containerd runtime release notes - Container Service for Kubernetes

containerd is an industry-standard container runtime that manages the complete container lifecycle on a host. It is a streamlined and stable container runtime. This topic describes the release history of the containerd runtime.

Usage notes

For a detailed comparison of the containerd runtime with other runtimes, see Comparison of containerd, sandboxed-container, and Docker runtimes.
For information about feature changes and deprecated features in containerd 2.1, see Introduction to containerd 2.1.

January 2026

Version number	Change date	Changes	Impact
2.1.6	January 15, 2026	Dependency upgrades: Upgraded runc to version 1.3.4. Upgraded Go to version 1.24.11.	This upgrade does not affect your services.

November 2025

Version number

Change date

Change description

Impact

2.1.5

November 30, 2025

Dependency upgrades:
- Upgraded runc to version 1.3.3.
- Upgraded Go to version 1.24.9.
Bug fixes:
- Fixed containerd CVE vulnerabilities CVE-2024-25621 and CVE-2025-64329.

This upgrade does not affect your services.

October 2025

Version number

Change date

Changes

Impact

2.1.4

October 13, 2025

Optimizations:
- Added the nerdctl tool.
Bug fixes:
- Fixed a deadlock issue that occurred when you download images from some self-managed image repositories. For more information, see #12126.
- Fixed an issue where I/O handles were not closed when the runtime failed to be created. For more information, see #11885.

This upgrade does not affect your services.

1.6.39

October 31, 2025

Dependency upgrades:
- Upgraded runc to version 1.3.
Bug fixes:
- Fixed an issue where I/O handles were not closed when the runtime failed to be created. For more information, see #12052.

This upgrade does not affect your services.

July 2025

Version number

Change date

Changes

Impact

2.1.3

July 7, 2025

Fixed an issue where image shard pulls failed when the server did not return a Content-Length header. For more information, see #12003.
Improved the platform compatibility of the Transfer Service. Fixed potential issues that occurred during local image imports and when handling registry errors. For more information, see #11999, #12000, and #11979.
Fixed an issue where the fetch operation added a range field to requests regardless of whether it was needed. For more information, see #12001.
Optimized the fetcher error messages to include complete error details returned from the registry. This helps with troubleshooting. For more information, see #11997.

This upgrade does not affect your services.

May 2025

Version number	Change date	Change description	Impact
2.1.1	May 27, 2025	Features The Node Resource Interface (NRI) feature is supported. This feature is enabled by default. The Container Device Interface (CDI) feature is supported. This feature is enabled by default. The Sandbox API is supported. Deprecated features and APIs The following parameters are deprecated: registry.auths, registry.configs, and registry.mirrors. For more information about how to customize the containerd parameters in the Container Service for Kubernetes (ACK) console, see Customize the containerd parameters of a node pool. Docker images of the Schema 1 format, such as `application/vnd.docker.distribution.manifest.v1+json` and `application/vnd.docker.distribution.manifest.v1+prettyjws`, are no longer supported. Requests for pulling such images will be rejected. For more information about how to identify Docker images of the Schema 1 format, see Identify Docker images of the Schema 1 format. The `io_uring_` system call (syscall) is removed from the default seccomp profile of containerd. By default, containers cannot make the `io_uring_` syscall. The CRI v1alpha2 API is deprecated. CRI v1alpha2 API has been deprecated since Kubernetes 1.26.	This upgrade does not affect your services.

March 2025

Version number	Change date	Changes	Impact
1.6.37	March 3, 2025	Upgraded Go to version 1.22.10. Upgraded runC to version 1.2.5. Fixed an issue where enabling TTY and stdin for a container could cause a TTY leak, which in turn caused the container to fail to start. For more information, see #11160. Fixed an issue where an image pull could fail if garbage collection (GC) and a pull operation were performed on the same image at the same time. For more information, see #3787.	This upgrade does not affect your services.
1.6.38	March 31, 2025	Upgraded Go to version 1.23.7. Fixed the CVE issue CVE-2024-40635.	This upgrade does not affect your services.

November 2024

Version number	Change date	Change description	Impact
1.6.36	November 8, 2024	Upgraded Go to version 1.22.7. Upgraded runC to version 1.1.14. Fixed an issue where containers might fail to stop. For more information, see #10651.	This upgrade does not affect your services.

September 2024

Version number	Change date	Change Description	Impact
1.6.34	September 9, 2024	Upgraded Go to version 1.21.12. Upgraded runC to version 1.1.13. Added the `drain_exec_sync_io_timeout` parameter. For more information, see #9768.	This upgrade does not affect your services.

February 2024

Version number	Change date	Change description	Impact
1.6.28	February 4, 2024	Fixed the CVE issue CVE-2024-21626. Upgraded runC to v1.1.12 (GHSA-xr7r-f8xq-vfvv).	This upgrade does not affect your services.

January 2024

Version number	Change date	Changes	Impact
1.6.21	January 31, 2024	Upgraded runC to v1.1.7. Fixed the CVE-2024-21626 issue.	This upgrade does not affect your services.

May 2023

Version number	Change date	Change description	Impact
1.6.20	May 17, 2023	Upgraded to the latest version of the first official long-term stable (LTS) release of containerd. For more information, see the Release Notes. Upgraded Go to version 1.18.8. Fixed multiple CVE issues: CVE-2022-41717 CVE-2022-41720 CVE-2022-41716 CVE-2022-27191 Added support for custom repositories. By default, cert.d is used to configure custom hosts. Upgraded runC to v1.1.5.	This upgrade does not affect your services.

September 2022

Version number	Change date	Changes	Impact
1.5.13	September 8, 2022	Fixed CVE issues: CVE-2022-24769 CVE-2022-31030 Fixed a file descriptor (FD) leak issue that occurred when a cgroup was deleted. Ensured that the MaxConcurrentDownloads setting takes effect when a container needs to be unpacked. Changed the temporary mounts created for volumes in Dockerfiles to read-only.	This upgrade does not affect your services.

March 2022

Version number	Change date	Changes	Impact
1.5.10	March 22, 2022	Fixed CVE issues: CVE-2022-23648 CVE-2021-43816 CVE-2021-41190 Upgraded runC to version 1.0.3. This fixes issues such as nodes becoming NotReady due to runC pipeline blockages during process ID (PID) leaks.	This upgrade does not affect your services.

August 2021

Version number	Change date	Change description	Impact
1.4.8	August 3, 2021	Fixed an issue where high payloads caused sandbox creation timeouts, which in turn led to IP address resource leaks. Fixed the CVE issue: CVE-2021-32760.	This upgrade does not affect your services.

June 2021

Version number	Change date	Changes	Impact
1.4.6	June 3, 2021	Fixed the CVE issue: CVE-2021-30465.	This upgrade does not affect your services.

March 2021

Version number	Change date	Change description	Impact
1.4.4	March 16, 2021	The containerd runtime is now supported for cluster creation. Note The containerd runtime feature is in public preview.	This upgrade does not affect your services.