-allow-mounts`.
  - The `containerd.io/runtime-allow-mounts` shim annotation is deprecated in favor of the `MountCapabilities` bootstrap extension.
- **[deprecated]** The task API address and version fields in runc options
  - Applies if you use the task API address and version fields.
  - The task API address and version fields in runc options are deprecated and moved to `CreateTaskRequest`.
- **[deprecated]** The `pkg/tracing` `Logrushook`
  - Applies if you use `Logrushook`.
  - `Logrushook` in `pkg/tracing` is deprecated in favor of `log/otel.Logrushook`.
- **[deprecated]** The CRI image pulling throughput fields
  - Applies if you configure `image_pulling_throughput`.
  - The CRI plugin adds `image_pulling_throughput_mibps` and deprecates `image_pulling_throughput`.

## Other recorded changes
- 188 (value_changed 108, defect_corrected 47, added 26, constraint_changed 5, removed 2)

[Full analysis](https://ratatosk.io/en/releases/containerd/v2.4.0)

[Original release notes](https://github.com/containerd/containerd/releases/tag/v2.4.0)