Tags

Tags give the ability to mark specific points in history as being important

debian/1.7.24_ds1-6+deb13u1

6aabc785 · debian/changelog: update · Nov 17, 2025
```
containerd Debian release 1.7.24~ds1-6+deb13u1
```

archive/debian/1.7.24_ds1-10

953a9427 · Make fast forward from 1.7.24~ds1-9 · Nov 07, 2025

containerd release 1.7.24~ds1-10 for unstable (sid) [dgit]

[dgit distro=debian split --quilt=gbp]
[dgit split-maint-view-tag=0a1396d765e1567713f01f002c1bd124df3c6da8]

Unverified

debian/1.7.24_ds1-10

5e72d13e · debian/changelog: update · Nov 07, 2025

containerd release 1.7.24~ds1-10 for unstable (sid)

(maintainer view tag generated by dgit --quilt=gbp)

[dgit distro=debian split --quilt=gbp]

Unverified

archive/debian/1.7.24_ds1-9

3ef60e9c · Declare fast forward from 1.7.24~ds1-8 · Nov 06, 2025

containerd release 1.7.24~ds1-9 for unstable (sid) [dgit]

[dgit distro=debian split --quilt=gbp]
[dgit split-maint-view-tag=ae16d73a3a5390ac95f2bd2d531f41d486e9003e]

Unverified

debian/1.7.24_ds1-9

44dd36e8 · debian/changelog: update · Nov 06, 2025

containerd release 1.7.24~ds1-9 for unstable (sid)

(maintainer view tag generated by dgit --quilt=gbp)

[dgit distro=debian split --quilt=gbp]

Unverified

v2.2.0

1c4457e0 · Merge pull request #12473 from dmcgowan/prepare-v2.2.0 · Nov 05, 2025

containerd 2.2.0

Welcome to the v2.2.0 release of containerd!

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

### Highlights

* **Add mount manager** ([#12063](https://github.com/containerd/containerd/pull/12063))

  The mount manager is a new service that provides lifecycle management for filesystem mounts
  to support more advanced use cases, such as:
  * **Device formatting** to create formatted filesystems (xfs, ext4) on-demand
  * **Mount activation** to prepare devices such as loopbacks or network fileystems
  * **Mount transformation** to allow mount arguments to be filled in dynamically from previous mounts
  * **Garbage collection** of mounts to ensure temporary mounts are never leaked
* **Add conf.d include in the default config** ([#12323](https://github.com/containerd/containerd/pull/12323))
* **Add support for back references in the garbage collector** ([#12025](https://github.com/containerd/containerd/pull/12025))

#### Container Runtime Interface (CRI)

* **Pod Sandbox Metrics** ([#10691](https://github.com/containerd/containerd/pull/10691))

  Full implementation of Kubernetes CRI pod-level metrics API
  * **ListPodSandboxMetrics**: Query metrics for  running pods/sandboxes
  * **ListMetricsDescriptors**: Discover available metrics and their descriptions
* **Support image volume mount subpath** ([#11578](https://github.com/containerd/containerd/pull/11578))

#### Go client

* **Update pkg/oci to use fs.FS interface and os.OpenRoot** ([#12245](https://github.com/containerd/containerd/pull/12245))

#### Image Distribution

* **Parallel Unpack**  ([#12332](https://github.com/containerd/containerd/pull/12332))

  Adds support for unpacking layers in parallel during pull operations. This feature is supported with overlayfs and EROFS snapshotters.
* **OCI Referrers Support** ([#12309](https://github.com/containerd/containerd/pull/12309))

  Adds new referrers fetcher to remote registry interface using the [new referrers endpoint added in OCI distribution-spec 1.1](https://github.com/opencontainers/distribution-spec/blob/v1.1.0/spec.md#listing-referrers)
* **Tar unpack progress through transfer service** ([#11921](https://github.com/containerd/containerd/pull/11921))

#### Image Storage

* **EROFS enhancements using mount manager** ([#12333](https://github.com/containerd/containerd/pull/12333))

  Improvements to EROFS snapshotter using the new mount manager service
  * **Quota Support**: Support for sized block devices as the upper layer for overlayfs
  * **Mount Lifecycle**: Loopback setup, block device creation, and overlayfs argument formatting is moved to the
     mount  manager to be performed on-demand or within the runtime.
  * **Mount handler**: To allow optimization of EROFS mount types based on the current system
  * **macOS Support**: EROFS snapshotter can now be used on Darwin to natively allow image pulls
  * **Tar index mode**: Efficiently generate EROFS metadata backed by original tar content ([#11919](https://github.com/containerd/containerd/pull/11919))
* **Add snapshotter and differ for block CIMs** ([#12050](https://github.com/containerd/containerd/pull/12050))

#### Node Resource Interface (NRI)

* **Enable otel traces in NRI** ([#12082](https://github.com/containerd/containerd/pull/12082))
* **Add WASM plugin support** ([containerd/nri#121](https://github.com/containerd/nri/pull/121))

#### Runtime

* **Improve shim load time after restart by loading in parallel** ([#12142](https://github.com/containerd/containerd/pull/12142))
* **Fix pidfd leak in UnshareAfterEnterUserns** ([#12167](https://github.com/containerd/containerd/pull/12167))

#### Deprecations

* **Deprecate cgroup v1** ([#12445](https://github.com/containerd/containerd/pull/12445))
* **Postpone v2.2 deprecation items to v2.3** ([#12417](https://github.com/containerd/containerd/pull/12417))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Akihiro Suda
* Maksym Pavlenko
* Wei Fu
* Krisztian Litkey
* Mike Brown
* Akhil Mohan
* Markus Lehtonen
* Samuel Karp
* Sebastiaan van Stijn
* ningmingxiao
* Austin Vazquez
* yashsingh74
* Gao Xiang
* Kirtana Ashok
* Jin Dong
* Chris Henzie
* Aadhar Agarwal
* Etienne Champetier
* Henry Wang
* Rodrigo Campos
* Sascha Grunert
* Aleksa Sarai
* Eric Mountain
* Keith Mattix II
* Paweł Gronowski
* Tõnis Tiigi
* Adrien Delorme
* Apurv Barve
* Enji Cooper
* Kohei Tokunaga
* Max Jonas Werner
* Rehan Khan
* Yang Yang
* jinda.ljd
* jokemanfire
* Amit Barve
* Andrew Halaney
* Antonio Ojea
* Brian Goff
* Carlos Eduardo Arango Gutierrez
* Chenyang Yan
* Dawei Wei
* Divya Rani
* Evan Anderson
* Fabiano Fidêncio
* Iceber Gu
* Jared Ledvina
* Jonathan Perkin
* Jose Fernandez
* Karl Baumgartner
* Michael Weibel
* Osama Abdelkader
* Radostin Stoyanov
* Ruidong Cao
* Sameer
* Sergey Kanzhelev
* Swagat Bora
* Sylvain MOUQUET
* Tom Wieczorek
* Tycho Andersen
* Wuyue (Tony) Sun
* suranmiao
* tanhuaan
* wheat2018
* zounengren

### Dependency Changes

* **dario.cat/mergo**                                                    v1.0.1 -> v1.0.2
* **github.com/Microsoft/hcsshim**                                       v0.13.0-rc.3 -> v0.14.0-rc.1
* **github.com/StackExchange/wmi**                                       cbe66965904d **_new_**
* **github.com/checkpoint-restore/checkpointctl**                        v1.3.0 -> v1.4.0
* **github.com/containerd/cgroups/v3**                                   v3.0.5 -> v3.1.0
* **github.com/containerd/console**                                      v1.0.4 -> v1.0.5
* **github.com/containerd/containerd/api**                               v1.9.0 -> v1.10.0
* **github.com/containerd/go-cni**                                       v1.1.12 -> v1.1.13
* **github.com/containerd/nri**                                          v0.8.0 -> v0.10.0
* **github.com/containerd/platforms**                                    v1.0.0-rc.1 -> v1.0.0-rc.2
* **github.com/containernetworking/plugins**                             v1.7.1 -> v1.8.0
* **github.com/coreos/go-systemd/v22**                                   v22.5.0 -> v22.6.0
* **github.com/cpuguy83/go-md2man/v2**                                   v2.0.5 -> v2.0.7
* **github.com/emicklei/go-restful/v3**                                  v3.11.0 -> v3.13.0
* **github.com/fxamacker/cbor/v2**                                       v2.7.0 -> v2.9.0
* **github.com/go-jose/go-jose/v4**                                      v4.0.5 -> v4.1.2
* **github.com/go-logr/logr**                                            v1.4.2 -> v1.4.3
* **github.com/go-ole/go-ole**                                           v1.2.6 **_new_**
* **github.com/golang/groupcache**                                       41bb18bfe9da -> 2c02b8208cf8
* **github.com/google/certtostore**                                      v1.0.6 **_new_**
* **github.com/google/deck**                                             105ad94aa8ae **_new_**
* **github.com/gorilla/websocket**                                       v1.5.0 -> e064f32e3674
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**  v1.0.1 -> v1.1.0
* **github.com/hashicorp/errwrap**                                       v1.1.0 **_new_**
* **github.com/intel/goresctrl**                                         v0.8.0 -> v0.10.0
* **github.com/klauspost/compress**                                      v1.18.0 -> v1.18.1
* **github.com/knqyf263/go-plugin**                                      v0.9.0 **_new_**
* **github.com/moby/sys/capability**                                     v0.4.0 **_new_**
* **github.com/modern-go/reflect2**                                      v1.0.2 -> 35a7c28c31ee
* **github.com/opencontainers/runtime-tools**                            2e043c6bd626 -> 0ea5ed0382a2
* **github.com/prometheus/client_golang**                                v1.22.0 -> v1.23.2
* **github.com/prometheus/client_model**                                 v0.6.1 -> v0.6.2
* **github.com/prometheus/common**                                       v0.62.0 -> v0.66.1
* **github.com/prometheus/procfs**                                       v0.15.1 -> v0.16.1
* **github.com/stretchr/testify**                                        v1.10.0 -> v1.11.1
* **github.com/tchap/go-patricia/v2**                                    v2.3.2 -> v2.3.3
* **github.com/tetratelabs/wazero**                                      v1.9.0 **_new_**
* **github.com/urfave/cli/v2**                                           v2.27.6 -> v2.27.7
* **github.com/vishvananda/netlink**                                     0e7078ed04c8 -> v1.3.1
* **go.etcd.io/bbolt**                                                   v1.4.0 -> v1.4.3
* **go.opentelemetry.io/otel**                                           v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/metric**                                    v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/sdk**                                       v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/trace**                                     v1.35.0 -> v1.37.0
* **go.uber.org/goleak**                                                 v1.3.0 **_new_**
* **go.yaml.in/yaml/v2**                                                 v2.4.2 **_new_**
* **golang.org/x/crypto**                                                v0.36.0 -> v0.41.0
* **golang.org/x/mod**                                                   v0.24.0 -> v0.29.0
* **golang.org/x/net**                                                   v0.38.0 -> v0.43.0
* **golang.org/x/oauth2**                                                v0.27.0 -> v0.30.0
* **golang.org/x/sync**                                                  v0.14.0 -> v0.17.0
* **golang.org/x/sys**                                                   v0.33.0 -> v0.37.0
* **golang.org/x/term**                                                  v0.30.0 -> v0.34.0
* **golang.org/x/text**                                                  v0.23.0 -> v0.28.0
* **golang.org/x/time**                                                  v0.7.0 -> v0.14.0
* **google.golang.org/genproto/googleapis/api**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/genproto/googleapis/rpc**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/grpc**                                             v1.72.0 -> v1.76.0
* **google.golang.org/protobuf**                                         v1.36.6 -> v1.36.10
* **k8s.io/api**                                                         v0.32.3 -> v0.34.1
* **k8s.io/apimachinery**                                                v0.32.3 -> v0.34.1
* **k8s.io/client-go**                                                   v0.32.3 -> v0.34.1
* **k8s.io/cri-api**                                                     v0.32.3 -> v0.34.1
* **k8s.io/utils**                                                       3ea5e8cea738 -> 4c0f3b243397
* **sigs.k8s.io/json**                                                   9aa6b5e7a4b3 -> cfa47c3a1cc8
* **sigs.k8s.io/randfill**                                               v1.0.0 **_new_**
* **sigs.k8s.io/structured-merge-diff/v6**                               v6.3.0 **_new_**
* **sigs.k8s.io/yaml**                                                   v1.4.0 -> v1.6.0

Previous release can be found at [v2.1.0](https://github.com/containerd/containerd/releases/tag/v2.1.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

v2.1.5

fcd43222 · Merge pull request #12483 from austinvazquez/prep_2_1_5 · Nov 05, 2025

containerd 2.1.5

Welcome to the v2.1.5 release of containerd!

