fix(deps): update module github.com/containerd/containerd to v2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
github.com/containerd/containerd	require	major	v1.7.29 → v2.2.2

---

Release Notes

containerd/containerd (github.com/containerd/containerd)

v2.2.2: containerd 2.2.2

Compare Source

Welcome to the v2.2.2 release of containerd!

The second patch release for containerd 2.2 contains various fixes and improvements.

Highlights

Container Runtime Interface (CRI)

• Fix migrated CRI image config when using legacy registry mirrors (#​12987)
• Unpack images with per-layer labels for runtime-specific snapshotters (#​12936)
• Fix CNI issue where DEL is never executed after a restart (#​12926)
• Harden error handling to strip potentially-sensitive registry parameters (#​12804)
• Fix nil pointer dereference in container spec memory metrics when memory constraints are not fully configured (#​12731)
• Use the specified runtime handler when pulling images (#​12721)
• Reduce noisy CDI logs (#​12717)
• Fix regression for pulling encrypted images (#​12712)

Runtime

• Fix unintended dropping of mount flags for read-only bind-mounts in user namespaces (#​12944)
• Fix AppArmor bug disallowing unix domain sockets on newer kernels (#​12897)

ctr development tool

• Fix ctr image mount failing with "no such device" (#​12831)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Akhil Mohan
• Samuel Karp
• Wei Fu
• Michael Zappa
• Phil Estes
• Fabiano Fidêncio
• Jérôme Poulin
• Luke Hinds
• Aadhar Agarwal
• Akihiro Suda
• Alex Chernyakhovsky
• Chris Adeniyi-Jones
• Kazuyoshi Kato
• Rodrigo Campos
• Sebastiaan van Stijn
• You Binhao
• ningmingxiao
• qiuxue

Changes

48 commits

• Prepare release notes for v2.2.2 (#​12998)
  • 7e6ecf434 Prepare release notes for v2.2.2
• Fix migrated CRI image config when using legacy registry mirrors (#​12987)
  • a20dead7c set default config_path in plugin init
• Unpack images with per-layer labels for runtime-specific snapshotters (#​12936)
  • a5f83d8c2 cri: unpack images with per-layer labels for runtime-specific snapshotters
• ci: modprobe xt_comment on almalinux (#​12957)
  • 68855cb0b ci: modprobe xt_comment on almalinux
• Fix unintended dropping of mount flags for read-only bind-mounts in user namespaces (#​12944)
  • ef7a8beb3 core/mount: add test for getUnprivilegedMountFlags
  • 07b2cc07e core/mount: fix getUnprivilegedMountFlags iterating over indices instead of values
• Fix CNI issue where DEL is never executed after a restart (#​12926)
  • 54101116f add integration test for cni result nil
  • d44c4384e address comment
  • f1835270b fix issue where cni del is never executed
• Fix AppArmor bug disallowing unix domain sockets on newer kernels (#​12897)
  • 6c05047b4 apparmor: explicitly set abi/3.0
• ci: add build/test go1.26.0, drop go1.24 (#​12917)
  • 5dbf1b915 update golangci-lint to v2.9.0 with go1.26 support
  • 8ec695ebe remove windows/arm from cross build
  • b9c22a6e3 ci: build/test go1.26.0
• integration: Fix TestImageLoad() failure on CI (#​12906)
  • 09b876a81 integration: Fix TestImageLoad() failure on CI
• cri: Fix image volumes with user namespaces (#​12885)
  • 172ba65b6 cri: Fix image volumes with user namespaces
• update to go1.24.13, go1.25.7 (#​12871)
  • b4240ef87 update to go1.24.13, go1.25.7
  • 94dbfaea7 ci: bump go 1.24.12, 1.25.6
• ci: set fetch-depth for containerd to 0 for version parsing (#​12875)
  • e46a7a286 set fetch-depth for containerd to 0 for version parsing
• Fix ctr image mount failing with "no such device" (#​12831)
  • 1d7908273 core/mount/manager: fix bind mount missing rbind option
  • 3d509bcd3 core/mount/manager: add tests for WithTemporary option
• Harden error handling to strip potentially-sensitive registry parameters (#​12804)
  • cb3ae2119 fix: sanitize error before gRPC return to prevent credential leak in pod events
• bump google.golang.org/grpc from 1.76.0 to 1.78.0 (#​12739)
  • 533a2552e build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0
  • b120237fb build(deps): bump google.golang.org/grpc from 1.76.0 to 1.77.0
• Fix nil pointer dereference in container spec memory metrics when memory constraints are not fully configured (#​12731)
  • 4be4e5156 Fix nil pointer dereference in container spec memory metrics
• cri: emit warning for concurrent CreateContainer (#​12735)
  • a76eb698a cri: emit warning for concurrent CreateContainer
• Use the specified runtime handler when pulling images (#​12721)
  • 3d2e188b1 cri: Use the runtimeHandler parameter in PullImage
• Reduce noisy CDI logs (#​12717)
  • 633057382 cri: move noisy CDI logs to debug level
• Fix regression for pulling encrypted images (#​12712)
  • 8a7409e2e Reinstate image decryption

