containerd v2.3.7

Welcome to the v2.3.7 release of containerd!

The seventh patch release for containerd 2.3 contains various fixes and updates including security patches.

Security Updates

containerd

Highlights

Container Runtime Interface (CRI)

Apply hardening to not follow symlinks for container log files (#14301)

Image Distribution

Apply hardening to reject image references with ”..” path components (#14281)

Runtime

Apply hardening to allowlist socket domains in the default seccomp profile (#14248)

Snapshotters

Apply hardening to filter ID-mapping labels from image annotations during unpack (#14261)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

Samuel Karp
Wei Fu
Maksym Pavlenko
Aysha Afrah Ziya
Derek McGowan
Sebastiaan van Stijn
Akihiro Suda
LEI WANG
Paweł Gronowski
Phil Estes
Vishal Srinivasan
syed abdul khaliq
申玥

Changes

31 commits

Prepare release notes for v2.3.7 (#14339)
- c8b271adb Prepare release notes for v2.3.7
Update to go1.26.9 (#14353)
- 320278f96 Update to go1.26.9
- ca3d94d2f Merge commit from fork
- 9621a5f9c remotes/docker: bound parallel fetch readers
- dff0d82dd Merge commit from fork
- 2181d7baa images: skip malformed digests when computing referrer labels
- 29ed4ba2e Merge commit from fork
- 80885a94d content, remotes: bound reads to expected size
- 5c6687786 Merge commit from fork
- 2e17e62e2 cri: unmount checkpoint view on every CRImportCheckpoint return path
integration/client: fix TestContainerExecLargeOutputWithTTY (#14306)
- da23fb7af integration/client: fix TestContainerExecLargeOutputWithTTY
cri: should not follow log file (#14301)
- 50a18659f cri: should not follow log file
reference: reject .. path components that rewrite the host (#14281)
- b3dd30ae5 reference: reject .. path components that rewrite the host
vendor: google.golang.org/grpc v1.83.2 (#14263)
- 993898bbf [release/2.3] vendor: google.golang.org/grpc v1.83.2
core/unpack: don’t honor id-mapping labels from image annotations (#14261)
- fe408f2a4 core/unpack: tighten comments around id-mapping label filtering
- 3ab5f9c0e core/unpack: don’t honor id-mapping labels from image annotations
seccomp: Use an allow-list for socket domains (#14248)
- 658428e2f seccomp: Use an allow-list for socket domains
Conditional actions (#14244)
- c73186ea6 Makefile: remove go mod download from integration
- 030b7b3f7 ci: skip linters steps in private repositories
- ec6240e3e workflows: skip non-CI jobs in private forks
update runc binary to v1.5.2 (#14240)
- 63092f411 update runc binary to v1.5.2

Dependency Changes

go.opentelemetry.io/otel v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace v1.43.0 -> v1.44.0
golang.org/x/crypto v0.53.0 -> v0.55.0
golang.org/x/mod v0.36.0 -> v0.38.0
golang.org/x/net v0.55.0 -> v0.58.0
golang.org/x/oauth2 v0.35.0 -> v0.36.0
golang.org/x/sync v0.21.0 -> v0.22.0
golang.org/x/sys v0.46.0 -> v0.47.0
golang.org/x/term v0.44.0 -> v0.45.0
golang.org/x/text v0.38.0 -> v0.41.0
google.golang.org/genproto/googleapis/api 9d38bb4040a9 -> 3dc84a4a5aaa
google.golang.org/genproto/googleapis/rpc 6f92a3bedf2d -> 3dc84a4a5aaa
google.golang.org/grpc v1.80.0 -> v1.83.2

Previous release can be found at v2.3.6

Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

Source containerd/containerd · v2.3.7 · 2026-10-13 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.

Release notes are published by the upstream project and mirrored here for indexing. All rights belong to their authors.