The fifth patch release for containerd 2.1 contains various fixes and updates.

### Security Updates

* **containerd**
  * [**GHSA-pwhc-rpq9-4c8w**](https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
  * [**GHSA-m6hq-p25p-ffr2**](https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

* **runc**
  * [**GHSA-qw9x-cqr3-wc7r**](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
  * [**GHSA-cgrx-mc8f-2prm**](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
  * [**GHSA-9493-h29p-rfm2**](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)

### Highlights

#### Container Runtime Interface (CRI)

* **Disable event subscriber during task cleanup** ([#12410](https://github.com/containerd/containerd/pull/12410))
* **Add SystemdCgroup to default runtime options** ([#12253](https://github.com/containerd/containerd/pull/12253))
* **Fix userns with container image VOLUME mounts that need copy** ([#12242](https://github.com/containerd/containerd/pull/12242))

#### Image Distribution

* **Ensure errContentRangeIgnored error when range-get request is ignored** ([#12312](https://github.com/containerd/containerd/pull/12312))

#### Runtime

* **Update runc binary to v1.3.3** ([#12478](https://github.com/containerd/containerd/pull/12478))

#### Deprecations

* **Postpone v2.2 deprecation items to v2.3** ([#12431](https://github.com/containerd/containerd/pull/12431))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Phil Estes
* Akihiro Suda
* Derek McGowan
* Austin Vazquez
* Rodrigo Campos
* Maksym Pavlenko
* Wei Fu
* ningmingxiao
* Akhil Mohan
* Henry Wang
* Andrew Halaney
* Divya Rani
* Jose Fernandez
* Swagat Bora
* wheat2018

### Changes
<details><summary>58 commits</summary>
<p>

* Prepare release notes for v2.1.5 ([#12483](https://github.com/containerd/containerd/pull/12483))
  * [`fc5bdfeac`](https://github.com/containerd/containerd/commit/fc5bdfeacefc7ff2a4f6bafaa2ed6453dbb8c472) Prepare release notes for v2.1.5
  * [`c578c26bf`](https://github.com/containerd/containerd/commit/c578c26bf9e9d3368e87edb837b706053c3ef30e) Update mailmap
  * [`46a4a03fb`](https://github.com/containerd/containerd/commit/46a4a03fb4131739e948f983af8c984eb0c36d61) Merge commit from fork
  * [`232786c90`](https://github.com/containerd/containerd/commit/232786c906a11dae0c1ef5059653d4164345401f) Fix directory permissions
  * [`239ab877d`](https://github.com/containerd/containerd/commit/239ab877db8edf31ffb2ae63d83919d1c242e8d2) Merge commit from fork
  * [`0766796e8`](https://github.com/containerd/containerd/commit/0766796e8e95ffdbf6d2b4fb08bda536c03d444c) fix goroutine leak of container Attach
* Update runc binary to v1.3.3 ([#12478](https://github.com/containerd/containerd/pull/12478))
  * [`3d713d3d0`](https://github.com/containerd/containerd/commit/3d713d3d0db35b9e0d587e482498c891cc6fa3f2) runc: Update runc binary to v1.3.3
* Update GHA runners to use latest images for basic binaries build ([#12470](https://github.com/containerd/containerd/pull/12470))
  * [`de4221cb7`](https://github.com/containerd/containerd/commit/de4221cb7fb5f3ebb2fb5b2bdecfa907cdce94fb) Update GHA runners to use latest images for basic binaries build
* ci: bump Go 1.24.9, 1.25.3 ([#12467](https://github.com/containerd/containerd/pull/12467))
  * [`2045b1920`](https://github.com/containerd/containerd/commit/2045b1920f150e1591ed5d6e146ff280abb18be0) ci: bump Go 1.24.9, 1.25.3
* Update GHA runners to use latest image for most jobs ([#12468](https://github.com/containerd/containerd/pull/12468))
  * [`21ec7cc7d`](https://github.com/containerd/containerd/commit/21ec7cc7d15d031e9d798971486237097173babe) Update GHA runners to use latest image for most jobs
* CI: update Fedora to 43 ([#12449](https://github.com/containerd/containerd/pull/12449))
  * [`893b5f92e`](https://github.com/containerd/containerd/commit/893b5f92e3fd9a75e3f4f9aa824287b97107b390) CI: update Fedora to 43
* Postpone v2.2 deprecation items to v2.3 ([#12431](https://github.com/containerd/containerd/pull/12431))
  * [`6374a8f9d`](https://github.com/containerd/containerd/commit/6374a8f9d7123bc380a060586c387508069b3cea) Postpone v2.2 deprecation items to v2.3
* CI: skip ubuntu-24.04-arm on private repos ([#12427](https://github.com/containerd/containerd/pull/12427))
  * [`98e0e73de`](https://github.com/containerd/containerd/commit/98e0e73de78c18bbb15f2e3194a7837c20a6eff4) CI: skip ubuntu-24.04-arm on private repos
* Disable event subscriber during task cleanup ([#12410](https://github.com/containerd/containerd/pull/12410))
  * [`a3770cf83`](https://github.com/containerd/containerd/commit/a3770cf83bc55558977b669495f5b6ed8abcc978) cri/server/podsandbox: disable event subscriber
* Fix lost container logs from quickly closing io ([#12377](https://github.com/containerd/containerd/pull/12377))
  * [`7d9f09ba0`](https://github.com/containerd/containerd/commit/7d9f09ba048da562cdc0a971be439641c87aedcf) bugfix:fix container logs lost because io close too quickly
* ci: bump Go 1.24.8 ([#12360](https://github.com/containerd/containerd/pull/12360))
  * [`d1cab3cc5`](https://github.com/containerd/containerd/commit/d1cab3cc58c001d314d638419032c0de0a8c1eb1) ci: bump Go 1.24.8
* Prevent goroutine hangs during ProgressTracker shutdown ([#12336](https://github.com/containerd/containerd/pull/12336))
  * [`9b57a4d35`](https://github.com/containerd/containerd/commit/9b57a4d35a9728ccb99a03b1a27cca8b431e99ab) Prevent goroutine hangs during ProgressTracker shutdown
* Ensure errContentRangeIgnored error when range-get request is ignored ([#12312](https://github.com/containerd/containerd/pull/12312))
  * [`ca3de4fe7`](https://github.com/containerd/containerd/commit/ca3de4fe7b3219d1d2f8ac9482b93b0e63b52801) Ensure errContentRangeIgnored error when range-get request is ignored by registry
* Remove additional fuzzers from instrumentation repo ([#12313](https://github.com/containerd/containerd/pull/12313))
  * [`dfffe3d9c`](https://github.com/containerd/containerd/commit/dfffe3d9c59f85151bf3a2eceeca1c6e61f5e8a0) Remove additional fuzzers from CI
* update release builds to 1.24.7 and add 1.25.1 to CI ([#12258](https://github.com/containerd/containerd/pull/12258))
  * [`c54585ba7`](https://github.com/containerd/containerd/commit/c54585ba72f68ff3df49c16ecc19793d8d872e88) update release builds to 1.24.7 and add 1.25.1 to CI
* runc:Update runc binary to v1.3.1 ([#12277](https://github.com/containerd/containerd/pull/12277))
  * [`f0a48ce38`](https://github.com/containerd/containerd/commit/f0a48ce38a34730ce56d8e97436c2b92e9fd7156) runc:Update runc binary to v1.3.1
* Add SystemdCgroup to default runtime options ([#12253](https://github.com/containerd/containerd/pull/12253))
  * [`f13f8c431`](https://github.com/containerd/containerd/commit/f13f8c4313c18b99f8d5e6f71cf9257a0b8d2f64) add SystemdCgroup to default runtime options
* install-runhcs-shim: fetch target commit instead of tags ([#12256](https://github.com/containerd/containerd/pull/12256))
  * [`42bb71e1e`](https://github.com/containerd/containerd/commit/42bb71e1e5bd40299d1ca58335d108ca64dbc203) install-runhcs-shim: fetch target commit instead of tags
* Fix userns with container image VOLUME mounts that need copy ([#12242](https://github.com/containerd/containerd/pull/12242))
  * [`10944e19f`](https://github.com/containerd/containerd/commit/10944e19f78c0286327838728dac0e3ee2bbb0a1) integration: Add test for directives with userns
  * [`41d74aee2`](https://github.com/containerd/containerd/commit/41d74aee202409a8b15029615a9c0a95ef1a9f29) cri: Fix userns with Dockerfile VOLUME mounts that need copy
* Fix overlayfs issues related to user namespace ([#12222](https://github.com/containerd/containerd/pull/12222))
  * [`f40bfc46b`](https://github.com/containerd/containerd/commit/f40bfc46b0b680f07299c05623d7383cd4204bcb) core/mount: Retry unmounting idmapped directories
  * [`1f51d2dea`](https://github.com/containerd/containerd/commit/1f51d2deada6bf493214c78069d93e94dc226091) core/mount: Test cleanup of DoPrepareIDMappedOverlay()
  * [`8fbf8c503`](https://github.com/containerd/containerd/commit/8fbf8c503ef9ebf837f82a40b9ea54f98d9dccbe) core/mount: Properly cleanup on doPrepareIDMappedOverlay errors
  * [`b9d678e15`](https://github.com/containerd/containerd/commit/b9d678e15e27ab45a7cfa9876a46f88afeaca90c) core/mount: Don't call nil function on errors
  * [`583fe2d24`](https://github.com/containerd/containerd/commit/583fe2d244568d585c9b5688d42a24e2cf407709) core/mount: Only idmap once per overlayfs, not per layer
* Add documentation for cgroup_writable field ([#12229](https://github.com/containerd/containerd/pull/12229))
  * [`4832b4d15`](https://github.com/containerd/containerd/commit/4832b4d1541ab01b35e087afda266cef8a66416c) Add documentation for cgroup_writable field
* fix: create bootstrap.json with 0644 permission ([#12183](https://github.com/containerd/containerd/pull/12183))
  * [`3c174cf64`](https://github.com/containerd/containerd/commit/3c174cf64e5b4e6cdae6f06e091e458120390fe7) fix: create bootstrap.json with 0644 permission
* ci: bump Go 1.23.12, 1.24.6 ([#12186](https://github.com/containerd/containerd/pull/12186))
  * [`74b0505eb`](https://github.com/containerd/containerd/commit/74b0505ebd86e8e27f80606322a8c3af73f00e33) ci: bump Go 1.23.12, 1.24.6
* sys: fix pidfd leak in UnshareAfterEnterUserns ([#12179](https://github.com/containerd/containerd/pull/12179))
  * [`5ef6ea747`](https://github.com/containerd/containerd/commit/5ef6ea7470dd18e3c93f21c2ea5004f6e72b0642) sys: fix pidfd leak in UnshareAfterEnterUserns
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.1.4](https://github.com/containerd/containerd/releases/tag/v2.1.4)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

v2.0.7

4ac6c20c · Merge pull request #12482 from austinvazquez/prep_2_0_7 · Nov 05, 2025

containerd 2.0.7

Welcome to the v2.0.7 release of containerd!