Dependency Changes

• github.com/go-jose/go-jose/v4 v4.1.2 -> v4.1.3
• go.opentelemetry.io/auto/sdk v1.1.0 -> v1.2.1
• go.opentelemetry.io/otel v1.37.0 -> v1.38.0
• go.opentelemetry.io/otel/metric v1.37.0 -> v1.38.0
• go.opentelemetry.io/otel/sdk v1.37.0 -> v1.38.0
• go.opentelemetry.io/otel/trace v1.37.0 -> v1.38.0
• golang.org/x/oauth2 v0.30.0 -> v0.32.0
• google.golang.org/genproto/googleapis/api a7a43d2 -> ab9386a
• google.golang.org/genproto/googleapis/rpc a7a43d2 -> ab9386a
• google.golang.org/grpc v1.76.0 -> v1.78.0

Previous release can be found at v2.2.1

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

v2.2.1: containerd 2.2.1

Compare Source

Welcome to the v2.2.1 release of containerd!

The first patch release for containerd 2.2 contains various fixes and improvements.

Highlights

Container Runtime Interface (CRI)

• Redact all query parameters in CRI error logs (#​12546)

Image Distribution

• Fix image defaults on Darwin to usable configuration (#​12544)
• Fix possible panic from WithMediaTypeKeyPrefix (#​12516)

Runtime

• Update runc binary to v1.3.4 (#​12593)
• Fix parsing of hugetlb..events files (containerd/cgroups#379)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Krisztian Litkey
• Markus Lehtonen
• Akihiro Suda
• Mike Brown
• Sebastiaan van Stijn
• Derek McGowan
• Heran Yang
• Wei Fu
• Phil Estes
• Samuel Karp
• Austin Vazquez
• Sascha Grunert
• Akhil Mohan
• Andrey Noskov
• Brian Goff
• CrazyMax
• Davanum Srinivas
• Gaurav Ghildiyal
• Neeraj Krishna Gopalakrishna
• Paweł Gronowski
• Tariq Ibrahim
• TomerLev
• Tõnis Tiigi
• bo.jiang
• ningmingxiao

Changes

53 commits

• Prepare release notes for v2.2.1 (#​12677)
  • f6bae1f88 Prepare release notes for v2.2.1
• cri,nri: bump NRI dependencies to v0.11.0 (#​12701)
  • c22cf5d49 cri,nri: pass any linux security profile to plugins.
  • d7532de75 cri,nri: pass any linux RDT constraints to plugins.
  • ef36e6181 cri,nri: pass any linux net devices to plugins.
  • d56faf426 cri,nri: pass any linux scheduler attributes to plugins.
  • e1824d261 cri,nri: pass any linux I/O priority to plugins.
  • 01d5490ae go.{mod,sum}: bump NRI deps to v0.11.0, re-vendor.
• pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const (#​12697)
  • 58d23ab63 pkg/tracing: HTTPStatusCodeAttributes: remove use of deprecated SemConv const
• cri/nri: short-circuit nil adjustment. (#​12672)
  • 05ccbb3a7 cri/nri: short-circuit nil adjustment.
• go.{mod,sum}: bump CDI deps to v1.1.0. (#​12664)
  • c166a577d go.{mod,sum} bump CDI deps to v1.1.0.
• go.mod: containerd/zfs v2.0.0; remove exclude rules (#​12654)
  • 73a08aa00 go.mod: remove exclude rules
  • cee08c8af build(deps): bump github.com/containerd/zfs/v2 from 2.0.0-rc.0 to 2.0.0
• go.mod: github.com/containernetworking/plugins v1.9.0 (#​12658)
  • 8a5fc8641 go.mod: github.com/containernetworking/plugins v1.9.0
• go.mod: golang.org/x/crypto v0.45.0 (#​12638)
  • 55c93d6fb go.mod: golang.org/x/crypto v0.45.0
• ci :bump Go 1.24.11, 1.25.5 (#​12625)
  • aedd29bb4 ci: bump Go 1.24.11, 1.25.5
  • 26628f139 ci: bump Go 1.24.10, 1.25.4
  • 8bb0e9be6 ci(release): set GO_VERSION in Dockerfile
• core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor (#​12622)
  • ed19c5420 core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor
• ci: update CIFuzz actions to support Ubuntu 24.04 (#​12632)
  • 952237d9b ci: update CIFuzz actions to support Ubuntu 24.04
• Update runc binary to v1.3.4 (#​12593)
  • fb5b818a9 runc: Update runc binary to v1.3.4
• : update containerd/cgroups from v3.1.0 to v3.1.2 (#​12598)
  • 51582ed27 bump containerd/cgroups to v3.1.2
  • 50d0e4fd4 build(deps): bump github.com/containerd/cgroups/v3 from 3.1.0 to 3.1.1
• core/mount: should not call removeLoop when set autoclear (#​12587)
  • 41a69eb0d core/mount: should not call removeLoop when set autoclear
• build(deps): bump github.com/opencontainers/selinux (#​12589)
  • e3bf2b80b build(deps): bump github.com/opencontainers/selinux
• .github: skip 5 critest cases for window-2022 (#​12584)
  • da8e846f9 .github: skip 5 critest cases in window CI pipeline
• Fix image defaults on Darwin to usable configuration (#​12544)
  • d154e234b Update the ctr pull defaults when using the transfer service
  • 09364216d Fix transfer unpack defaults on darwin
  • 2055d3c62 Update default differs on darwin
  • 9da97686d Use default writable size in erofs snapshotter for non-Linux hosts
  • eeb0f889a Update default erofs block size on macOS during erofs diff
• Redact all query parameters in CRI error logs (#​12546)
  • c707f771a fix: redact all query parameters in CRI error logs
• Revert "Implement io.ReaderAt on docker fetch reader" (#​12542)
  • 678f944dd Revert "Implement io.ReaderAt on docker fetch reader"
• Fix possible panic from WithMediaTypeKeyPrefix (#​12516)
  • 8b73c2de3 remotes: fix possible panic from WithMediaTypeKeyPrefix

