containerd runtime release notes - Container Service for Kubernetes

containerd is an industry-standard container runtime that manages the full container lifecycle on hosts. This topic tracks version updates, bug fixes, CVE patches, and dependency upgrades for the containerd runtime.

Usage notes

See Comparison of containerd, sandboxed-container, and Docker runtimes.
See Introduction to containerd 2.1 for feature changes and deprecations.

January 2026

Version number	Change date	Changes	Impact
2.1.6	January 15, 2026	Dependency upgrades: Upgraded runc to version 1.3.4. Upgraded Go to version 1.24.11.	This upgrade does not affect your services.

November 2025

Version number

Change date

Change description

Impact

2.1.5

November 30, 2025

Dependency upgrades:
- Upgraded runc to version 1.3.3.
- Upgraded Go to version 1.24.9.
Bug fixes:
- Fixed CVE-2024-25621 and CVE-2025-64329.

This upgrade does not affect your services.

October 2025

Version number

Change date

Changes

Impact

2.1.4

October 13, 2025

Optimizations:
- Added the nerdctl tool.
Bug fixes:
- Fixed a deadlock when downloading images from self-managed registries (#12126).
- Fixed unclosed I/O handles on runtime creation failure (#11885).

This upgrade does not affect your services.

1.6.39

October 31, 2025

Dependency upgrades:
- Upgraded runc to version 1.3.
Bug fixes:
- Fixed unclosed I/O handles on runtime creation failure (#12052).

This upgrade does not affect your services.

July 2025

Version number

Change date

Changes

Impact

2.1.3

July 7, 2025

Fixed image shard pull failures when the server omitted the Content-Length header (#12003).
Improved Transfer Service platform compatibility and fixed issues with local image imports and registry error handling (#11999, #12000, and #11979).
Fixed the fetch operation adding an unnecessary range field to requests (#12001).
Improved fetcher error messages to include complete registry error details for easier troubleshooting (#11997).

This upgrade does not affect your services.

May 2025

Version number	Change date	Change description	Impact
2.1.1	May 27, 2025	Features Node Resource Interface (NRI) is supported and enabled by default. Container Device Interface (CDI) is supported and enabled by default. Sandbox API is supported. Deprecated features and APIs registry.auths, registry.configs, and registry.mirrors are deprecated. See Customize the containerd parameters of a node pool. Docker Schema 1 images are no longer supported. Images with `application/vnd.docker.distribution.manifest.v1+json` or `application/vnd.docker.distribution.manifest.v1+prettyjws` manifests cannot be pulled. To find them, see Identify Docker Schema 1 images. The `io_uring_` syscall is removed from the default seccomp profile. Containers can no longer make `io_uring_` calls by default. The CRI v1alpha2 API is removed. This API has been deprecated since Kubernetes 1.26, and containerd 2.1 removes it entirely.	This upgrade does not affect your services.

March 2025

Version number	Change date	Changes	Impact
1.6.37	March 3, 2025	Upgraded Go to version 1.22.10. Upgraded runC to version 1.2.5. Fixed a TTY leak when enabling TTY and stdin for a container, which prevented the container from starting (#11160). Fixed image pull failures when garbage collection (GC) ran concurrently on the same image (#3787).	This upgrade does not affect your services.
1.6.38	March 31, 2025	Upgraded Go to version 1.23.7. Fixed CVE-2024-40635.	This upgrade does not affect your services.

November 2024

Version number	Change date	Change description	Impact
1.6.36	November 8, 2024	Upgraded Go to version 1.22.7. Upgraded runC to version 1.1.14. Fixed potential container stop failures (#10651).	This upgrade does not affect your services.

September 2024

Version number	Change date	Change Description	Impact
1.6.34	September 9, 2024	Upgraded Go to version 1.21.12. Upgraded runC to version 1.1.13. Added the `drain_exec_sync_io_timeout` parameter (#9768).	This upgrade does not affect your services.

February 2024

Version number	Change date	Change description	Impact
1.6.28	February 4, 2024	Fixed CVE-2024-21626. Upgraded runC to v1.1.12 (GHSA-xr7r-f8xq-vfvv).	This upgrade does not affect your services.

January 2024

Version number	Change date	Changes	Impact
1.6.21	January 31, 2024	Upgraded runC to v1.1.7. Fixed CVE-2024-21626.	This upgrade does not affect your services.

May 2023

Version number	Change date	Change description	Impact
1.6.20	May 17, 2023	Upgraded to the latest release of the first official containerd long-term support (LTS) version. (Release Notes). Upgraded Go to version 1.18.8. Fixed multiple CVE issues: CVE-2022-41717 CVE-2022-41720 CVE-2022-41716 CVE-2022-27191 Added custom repository support. By default, cert.d configures custom hosts. Upgraded runC to v1.1.5.	This upgrade does not affect your services.

September 2022

Version number	Change date	Changes	Impact
1.5.13	September 8, 2022	Fixed CVE issues: CVE-2022-24769 CVE-2022-31030 Fixed a file descriptor (FD) leak when a cgroup was deleted. Ensured the MaxConcurrentDownloads setting takes effect during container unpacking. Changed the temporary mounts created for volumes in Dockerfiles to read-only.	This upgrade does not affect your services.

March 2022

Version number	Change date	Changes	Impact
1.5.10	March 22, 2022	Fixed CVE issues: CVE-2022-23648 CVE-2021-43816 CVE-2021-41190 Upgraded runC to version 1.0.3, fixing issues such as nodes becoming NotReady due to runC pipeline blockages during PID leaks.	This upgrade does not affect your services.

August 2021

Version number	Change date	Change description	Impact
1.4.8	August 3, 2021	Fixed sandbox creation timeouts caused by high payloads, which led to IP address resource leaks. Fixed CVE-2021-32760.	This upgrade does not affect your services.

June 2021

Version number	Change date	Changes	Impact
1.4.6	June 3, 2021	Fixed CVE-2021-30465.	This upgrade does not affect your services.

March 2021

Version number	Change date	Change description	Impact
1.4.4	March 16, 2021	The containerd runtime is now supported for cluster creation. Note The containerd runtime feature is in public preview.	This upgrade does not affect your services.