The seventh patch release for containerd 2.0 includes various bug fixes and updates.

### Security Updates

* **containerd**
  * [**GHSA-pwhc-rpq9-4c8w**](https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
  * [**GHSA-m6hq-p25p-ffr2**](https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

* **runc**
  * [**GHSA-qw9x-cqr3-wc7r**](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
  * [**GHSA-cgrx-mc8f-2prm**](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
  * [**GHSA-9493-h29p-rfm2**](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)

### Highlights

#### Container Runtime Interface (CRI)

* **Disable event subscriber during task cleanup** ([#12406](https://github.com/containerd/containerd/pull/12406))
* **Add SystemdCgroup to default runtime options** ([#12254](https://github.com/containerd/containerd/pull/12254))
* **Fix userns with container image VOLUME mounts that need copy** ([#12241](https://github.com/containerd/containerd/pull/12241))

#### Image Distribution

* **Add dial timeout field to hosts toml configuration** ([#12136](https://github.com/containerd/containerd/pull/12136))

#### Runtime

* **Update runc binary to v1.3.3** ([#12479](https://github.com/containerd/containerd/pull/12479))
* **Fix lost container logs from quickly closing io** ([#12376](https://github.com/containerd/containerd/pull/12376))
* **Create bootstrap.json with 0644 permission** ([#12184](https://github.com/containerd/containerd/pull/12184))
* **Fix pidfd leak in UnshareAfterEnterUserns** ([#12178](https://github.com/containerd/containerd/pull/12178))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Austin Vazquez
* Phil Estes
* Rodrigo Campos
* Wei Fu
* Akihiro Suda
* Derek McGowan
* Maksym Pavlenko
* ningmingxiao
* Kirtana Ashok
* Akhil Mohan
* Andrew Halaney
* Jin Dong
* Jose Fernandez
* Mike Baynton
* Philip Laine
* Swagat Bora
* wheat2018

### Changes
<details><summary>56 commits</summary>
<p>

* Prepare release notes for v2.0.7 ([#12482](https://github.com/containerd/containerd/pull/12482))
  * [`4931e24f1`](https://github.com/containerd/containerd/commit/4931e24f169091cb4e425b7bfdd4fb0d3c20543b) Prepare release notes for v2.0.7
  * [`205bc4f2d`](https://github.com/containerd/containerd/commit/205bc4f2dbce3df32d2d5140a3d039332b02dbe6) Update mailmap
  * [`5f708b76a`](https://github.com/containerd/containerd/commit/5f708b76a41a1cf56e167971e271c7581cb2f8cb) Merge commit from fork
  * [`8cd112d82`](https://github.com/containerd/containerd/commit/8cd112d8295bafcf4a992816ff9e07f5a78ff71b) Fix directory permissions
  * [`05290b5bc`](https://github.com/containerd/containerd/commit/05290b5bc8fd938c8f77856927a280a1d5eec7b6) Merge commit from fork
  * [`4d1edf4ad`](https://github.com/containerd/containerd/commit/4d1edf4addf8c31b096680f04fee499cabc75439) fix goroutine leak of container Attach
* Update runc binary to v1.3.3 ([#12479](https://github.com/containerd/containerd/pull/12479))
  * [`b46dc6a67`](https://github.com/containerd/containerd/commit/b46dc6a67cc575a83db083f71dcdbc722605c841) runc: Update runc binary to v1.3.3
* ci: bump Go 1.24.9; 1.25.3 ([#12361](https://github.com/containerd/containerd/pull/12361))
  * [`5e9c82178`](https://github.com/containerd/containerd/commit/5e9c821780ff705c47406bf7a72d476da398135c) Update GHA runners to use latest images for basic binaries build
  * [`7f59248dc`](https://github.com/containerd/containerd/commit/7f59248dcd66cb0c418669a880e0c1d7e48e0dfa) Update GHA runners to use latest image for most jobs
  * [`e1373e8a8`](https://github.com/containerd/containerd/commit/e1373e8a8abf94b28507972694f8aea17f1b10c5) ci: bump Go 1.24.9, 1.25.3
  * [`e1a910a6a`](https://github.com/containerd/containerd/commit/e1a910a6a989b2cb0ed1ae4fda42eacbb6361e4b) ci: bump Go 1.24.8; 1.25.2
  * [`fd04b7f17`](https://github.com/containerd/containerd/commit/fd04b7f176ec52d17e0014d07d045d6fa79bd620) move exclude-dirs to issues.exclude-dirs
  * [`b49377975`](https://github.com/containerd/containerd/commit/b493779751d070255648e6b1e75dc9af8516c347) update golangci-lint to v1.64.2
  * [`6e45022a1`](https://github.com/containerd/containerd/commit/6e45022a1e01fd1c78217df3b271d7735b8c4440) build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
  * [`09ce0f2a1`](https://github.com/containerd/containerd/commit/09ce0f2a1ee5b1524c95c3831ed124e5d4fd0a2b) build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
  * [`de63a740b`](https://github.com/containerd/containerd/commit/de63a740b8108c62bf018cf1f508bb9e5842bfd2) build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
* Fix lost container logs from quickly closing io ([#12376](https://github.com/containerd/containerd/pull/12376))
  * [`f953ee8a3`](https://github.com/containerd/containerd/commit/f953ee8a3c1feeaa60a3c9d386afa424040d56de) bugfix:fix container logs lost because io close too quickly
* CI: update Fedora to 43 ([#12448](https://github.com/containerd/containerd/pull/12448))
  * [`f6f15f513`](https://github.com/containerd/containerd/commit/f6f15f5135d313309a76fc6545e7cf86653d2f6e) CI: update Fedora to 43
* Disable event subscriber during task cleanup ([#12406](https://github.com/containerd/containerd/pull/12406))
  * [`2a2329cbd`](https://github.com/containerd/containerd/commit/2a2329cbd02dc5e1a3010730fab01c618dad768c) cri/server/podsandbox: disable event subscriber
* CI: skip ubuntu-24.04-arm on private repos ([#12428](https://github.com/containerd/containerd/pull/12428))
  * [`dfb954743`](https://github.com/containerd/containerd/commit/dfb95474370ef22c4555178a3d7cc34df2a3f5bc) CI: skip ubuntu-24.04-arm on private repos
* Remove additional fuzzers from instrumentation repo ([#12420](https://github.com/containerd/containerd/pull/12420))
  * [`f6b02f6bb`](https://github.com/containerd/containerd/commit/f6b02f6bb81dc079f60d421347c931c73d4227e7) Remove additional fuzzers from CI
* runc:Update runc binary to v1.3.1 ([#12275](https://github.com/containerd/containerd/pull/12275))
  * [`75c13ee3f`](https://github.com/containerd/containerd/commit/75c13ee3fc3657ee419395e20820d1cbd4bb2f88) runc:Update runc binary to v1.3.1
* Add SystemdCgroup to default runtime options ([#12254](https://github.com/containerd/containerd/pull/12254))
  * [`427cdd06c`](https://github.com/containerd/containerd/commit/427cdd06c9d093ede03384c550a440b0522e44ba) add SystemdCgroup to default runtime options
* install-runhcs-shim: fetch target commit instead of tags ([#12255](https://github.com/containerd/containerd/pull/12255))
  * [`0b35e19fb`](https://github.com/containerd/containerd/commit/0b35e19fb118b5144a75397522e476d0571ae9ef) install-runhcs-shim: fetch target commit instead of tags
* Fix userns with container image VOLUME mounts that need copy ([#12241](https://github.com/containerd/containerd/pull/12241))
  * [`3212afc2f`](https://github.com/containerd/containerd/commit/3212afc2f2d464157bcb24663360ee7dfa7207e6) integration: Add test for directives with userns
  * [`b855c6e10`](https://github.com/containerd/containerd/commit/b855c6e10372eb43d51186ab156cdce3d9eefb04) cri: Fix userns with Dockerfile VOLUME mounts that need copy
* Fix overlayfs issues related to user namespace ([#12223](https://github.com/containerd/containerd/pull/12223))
  * [`05c0c99f4`](https://github.com/containerd/containerd/commit/05c0c99f432b341152b54ce49d9b43c5cf3d131f) core/mount: Retry unmounting idmapped directories
  * [`afdede4ce`](https://github.com/containerd/containerd/commit/afdede4ced8c848191062b31dfcff1352161a844) core/mount: Test cleanup of DoPrepareIDMappedOverlay()
  * [`47205f814`](https://github.com/containerd/containerd/commit/47205f814d552a4eea9935375dd2f0874e107e5b) core/mount: Properly cleanup on doPrepareIDMappedOverlay errors
  * [`6f4abd970`](https://github.com/containerd/containerd/commit/6f4abd970aeea241f07edc1e0fd74f69a9a05979) core/mount: Don't call nil function on errors
  * [`a2f0d65d7`](https://github.com/containerd/containerd/commit/a2f0d65d78871832da6d2aa452aeeb180cd6d8f5) core/mount: Only idmap once per overlayfs, not per layer
  * [`1c32accd7`](https://github.com/containerd/containerd/commit/1c32accd71d34e3cb5798214adf26911609d11f1) Make ovl idmap mounts read-only
* ci: bump Go 1.23.12, 1.24.6 ([#12187](https://github.com/containerd/containerd/pull/12187))
  * [`9e72e91e6`](https://github.com/containerd/containerd/commit/9e72e91e63a75147f2a082565fc580babee8af06) ci: bump Go 1.23.12, 1.24.6
* Create bootstrap.json with 0644 permission ([#12184](https://github.com/containerd/containerd/pull/12184))
  * [`009622e04`](https://github.com/containerd/containerd/commit/009622e0424fa4234d67272339fb7e282c302190) fix: create bootstrap.json with 0644 permission
* Fix pidfd leak in UnshareAfterEnterUserns ([#12178](https://github.com/containerd/containerd/pull/12178))
  * [`5bec0a332`](https://github.com/containerd/containerd/commit/5bec0a33297ad485f96116efb333ea750a27c926) sys: fix pidfd leak in UnshareAfterEnterUserns
* Fix windows test failures ([#12120](https://github.com/containerd/containerd/pull/12120))
  * [`2a2488131`](https://github.com/containerd/containerd/commit/2a2488131e3602bbbecf4afa11d0f3e4135f01a4) Fix intermittent test failures on Windows CIs
  * [`018470948`](https://github.com/containerd/containerd/commit/018470948db89512760e9c25d4c5da9c7bef5321) Remove WS2025 from CIs due to regression
* Add dial timeout field to hosts toml configuration ([#12136](https://github.com/containerd/containerd/pull/12136))
  * [`b50cbbc98`](https://github.com/containerd/containerd/commit/b50cbbc98550580b2baf5565ec5f1a3ded422b0e) Add dial timeout field to hosts toml configuration
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v2.0.6](https://github.com/containerd/containerd/releases/tag/v2.0.6)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

v1.7.29

442cb34b · Merge commit from fork · Nov 05, 2025

containerd 1.7.29

Welcome to the v1.7.29 release of containerd!

The twenty-ninth patch release for containerd 1.7 contains various fixes
and updates including security patches.