Changes from containerd/cgroups

13 commits

• ci: bump golangci-lint to v2.6.2 (containerd/cgroups#382)
  • a302e56 ci: bump golangci-lint to v2.6.2
  • 731cf7a ci: suppress errcheck
  • 9bee663 utils: move Close() to defer block
  • 9d7647c rdma: use strings.Cut in Go 1.18
  • 109f063 memory_test: apply De Morgan's law
  • e6fcf3f memory_test: omit type from declaration
• build(deps): bump actions/checkout from 5 to 6 (containerd/cgroups#381)
  • 4e30098 build(deps): bump actions/checkout from 5 to 6
• Fix parsing of hugetlb..events files (containerd/cgroups#379)
  • 2ad7a12 hugetlb: correctly parse hugetlb..events files
• go.mod: github.com/opencontainers/runtime-spec v1.3.0 (containerd/cgroups#376)
  • 34ef430 go.mod: github.com/opencontainers/runtime-spec v1.3.0

Changes from containerd/nri

79 commits

• adaptation: allow compiling out WASM support altogether. (containerd/nri#253)
  • ab88fe6 adaptation: allow compiling out WASM support altogether.
• Support direct editing of the intelRdt config (containerd/nri#215)
  • 8c0c9f6 Implement removal of RDT
  • dfbae8a plugins: add sample rdt plugin
  • d05dd81 pkg/adaptation: support new RDT fields
  • 725289b pkg/runtime-tools/generate: support new RDT fields
  • a7832a2 api: add rdt
• update wazero/wazero version to v1.10.1 (containerd/nri#252)
  • 9eb9a0f update tetratelabs/wazero version to v1.10.1
• support specifying a custom NRI socket path (containerd/nri#249)
  • 2df6565 [plugins] support specifying a custom NRI socket path
• pkg/api: add OptionalRepeatedString type (containerd/nri#212)
  • 687c1a6 pkg/api: add OptionalRepeatedString type
• api,adaptation,generate: allow setting kernel scheduling policy attributes. (containerd/nri#160)
  • 6a371ac device-injector: add scheduling policy adjustment.
  • e06369e api,adaptation,generate: allow setting scheduler attributes.
• device-injector: always log injection summary. (containerd/nri#246)
  • 14cc2e2 device-injector: always log injection summary.
• api,adaptation,generate: allow adjusting linux net devices (containerd/nri#157)
  • 5145c92 device-injector: add network device injection.
  • 8a03823 api,adaptation,generate: allow adjusting linux net devices.
• Add support for sysctl adjustment (containerd/nri#248)
  • 914fbf3 default-validator: restrict sysctl adjustment
  • a418956 api: apply sysctl adjustments
  • 8705f9b api: add sysctl container adjustment
• feat: Make logger a configurable struct member for stub (containerd/nri#239)
  • 08a891a feat: Make logger a configurable struct member for stub
• Drop dependency on opencontainers/runtime-tools (containerd/nri#247)
  • 5e5c2be Drop dependency on opencontainers/runtime-tools
• deps: bump runtime-spec to v1.3.0. (containerd/nri#243)
  • 29c5811 (v0.1.0) examples: lock NRI, runtime spec deps.
  • d812952 v010-adapter: lock NRI, runtime spec and tools deps.
  • 7dd7c7f api,runtime-tools: adjust for runtime-spec v1.3.0.
  • 5d5d4c4 go.{mod,sum}: update runtime-tools, runtime-spec to v1.3.0.
• adaptation: ensure sync'ed plugins are fully registered in tests. (containerd/nri#234)
  • c840397 adaptation: ensure sync'ed plugins are fully registered in tests.
• Fix wasm example (containerd/nri#237)
  • 44b2861 Fix wasm example
• Makefile: build proto files unconditionally (containerd/nri#229)
  • d99f960 Fix dockerized proto build
  • 9623748 Makefile: build proto files unconditionally
  • 25d9391 build: ensure we use correct version of protoc and its deps.
• adaptation: test with populated initial resources. (containerd/nri#231)
  • b6b98b5 adaptation: test with populated initial resources.
• Install protoc locally in the source tree (containerd/nri#232)
  • 2394daa Install protoc locally in the source tree
• plugins/logger: fix default event subscription mask. (containerd/nri#158)
  • 33b1db1 logger: fix default event subscription mask.
• extract memory and CPU resource helpers (containerd/nri#210)
  • 7afb32a extract memory and CPU resource helpers
• api: expose container user/group ID to plugins. (containerd/nri#230)
  • 22aeb46 docs: update README with container uid/gid info.
  • 71b0335 api,adaptation: add container uid/gid info.
• contrib: add example for enabling per-container RDT monitoring (containerd/nri#228)
  • 91fbf06 contrib: add example for enabling per-container RDT monitoring
• ci: enable image signing (containerd/nri#224)
  • fb54916 ci: enable image signing
• golangci: disable QF1008 from staticcheck linter (containerd/nri#226)
  • 0b3b577 golangci: disable QF1008 from staticcheck linter
• ci: bump golangci-lint to v2.4 (containerd/nri#225)
  • 9787127 Bump golangci-lint to v2.4
  • 1a50ff5 Add nolint directives
  • 00fa1a1 Add and fix comments for exported types
  • ac21da7 pkg/api/seccomp: add comments for exported functions
  • 3aff986 pkg/runtime-tools/generate: remove embedded field "Generator"
  • c0c4bb6 pkg/api/validate: add comments for exported methods
  • c0ba9da adaptation/builtin: add comment for exported symbols
• .gitignore: revert hastily reviewed editor-specific addition. (containerd/nri#221)
  • 02376f3 .gitignore: add comment about global gitignore.
  • 9336a79 Revert "nit: Add .idea folder to gitignore"
• nit: Add .idea folder to gitignore (containerd/nri#218)
  • f578ea2 nit: Add .idea folder to gitignore
• chore: clean and unify nolint directives (containerd/nri#217)
  • 21741b9 chore: clean and unify nolint directives
• Downgrade go to require 1.24.0 (containerd/nri#214)
  • d26e910 Downgrade go to require 1.24.0
• Add dockerized target for building proto files (containerd/nri#211)
  • 13fcc07 Add dockerized target for building proto files

