LoginSign Up
← Back to all sparks
C

containerd

DEVOPS
Velocity5.0

Industry-standard container runtime

containerd.io ↗

Five maintained branches, one coordinated patch day, and a CVE round that touched them all

container-runtimekubernetescribackportssecurity-patches
◆Current state
containerd is maintaining 1.7, 2.0, 2.1, 2.2 and 2.3 concurrently, cutting patches across all of them in tight same-day batches. The recent work is almost entirely CRI-layer correctness — nil dereferences during sandbox teardown, mount leaks when RunPodSandbox hooks fail, and rejecting CreateContainer against a non-running sandbox. A June batch shipped five CVE fixes across the supported lines.
◆Where it's heading
The project is in pure stewardship mode on the runtime, with the forward motion happening in the separately versioned API module, now at 1.12.0-beta.0 and aligned to the upcoming containerd 2.4. The pattern of fixing one CRI bug and backporting it to four branches in an hour suggests a mature, heavily automated release process rather than feature development.
◆Prediction
The next visible move is containerd 2.4 landing with the 1.12.0 API module, followed by the usual same-day patch sweep across the older lines.

◆Recent moves

  1. 1d ago

    containerd API 1.12.0-beta.0

    The thirteenth API module release, aligned to the coming containerd 2.4. It adds media type to content create events and a parent path to runc checkpoint options, plus a deprecation cleaning up sandbox task endpoints for non-runc runtimes.

    View source ↗
  2. 27d ago

    containerd 2.3.3

    The most substantive patch in this batch: it fixes a nil dereference in NRI GetIPs during teardown, rejects CreateContainer against a stopped sandbox, and closes a mount leak when RunPodSandbox hooks fail. All three are failure modes that leave clusters in a bad state rather than merely erroring.

    View source ↗
  3. 27d ago

    containerd 2.2.6

    The same three CRI fixes as 2.3.3, backported to the 2.2 line minutes apart, plus a limit on /blobs endpoint fallback to stop content store pollution during ref resolution.

    View source ↗
  4. 27d ago

    containerd 2.0.11

    A four-commit patch carrying only the /blobs fallback limit to the 2.0 line. Backport hygiene rather than new work.

    View source ↗
  5. 27d ago

    containerd 1.7.34

    The thirty-fourth patch on the 1.7 line, carrying a single CRI fix for container exit events lost when they arrive before container info is cached. Long-tail maintenance on a branch still in service.

    View source ↗
  6. 1mo ago

    containerd 2.1.9

    A security-only patch carrying five containerd CVEs, cut alongside identical releases on 1.7, 2.0, 2.2 and 2.3 within minutes. Coordinated disclosure handled the way a runtime at this level of deployment has to handle it.

    View source ↗