### Security Updates

* **containerd**
  * [**GHSA-pwhc-rpq9-4c8w**](https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w)
  * [**GHSA-m6hq-p25p-ffr2**](https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2)

* **runc**
  * [**GHSA-qw9x-cqr3-wc7r**](https://github.com/opencontainers/runc/security/advisories/GHSA-qw9x-cqr3-wc7r)
  * [**GHSA-cgrx-mc8f-2prm**](https://github.com/opencontainers/runc/security/advisories/GHSA-cgrx-mc8f-2prm)
  * [**GHSA-9493-h29p-rfm2**](https://github.com/opencontainers/runc/security/advisories/GHSA-9493-h29p-rfm2)

### Highlights

#### Image Distribution

* **Update differ to handle zstd media types** ([#12018](https://github.com/containerd/containerd/pull/12018))

#### Runtime

* **Update runc binary to v1.3.3** ([#12480](https://github.com/containerd/containerd/pull/12480))
* **Fix lost container logs from quickly closing io** ([#12375](https://github.com/containerd/containerd/pull/12375))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Phil Estes
* Austin Vazquez
* Sebastiaan van Stijn
* ningmingxiao
* Maksym Pavlenko
* StepSecurity Bot
* wheat2018

### Changes
<details><summary>38 commits</summary>
<p>

  * [`442cb34bd`](https://github.com/containerd/containerd/commit/442cb34bda9a6a0fed82a2ca7cade05c5c749582) Merge commit from fork
  * [`0450f046e`](https://github.com/containerd/containerd/commit/0450f046e6942e513d0ebf1ef5c2aff13daa187f) Fix directory permissions
  * [`e5cb6ddb7`](https://github.com/containerd/containerd/commit/e5cb6ddb7a7730c24253a94d7fdb6bbe13dba6f7) Merge commit from fork
  * [`c575d1b5f`](https://github.com/containerd/containerd/commit/c575d1b5f4011f33b32f71ace75367a92b08c750) fix goroutine leak of container Attach
* Prepare release notes for v1.7.29 ([#12486](https://github.com/containerd/containerd/pull/12486))
  * [`1fc2daaf3`](https://github.com/containerd/containerd/commit/1fc2daaf3ed53f4c9e76fbc5786a6f1ae3bb885f) Prepare release notes for v1.7.29
* Update runc binary to v1.3.3 ([#12480](https://github.com/containerd/containerd/pull/12480))
  * [`3f5f9f872`](https://github.com/containerd/containerd/commit/3f5f9f872707a743563d316e85e530193a2e30ac) runc: Update runc binary to v1.3.3
* Update GHA images and bump Go 1.24.9; 1.25.3 ([#12471](https://github.com/containerd/containerd/pull/12471))
  * [`667409fb6`](https://github.com/containerd/containerd/commit/667409fb63098cb80280940ab06038114e7712da) ci: bump Go 1.24.9, 1.25.3
  * [`294f8c027`](https://github.com/containerd/containerd/commit/294f8c027b607c4450b3e52f44280581a737a73f) Update GHA runners to use latest images for basic binaries build
  * [`cf66b4141`](https://github.com/containerd/containerd/commit/cf66b4141defb757dee0fc5653bfd0a7ba1e8fed) Update GHA runners to use latest image for most jobs
  * [`fa3e6fa18`](https://github.com/containerd/containerd/commit/fa3e6fa18aa8dc7e699428958e1fb1d38e832e15) pkg/epoch: extract parsing SOURCE_DATE_EPOCH to a function
  * [`ac334bffc`](https://github.com/containerd/containerd/commit/ac334bffc4e759f188afb58efd74a603ade0855a) pkg/epoch: fix tests on macOS
  * [`d04b8721f`](https://github.com/containerd/containerd/commit/d04b8721fc5bff2677beadb4f3d15d7c0ec989ca) pkg/epoch: replace some fmt.Sprintfs with strconv
* CI: update Fedora to 43 ([#12450](https://github.com/containerd/containerd/pull/12450))
  * [`5cfedbf52`](https://github.com/containerd/containerd/commit/5cfedbf52300d09f77a51f02a0c784c37284302c) CI: update Fedora to 43
* CI: skip ubuntu-24.04-arm on private repos ([#12429](https://github.com/containerd/containerd/pull/12429))
  * [`cf99a012d`](https://github.com/containerd/containerd/commit/cf99a012d6f7fcb51afdea641d87474dae95f50d) CI: skip ubuntu-24.04-arm on private repos
* runc:Update runc binary to v1.3.1 ([#12276](https://github.com/containerd/containerd/pull/12276))
  * [`4c77b8d07`](https://github.com/containerd/containerd/commit/4c77b8d078a65a5e99e40847a9eaa18a944ff68e) runc:Update runc binary to v1.3.1
* Fix lost container logs from quickly closing io ([#12375](https://github.com/containerd/containerd/pull/12375))
  * [`d30024db2`](https://github.com/containerd/containerd/commit/d30024db25590e6ec74b639746a5dc792f5c1403) bugfix:fix container logs lost because io close too quickly
* ci: bump Go 1.24.8 ([#12362](https://github.com/containerd/containerd/pull/12362))
  * [`f4b3d96f3`](https://github.com/containerd/containerd/commit/f4b3d96f3d83a0ac7bde03ae9eec749aa1936a59) ci: bump Go 1.24.8
  * [`334fd8e4b`](https://github.com/containerd/containerd/commit/334fd8e4b974d88ebea43a998d76760aad49773a) update golangci-lint to v1.64.2
  * [`8a67abc4c`](https://github.com/containerd/containerd/commit/8a67abc4cac67bf806da0b2b55ac7159e91f6996) Drop inactivated linter exportloopref
  * [`e4dbf08f0`](https://github.com/containerd/containerd/commit/e4dbf08f0ff3dc9f6b2a9a36eab71d73ac707956) build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
  * [`d7db2ba06`](https://github.com/containerd/containerd/commit/d7db2ba063385d06132ec80890eb6c1fe4126692) build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
  * [`d7182888f`](https://github.com/containerd/containerd/commit/d7182888f0071cce86d40fcf09cd9a247ac15c41) build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
  * [`4be6c7e3b`](https://github.com/containerd/containerd/commit/4be6c7e3b5d5da7be8c1c87e1c16450b7ea8dadb) build(deps): bump actions/cache from 4.1.2 to 4.2.0
  * [`a2e097e86`](https://github.com/containerd/containerd/commit/a2e097e865887382c2fc29ee0cea0053e6152a12) build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  * [`6de404d11`](https://github.com/containerd/containerd/commit/6de404d11b8e237a7867c7fbe535579c5736bfde) build(deps): bump actions/cache from 4.1.1 to 4.1.2
  * [`038a25584`](https://github.com/containerd/containerd/commit/038a25584e7f66272114ec0801b071e6149ef841) [StepSecurity] ci: Harden GitHub Actions
* Update differ to handle zstd media types ([#12018](https://github.com/containerd/containerd/pull/12018))
  * [`eaeb4b6ac`](https://github.com/containerd/containerd/commit/eaeb4b6ac581c0704bed0ff96ee7e53170345e84) Update differ to handle zstd media types
* ci: bump Go 1.23.12, 1.24.6 ([#12188](https://github.com/containerd/containerd/pull/12188))
  * [`83c535339`](https://github.com/containerd/containerd/commit/83c535339bbe253ce9e7a616a90f770994b754e5) ci: bump Go 1.23.12, 1.24.6
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v1.7.28](https://github.com/containerd/containerd/releases/tag/v1.7.28)

Unverified

api/v1.10.0

8b34ce39 · Merge pull request #12472 from dmcgowan/prepare-api-v1.10.0 · Nov 05, 2025

containerd api/v1.10.0

Welcome to the api/v1.10.0 release of containerd!

The 11th release for the containerd 1.x API aligns with the containerd 2.2 release.

### Highlights

* **Add mount manager**

  The mount manager is a new service that provides lifecycle management for filesystem mounts
  to support more advanced use cases, such as:
  * **Device formatting** to create formatted filesystems (xfs, ext4) on-demand
  * **Mount activation** to prepare devices such as loopbacks or network fileystems
  * **Mount transformation** to allow mount arguments to be filled in dynamically from previous mounts
  * **Garbage collection** of mounts to ensure temporary mounts are never leaked ([#12063](https://github.com/containerd/containerd/pull/12063))

#### Image Distribution

* **Parallel Unpack**

  Adds support for unpacking layers in parallel during pull operations. This feature is supported with overlayfs and EROFS snapshotters. ([#12332](https://github.com/containerd/containerd/pull/12332))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Henry Wang
* Phil Estes
* Wei Fu

### Changes
<details><summary>14 commits</summary>
<p>

* Prepare release notes for api/v1.10.0 ([#12472](https://github.com/containerd/containerd/pull/12472))
  * [`69c855bb5`](https://github.com/containerd/containerd/commit/69c855bb54f53311cd5f8854719d8428dd692f96) Prepare release notes for api/v1.10.0
* api/go.mod: golang.org/x/net v0.38.0 ([#12430](https://github.com/containerd/containerd/pull/12430))
  * [`4c7b94fce`](https://github.com/containerd/containerd/commit/4c7b94fce7bd19abce9b78538e3218b572f98127) api/go.mod: golang.org/x/net v0.38.0
* Prepare release notes for api/v1.10.0-rc.0 ([#12408](https://github.com/containerd/containerd/pull/12408))
  * [`fbc7848f2`](https://github.com/containerd/containerd/commit/fbc7848f2378afa2cf58c868bfcab1467f3ccccd) Prepare release notes for api/v1.10.0-rc.0
* Add parallel unpack support ([#12332](https://github.com/containerd/containerd/pull/12332))
  * [`0198b87fc`](https://github.com/containerd/containerd/commit/0198b87fcfb31492c23de83059291efc0f06a1f9) Implement parallel unpack
* Prepare release notes for api/v1.10.0-beta.0 ([#12346](https://github.com/containerd/containerd/pull/12346))
  * [`aa571f63c`](https://github.com/containerd/containerd/commit/aa571f63c6529d827bfef02956a8db9bee57ab8c) Prepare release notes for api/v1.10.0-beta.0
* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
  * [`8db301086`](https://github.com/containerd/containerd/commit/8db3010865ae9926aed6c5e476a7c6b2413b44d5) Add mounts api service
  * [`67fbf9db9`](https://github.com/containerd/containerd/commit/67fbf9db9cbf6ae83df58d18a19f32b28ebc0017) Generate and vendor proto changes
  * [`c5097ac63`](https://github.com/containerd/containerd/commit/c5097ac63fd704213c507a2b712fa2db7744090b) Add mount manager to protobuf services and types
</p>
</details>

### Dependency Changes

* **golang.org/x/net**  v0.37.0 -> v0.38.0

Previous release can be found at [api/v1.9.0](https://github.com/containerd/containerd/releases/tag/api/v1.9.0)

Unverified

v2.2.0-rc.1

8bcea102 · Merge pull request #12458 from dmcgowan/fix-referrers-manifest-size · Nov 03, 2025

containerd 2.2.0-rc.1

Welcome to the v2.2.0-rc.1 release of containerd!
*This is a pre-release of containerd*

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

### Highlights

* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
* Add conf.d include in the default config ([#12323](https://github.com/containerd/containerd/pull/12323))
* Add support for back references in the garbage collector ([#12025](https://github.com/containerd/containerd/pull/12025))

#### Container Runtime Interface (CRI)

* Implement CRI ListPodSandboxMetrics ([#10691](https://github.com/containerd/containerd/pull/10691))
* Support image volume mount subpath ([#11578](https://github.com/containerd/containerd/pull/11578))

#### Go client

* Update pkg/oci to use fs.FS interface and os.OpenRoot ([#12245](https://github.com/containerd/containerd/pull/12245))

#### Image Distribution

* Add parallel unpack support ([#12332](https://github.com/containerd/containerd/pull/12332))
* Add referrers fetcher to remotes ([#12309](https://github.com/containerd/containerd/pull/12309))
* Tar unpack progress through transfer service ([#11921](https://github.com/containerd/containerd/pull/11921))

#### Image Storage

* Update erofs snapshotter to use mount manager ([#12333](https://github.com/containerd/containerd/pull/12333))
* Add snapshotter and differ for block CIMs ([#12050](https://github.com/containerd/containerd/pull/12050))
* Add tar index mode to erofs snapshotter ([#11919](https://github.com/containerd/containerd/pull/11919))

#### Node Resource Interface (NRI)

* Enable otel traces in NRI ([#12082](https://github.com/containerd/containerd/pull/12082))
* Add WASM plugin support ([containerd/nri#121](https://github.com/containerd/nri/pull/121))