Changes from containerd/zfs

11 commits

• go.mod: update to stable containerd v2.0 (containerd/zfs#89)
  • f11f891 go.mod: update to stable containerd v2.0
• ci: update actions, test against go1.23, fix linting, and update golangci-lint (containerd/zfs#88)
  • 662ad3c gha: update golangci/golangci-lint-action@​v9, golangci-lint v2.7
  • b0b2584 remove nolint comments
  • 7c4274b fix error capitalization
  • 24ce1b9 fix inconsistent receiver name
  • c8545c3 gha: update actions/checkout@​v6
  • d23ec04 gha: update actions/setup-go@​v6
  • bb45f6e gha: update containerd/project-checks@​v1.2.2
  • 65bc451 gha: test against go1.23

Dependency Changes

• github.com/containerd/cgroups/v3 v3.1.0 -> v3.1.2
• github.com/containerd/nri v0.10.0 -> v0.11.0
• github.com/containerd/zfs/v2 v2.0.0-rc.0 -> v2.0.0
• github.com/containernetworking/plugins v1.8.0 -> v1.9.0
• github.com/cyphar/filepath-securejoin v0.5.1 new
• github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
• github.com/opencontainers/runtime-tools 0ea5ed0 -> edf4cb3
• github.com/opencontainers/selinux v1.12.0 -> v1.13.1
• github.com/tetratelabs/wazero v1.9.0 -> v1.10.1
• golang.org/x/crypto v0.41.0 -> v0.45.0
• golang.org/x/net v0.43.0 -> v0.47.0
• golang.org/x/sync v0.17.0 -> v0.18.0
• golang.org/x/sys v0.37.0 -> v0.38.0
• golang.org/x/term v0.34.0 -> v0.37.0
• golang.org/x/text v0.28.0 -> v0.31.0
• tags.cncf.io/container-device-interface v1.0.1 -> v1.1.0
• tags.cncf.io/container-device-interface/specs-go v1.0.0 -> v1.1.0

Previous release can be found at v2.2.0

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

v2.2.0: containerd 2.2.0

Compare Source

Welcome to the v2.2.0 release of containerd!

The second minor release of containerd 2.x focuses on continued stability alongside
new features and improvements. This is the second time-based released for containerd.

