containerd

containerd 2.3.4

Welcome to the v2.3.4 release of containerd! The fourth patch release for containerd 2.3 contains various fixes and updates. ### Highlights #### Container Runtime Interface (CRI) * Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13913](https://github.com/containe

containerd 2.2.7

Welcome to the v2.2.7 release of containerd! The seventh patch release for containerd 2.2 contains various fixes and updates. ### Highlights #### Container Runtime Interface (CRI) * Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13937](https://github.com/contain

containerd 2.2.7

Welcome to the v2.2.7 release of containerd! The seventh patch release for containerd 2.2 contains various fixes and updates. ### Highlights #### Container Runtime Interface (CRI) * Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13937](https://github.com/contain

containerd 2.3.4

Welcome to the v2.3.4 release of containerd! The fourth patch release for containerd 2.3 contains various fixes and updates. ### Highlights #### Container Runtime Interface (CRI) * Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13913](https://github.com/containe

containerd-shim process isn't reaped for some killed containers

**Description** We have several EKS clusters which autoscale throughout the day - they handle burst workloads, and in a given day the underlying ASG-s may scale down to 0 nodes, or scale up to tens of nodes. We've noticed that once in a while, we have nodes which have pods stuck in a 'Terminating' status on them for days on-end, until we manually intervene a

Continuous memory growth in containerd v2.1.4

### Description We are seeing continuous memory growth on `containerd` version `github.com/containerd/containerd/v2 2.1.4` in our AWS EKS v1.32 cluster. The containerd process memory grows constantly and reaches maximum capacity and causes the node to become non-responsive and also causes OS to kill other things abruptly due to memory pressure causing node t

TaskOOM event lost

### Description https://github.com/kubernetes/kubernetes/issues/119600 When I was troubleshooting the problem that the Reason was not OOMKilled, I found that the container lost the TaskOOM event. ### Steps to reproduce the issue e2e: https://prow.k8s.io/view/gs/kubernetes-jenkins/logs/ci-containerd-node-e2e-1-7/1683184526936772608 logfile: https://storage.go

Unpack failure when mixing remote and local snapshotters

### Description We are encountering unpack failures when mixing remote snapshotters (like `stargz`) and local snapshotters (like `overlayfs`) on the same node. If an image is first pulled using a remote snapshotter—which lazy-loads content—and is later used by a container requiring a local snapshotter, the operation fails. `LocalResolve` incorrectly assumes

Support container checkpoint/restore for gVisor runtime

### What is the problem you're trying to solve Hey containerd-maintainers team! I am trying to enable container checkpoint/restore support using the gVisor (runsc) runtime. Currently, the CheckpointContainer method is not implemented in both containerd’s CRI service and the containerd-runsc-shim I am working on implementing the missing functionality in conta

containerd crash with program exceeds 10000-thread limit - container-log FIFO open leaks an OS thread per failed CreateContainer

### Description On a busy Kubernetes node, containerd crashed with: ``` runtime: program exceeds 10000-thread limit fatal error: thread exhaustion ``` The process had leaked OS threads steadily over ~17 hours until it hit Go's default maxmcount (10,000), then aborted. A goroutine dump taken at crash time shows the leaked threads are all blocked in a blocking

Improve image pull progress in ctr

### What is the problem you're trying to solve Show the total size and progress of the total downloaded size when pulling the image ### Describe the solution you'd like Hi When we pull the images, nothing is displayed about the image size, how many layers are there, or how much is downloaded. This can be most user-friendly. However, from my study of the cont

containerd on Windows 11 - cannot override root directory using --root parameter

### Description Hi All, I am trying to use `containerd.exe` on Windows 11. This is a corporate workstation and is locked down. Whenever I run containerd.exe from the command line, I get the following error: ``` containerd: mkdir C:\ProgramData\containerd\root: Access is denied. ``` I cannot create/edit any folders under `c:\ProgramData\containerd\root` since

Support for time namespaces

### What is the problem you're trying to solve Support for time namespaces is added to OCI runtime spec and runc implemented the necessary functionality in https://github.com/opencontainers/runc/issues/2345 but there seems to be no way to utilize this feature in containerd. ### Describe the solution you'd like Similar to network namespaces, a pod can share a

容器没有重启功能，是否可以出一个重启功能

### Description 容器没有重启功能，是否可以出一个重启功能，类似于docker restart id这样的功能 ### Steps to reproduce the issue 1. 2. 3. ### Describe the results you received and expected docker restart id ### What version of containerd are you using? 1.7 ### Any other relevant information _No response_ ### Show configuration if it is related to CRI plugin. _No response_

Cannot run OPA image in user namespace on GKE

## Short description `opa:1.14.1-envoy` image fails to start with `hostUsers: false` (Kubernetes user namespaces) due to missing `/dev/console` `containerd: 2.1.5` ``` $ kubectl version -o yaml clientVersion: buildDate: "2026-03-18T18:30:07Z" compiler: gc gitCommit: 6c1cd99aef09161ddb07b8ade6c9564e9b9bfe27 gitTreeState: clean gitVersion: v1.35.3 goVersion: g

