LoginSign Up
← Back to all sparks
C

containerd

DEVOPS
Velocity6.3

Industry-standard container runtime

containerd.io ↗

containerd 2.4.0-rc.0 removes checkpoint-restore-via-CreateContainer and flips user-namespace networking on by default

container-runtimesecurity-hardeningbreaking-changecrierofsshim-api
◆Current state
containerd is in active parallel-maintenance mode across four branches (1.7, 2.0, 2.2, 2.3 LTS, 2.4 dev). The September 4 patch wave addressed CVE-2026-53495 across all active branches — stripping sensitive auth headers when fetching descriptor image URLs. The 2.3 LTS branch continues to absorb fixes at a steady pace: startup hang prevention, EROFS layer-stack reliability, Windows compatibility improvements, and a runc upgrade to v1.5.1.
◆Where it's heading
Development is converging on the 2.4 release, the first non-LTS cycle after 2.3. The 2.4 RC removes the deprecated checkpoint-restore-via-CreateContainer codepath (disabled by default in 2.2/2.3, now gone entirely), enables user-namespace host-network by default, and expands EROFS warm-cache support. The new UpdateSandbox RPC and the MountCapabilities bootstrap extension replacing the old `runtime-allow-mounts` shim annotation reflect containerd pushing a tighter, more auditable shim API contract.
◆Prediction
2.4.0 stable will likely ship within a few weeks given the RC0 is tagged. The auth-header-stripping pattern applied across all branches in the CVE patch suggests a follow-on audit of remaining registry interaction surfaces is possible.

◆Recent moves

  1. 21h ago

    containerd 2.4.0-rc.0: checkpoint restore removed, user-namespace networking on by default

    ⚡ SPARK

    The 2.4.0-rc.0 is the first RC for containerd's post-LTS release, completing the removal of checkpoint-restore-via-CreateContainer (deprecated in 2.2/2.3), flipping user-namespace host-network to on by default, and landing the UpdateSandbox RPC — all breaking-or-behavior-changing moves that will need orchestrator-side absorption before stable.

    View source ↗
  2. 1d ago

    containerd API 1.12.0-rc.1

    The 1.12.0-rc.1 API release adds the UpdateSandbox RPC that wires sandbox-controller updates through to the shim, completing the API surface for 2.4's sandbox lifecycle control improvements.

    View source ↗
  3. 11d ago

    containerd 1.7.35

    1.7.35 is a security-focused patch: CVE-2026-53495 (sensitive auth header stripping on descriptor URL fetches) applied to the still-supported 1.7 branch, alongside a Windows log-scrubbing default flip.

    View source ↗
  4. 11d ago

    containerd 2.0.12

    2.0.12 backports the CVE-2026-53495 auth-header fix, adds OCI error body surfacing on registry 403 responses (improving error debuggability), and fixes Windows SystemTemp handling — a security-and-polish patch for the 2.0 branch.

    View source ↗
  5. 11d ago

    containerd 2.3.5

    2.3.5 is the most substantive of the September CVE batch: beyond the auth-header fix it resolves a CRI exec-sync I/O hang, an EROFS unpack failure for images with the erofs OS feature, a shim-load startup hang, and ships runc v1.5.1 — meaningful stability work for the LTS branch.

    View source ↗
  6. 11d ago

    containerd 2.2.8

    2.2.8 delivers the CVE-2026-53495 fix to the 2.2 branch alongside a Windows SystemTemp fix and an EROFS concurrent-snapshot race condition fix — a targeted security-and-stability patch.

    View source ↗