Highlights

• Add mount manager (#​12063)

  The mount manager is a new service that provides lifecycle management for filesystem mounts
  to support more advanced use cases, such as:

  • Device formatting to create formatted filesystems (xfs, ext4) on-demand
  • Mount activation to prepare devices such as loopbacks or network fileystems
  • Mount transformation to allow mount arguments to be filled in dynamically from previous mounts
  • Garbage collection of mounts to ensure temporary mounts are never leaked

• Add conf.d include in the default config (#​12323)

• Add support for back references in the garbage collector (#​12025)

Container Runtime Interface (CRI)

• Pod Sandbox Metrics (#​10691)

  Full implementation of Kubernetes CRI pod-level metrics API

  • ListPodSandboxMetrics: Query metrics for running pods/sandboxes
  • ListMetricsDescriptors: Discover available metrics and their descriptions

• Support image volume mount subpath (#​11578)

Go client

• Update pkg/oci to use fs.FS interface and os.OpenRoot (#​12245)

Image Distribution

• Parallel Unpack (#​12332)

  Adds support for unpacking layers in parallel during pull operations. This feature is supported with overlayfs and EROFS snapshotters.

• OCI Referrers Support (#​12309)

  Adds new referrers fetcher to remote registry interface using the new referrers endpoint added in OCI distribution-spec 1.1

• Tar unpack progress through transfer service (#​11921)

Image Storage

• EROFS enhancements using mount manager (#​12333)

  Improvements to EROFS snapshotter using the new mount manager service

  • Quota Support: Support for sized block devices as the upper layer for overlayfs
  • Mount Lifecycle: Loopback setup, block device creation, and overlayfs argument formatting is moved to the
    mount manager to be performed on-demand or within the runtime.
  • Mount handler: To allow optimization of EROFS mount types based on the current system
  • macOS Support: EROFS snapshotter can now be used on Darwin to natively allow image pulls
  • Tar index mode: Efficiently generate EROFS metadata backed by original tar content (#​11919)

• Add snapshotter and differ for block CIMs (#​12050)

Node Resource Interface (NRI)

• Enable otel traces in NRI (#​12082)
• Add WASM plugin support (containerd/nri#121)

Runtime

• Improve shim load time after restart by loading in parallel (#​12142)
• Fix pidfd leak in UnshareAfterEnterUserns (#​12167)

Deprecations

• Deprecate cgroup v1 (#​12445)
• Postpone v2.2 deprecation items to v2.3 (#​12417)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Derek McGowan
• Phil Estes
• Akihiro Suda
• Maksym Pavlenko
• Wei Fu
• Krisztian Litkey
• Mike Brown
• Akhil Mohan
• Markus Lehtonen
• Samuel Karp
• Sebastiaan van Stijn
• ningmingxiao
• Austin Vazquez
• yashsingh74
• Gao Xiang
• Kirtana Ashok
• Jin Dong
• Chris Henzie
• Aadhar Agarwal
• Etienne Champetier
• Henry Wang
• Rodrigo Campos
• Sascha Grunert
• Aleksa Sarai
• Eric Mountain
• Keith Mattix II
• Paweł Gronowski
• Tõnis Tiigi
• Adrien Delorme
• Apurv Barve
• Enji Cooper
• Kohei Tokunaga
• Max Jonas Werner
• Rehan Khan
• Yang Yang
• jinda.ljd
• jokemanfire
• Amit Barve
• Andrew Halaney
• Antonio Ojea
• Brian Goff
• Carlos Eduardo Arango Gutierrez
• Chenyang Yan
• Dawei Wei
• Divya Rani
• Evan Anderson
• Fabiano Fidêncio
• Iceber Gu
• Jared Ledvina
• Jonathan Perkin
• Jose Fernandez
• Karl Baumgartner
• Michael Weibel
• Osama Abdelkader
• Radostin Stoyanov
• Ruidong Cao
• Sameer
• Sergey Kanzhelev
• Swagat Bora
• Sylvain MOUQUET
• Tom Wieczorek
• Tycho Andersen
• Wuyue (Tony) Sun
• suranmiao
• tanhuaan
• wheat2018
• zounengren

