containerd v2.3.6

Welcome to the v2.3.6 release of containerd!

The sixth patch release for containerd 2.3 contains various fixes and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14211)
• Enable mount manager for image mounts in CRI (#14147)

Image Storage

• Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14139)

Runtime

• Avoid unexpected mutation of mount options in mount helpers (#14192)
• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14144)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Paweł Gronowski
• Samuel Karp
• Chris Henzie
• Maksym Pavlenko
• Wei Fu
• Gao Xiang
• Nan Liu

Changes

26 commits

• 086fc0d40e Prepare release notes for v2.3.6
• 3e3b3daabc Merge commit from fork
• 03fbef37da Bound Walk references
• bfe167214b Bound Dispatch concurrency and references
• Fix input mutation in mount option helpers (#14192)
  • 5f17a29a9b core/mount: Keep lazy copy for filtered options
  • 49796574fb core/mount: Return copied filtered mount options
  • cb3f358aea mount: share lazy option filtering
  • ee7ae5b7c7 mount: fix shallow copy of Options in RemoveVolatileOption and RemoveIDMapOption
  • 1facedfb21 mount: fix input mutation in readonlyMounts
  • 5ca695a441 mount: replace copyMounts with slices.Clone
• cri: tolerate wrapped ENOTSUP during relabel (#14211)
  • 7fd198f858 cri: tolerate wrapped ENOTSUP during relabel
• release: don’t mark 2.3 releases as latest (#14180)
  • 147edce99f release: don’t mark 2.3 releases as latest
• cri: Backport image mount fixes 2.3 (#14147)
  • c2c5164437 cri: only unmount image volumes when mounting fails
  • 74d0c79682 cri: enable mount manager for image mounts
• core/unpack: fetch layers of every config-sharing manifest (#14139)
  • 4a3a41d353 core/unpack: fetch layers of every config-sharing manifest
• pkg/oci: mask thermal interrupt info (#14144)
  • 9c6d7e9509 pkg/oci: mask thermal interrupt info
• Update to go1.26.8 (#14088)
  • ac4464a399 Update to go1.26.8
  • f7f64ddc06 Update to go1.26.7
  • 902a7d5e6c Update to go1.26.6

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.3.5

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

---

Source containerd/containerd · v2.3.6 · 2026-09-24 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.