#### Runtime

* Improve shim load time after restart by loading in parallel ([#12142](https://github.com/containerd/containerd/pull/12142))
* Fix pidfd leak in UnshareAfterEnterUserns ([#12167](https://github.com/containerd/containerd/pull/12167))

#### Deprecations

* Deprecate cgroup v1 ([#12445](https://github.com/containerd/containerd/pull/12445))
* Postpone v2.2 deprecation items to v2.3 ([#12417](https://github.com/containerd/containerd/pull/12417))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Akihiro Suda
* Maksym Pavlenko
* Wei Fu
* Krisztian Litkey
* Mike Brown
* Akhil Mohan
* Markus Lehtonen
* Samuel Karp
* Sebastiaan van Stijn
* ningmingxiao
* Austin Vazquez
* yashsingh74
* Gao Xiang
* Jin Dong
* Chris Henzie
* Kirtana Ashok
* Aadhar Agarwal
* Etienne Champetier
* Henry Wang
* Rodrigo Campos
* Sascha Grunert
* Aleksa Sarai
* Eric Mountain
* Keith Mattix II
* Paweł Gronowski
* Tõnis Tiigi
* Adrien Delorme
* Apurv Barve
* Enji Cooper
* Kohei Tokunaga
* Max Jonas Werner
* Rehan Khan
* Yang Yang
* jinda.ljd
* jokemanfire
* Amit Barve
* Andrew Halaney
* Antonio Ojea
* Brian Goff
* Carlos Eduardo Arango Gutierrez
* Chenyang Yan
* Dawei Wei
* Divya Rani
* Evan Anderson
* Fabiano Fidêncio
* Iceber Gu
* Jared Ledvina
* Jonathan Perkin
* Jose Fernandez
* Karl Baumgartner
* Osama Abdelkader
* Radostin Stoyanov
* Ruidong Cao
* Sameer
* Sergey Kanzhelev
* Swagat Bora
* Sylvain MOUQUET
* Tom Wieczorek
* Tycho Andersen
* Ubuntu
* Wuyue (Tony) Sun
* suranmiao
* tanhuaan
* zounengren

### Dependency Changes

* **dario.cat/mergo**                                                    v1.0.1 -> v1.0.2
* **github.com/Microsoft/hcsshim**                                       v0.13.0-rc.3 -> v0.14.0-rc.1
* **github.com/StackExchange/wmi**                                       cbe66965904d **_new_**
* **github.com/checkpoint-restore/checkpointctl**                        v1.3.0 -> v1.4.0
* **github.com/containerd/cgroups/v3**                                   v3.0.5 -> v3.1.0
* **github.com/containerd/console**                                      v1.0.4 -> v1.0.5
* **github.com/containerd/containerd/api**                               v1.9.0 -> v1.10.0-rc.0
* **github.com/containerd/go-cni**                                       v1.1.12 -> v1.1.13
* **github.com/containerd/nri**                                          v0.8.0 -> v0.10.0
* **github.com/containernetworking/plugins**                             v1.7.1 -> v1.8.0
* **github.com/coreos/go-systemd/v22**                                   v22.5.0 -> v22.6.0
* **github.com/cpuguy83/go-md2man/v2**                                   v2.0.5 -> v2.0.7
* **github.com/emicklei/go-restful/v3**                                  v3.11.0 -> v3.13.0
* **github.com/fxamacker/cbor/v2**                                       v2.7.0 -> v2.9.0
* **github.com/go-jose/go-jose/v4**                                      v4.0.5 -> v4.1.2
* **github.com/go-logr/logr**                                            v1.4.2 -> v1.4.3
* **github.com/go-ole/go-ole**                                           v1.2.6 **_new_**
* **github.com/golang/groupcache**                                       41bb18bfe9da -> 2c02b8208cf8
* **github.com/google/certtostore**                                      v1.0.6 **_new_**
* **github.com/google/deck**                                             105ad94aa8ae **_new_**
* **github.com/gorilla/websocket**                                       v1.5.0 -> e064f32e3674
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**  v1.0.1 -> v1.1.0
* **github.com/hashicorp/errwrap**                                       v1.1.0 **_new_**
* **github.com/intel/goresctrl**                                         v0.8.0 -> v0.9.0
* **github.com/klauspost/compress**                                      v1.18.0 -> v1.18.1
* **github.com/knqyf263/go-plugin**                                      v0.9.0 **_new_**
* **github.com/moby/sys/capability**                                     v0.4.0 **_new_**
* **github.com/modern-go/reflect2**                                      v1.0.2 -> 35a7c28c31ee
* **github.com/opencontainers/runtime-tools**                            2e043c6bd626 -> 0ea5ed0382a2
* **github.com/prometheus/client_golang**                                v1.22.0 -> v1.23.2
* **github.com/prometheus/client_model**                                 v0.6.1 -> v0.6.2
* **github.com/prometheus/common**                                       v0.62.0 -> v0.66.1
* **github.com/prometheus/procfs**                                       v0.15.1 -> v0.16.1
* **github.com/stretchr/testify**                                        v1.10.0 -> v1.11.1
* **github.com/tchap/go-patricia/v2**                                    v2.3.2 -> v2.3.3
* **github.com/tetratelabs/wazero**                                      v1.9.0 **_new_**
* **github.com/urfave/cli/v2**                                           v2.27.6 -> v2.27.7
* **github.com/vishvananda/netlink**                                     0e7078ed04c8 -> v1.3.1
* **go.etcd.io/bbolt**                                                   v1.4.0 -> v1.4.3
* **go.opentelemetry.io/otel**                                           v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/metric**                                    v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/sdk**                                       v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/trace**                                     v1.35.0 -> v1.37.0
* **go.uber.org/goleak**                                                 v1.3.0 **_new_**
* **go.yaml.in/yaml/v2**                                                 v2.4.2 **_new_**
* **golang.org/x/crypto**                                                v0.36.0 -> v0.41.0
* **golang.org/x/mod**                                                   v0.24.0 -> v0.29.0
* **golang.org/x/net**                                                   v0.38.0 -> v0.43.0
* **golang.org/x/oauth2**                                                v0.27.0 -> v0.30.0
* **golang.org/x/sync**                                                  v0.14.0 -> v0.17.0
* **golang.org/x/sys**                                                   v0.33.0 -> v0.37.0
* **golang.org/x/term**                                                  v0.30.0 -> v0.34.0
* **golang.org/x/text**                                                  v0.23.0 -> v0.28.0
* **golang.org/x/time**                                                  v0.7.0 -> v0.14.0
* **google.golang.org/genproto/googleapis/api**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/genproto/googleapis/rpc**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/grpc**                                             v1.72.0 -> v1.76.0
* **google.golang.org/protobuf**                                         v1.36.6 -> v1.36.10
* **k8s.io/api**                                                         v0.32.3 -> v0.34.1
* **k8s.io/apimachinery**                                                v0.32.3 -> v0.34.1
* **k8s.io/client-go**                                                   v0.32.3 -> v0.34.1
* **k8s.io/cri-api**                                                     v0.32.3 -> v0.34.1
* **k8s.io/utils**                                                       3ea5e8cea738 -> 4c0f3b243397
* **sigs.k8s.io/json**                                                   9aa6b5e7a4b3 -> cfa47c3a1cc8
* **sigs.k8s.io/randfill**                                               v1.0.0 **_new_**
* **sigs.k8s.io/structured-merge-diff/v6**                               v6.3.0 **_new_**
* **sigs.k8s.io/yaml**                                                   v1.4.0 -> v1.6.0

Previous release can be found at [v2.1.0](https://github.com/containerd/containerd/releases/tag/v2.1.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

archive/debian/2.1.4_ds2-2

a0da7cbd · Add missing sources for containerd/{zfs,aufs} · Oct 31, 2025

containerd2 release 2.1.4~ds2-2 for experimental (rc-buggy) [dgit]

[dgit distro=debian split --quilt=gbp --deliberately-include-questionable-history]
[dgit split-maint-view-tag=bdbe34650d531d895bc849cd6f9e8482436b383e]

Unverified

debian/2.1.4_ds2-2

01392085 · debian/changelog: update · Oct 31, 2025

containerd2 release 2.1.4~ds2-2 for experimental (rc-buggy)

(maintainer view tag generated by dgit --quilt=gbp)

[dgit distro=debian split --quilt=gbp --deliberately-include-questionable-history]

Unverified

v2.2.0-rc.0

870bb7c8 · Merge pull request #12413 from dmcgowan/prepare-v2.2.0-rc.0 · Oct 29, 2025

containerd 2.2.0-rc.0

Welcome to the v2.2.0-rc.0 release of containerd!
*This is a pre-release of containerd*

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

### Highlights

* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
* Add conf.d include in the default config ([#12323](https://github.com/containerd/containerd/pull/12323))
* Add support for back references in the garbage collector ([#12025](https://github.com/containerd/containerd/pull/12025))

#### Container Runtime Interface (CRI)

* Implement CRI ListPodSandboxMetrics ([#10691](https://github.com/containerd/containerd/pull/10691))
* Support image volume mount subpath ([#11578](https://github.com/containerd/containerd/pull/11578))

#### Go client

* Update pkg/oci to use fs.FS interface and os.OpenRoot ([#12245](https://github.com/containerd/containerd/pull/12245))

#### Image Distribution

* Add parallel unpack support ([#12332](https://github.com/containerd/containerd/pull/12332))
* Add referrers fetcher to remotes ([#12309](https://github.com/containerd/containerd/pull/12309))
* Tar unpack progress through transfer service ([#11921](https://github.com/containerd/containerd/pull/11921))

#### Image Storage

* Update erofs snapshotter to use mount manager ([#12333](https://github.com/containerd/containerd/pull/12333))
* Add snapshotter and differ for block CIMs ([#12050](https://github.com/containerd/containerd/pull/12050))
* Add tar index mode to erofs snapshotter ([#11919](https://github.com/containerd/containerd/pull/11919))

#### Node Resource Interface (NRI)

* Enable otel traces in NRI ([#12082](https://github.com/containerd/containerd/pull/12082))
* Add WASM plugin support ([containerd/nri#121](https://github.com/containerd/nri/pull/121))

#### Runtime

* Improve shim load time after restart by loading in parallel ([#12142](https://github.com/containerd/containerd/pull/12142))
* Fix pidfd leak in UnshareAfterEnterUserns ([#12167](https://github.com/containerd/containerd/pull/12167))

#### Deprecations

* Postpone v2.2 deprecation items to v2.3 ([#12417](https://github.com/containerd/containerd/pull/12417))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Akihiro Suda
* Maksym Pavlenko
* Krisztian Litkey
* Wei Fu
* Mike Brown
* Markus Lehtonen
* Sebastiaan van Stijn
* Samuel Karp
* ningmingxiao
* Akhil Mohan
* Austin Vazquez
* yashsingh74
* Gao Xiang
* Jin Dong
* Chris Henzie
* Kirtana Ashok
* Aadhar Agarwal
* Etienne Champetier
* Henry Wang
* Rodrigo Campos
* Sascha Grunert
* Aleksa Sarai
* Eric Mountain
* Keith Mattix II
* Paweł Gronowski
* Tõnis Tiigi
* Adrien Delorme
* Apurv Barve
* Enji Cooper
* Kohei Tokunaga
* Max Jonas Werner
* Rehan Khan
* Yang Yang
* jinda.ljd
* jokemanfire
* Amit Barve
* Andrew Halaney
* Antonio Ojea
* Brian Goff
* Carlos Eduardo Arango Gutierrez
* Chenyang Yan
* Dawei Wei
* Divya Rani
* Evan Anderson
* Fabiano Fidêncio
* Iceber Gu
* Jared Ledvina
* Jonathan Perkin
* Jose Fernandez
* Karl Baumgartner
* Osama Abdelkader
* Radostin Stoyanov
* Ruidong Cao
* Sameer
* Sergey Kanzhelev
* Swagat Bora
* Sylvain MOUQUET
* Tom Wieczorek
* Tycho Andersen
* Ubuntu
* Wuyue (Tony) Sun
* suranmiao
* tanhuaan
* zounengren