Dependency Changes

• dario.cat/mergo v1.0.1 -> v1.0.2
• github.com/Microsoft/hcsshim v0.13.0-rc.3 -> v0.14.0-rc.1
• github.com/StackExchange/wmi cbe6696 new
• github.com/checkpoint-restore/checkpointctl v1.3.0 -> v1.4.0
• github.com/containerd/cgroups/v3 v3.0.5 -> v3.1.0
• github.com/containerd/console v1.0.4 -> v1.0.5
• github.com/containerd/containerd/api v1.9.0 -> v1.10.0
• github.com/containerd/go-cni v1.1.12 -> v1.1.13
• github.com/containerd/nri v0.8.0 -> v0.10.0
• github.com/containerd/platforms v1.0.0-rc.1 -> v1.0.0-rc.2
• github.com/containernetworking/plugins v1.7.1 -> v1.8.0
• github.com/coreos/go-systemd/v22 v22.5.0 -> v22.6.0
• github.com/cpuguy83/go-md2man/v2 v2.0.5 -> v2.0.7
• github.com/emicklei/go-restful/v3 v3.11.0 -> v3.13.0
• github.com/fxamacker/cbor/v2 v2.7.0 -> v2.9.0
• github.com/go-jose/go-jose/v4 v4.0.5 -> v4.1.2
• github.com/go-logr/logr v1.4.2 -> v1.4.3
• github.com/go-ole/go-ole v1.2.6 new
• github.com/golang/groupcache 41bb18b -> 2c02b82
• github.com/google/certtostore v1.0.6 new
• github.com/google/deck 105ad94 new
• github.com/gorilla/websocket v1.5.0 -> e064f32
• github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 -> v1.1.0
• github.com/hashicorp/errwrap v1.1.0 new
• github.com/intel/goresctrl v0.8.0 -> v0.10.0
• github.com/klauspost/compress v1.18.0 -> v1.18.1
• github.com/knqyf263/go-plugin v0.9.0 new
• github.com/moby/sys/capability v0.4.0 new
• github.com/modern-go/reflect2 v1.0.2 -> 35a7c28
• github.com/opencontainers/runtime-tools 2e043c6 -> 0ea5ed0
• github.com/prometheus/client_golang v1.22.0 -> v1.23.2
• github.com/prometheus/client_model v0.6.1 -> v0.6.2
• github.com/prometheus/common v0.62.0 -> v0.66.1
• github.com/prometheus/procfs v0.15.1 -> v0.16.1
• github.com/stretchr/testify v1.10.0 -> v1.11.1
• github.com/tchap/go-patricia/v2 v2.3.2 -> v2.3.3
• github.com/tetratelabs/wazero v1.9.0 new
• github.com/urfave/cli/v2 v2.27.6 -> v2.27.7
• github.com/vishvananda/netlink 0e7078e -> v1.3.1
• go.etcd.io/bbolt v1.4.0 -> v1.4.3
• go.opentelemetry.io/otel v1.35.0 -> v1.37.0
• go.opentelemetry.io/otel/metric v1.35.0 -> v1.37.0
• go.opentelemetry.io/otel/sdk v1.35.0 -> v1.37.0
• go.opentelemetry.io/otel/trace v1.35.0 -> v1.37.0
• go.uber.org/goleak v1.3.0 new
• go.yaml.in/yaml/v2 v2.4.2 new
• golang.org/x/crypto v0.36.0 -> v0.41.0
• golang.org/x/mod v0.24.0 -> v0.29.0
• golang.org/x/net v0.38.0 -> v0.43.0
• golang.org/x/oauth2 v0.27.0 -> v0.30.0
• golang.org/x/sync v0.14.0 -> v0.17.0
• golang.org/x/sys v0.33.0 -> v0.37.0
• golang.org/x/term v0.30.0 -> v0.34.0
• golang.org/x/text v0.23.0 -> v0.28.0
• golang.org/x/time v0.7.0 -> v0.14.0
• google.golang.org/genproto/googleapis/api 56aae31 -> a7a43d2
• google.golang.org/genproto/googleapis/rpc 56aae31 -> a7a43d2
• google.golang.org/grpc v1.72.0 -> v1.76.0
• google.golang.org/protobuf v1.36.6 -> v1.36.10
• k8s.io/api v0.32.3 -> v0.34.1
• k8s.io/apimachinery v0.32.3 -> v0.34.1
• k8s.io/client-go v0.32.3 -> v0.34.1
• k8s.io/cri-api v0.32.3 -> v0.34.1
• k8s.io/utils 3ea5e8c -> 4c0f3b2
• sigs.k8s.io/json 9aa6b5e -> cfa47c3
• sigs.k8s.io/randfill v1.0.0 new
• sigs.k8s.io/structured-merge-diff/v6 v6.3.0 new
• sigs.k8s.io/yaml v1.4.0 -> v1.6.0

Previous release can be found at v2.1.0

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

v2.1.6: containerd 2.1.6

Compare Source

Welcome to the v2.1.6 release of containerd!

The sixth patch release for containerd 2.1 contains various fixes and updates.

Highlights

Runtime

• Update runc binary to v1.3.4 (#​12618)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Akihiro Suda
• Derek McGowan
• Mike Brown
• Phil Estes
• Austin Vazquez
• Kirtana Ashok
• Andrey Noskov
• CrazyMax
• Davanum Srinivas
• Krisztian Litkey
• Maksym Pavlenko
• Michael Weibel
• Paweł Gronowski
• Sebastiaan van Stijn
• Wei Fu

