containerd v2.4.1

Welcome to the v2.4.1 release of containerd!

The first patch release for containerd 2.4 contains various fixes and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where failed container start cleanup leaked tasks and prevented container removal (#14223)
• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14212)

Image Distribution

• Fix content upload failures when retrying fetch content after reaching EOF (#14197)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#14200)

ctr development tool

• Fix bug where arguments following ”-” were dropped in “ctr images export” (#14219)
• Fix bug where container command arguments were parsed as flags in “ctr run”, “ctr containers create”, “ctr tasks exec”, and “containerd oci-hook” (#14215)
• Fix bug where comma-separated flag values were incorrectly split in ctr subcommands (#14188)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Aysha Afrah Ziya
• Chris Henzie
• CrazyMax
• Maksym Pavlenko
• Nan Liu
• Sebastiaan van Stijn

Changes

23 commits

• 9f7f70fc31 Prepare release notes for v2.4.1
• 98e88f2afe Merge commit from fork
• e0c8eed120 Bound Walk references
• ddf544326a Bound Dispatch concurrency and references
• cri: don’t leak task when StartContainer cleanup fails to delete task (#14223)
  • 9e8abe0405 cri: fix process leak when start cleanup fails to delete task
• ctr: preserve args after ”-” in images export (#14219)
  • acbdd57f0d ctr: preserve args after ”-” in images export
• ctr: fix flag parsing issues in run, containers create, tasks exec, and oci-hook (#14215)
  • a2e9a5196e cmd/containerd: stop flag parsing on oci-hook
  • 2d0e53474d ctr: stop flag parsing before container command
• cri: tolerate wrapped ENOTSUP during relabel (#14212)
  • eb2dfa125d cri: tolerate wrapped ENOTSUP during relabel
• core/unpack: don’t honor id-mapping labels from image annotations (#14200)
  • 429f317b55 core/unpack: tighten comments around id-mapping label filtering
  • cc1b8a2dc5 core/unpack: don’t honor id-mapping labels from image annotations
• remotes: revert closing fetch readers at EOF (#14197)
  • d265baec5a remotes: test fetch retries and HTTP reader lifetime
  • 9e8507bea8 Revert “remotes: close fetch reader immediately on EOF”
• ctr: disable slice flag separator on commands (#14188)
  • 2543d23905 ctr: disable slice flag separator on commands
• vendor: github.com/fxamacker/cbor/v2 v2.9.4 (#14179)
  • f00dd7552e vendor: github.com/fxamacker/cbor/v2 v2.9.4

Dependency Changes

• github.com/fxamacker/cbor/v2 v2.9.1 -> v2.9.4

Previous release can be found at v2.4.0

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc and CNI plugins from their official sites too.

See also the Getting Started documentation.

---

Source containerd/containerd · v2.4.1 · 2026-09-24 · upstream release

Mirrored verbatim for indexing. All rights belong to the upstream project.