LoginSign Up
← Back to all sparks
C

containerd

DEVOPS
Velocity6.3

Industry-standard container runtime

containerd.io ↗

containerd 2.4.0 defaults user namespace networking to on and purges two years of deprecated config.

container-runtimeocikubernetessecurityerofsuser-namespaces
◆Current state
containerd 2.4.0 is the first regular (non-LTS) release following the 2.3 LTS cycle, and it lands as a security-default-hardening release as much as a feature one. User namespace host networking now defaults to true, /proc/interrupts and CPU thermal throttle sysfs paths are masked in containers out of the box, and long-deprecated CDI, OTLP tracing, and CNI plugin directory configuration is permanently removed. EROFS snapshotter gains a warm image cache and Prometheus metrics. Simultaneously, three older branches (1.7, 2.0, 2.2, 2.3) received a coordinated security patch for CVE-2026-53495, which strips authentication headers on registry descriptor URL redirects.
◆Where it's heading
The 2.4 release signals that containerd's default security posture is being actively tightened: user namespaces and /proc hardening are now opt-out rather than opt-in. The sustained EROFS investment (warm cache, metrics, blob source tracking across multiple releases) points to serious production deployment work on immutable filesystem-backed container images. The new UpdateSandbox RPC in the API hints at more dynamic sandbox lifecycle management coming to CRI integrations. Coordinated multi-branch security patches signal an active maintained release tree.
◆Prediction
Subsequent releases will likely continue tightening security defaults and expanding EROFS capabilities. The deprecated task API fields moved to CreateTaskRequest in 2.4 are candidates for removal in a near-term follow-on.

◆Recent moves

  1. 3d ago

    containerd 2.4.0: user namespace networking defaults on, deprecated configs removed

    ⚡ SPARK

    containerd 2.4.0 ships with UserNamespacesHostNetwork defaulting to true and /proc/interrupts masked in containers by default — two security default changes that affect how containers interact with the host. EROFS gains a warm image cache and Prometheus layer content metrics. The release removes CDI, OTLP tracing, and old CNI bin_dir configuration, clearing the accumulated deprecated surface from the 2.3 LTS cycle.

    View source ↗
  2. 3d ago

    containerd API 1.12.0

    The 1.12.0 API release aligns with containerd 2.4.0 and adds the UpdateSandbox RPC, enabling sandbox controller updates to propagate to the shim. Shim mount capabilities are formalized as a first-class API extension, deprecating the older runtime-allow-mounts annotation. These additions enable more dynamic sandbox lifecycle operations than the current static configuration model.

    View source ↗
  3. 5d ago

    containerd 2.4.0-rc.0

    Release candidate for containerd 2.4.0 with the same feature set as the GA. No distinct user-facing content beyond what shipped in the final 2.4.0 release.

    View source ↗
  4. 5d ago

    containerd API 1.12.0-rc.1

    API release candidate for the 1.12.0 series aligned with the 2.4.0 release cycle. Content matches the 1.12.0 GA; no distinct user-facing changes.

    View source ↗
  5. 15d ago

    containerd 1.7.35: CVE-2026-53495 security patch for the 1.7 LTS branch

    Security patch for the 1.7.x LTS branch fixing CVE-2026-53495 by stripping sensitive authentication headers when following registry descriptor URL redirects. Windows log scrubbing defaults to enabled. Part of the coordinated multi-branch security patch cycle that simultaneously addressed the same CVE across 1.7, 2.0, 2.2, and 2.3.

    View source ↗
  6. 15d ago

    containerd 2.0.12: CVE-2026-53495 patched in the 2.0 branch

    Security patch for 2.0.x covering CVE-2026-53495 (auth header stripping on descriptor URL redirects), plus OCI 403 error body surfacing and a Windows SystemTemp fix. Part of the same coordinated security patch cycle across multiple release branches.

    View source ↗