Changes

28 commits

• Prepare release notes for v2.1.6 (#​12653)
  • 93f79087a Prepare release notes for v2.1.6
• go.mod: containerd/zfs v2.0.0 (#​12655)
  • 7e75db3a9 build(deps): bump github.com/containerd/zfs/v2 from 2.0.0-rc.0 to 2.0.0
• cri/nri: short-circuit nil adjustment. (#​12673)
  • 2b8e11b12 cri/nri: short-circuit nil adjustment.
• go.mod: github.com/containernetworking/plugins v1.9.0 (#​12659)
  • 69efd067c go.mod: github.com/containernetworking/plugins v1.9.0
• go.mod: golang.org/x/crypto v0.45.0 (drop support for Go 1.23) (#​12639)
  • e81678853 go.mod: golang.org/x/crypto v0.45.0
  • 55a2d8c8d CI: drop Go 1.23
  • fd8e3c39b Update Go requirements in BUILDING
• core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor (#​12623)
  • a4454c49a core/runtime/v2: remove uses of otelgrpc.UnaryClientInterceptor
• Update runc binary to v1.3.4 (#​12618)
  • 251f0a285 runc: Update runc binary to v1.3.4
• ci: bump Go 1.24.11, 1.25.5 (#​12626)
  • c07c29bca ci: bump Go 1.24.11, 1.25.5
  • e52817652 ci: bump Go 1.24.10, 1.25.4
  • 04bbb66e4 ci(release): set GO_VERSION in Dockerfile
• ci: update CIFuzz actions to support Ubuntu 24.04 ([#​12633](https

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 59 additional dependencies were updated

Details:

Package	Change
github.com/containerd/containerd/api	v1.8.0 -> v1.10.0
github.com/golang/glog	v1.2.4 -> v1.2.5
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus	v1.0.1 -> v1.1.0
github.com/prometheus/client_golang	v1.21.1 -> v1.23.2
golang.org/x/net	v0.42.0 -> v0.44.0
golang.org/x/sync	v0.16.0 -> v0.17.0
golang.org/x/sys	v0.35.0 -> v0.37.0
golang.org/x/time	v0.12.0 -> v0.14.0
google.golang.org/grpc	v1.71.1 -> v1.76.0
google.golang.org/protobuf	v1.36.6 -> v1.36.10
k8s.io/api	v0.32.3 -> v0.34.1
k8s.io/apimachinery	v0.32.3 -> v0.34.1
k8s.io/client-go	v0.32.3 -> v0.34.1
k8s.io/cri-api	v0.32.2 -> v0.34.1
cel.dev/expr	v0.23.1 -> v0.24.0
dario.cat/mergo	v1.0.1 -> v1.0.2
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.25.0 -> v1.29.0
github.com/cncf/xds/go	v0.0.0-20250121191232-2f005788dc42 -> v0.0.0-20250501225837-2ac532fd4443
github.com/containerd/cgroups/v3	v3.0.3 -> v3.1.0
github.com/containerd/platforms	v1.0.0-rc.1 -> v1.0.0-rc.2
github.com/coreos/go-systemd/v22	v22.5.0 -> v22.6.0
github.com/fxamacker/cbor/v2	v2.7.0 -> v2.9.0
github.com/tchap/go-patricia/v2	v2.3.2 -> v2.3.3
github.com/vishvananda/netlink	v1.3.1-0.20241022031324-976bd8de7d81 -> v1.3.1
go.etcd.io/bbolt	v1.4.0 -> v1.4.3
go.opentelemetry.io/contrib/detectors/gcp	v1.34.0 -> v1.36.0
go.opentelemetry.io/otel/sdk/metric	v1.35.0 -> v1.37.0
golang.org/x/tools	v0.34.0 -> v0.37.0
cloud.google.com/go/compute/metadata	v0.6.0 -> v0.7.0
github.com/Microsoft/hcsshim	v0.12.9 -> v0.14.0-rc.1
github.com/emicklei/go-restful/v3	v3.12.1 -> v3.13.0
github.com/fsnotify/fsnotify	v1.8.0 -> v1.9.0
github.com/go-logr/logr	v1.4.2 -> v1.4.3
github.com/google/gnostic-models	v0.6.9 -> v0.7.0
github.com/gorilla/websocket	v1.5.3 -> v1.5.4-0.20250319132907-e064f32e3674
github.com/klauspost/compress	v1.18.0 -> v1.18.1
github.com/mdlayher/socket	v0.5.0 -> v0.5.1
github.com/moby/sys/user	v0.3.0 -> v0.4.0
github.com/modern-go/reflect2	v1.0.2 -> v1.0.3-0.20250322232337-35a7c28c31ee
github.com/opencontainers/runtime-spec	v1.2.0 -> v1.2.1
github.com/opencontainers/selinux	v1.11.1 -> v1.12.0
github.com/pelletier/go-toml/v2	v2.2.3 -> v2.2.4
github.com/prometheus/client_model	v0.6.1 -> v0.6.2
github.com/prometheus/common	v0.63.0 -> v0.66.1
github.com/prometheus/procfs	v0.15.1 -> v0.16.1
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.59.0 -> v0.60.0
go.opentelemetry.io/otel	v1.35.0 -> v1.37.0
go.opentelemetry.io/otel/metric	v1.35.0 -> v1.37.0
go.opentelemetry.io/otel/sdk	v1.35.0 -> v1.37.0
go.opentelemetry.io/otel/trace	v1.35.0 -> v1.37.0
golang.org/x/crypto	v0.40.0 -> v0.42.0
golang.org/x/mod	v0.26.0 -> v0.29.0
golang.org/x/term	v0.33.0 -> v0.35.0
golang.org/x/text	v0.27.0 -> v0.29.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250303144028-a0af3efb3deb -> v0.0.0-20250804133106-a7a43d27e69b
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250313205543-e70fdf4c4cb4 -> v0.0.0-20250804133106-a7a43d27e69b
k8s.io/kube-openapi	v0.0.0-20241212222426-2c72e554b1e7 -> v0.0.0-20250710124328-f3f2b991d03b
k8s.io/utils	v0.0.0-20241210054802-24370beab758 -> v0.0.0-20250604170112-4c0f3b243397
sigs.k8s.io/yaml	v1.4.0 -> v1.6.0