### Dependency Changes

* **dario.cat/mergo**                                                    v1.0.1 -> v1.0.2
* **github.com/Microsoft/hcsshim**                                       v0.13.0-rc.3 -> v0.14.0-rc.1
* **github.com/StackExchange/wmi**                                       cbe66965904d **_new_**
* **github.com/checkpoint-restore/checkpointctl**                        v1.3.0 -> v1.4.0
* **github.com/containerd/cgroups/v3**                                   v3.0.5 -> v3.1.0
* **github.com/containerd/console**                                      v1.0.4 -> v1.0.5
* **github.com/containerd/containerd/api**                               v1.9.0 -> v1.10.0-rc.0
* **github.com/containerd/go-cni**                                       v1.1.12 -> v1.1.13
* **github.com/containerd/nri**                                          v0.8.0 -> v0.10.0
* **github.com/containernetworking/plugins**                             v1.7.1 -> v1.8.0
* **github.com/coreos/go-systemd/v22**                                   v22.5.0 -> v22.6.0
* **github.com/cpuguy83/go-md2man/v2**                                   v2.0.5 -> v2.0.7
* **github.com/emicklei/go-restful/v3**                                  v3.11.0 -> v3.13.0
* **github.com/fxamacker/cbor/v2**                                       v2.7.0 -> v2.9.0
* **github.com/go-jose/go-jose/v4**                                      v4.0.5 -> v4.1.2
* **github.com/go-logr/logr**                                            v1.4.2 -> v1.4.3
* **github.com/go-ole/go-ole**                                           v1.2.6 **_new_**
* **github.com/golang/groupcache**                                       41bb18bfe9da -> 2c02b8208cf8
* **github.com/google/certtostore**                                      v1.0.6 **_new_**
* **github.com/google/deck**                                             105ad94aa8ae **_new_**
* **github.com/gorilla/websocket**                                       v1.5.0 -> e064f32e3674
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**  v1.0.1 -> v1.1.0
* **github.com/hashicorp/errwrap**                                       v1.1.0 **_new_**
* **github.com/intel/goresctrl**                                         v0.8.0 -> v0.9.0
* **github.com/klauspost/compress**                                      v1.18.0 -> v1.18.1
* **github.com/knqyf263/go-plugin**                                      v0.9.0 **_new_**
* **github.com/moby/sys/capability**                                     v0.4.0 **_new_**
* **github.com/modern-go/reflect2**                                      v1.0.2 -> 35a7c28c31ee
* **github.com/opencontainers/runtime-tools**                            2e043c6bd626 -> 0ea5ed0382a2
* **github.com/prometheus/client_golang**                                v1.22.0 -> v1.23.2
* **github.com/prometheus/client_model**                                 v0.6.1 -> v0.6.2
* **github.com/prometheus/common**                                       v0.62.0 -> v0.66.1
* **github.com/prometheus/procfs**                                       v0.15.1 -> v0.16.1
* **github.com/stretchr/testify**                                        v1.10.0 -> v1.11.1
* **github.com/tchap/go-patricia/v2**                                    v2.3.2 -> v2.3.3
* **github.com/tetratelabs/wazero**                                      v1.9.0 **_new_**
* **github.com/urfave/cli/v2**                                           v2.27.6 -> v2.27.7
* **github.com/vishvananda/netlink**                                     0e7078ed04c8 -> v1.3.1
* **go.etcd.io/bbolt**                                                   v1.4.0 -> v1.4.3
* **go.opentelemetry.io/otel**                                           v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/metric**                                    v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/sdk**                                       v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/trace**                                     v1.35.0 -> v1.37.0
* **go.uber.org/goleak**                                                 v1.3.0 **_new_**
* **go.yaml.in/yaml/v2**                                                 v2.4.2 **_new_**
* **golang.org/x/crypto**                                                v0.36.0 -> v0.41.0
* **golang.org/x/mod**                                                   v0.24.0 -> v0.29.0
* **golang.org/x/net**                                                   v0.38.0 -> v0.43.0
* **golang.org/x/oauth2**                                                v0.27.0 -> v0.30.0
* **golang.org/x/sync**                                                  v0.14.0 -> v0.17.0
* **golang.org/x/sys**                                                   v0.33.0 -> v0.37.0
* **golang.org/x/term**                                                  v0.30.0 -> v0.34.0
* **golang.org/x/text**                                                  v0.23.0 -> v0.28.0
* **golang.org/x/time**                                                  v0.7.0 -> v0.14.0
* **google.golang.org/genproto/googleapis/api**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/genproto/googleapis/rpc**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/grpc**                                             v1.72.0 -> v1.76.0
* **google.golang.org/protobuf**                                         v1.36.6 -> v1.36.10
* **k8s.io/api**                                                         v0.32.3 -> v0.34.1
* **k8s.io/apimachinery**                                                v0.32.3 -> v0.34.1
* **k8s.io/client-go**                                                   v0.32.3 -> v0.34.1
* **k8s.io/cri-api**                                                     v0.32.3 -> v0.34.1
* **k8s.io/utils**                                                       3ea5e8cea738 -> 4c0f3b243397
* **sigs.k8s.io/json**                                                   9aa6b5e7a4b3 -> cfa47c3a1cc8
* **sigs.k8s.io/randfill**                                               v1.0.0 **_new_**
* **sigs.k8s.io/structured-merge-diff/v6**                               v6.3.0 **_new_**
* **sigs.k8s.io/yaml**                                                   v1.4.0 -> v1.6.0

Previous release can be found at [v2.1.0](https://github.com/containerd/containerd/releases/tag/v2.1.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

api/v1.10.0-rc.0

4f0b20fe · Merge pull request #12408 from dmcgowan/prepare-api-v1.10.0-rc.0 · Oct 24, 2025

containerd api/v1.10.0-rc.0

Welcome to the api/v1.10.0-rc.0 release of containerd!
*This is a pre-release of containerd*

The 11th release for the containerd 1.x API aligns with the containerd 2.2 release.

### Highlights

* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))

#### Image Distribution

* Add parallel unpack support ([#12332](https://github.com/containerd/containerd/pull/12332))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Henry Wang
* Wei Fu

### Changes
<details><summary>10 commits</summary>
<p>

* Prepare release notes for api/v1.10.0-rc.0 ([#12408](https://github.com/containerd/containerd/pull/12408))
  * [`fbc7848f2`](https://github.com/containerd/containerd/commit/fbc7848f2378afa2cf58c868bfcab1467f3ccccd) Prepare release notes for api/v1.10.0-rc.0
* Add parallel unpack support ([#12332](https://github.com/containerd/containerd/pull/12332))
  * [`0198b87fc`](https://github.com/containerd/containerd/commit/0198b87fcfb31492c23de83059291efc0f06a1f9) Implement parallel unpack
* Prepare release notes for api/v1.10.0-beta.0 ([#12346](https://github.com/containerd/containerd/pull/12346))
  * [`aa571f63c`](https://github.com/containerd/containerd/commit/aa571f63c6529d827bfef02956a8db9bee57ab8c) Prepare release notes for api/v1.10.0-beta.0
* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
  * [`8db301086`](https://github.com/containerd/containerd/commit/8db3010865ae9926aed6c5e476a7c6b2413b44d5) Add mounts api service
  * [`67fbf9db9`](https://github.com/containerd/containerd/commit/67fbf9db9cbf6ae83df58d18a19f32b28ebc0017) Generate and vendor proto changes
  * [`c5097ac63`](https://github.com/containerd/containerd/commit/c5097ac63fd704213c507a2b712fa2db7744090b) Add mount manager to protobuf services and types
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [api/v1.9.0](https://github.com/containerd/containerd/releases/tag/api/v1.9.0)

Unverified

v2.2.0-beta.2

995d9718 · Merge pull request #12311 from tonistiigi/referrers-support · Oct 21, 2025

containerd 2.2.0-beta.2

Welcome to the v2.2.0-beta.2 release of containerd!
*This is a pre-release of containerd*

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

This is a beta release and some functionality is still under development.

### Highlights

* Update erofs snapshotter to use mount manager ([#12333](https://github.com/containerd/containerd/pull/12333))
* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
* Add conf.d include in the default config ([#12323](https://github.com/containerd/containerd/pull/12323))
* Add support for back references in the garbage collector ([#12025](https://github.com/containerd/containerd/pull/12025))

#### Go client

* Update pkg/oci to use fs.FS interface and os.OpenRoot ([#12245](https://github.com/containerd/containerd/pull/12245))

#### Image Distribution

* Add referrers fetcher to remotes ([#12309](https://github.com/containerd/containerd/pull/12309))
* Tar unpack progress through transfer service ([#11921](https://github.com/containerd/containerd/pull/11921))

#### Image Storage

* Add snapshotter and differ for block CIMs ([#12050](https://github.com/containerd/containerd/pull/12050))
* Add tar index mode to erofs snapshotter ([#11919](https://github.com/containerd/containerd/pull/11919))

#### Node Resource Interface (NRI)

* Enable otel traces in NRI ([#12082](https://github.com/containerd/containerd/pull/12082))
* Add WASM plugin support ([containerd/nri#121](https://github.com/containerd/nri/pull/121))

#### Runtime

* Improve shim load time after restart by loading in parallel ([#12142](https://github.com/containerd/containerd/pull/12142))
* Fix pidfd leak in UnshareAfterEnterUserns ([#12167](https://github.com/containerd/containerd/pull/12167))

#### Deprecations

* 1.6 is EOL ([#12348](https://github.com/containerd/containerd/pull/12348))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Maksym Pavlenko
* Akihiro Suda
* Krisztian Litkey
* Mike Brown
* Wei Fu
* Markus Lehtonen
* Sebastiaan van Stijn
* Samuel Karp
* ningmingxiao
* Austin Vazquez
* yashsingh74
* Jin Dong
* Chris Henzie
* Gao Xiang
* Kirtana Ashok
* Aadhar Agarwal
* Etienne Champetier
* Rodrigo Campos
* Akhil Mohan
* Sascha Grunert
* Henry Wang
* Aleksa Sarai
* Eric Mountain
* Keith Mattix II
* Paweł Gronowski
* Adrien Delorme
* Apurv Barve
* Enji Cooper
* Kohei Tokunaga
* Max Jonas Werner
* Rehan Khan
* Tõnis Tiigi
* Yang Yang
* jinda.ljd
* jokemanfire
* Amit Barve
* Andrew Halaney
* Antonio Ojea
* Brian Goff
* Carlos Eduardo Arango Gutierrez
* Chenyang Yan
* Dawei Wei
* Divya Rani
* Fabiano Fidêncio
* Iceber Gu
* Jared Ledvina
* Jonathan Perkin
* Jose Fernandez
* Karl Baumgartner
* Osama Abdelkader
* Radostin Stoyanov
* Ruidong Cao
* Sameer
* Sergey Kanzhelev
* Swagat Bora
* Sylvain MOUQUET
* Tom Wieczorek
* Tycho Andersen
* Ubuntu
* Wuyue (Tony) Sun
* suranmiao
* tanhuaan
* zounengren

