New features of containerd 2.1 - Container Service for Kubernetes

Features

Lists only key features. See containerd release notes.

Node Resource Interface (NRI) is supported and enabled by default.
Container Device Interface (CDI) is supported and enabled by default.
Sandbox API is supported.

Deprecated features and APIs

Lists only key deprecations. See containerd release notes.

registry.auths, registry.configs, and registry.mirrors are deprecated. See Customize the containerd parameters of a node pool.
Docker Schema 1 images are no longer supported. Images with application/vnd.docker.distribution.manifest.v1+json or application/vnd.docker.distribution.manifest.v1+prettyjws manifests cannot be pulled. To find them, see Identify Docker Schema 1 images.
The io_uring_* syscall is removed from the default seccomp profile. Containers can no longer make io_uring_* calls by default.
The CRI v1alpha2 API is removed. This API has been deprecated since Kubernetes 1.26, and containerd 2.1 removes it entirely.
The AUFS snapshotter is removed.
The [plugins."io.containerd.internal.v1".tracing] parameter is removed.

Upgrade notes

The CRI v1alpha2 API is no longer supported in containerd 2.1. If you use this API, migrate to CRI v1.
Before upgrading, identify deprecated APIs. Before upgrading, identify deprecated APIs. To run a precheck from the console, on the cluster details page, choose ... > ..., and run ....: on the cluster details page, choose Operations > Upgrade Cluster, and run Precheck.
The upgrade automatically checks for deprecated APIs and suspends if any are detected.

Identify deprecated APIs

Use kubectl

Check whether containerd-related directories are mounted to pods in the cluster:

kubectl and jq must be installed. Install jq with yum install jq.

kubectl get pods --all-namespaces -o json |
jq -r '.items[] |
  select(.spec.volumes[]?.hostPath.path as $p |
    ["/", "/var", "/var/","/var/run", "/var/run/",
     "/var/run/containerd", "/var/run/containerd/",
     "/var/run/containerd/containerd.sock",
     "/run", "/run/", "/run/containerd", "/run/containerd/",
     "/run/containerd/containerd.sock"] | index($p)) |
  .metadata.namespace + "/" + .metadata.name'

Use ctr

List deprecated APIs with ctr deprecations list:

ctr deprecations list

Identify Docker Schema 1 images

ctr --namespace k8s.io images list 'labels."io.containerd.image/converted-docker-schema1"'

Upgrade methods

First, manually upgrade the ACK cluster control plane to Kubernetes 1.33 or later. Then, update a node pool to upgrade containerd.

FAQ

Does the upgrade affect my business?

Update a node pool to upgrade containerd. Node pool upgrades perform in-place updates by default, which do not restart containers.

After I upgrade containerd from V1.6 to V2.1, can I roll back the upgrade?

No. containerd V2.1 introduces the shim-v3 API, which is incompatible with shim-v2 in V1.6.

Does data loss occur when I upgrade containerd from V1.6 to V2.1?

If you update a node pool to upgrade containerd, an in-place upgrade runs by default and uses the original data directories. No data loss occurs.

Container Service for Kubernetes:Containerd 2.1