containerd v2.0.14

Welcome to the v2.0.14 release of containerd!

The fourteenth patch release for containerd 2.0 contains various fixes and updates including a security patch.

Security Updates

• containerd
  • GHSA-hc94-p972-ch66

Highlights

Container Runtime Interface (CRI)

• Apply hardening to not follow symlinks for container log files (#14299)

Runtime

• Apply hardening to allowlist socket domains in the default seccomp profile (#14251)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14270)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Wei Fu
• Maksym Pavlenko
• Aysha Afrah Ziya
• Paweł Gronowski
• Phil Estes
• Shiming Zhang
• ningmingxiao

Changes

21 commits

• 30145a48d Prepare release notes for v2.0.14
• eaae6434c Merge commit from fork
• 21fd0a996 content, remotes: bound reads to expected size
• Skip critest OOMKilled testcase for systemd cgroup (#14320)
  • eb878c296 script/critest.sh: always skip OOMKilled on systemd cgroup
  • 95be879a5 *: skip critest OOMKilled testcase for systemd cgroup
• integration/client: fix TestContainerExecLargeOutputWithTTY (#14308)
  • 9101dc4e3 integration/client: fix TestContainerExecLargeOutputWithTTY
  • 16e119c17 ci:fix ci TestContainerExecLargeOutputWithTTY panic
• cri: should not follow log file (#14299)
  • 85b6459b2 cri: should not follow log file
• core/unpack: don’t honor id-mapping labels from image annotations (#14270)
  • 1e0b4964e core/unpack: tighten comments around id-mapping label filtering
  • 6e9229820 core/unpack: don’t honor id-mapping labels from image annotations
• seccomp: Use an allow-list for socket domains (#14251)
  • 1183551f1 seccomp: Use an allow-list for socket domains
• Conditional actions (#14250)
  • 29ab0dcca [CI] Prevents triggering of an inactive issue/PR check for forked repository.
  • 23c28d68c Makefile: remove go mod download from integration
  • 4b3976166 ci: skip linters steps in private repositories
  • db335dfa0 workflows: skip non-CI jobs in private forks

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.0.13

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

---

Source containerd/containerd · v2.0.14 · 2026-10-13 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.