CRI: tag+digest sandbox image breaks RunPodSandbox

### Description A CRI sandbox image (`pinned_images.sandbox`, or legacy `sandbox_image`) configured as a reference with both a tag and a digest (name:tag@sha256:…) makes `RunPodSandbox` fail with "failed to get sandbox image … not found", even though containerd successfully pulls that exact image during the same call and stores it. No pods can start on the n

CRI image pull is sometimes canceled by image_pull_progress_timeout during unpack

### Description When the CRI plugin pulls an image through the transfer service (`use_local_image_pull = false`), the image pull can be canceled by `image_pull_progress_timeout` even when all blob downloads have finished and the remaining unpack is progressing. The unpack then fails with: ``` cancel pulling image <ref> because of no progress in 5m0s stop pul

Support env variable configuration for logging binary

### What is the problem you're trying to solve When configuring container IO to use a logger binary, containerd only allows me to pass values as command line arguments. ``` // BinaryIO forwards container STDOUT|STDERR directly to a logging binary func BinaryIO(binary string, args map[string]string) Creator ``` ### Describe the solution you'd like I would lik

make benchmark never work

### Description make benchmark only test the current directory, not subdirectories. ### Steps to reproduce the issue ``` make benchmark + benchmark no Go files in /home/nmx/github.com/ningmingxiao/tmp/containerd FAIL . [setup failed] make: *** [Makefile:252：benchmark ``` ### Describe the results you received and expected make benchmark can test subdirectorie

Allow hosts file configuration for proxies per registry

Fixes #8377 The setup: I have a proxy running that has DNS mapped `local.registry` to `127.0.0.1`, because I have a registry (with a self signed certificate) running locally as well with an image tagged `local.registry/localpython` in it. (Setup directions are [here](https://gist.github.com/lauralorenz/085c7368886ea4f8ab8b9e2419db8841).) ``` docker run -d --

shim: send event to a queue to prevent event to be dropped

@dmcgowan @fuweid @mxpv can you take a look. fix https://github.com/containerd/containerd/issues/12678 ``` func (s *service) processExits() { for e := range s.ec { // if consumer use much time more than 1s event will be dropped } ``` because notify will drop new events if consumer use more than 1s ``` func Reap() error { now := time.Now() exits, err := reap(

tracing: align span attribute keys with OTel semantic conventions

Closes #12191 Rename trace span attribute keys to follow the OpenTelemetry semantic conventions. Keys that have no semconv equivalent (snapshotter, pull ref, unpack) are moved under the `containerd.` namespace instead. | Legacy key | New key | | --- | --- | | `task.container.id` | `container.id` | | `task.runtime.name` | `container.runtime.name` | | `task.pi

ignore update status file when no space

Fix #7247 Failed to start recovre, the root cause is inconsistent data between `cri` and `container in metadata` Ensure consistency, the following manual recovery could be resolve. ``` - stop containerd service, like `systemctl stop containerd` - disable cri plugin in config.toml and start containerd service - find container and task which reversed, and stop