### Dependency Changes

* **dario.cat/mergo**                                                    v1.0.1 -> v1.0.2
* **github.com/Microsoft/hcsshim**                                       v0.13.0-rc.3 -> v0.14.0-rc.1
* **github.com/StackExchange/wmi**                                       cbe66965904d **_new_**
* **github.com/checkpoint-restore/checkpointctl**                        v1.3.0 -> v1.4.0
* **github.com/containerd/console**                                      v1.0.4 -> v1.0.5
* **github.com/containerd/containerd/api**                               v1.9.0 -> v1.10.0-beta.1
* **github.com/containerd/go-cni**                                       v1.1.12 -> v1.1.13
* **github.com/containerd/nri**                                          v0.8.0 -> v0.10.0
* **github.com/containernetworking/plugins**                             v1.7.1 -> v1.8.0
* **github.com/coreos/go-systemd/v22**                                   v22.5.0 -> v22.6.0
* **github.com/cpuguy83/go-md2man/v2**                                   v2.0.5 -> v2.0.7
* **github.com/emicklei/go-restful/v3**                                  v3.11.0 -> v3.13.0
* **github.com/fxamacker/cbor/v2**                                       v2.7.0 -> v2.9.0
* **github.com/go-jose/go-jose/v4**                                      v4.0.5 -> v4.1.2
* **github.com/go-logr/logr**                                            v1.4.2 -> v1.4.3
* **github.com/go-ole/go-ole**                                           v1.2.6 **_new_**
* **github.com/golang/groupcache**                                       41bb18bfe9da -> 2c02b8208cf8
* **github.com/google/certtostore**                                      v1.0.6 **_new_**
* **github.com/google/deck**                                             105ad94aa8ae **_new_**
* **github.com/gorilla/websocket**                                       v1.5.0 -> e064f32e3674
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**  v1.0.1 -> v1.1.0
* **github.com/hashicorp/errwrap**                                       v1.1.0 **_new_**
* **github.com/intel/goresctrl**                                         v0.8.0 -> v0.9.0
* **github.com/klauspost/compress**                                      v1.18.0 -> v1.18.1
* **github.com/knqyf263/go-plugin**                                      v0.9.0 **_new_**
* **github.com/moby/sys/capability**                                     v0.4.0 **_new_**
* **github.com/modern-go/reflect2**                                      v1.0.2 -> 35a7c28c31ee
* **github.com/opencontainers/runtime-tools**                            2e043c6bd626 -> 0ea5ed0382a2
* **github.com/prometheus/client_golang**                                v1.22.0 -> v1.23.2
* **github.com/prometheus/client_model**                                 v0.6.1 -> v0.6.2
* **github.com/prometheus/common**                                       v0.62.0 -> v0.66.1
* **github.com/prometheus/procfs**                                       v0.15.1 -> v0.16.1
* **github.com/stretchr/testify**                                        v1.10.0 -> v1.11.1
* **github.com/tchap/go-patricia/v2**                                    v2.3.2 -> v2.3.3
* **github.com/tetratelabs/wazero**                                      v1.9.0 **_new_**
* **github.com/urfave/cli/v2**                                           v2.27.6 -> v2.27.7
* **github.com/vishvananda/netlink**                                     0e7078ed04c8 -> v1.3.1
* **go.etcd.io/bbolt**                                                   v1.4.0 -> v1.4.3
* **go.opentelemetry.io/otel**                                           v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/metric**                                    v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/sdk**                                       v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/trace**                                     v1.35.0 -> v1.37.0
* **go.uber.org/goleak**                                                 v1.3.0 **_new_**
* **go.yaml.in/yaml/v2**                                                 v2.4.2 **_new_**
* **golang.org/x/crypto**                                                v0.36.0 -> v0.41.0
* **golang.org/x/mod**                                                   v0.24.0 -> v0.29.0
* **golang.org/x/net**                                                   v0.38.0 -> v0.43.0
* **golang.org/x/oauth2**                                                v0.27.0 -> v0.30.0
* **golang.org/x/sync**                                                  v0.14.0 -> v0.17.0
* **golang.org/x/sys**                                                   v0.33.0 -> v0.37.0
* **golang.org/x/term**                                                  v0.30.0 -> v0.34.0
* **golang.org/x/text**                                                  v0.23.0 -> v0.28.0
* **golang.org/x/time**                                                  v0.7.0 -> v0.9.0
* **google.golang.org/genproto/googleapis/api**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/genproto/googleapis/rpc**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/grpc**                                             v1.72.0 -> v1.76.0
* **google.golang.org/protobuf**                                         v1.36.6 -> v1.36.10
* **k8s.io/api**                                                         v0.32.3 -> v0.34.1
* **k8s.io/apimachinery**                                                v0.32.3 -> v0.34.1
* **k8s.io/client-go**                                                   v0.32.3 -> v0.34.1
* **k8s.io/cri-api**                                                     v0.32.3 -> v0.34.1
* **k8s.io/utils**                                                       3ea5e8cea738 -> 4c0f3b243397
* **sigs.k8s.io/json**                                                   9aa6b5e7a4b3 -> cfa47c3a1cc8
* **sigs.k8s.io/randfill**                                               v1.0.0 **_new_**
* **sigs.k8s.io/structured-merge-diff/v6**                               v6.3.0 **_new_**
* **sigs.k8s.io/yaml**                                                   v1.4.0 -> v1.6.0

Previous release can be found at [v2.1.0](https://github.com/containerd/containerd/releases/tag/v2.1.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

v2.2.0-beta.1

d94e514f · Merge pull request #12310 from aadhar-agarwal/aadagarwal/add_tar_index_tests · Oct 09, 2025

containerd 2.2.0-beta.1

Welcome to the v2.2.0-beta.1 release of containerd!
*This is a pre-release of containerd*

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

This is a beta release and some functionality is still under development.

### Highlights

* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
* Add conf.d include in the default config ([#12323](https://github.com/containerd/containerd/pull/12323))
* Add support for back references in the garbage collector ([#12025](https://github.com/containerd/containerd/pull/12025))

#### Go client

* Update pkg/oci to use fs.FS interface and os.OpenRoot ([#12245](https://github.com/containerd/containerd/pull/12245))

#### Image Distribution

* Add referrers fetcher to remotes ([#12309](https://github.com/containerd/containerd/pull/12309))
* Tar unpack progress through transfer service ([#11921](https://github.com/containerd/containerd/pull/11921))

#### Image Storage

* Add snapshotter and differ for block CIMs ([#12050](https://github.com/containerd/containerd/pull/12050))
* Add tar index mode to erofs snapshotter ([#11919](https://github.com/containerd/containerd/pull/11919))

#### Node Resource Interface (NRI)

* Enable otel traces in NRI ([#12082](https://github.com/containerd/containerd/pull/12082))
* Add WASM plugin support ([containerd/nri#121](https://github.com/containerd/nri/pull/121))

#### Runtime

* Fix pidfd leak in UnshareAfterEnterUserns ([#12167](https://github.com/containerd/containerd/pull/12167))

#### Deprecations

* 1.6 is EOL ([#12348](https://github.com/containerd/containerd/pull/12348))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Maksym Pavlenko
* Krisztian Litkey
* Akihiro Suda
* Mike Brown
* Wei Fu
* Markus Lehtonen
* Sebastiaan van Stijn
* Samuel Karp
* Austin Vazquez
* ningmingxiao
* yashsingh74
* Jin Dong
* Kirtana Ashok
* Aadhar Agarwal
* Chris Henzie
* Etienne Champetier
* Rodrigo Campos
* Akhil Mohan
* Gao Xiang
* Sascha Grunert
* Henry Wang
* Aleksa Sarai
* Eric Mountain
* Keith Mattix II
* Paweł Gronowski
* Adrien Delorme
* Apurv Barve
* Enji Cooper
* Kohei Tokunaga
* Rehan Khan
* Yang Yang
* jokemanfire
* Amit Barve
* Andrew Halaney
* Antonio Ojea
* Brian Goff
* Carlos Eduardo Arango Gutierrez
* Chenyang Yan
* Dawei Wei
* Divya Rani
* Fabiano Fidêncio
* Iceber Gu
* Jared Ledvina
* Jonathan Perkin
* Jose Fernandez
* Karl Baumgartner
* Osama Abdelkader
* Radostin Stoyanov
* Ruidong Cao
* Sameer
* Sergey Kanzhelev
* Swagat Bora
* Sylvain MOUQUET
* Tom Wieczorek
* Tycho Andersen
* Tõnis Tiigi
* Wuyue (Tony) Sun
* jinda.ljd
* tanhuaan
* zounengren

### Dependency Changes

* **dario.cat/mergo**                                                    v1.0.1 -> v1.0.2
* **github.com/Microsoft/hcsshim**                                       v0.13.0-rc.3 -> v0.14.0-rc.1
* **github.com/StackExchange/wmi**                                       cbe66965904d **_new_**
* **github.com/checkpoint-restore/checkpointctl**                        v1.3.0 -> v1.4.0
* **github.com/containerd/console**                                      v1.0.4 -> v1.0.5
* **github.com/containerd/containerd/api**                               v1.9.0 -> v1.10.0-beta.1
* **github.com/containerd/go-cni**                                       v1.1.12 -> v1.1.13
* **github.com/containerd/nri**                                          v0.8.0 -> v0.10.0
* **github.com/containernetworking/plugins**                             v1.7.1 -> v1.8.0
* **github.com/coreos/go-systemd/v22**                                   v22.5.0 -> v22.6.0
* **github.com/cpuguy83/go-md2man/v2**                                   v2.0.5 -> v2.0.7
* **github.com/emicklei/go-restful/v3**                                  v3.11.0 -> v3.13.0
* **github.com/fxamacker/cbor/v2**                                       v2.7.0 -> v2.9.0
* **github.com/go-jose/go-jose/v4**                                      v4.0.5 -> v4.1.2
* **github.com/go-logr/logr**                                            v1.4.2 -> v1.4.3
* **github.com/go-ole/go-ole**                                           v1.2.6 **_new_**
* **github.com/golang/groupcache**                                       41bb18bfe9da -> 2c02b8208cf8
* **github.com/google/certtostore**                                      v1.0.6 **_new_**
* **github.com/google/deck**                                             105ad94aa8ae **_new_**
* **github.com/gorilla/websocket**                                       v1.5.0 -> e064f32e3674
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**  v1.0.1 -> v1.1.0
* **github.com/hashicorp/errwrap**                                       v1.1.0 **_new_**
* **github.com/intel/goresctrl**                                         v0.8.0 -> v0.9.0
* **github.com/knqyf263/go-plugin**                                      v0.9.0 **_new_**
* **github.com/moby/sys/capability**                                     v0.4.0 **_new_**
* **github.com/modern-go/reflect2**                                      v1.0.2 -> 35a7c28c31ee
* **github.com/opencontainers/runtime-tools**                            2e043c6bd626 -> 0ea5ed0382a2
* **github.com/prometheus/client_golang**                                v1.22.0 -> v1.23.2
* **github.com/prometheus/client_model**                                 v0.6.1 -> v0.6.2
* **github.com/prometheus/common**                                       v0.62.0 -> v0.66.1
* **github.com/prometheus/procfs**                                       v0.15.1 -> v0.16.1
* **github.com/stretchr/testify**                                        v1.10.0 -> v1.11.1
* **github.com/tchap/go-patricia/v2**                                    v2.3.2 -> v2.3.3
* **github.com/tetratelabs/wazero**                                      v1.9.0 **_new_**
* **github.com/urfave/cli/v2**                                           v2.27.6 -> v2.27.7
* **github.com/vishvananda/netlink**                                     0e7078ed04c8 -> v1.3.1
* **go.etcd.io/bbolt**                                                   v1.4.0 -> v1.4.3
* **go.opentelemetry.io/otel**                                           v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/metric**                                    v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/sdk**                                       v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/trace**                                     v1.35.0 -> v1.37.0
* **go.uber.org/goleak**                                                 v1.3.0 **_new_**
* **go.yaml.in/yaml/v2**                                                 v2.4.2 **_new_**
* **golang.org/x/crypto**                                                v0.36.0 -> v0.41.0
* **golang.org/x/mod**                                                   v0.24.0 -> v0.28.0
* **golang.org/x/net**                                                   v0.38.0 -> v0.43.0
* **golang.org/x/oauth2**                                                v0.27.0 -> v0.30.0
* **golang.org/x/sync**                                                  v0.14.0 -> v0.17.0
* **golang.org/x/sys**                                                   v0.33.0 -> v0.36.0
* **golang.org/x/term**                                                  v0.30.0 -> v0.34.0
* **golang.org/x/text**                                                  v0.23.0 -> v0.28.0
* **golang.org/x/time**                                                  v0.7.0 -> v0.9.0
* **google.golang.org/genproto/googleapis/api**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/genproto/googleapis/rpc**                          56aae31c358a -> a7a43d27e69b
* **google.golang.org/grpc**                                             v1.72.0 -> v1.76.0
* **google.golang.org/protobuf**                                         v1.36.6 -> v1.36.10
* **k8s.io/api**                                                         v0.32.3 -> v0.34.1
* **k8s.io/apimachinery**                                                v0.32.3 -> v0.34.1
* **k8s.io/client-go**                                                   v0.32.3 -> v0.34.1
* **k8s.io/cri-api**                                                     v0.32.3 -> v0.34.1
* **k8s.io/utils**                                                       3ea5e8cea738 -> 4c0f3b243397
* **sigs.k8s.io/json**                                                   9aa6b5e7a4b3 -> cfa47c3a1cc8
* **sigs.k8s.io/randfill**                                               v1.0.0 **_new_**
* **sigs.k8s.io/structured-merge-diff/v6**                               v6.3.0 **_new_**
* **sigs.k8s.io/yaml**                                                   v1.4.0 -> v1.6.0

Previous release can be found at [v2.1.0](https://github.com/containerd/containerd/releases/tag/v2.1.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified

api/v1.10.0-beta.1

ea46953f · Merge pull request #12356 from dmcgowan/fix-api-release · Oct 07, 2025

containerd api/v1.10.0-beta.1

Welcome to the api/v1.10.0-beta.1 release of containerd!
*This is a pre-release of containerd*

The 11th release for the containerd 1.x API aligns with the containerd 2.2 release.