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 54 additional dependencies were updated

Details:

Package	Change
github.com/containerd/containerd/api	v1.8.0 -> v1.10.0
github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus	v1.0.1 -> v1.1.0
github.com/prometheus/client_golang	v1.21.1 -> v1.23.2
golang.org/x/net	v0.46.0 -> v0.47.0
golang.org/x/sys	v0.37.0 -> v0.38.0
google.golang.org/grpc	v1.76.0 -> v1.78.0
k8s.io/api	v0.32.3 -> v0.34.1
k8s.io/apimachinery	v0.32.3 -> v0.34.1
k8s.io/client-go	v0.32.3 -> v0.34.1
k8s.io/cri-api	v0.32.2 -> v0.34.1
dario.cat/mergo	v1.0.1 -> v1.0.2
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.29.0 -> v1.30.0
github.com/cncf/xds/go	v0.0.0-20250501225837-2ac532fd4443 -> v0.0.0-20251022180443-0feb69152e9f
github.com/containerd/cgroups/v3	v3.0.3 -> v3.1.2
github.com/containerd/platforms	v1.0.0-rc.1 -> v1.0.0-rc.2
github.com/coreos/go-systemd/v22	v22.5.0 -> v22.6.0
github.com/envoyproxy/go-control-plane/envoy	v1.32.4 -> v1.35.0
github.com/fxamacker/cbor/v2	v2.7.0 -> v2.9.0
github.com/go-jose/go-jose/v4	v4.1.2 -> v4.1.3
github.com/spiffe/go-spiffe/v2	v2.5.0 -> v2.6.0
github.com/tchap/go-patricia/v2	v2.3.2 -> v2.3.3
github.com/vishvananda/netlink	v1.3.1-0.20241022031324-976bd8de7d81 -> v1.3.1
go.etcd.io/bbolt	v1.4.0 -> v1.4.3
go.opentelemetry.io/auto/sdk	v1.1.0 -> v1.2.1
go.opentelemetry.io/contrib/detectors/gcp	v1.36.0 -> v1.38.0
go.opentelemetry.io/otel/sdk/metric	v1.37.0 -> v1.38.0
golang.org/x/tools	v0.37.0 -> v0.38.0
github.com/Microsoft/hcsshim	v0.12.9 -> v0.14.0-rc.1
github.com/cyphar/filepath-securejoin	v0.4.1 -> v0.5.1
github.com/emicklei/go-restful/v3	v3.12.1 -> v3.13.0
github.com/fsnotify/fsnotify	v1.8.0 -> v1.9.0
github.com/google/gnostic-models	v0.6.9 -> v0.7.0
github.com/gorilla/websocket	v1.5.3 -> v1.5.4-0.20250319132907-e064f32e3674
github.com/klauspost/compress	v1.18.0 -> v1.18.1
github.com/mdlayher/socket	v0.5.0 -> v0.5.1
github.com/moby/sys/user	v0.3.0 -> v0.4.0
github.com/modern-go/reflect2	v1.0.2 -> v1.0.3-0.20250322232337-35a7c28c31ee
github.com/opencontainers/runtime-spec	v1.2.0 -> v1.3.0
github.com/opencontainers/selinux	v1.11.1 -> v1.13.1
github.com/pelletier/go-toml/v2	v2.2.3 -> v2.2.4
github.com/prometheus/client_model	v0.6.1 -> v0.6.2
github.com/prometheus/common	v0.63.0 -> v0.66.1
github.com/prometheus/procfs	v0.15.1 -> v0.16.1
go.opentelemetry.io/otel	v1.37.0 -> v1.38.0
go.opentelemetry.io/otel/metric	v1.37.0 -> v1.38.0
go.opentelemetry.io/otel/sdk	v1.37.0 -> v1.38.0
go.opentelemetry.io/otel/trace	v1.37.0 -> v1.38.0
golang.org/x/crypto	v0.43.0 -> v0.45.0
golang.org/x/mod	v0.28.0 -> v0.29.0
golang.org/x/term	v0.36.0 -> v0.37.0
golang.org/x/text	v0.30.0 -> v0.31.0
k8s.io/kube-openapi	v0.0.0-20241212222426-2c72e554b1e7 -> v0.0.0-20250710124328-f3f2b991d03b
k8s.io/utils	v0.0.0-20241210054802-24370beab758 -> v0.0.0-20250604170112-4c0f3b243397
sigs.k8s.io/yaml	v1.4.0 -> v1.6.0