Draft: ctr support print plugin config

``` bin/ctr plugin inspect runtime { "cdiSpecDirs": [ "/etc/cdi", "/var/run/cdi" ], "cni": { "binDir": "/opt/cni/bin", "confDir": "/etc/cni/net.d", "confTemplate": "", "ipPref": "", "maxConfNum": 1, "setupSerially": false, "useInternalLoopback": false }, "containerd": { "defaultRuntimeName": "runc", "ignoreBlockIONotEnabledErrors": false, "ignoreRdtNotEnable

docker fetcher: strip sensitive headers on descriptor URLs

# docker fetcher: strip sensitive headers for desc.urls fetches context: - containerd supports fetching content from `descriptor.urls` (oci descriptor URLs). - the desc.urls fetch path currently reuses resolver/global headers (e.g., CRI `registry.headers` / hosts headers). - when desc.urls points to a non-registry origin, forwarding well-known sensitive head

oom: avoid per-wakeup allocations in cgroup v2 OOM watcher (#13558)

## What this does Reduces continuous CPU/GC overhead of the per-container cgroup v2 OOM watcher (`internal/oom`), which is the only steadily-active, workload- proportional code path in `containerd-shim-runc-v2` on a static workload. ## Background (#13558) The watcher arms an inotify `IN_MODIFY` watch on `memory.events`. The kernel notifies that file on **eve

Add log message when a shim is loaded into the shim manager

This change proposes a happy path log for shims loaded into the shim manager for visibility in runtime logs of existing workloads and their version. This is to increase visibility for workloads picked up when the server is bounced or upgraded.

core/remotes/docker: only fetch descriptor urls for foreign layers

dockerFetcher.Fetch walks desc.URLs before it tries the registry endpoints and issues a GET to each one, checking only that the scheme is http or https. Those urls come straight from the image manifest, so a crafted image can put an arbitrary address on any descriptor (a config, a regular layer, even a child manifest) and make the daemon request it during a

metadata: bound snapshotter Remove during garbage collection

Fixes #13798 **Problem** During snapshot GC, `cleanupSnapshotter` calls the snapshotter's `Remove` while holding the metadata store write lock, with no deadline (it even strips the caller's cancellation). If the snapshotter never answers, the lock is held forever. Every snapshot operation on the node queues behind it, including CRI `RunPodSandbox`, so no new

remotes/docker: retry blob fetch on connection reset by peer

## What this does `httpReadSeeker` already resumes a blob fetch when the connection closes cleanly before the full body arrives (`io.ErrUnexpectedEOF`): it reopens the body with a ranged request at the current offset, bounded by `maxRetry` consecutive reopens that make no progress. A mid-body TCP RST, however, surfaces as a connection-reset error, misses tha

Ensure credentials are forwarded to configured mirrors

This PR fixes an issue with image credentials being forwarded to unrelated mirrors

vendor: github.com/sirupsen/logrus v1.10.0

### vendor: github.com/sirupsen/logrus v1.10.0 Notable changes: - Add bidirectional `log/slog` integration with a Logrus hook and `slog.Handler`. - Add minimal, composable logging interfaces for individual log levels. - Fix reentrant logging deadlocks and improve concurrency safety around formatters, hooks, and entries. - Fix generic `Log`, `Logf`, `Logln`,

fix: prevent tar extraction data corruption by limiting reader size

we find sometimes extract a binary file from a blob, binary is broken ls -l fabric-manager_bad fabric-manager_ok -rwxr-xr-x 1 root root 44538840 6月 12 15:44 fabric-manager_bad -rwxr-xr-x 1 root root 44538840 6月 12 15:44 fabric-manager_ok ``` cmp -l fabric-manager_bad fabric-manager_ok 5525505 177 75 5525506 376 272 5525571 377 203 5525572 377 75 5525573 377

ctr: dedupe CRI image aliases in images list by default

## Problem Fixes #11000 (related: #8421, #10090, #10303, #10328). CRI writes three image names into the containerd metadata store for each pull (`repo:tag`, `repo@digest`, and a digest-only config/image ID). That is intentional for CRI's own image store, but `ctr -n k8s.io images ls` lists every name, so operators see three rows for one image. ``` $ ctr -n k

pkg/shim: Report bootstrap API mismatch on startup

- replace / close: https://github.com/containerd/containerd/pull/13764 - address / close: https://github.com/containerd/containerd/issues/13763 A pre-2.3 containerd daemon can start a newly installed shim through the deprecated CLI, environment, and stdin API. The shim currently accepts that request but returns a protobuf bootstrap result, which the old daem

fix(cri): CRI image pull is sometimes canceled by image_pull_progress…

Fixes #13909. ### Description When the CRI plugin pulls an image through the transfer service, the image pull can be canceled by `image_pull_progress_timeout` even when all blob downloads have finished and the remaining unpack is progressing. This happens because the transfer service's polling period is 300ms, and extraction can start within a few millisecon

erofs: instrument warm up cache

It'd good go understand: - Rate of cache lookups. - How many cache hits alone / layer bytes served from cache. - Amount of time spent converting layers on cache miss

Prepare release notes for v2.3.4

containerd 2.3.4 Welcome to the v2.3.4 release of containerd! The fourth patch release for containerd 2.3 contains various fixes and updates. ### Highlights #### Container Runtime Interface (CRI) * Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13913](https://gi

[release/2.3] snapshots/erofs: protect snapshot staging from cleanup

Cherry-pick of https://github.com/containerd/containerd/pull/13932

Prepare release notes for v2.2.7

containerd 2.2.7 Welcome to the v2.2.7 release of containerd! The seventh patch release for containerd 2.2 contains various fixes and updates. ### Highlights #### Container Runtime Interface (CRI) * Disable checkpoint restore in CreateContainer by default, requiring the enable_experimental_restore_via_create configuration option to enable ([#13937](https://g

[pkg/shim] implement Windows support for the shim server

## What Implements the Windows-specific methods in `pkg/shim` that were previously `ErrNotImplemented` stubs, so a shim built on this package can actually run and serve on Windows (not just Unix). ## Why On Windows the package exposed the shim entry points but left every platform hook unimplemented, so the serve path failed immediately (no ttrpc server, no l

[release/2.2] snapshots/erofs: protect snapshot staging from cleanup

Cherry-pick of https://github.com/containerd/containerd/pull/13932

treat missing runtime state as container already dead during kill

Pods get stuck in terminating forever when the DeleteContainer call times out, but does partially delete the state. Example: ``` time="2026-08-04T16:21:31.095039308Z" level=info msg="StopPodSandbox for \"f37ee9eca302510909867fae89544fae2b480852fb1ccca45e46833aca5ab229\"" time="2026-08-04T16:21:45.129960940Z" level=error msg="failed to delete task" error="con

Forward credentials to cr mirrors

fix(runtime): apply load timeout to load shim

ci: add lima image list for fedora images

This change adds fallback image entries for Fedora's canonical dl.fedoraproject.org.

cri: mv io create from create stage to start stage

because k8s will reserve several dead containers https://kubernetes.io/docs/concepts/architecture/garbage-collection/#container-image-garbage-collection if start container failed container I/O should be closed as soon as possible.