### Highlights

* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Wei Fu

### Changes
<details><summary>6 commits</summary>
<p>

* Prepare release notes for api/v1.10.0-beta.0 ([#12346](https://github.com/containerd/containerd/pull/12346))
  * [`aa571f63c`](https://github.com/containerd/containerd/commit/aa571f63c6529d827bfef02956a8db9bee57ab8c) Prepare release notes for api/v1.10.0-beta.0
* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
  * [`8db301086`](https://github.com/containerd/containerd/commit/8db3010865ae9926aed6c5e476a7c6b2413b44d5) Add mounts api service
  * [`67fbf9db9`](https://github.com/containerd/containerd/commit/67fbf9db9cbf6ae83df58d18a19f32b28ebc0017) Generate and vendor proto changes
  * [`c5097ac63`](https://github.com/containerd/containerd/commit/c5097ac63fd704213c507a2b712fa2db7744090b) Add mount manager to protobuf services and types
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [api/v1.9.0](https://github.com/containerd/containerd/releases/tag/api/v1.9.0)

Unverified

api/v1.10.0-beta.0

7669bb4f · Merge pull request #12348 from SergeyKanzhelev/patch-3 · Oct 06, 2025

containerd api/v1.10.0-beta.0

Welcome to the api/v1.10.0-beta.0 release of containerd!
*This is a pre-release of containerd*

The 11th release for the containerd 1.x API aligns with the containerd 2.2 release.

### Highlights

* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Wei Fu

### Changes
<details><summary>6 commits</summary>
<p>

* Prepare release notes for api/v1.10.0-beta.0 ([#12346](https://github.com/containerd/containerd/pull/12346))
  * [`aa571f63c`](https://github.com/containerd/containerd/commit/aa571f63c6529d827bfef02956a8db9bee57ab8c) Prepare release notes for api/v1.10.0-beta.0
* Add mount manager ([#12063](https://github.com/containerd/containerd/pull/12063))
  * [`8db301086`](https://github.com/containerd/containerd/commit/8db3010865ae9926aed6c5e476a7c6b2413b44d5) Add mounts api service
  * [`67fbf9db9`](https://github.com/containerd/containerd/commit/67fbf9db9cbf6ae83df58d18a19f32b28ebc0017) Generate and vendor proto changes
  * [`c5097ac63`](https://github.com/containerd/containerd/commit/c5097ac63fd704213c507a2b712fa2db7744090b) Add mount manager to protobuf services and types
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [api/v1.9.0](https://github.com/containerd/containerd/releases/tag/api/v1.9.0)

Unverified

v2.2.0-beta.0

5bcf77a5 · Merge pull request #12293 from dmcgowan/prepare-v2.2.0-beta.0 · Sep 18, 2025

containerd 2.2.0-beta.0

Welcome to the v2.2.0-beta.0 release of containerd!
*This is a pre-release of containerd*

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

This is a beta release and some functionality is still under development.

### Highlights

* Add support for back references in the garbage collector ([#12025](https://github.com/containerd/containerd/pull/12025))

#### Go client

* Update pkg/oci to use fs.FS interface and os.OpenRoot ([#12245](https://github.com/containerd/containerd/pull/12245))

#### Image Distribution

* Tar unpack progress through transfer service ([#11921](https://github.com/containerd/containerd/pull/11921))

#### Image Storage

* Add snapshotter and differ for block CIMs ([#12050](https://github.com/containerd/containerd/pull/12050))
* Add tar index mode to erofs snapshotter ([#11919](https://github.com/containerd/containerd/pull/11919))

#### Node Resource Interface (NRI)

* Enable otel traces in NRI ([#12082](https://github.com/containerd/containerd/pull/12082))
* Add WASM plugin support ([containerd/nri#121](https://github.com/containerd/nri/pull/121))

#### Runtime

* Fix pidfd leak in UnshareAfterEnterUserns ([#12167](https://github.com/containerd/containerd/pull/12167))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Phil Estes
* Derek McGowan
* Krisztian Litkey
* Akihiro Suda
* Maksym Pavlenko
* Mike Brown
* Wei Fu
* Markus Lehtonen
* Samuel Karp
* Sebastiaan van Stijn
* Austin Vazquez
* ningmingxiao
* yashsingh74
* Jin Dong
* Kirtana Ashok
* Etienne Champetier
* Rodrigo Campos
* Akhil Mohan
* Chris Henzie
* Gao Xiang
* Sascha Grunert
* Aleksa Sarai
* Eric Mountain
* Keith Mattix II
* Paweł Gronowski
* Adrien Delorme
* Enji Cooper
* Kohei Tokunaga
* Yang Yang
* jokemanfire
* Aadhar Agarwal
* Amit Barve
* Andrew Halaney
* Antonio Ojea
* Brian Goff
* Chenyang Yan
* Dawei Wei
* Divya Rani
* Fabiano Fidêncio
* Henry Wang
* Iceber Gu
* Jared Ledvina
* Jonathan Perkin
* Jose Fernandez
* Karl Baumgartner
* Radostin Stoyanov
* Rehan Khan
* Ruidong Cao
* Sameer
* Swagat Bora
* Sylvain MOUQUET
* Tom Wieczorek
* Tycho Andersen
* Ubuntu
* Wuyue (Tony) Sun
* jinda.ljd
* tanhuaan
* zounengren

### Dependency Changes

* **dario.cat/mergo**                                                    v1.0.1 -> v1.0.2
* **github.com/Microsoft/hcsshim**                                       v0.13.0-rc.3 -> v0.14.0-rc.1
* **github.com/checkpoint-restore/checkpointctl**                        v1.3.0 -> v1.4.0
* **github.com/containerd/console**                                      v1.0.4 -> v1.0.5
* **github.com/containerd/go-cni**                                       v1.1.12 -> v1.1.13
* **github.com/containerd/nri**                                          v0.8.0 -> v0.10.0
* **github.com/containernetworking/plugins**                             v1.7.1 -> v1.8.0
* **github.com/coreos/go-systemd/v22**                                   v22.5.0 -> v22.6.0
* **github.com/cpuguy83/go-md2man/v2**                                   v2.0.5 -> v2.0.7
* **github.com/emicklei/go-restful/v3**                                  v3.11.0 -> v3.13.0
* **github.com/fxamacker/cbor/v2**                                       v2.7.0 -> v2.9.0
* **github.com/go-jose/go-jose/v4**                                      v4.0.5 -> v4.1.1
* **github.com/go-logr/logr**                                            v1.4.2 -> v1.4.3
* **github.com/golang/groupcache**                                       41bb18bfe9da -> 2c02b8208cf8
* **github.com/gorilla/websocket**                                       v1.5.0 -> e064f32e3674
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**  v1.0.1 -> v1.1.0
* **github.com/intel/goresctrl**                                         v0.8.0 -> v0.9.0
* **github.com/knqyf263/go-plugin**                                      v0.9.0 **_new_**
* **github.com/modern-go/reflect2**                                      v1.0.2 -> 35a7c28c31ee
* **github.com/prometheus/client_golang**                                v1.22.0 -> v1.23.2
* **github.com/prometheus/client_model**                                 v0.6.1 -> v0.6.2
* **github.com/prometheus/common**                                       v0.62.0 -> v0.66.1
* **github.com/prometheus/procfs**                                       v0.15.1 -> v0.16.1
* **github.com/stretchr/testify**                                        v1.10.0 -> v1.11.1
* **github.com/tchap/go-patricia/v2**                                    v2.3.2 -> v2.3.3
* **github.com/tetratelabs/wazero**                                      v1.9.0 **_new_**
* **github.com/urfave/cli/v2**                                           v2.27.6 -> v2.27.7
* **github.com/vishvananda/netlink**                                     0e7078ed04c8 -> v1.3.1
* **go.etcd.io/bbolt**                                                   v1.4.0 -> v1.4.3
* **go.opentelemetry.io/otel**                                           v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/metric**                                    v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/sdk**                                       v1.35.0 -> v1.37.0
* **go.opentelemetry.io/otel/trace**                                     v1.35.0 -> v1.37.0
* **go.uber.org/goleak**                                                 v1.3.0 **_new_**
* **go.yaml.in/yaml/v2**                                                 v2.4.2 **_new_**
* **golang.org/x/crypto**                                                v0.36.0 -> v0.41.0
* **golang.org/x/mod**                                                   v0.24.0 -> v0.28.0
* **golang.org/x/net**                                                   v0.38.0 -> v0.43.0
* **golang.org/x/oauth2**                                                v0.27.0 -> v0.30.0
* **golang.org/x/sync**                                                  v0.14.0 -> v0.17.0
* **golang.org/x/sys**                                                   v0.33.0 -> v0.36.0
* **golang.org/x/term**                                                  v0.30.0 -> v0.34.0
* **golang.org/x/text**                                                  v0.23.0 -> v0.28.0
* **golang.org/x/time**                                                  v0.7.0 -> v0.9.0
* **google.golang.org/genproto/googleapis/api**                          56aae31c358a -> 8d1bb00bc6a7
* **google.golang.org/genproto/googleapis/rpc**                          56aae31c358a -> 8d1bb00bc6a7
* **google.golang.org/grpc**                                             v1.72.0 -> v1.75.1
* **google.golang.org/protobuf**                                         v1.36.6 -> v1.36.9
* **k8s.io/api**                                                         v0.32.3 -> v0.34.1
* **k8s.io/apimachinery**                                                v0.32.3 -> v0.34.1
* **k8s.io/client-go**                                                   v0.32.3 -> v0.34.1
* **k8s.io/cri-api**                                                     v0.32.3 -> v0.34.1
* **k8s.io/utils**                                                       3ea5e8cea738 -> 4c0f3b243397
* **sigs.k8s.io/json**                                                   9aa6b5e7a4b3 -> cfa47c3a1cc8
* **sigs.k8s.io/randfill**                                               v1.0.0 **_new_**
* **sigs.k8s.io/structured-merge-diff/v6**                               v6.3.0 **_new_**
* **sigs.k8s.io/yaml**                                                   v1.4.0 -> v1.6.0

Previous release can be found at [v2.1.0](https://github.com/containerd/containerd/releases/tag/v2.1.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

Unverified