CuraDevOps

tag: Containerd · 8 items

Plan Moby/Docker Engine 29.9.1 patches three containerd CVEs
2026-10-19 · Releases: moby · source ↗ #container-runtime#security#containerd
  • Platform/SRE — Plan: Three containerd security fixes ship in this patch: two crash-on-pull vectors and a disk-exhaustion flaw (GHSA-hc94-p972-ch66) that could drain host storage on malicious image pulls. None are KEV-listed or actively exploited, but any team running Docker Engine or raw containerd in production should schedule an upgrade to 29.9.1 this sprint.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
Plan containerd 2.3.7 patches CVE-2026-95839 and multiple hardenings
2026-10-19 · Releases: containerd · source ↗ #containerd#container-runtime#security-patch
  • Platform/SRE — Plan: CVE-2026-95839 is not KEV-listed and no active exploitation is reported, but this patch hardens symlink handling, seccomp socket allowlisting, and image reference validation in the container runtime — all within the production-critical containerd path. Schedule an upgrade to 2.3.7 across node pools within your next maintenance window; containerd 2.3 EOL is 2028-04-30, so no forced-upgrade urgency.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 2.3 EOL 2028-04-30 · CVE-2026-95839 — CISA KEV: not listed, EPSS n/a, reported by 2 collected sources
Plan Docker 29 switches default image store to containerd for new installs
2026-10-16 · HN (docker) · source ↗ #docker#containerd#container-runtime
  • Platform/SRE — Plan: New Docker 29 installs default to the containerd image store, which has different behavior for image layering, multi-platform support, and tooling compatibility; review and test before rolling out Docker 29 on new nodes or golden AMIs to avoid unexpected differences from existing hosts still on the legacy store.
  • CI/CD — Plan: Any CI runner provisioning that installs Docker 29 fresh will get the containerd image store by default, which may affect build caching behavior and image layer handling; audit runner provisioning scripts and validate build pipelines against Docker 29 before upgrading runner images.
  • Leader — Skip
Plan archived containerd API v1.12.0 ships with shim and runc options deprecations
2026-09-21 · Releases: containerd · source ↗ #containerd#container-runtime#deprecation
  • Platform/SRE — Plan: This GA release deprecates the containerd.io/runtime-allow-mounts shim annotation (replaced by MountCapabilities extension) and task API address/version fields in runc options; plan migration away from both, though no removal date is confirmed yet.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 2.4 EOL 2027-05-16 · deprecation mentioned (no explicit date found)
Plan archived containerd 2.4.0 released with breaking changes, non-LTS support
2026-09-21 · Releases: containerd · source ↗ #containerd#container-runtime#breaking-changes
  • Platform/SRE — Plan: containerd 2.4.0 is a GA non-LTS release that removes previously deprecated features, so audit your current deployments for deprecation warnings before upgrading; the 2.3 LTS remains the stability-first choice, and this release’s EOL is 2027-05-16.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 2.4 EOL 2027-05-16 · deprecation mentioned (no explicit date found) · breaking-change flagged
Plan archived containerd 2.3.4 released with breaking checkpoint-restore change
2026-08-17 · Releases: containerd · source ↗ #containerd#container-runtime#patch-release
  • Platform/SRE — Plan: Despite being a patch release, 2.3.4 ships a breaking change: checkpoint restore in CreateContainer is now disabled by default, requiring an explicit config opt-in. Also fixes a memory leak in the OOM watcher and binary protobuf shim corruption. Review workloads using CRIU/checkpoint restore before upgrading; schedule the upgrade this quarter.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 2.3 EOL 2028-04-30 · deprecation mentioned (no explicit date found)
Plan archived containerd 2.2.7 released; 2.2 branch EOL 2026-11-06
2026-08-17 · Releases: containerd · source ↗ #containerd#container-runtime#eol
  • Platform/SRE — Plan: containerd 2.2 reaches EOL on 2026-11-06 (81 days), so plan migration to a supported branch before then; also note this patch disables checkpoint restore in CreateContainer by default, which may break CRIU-based workloads that haven’t set enable_experimental_restore_via_create.
  • CI/CD — Skip
  • Leader — Skip
  • Signals: containerd 2.2 reaches EOL in 81d (2026-11-06) · deprecation mentioned (no explicit date found)
Plan archived Docker 29 defaults to containerd image store on new installs
2026-07-16 · HN (docker) · source ↗ #docker#containerd#image-store
  • Platform/SRE — Plan: New Docker 29 installs default to the containerd image store rather than the classic overlay store, which changes image management behavior. Audit IaC and provisioning scripts that stand up Docker nodes to verify compatibility with the new default before rolling out Docker 29 to new infrastructure.
  • CI/CD — Plan: Ephemeral CI runners provisioned fresh on Docker 29 will silently get containerd-backed image storage, which can alter layer-caching behavior and multi-platform build handling. Test existing build and image-export workflows against the new default before adopting Docker 29 runner images.
  • Leader — Skip