containerd v2.2.10

Welcome to the v2.2.10 release of containerd!

The tenth patch release for containerd 2.2 contains various fixes and updates including security patches.

Security Updates

• containerd
  • CVE-2026-95839
  • GHSA-5p7c-hggf-c748
  • GHSA-8647-2jxj-p2rc
  • GHSA-hc94-p972-ch66

Highlights

Container Runtime Interface (CRI)

• Apply hardening to not follow symlinks for container log files (#14300)

Image Distribution

• Avoid hang and data corruption during multipart image fetch (#14316)
• Apply hardening to reject image references with ”..” path components (#14280)

Runtime

• Apply hardening to allowlist socket domains in the default seccomp profile (#14249)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14269)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Maksym Pavlenko
• Wei Fu
• Aysha Afrah Ziya
• Phil Estes
• Adrien Delorme
• LEI WANG
• Paweł Gronowski
• Sebastiaan van Stijn
• Shiming Zhang
• syed abdul khaliq
• 申玥

Changes

33 commits

• Prepare release notes for v2.2.10 (#14340)
  • 27d59fe59 Prepare release notes for v2.2.10
• Update to go1.26.9 (#14354)
  • cb4648a80 Update to go1.26.9, remove go1.25.12
  • 6fe70e5cc Merge commit from fork
  • 70c8ae49e remotes/docker: bound parallel fetch readers
  • aff52a508 Merge commit from fork
  • 2455fec2f images: skip malformed digests when computing referrer labels
  • 32fc74497 Merge commit from fork
  • 5f8c507a2 content, remotes: bound reads to expected size
  • 14da554b2 Merge commit from fork
  • c3b7534ed cri: unmount checkpoint view on every CRImportCheckpoint return path
• Skip critest OOMKilled testcase for systemd cgroup (#14319)
  • a47da7e9b script/critest.sh: always skip OOMKilled on systemd cgroup
  • 32c566557 *: skip critest OOMKilled testcase for systemd cgroup
• multipart fetch stability fixes (#14316)
  • 5dde40350 multipart fetch stability fixes
• integration/client: fix TestContainerExecLargeOutputWithTTY (#14307)
  • 7dff2d997 integration/client: fix TestContainerExecLargeOutputWithTTY
• cri: should not follow log file (#14300)
  • a5e41909a cri: should not follow log file
• reference: reject .. path components that rewrite the host (#14280)
  • 4f71fd9b0 reference: reject .. path components that rewrite the host
• core/unpack: don’t honor id-mapping labels from image annotations (#14269)
  • 4b3494a8d core/unpack: tighten comments around id-mapping label filtering
  • 076598878 core/unpack: don’t honor id-mapping labels from image annotations
• seccomp: Use an allow-list for socket domains (#14249)
  • 5ba51c0f2 seccomp: Use an allow-list for socket domains
• Conditional actions (#14246)
  • fa5e5452e [CI] Prevents triggering of an inactive issue/PR check for forked repository.
  • 1c0d72890 Makefile: remove go mod download from integration
  • 9cfd2b4f8 ci: skip linters steps in private repositories
  • 8c0ab89ce workflows: skip non-CI jobs in private forks

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.2.9

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

---

Source containerd/containerd · v2.2.10 · 2026-10-13 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.