fix(deps): update module github.com/containerd/containerd to v1.7.29 [security] (alauda-3.17.3)

[alaudaa-renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd	v1.7.23 -> v1.7.29

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

containerd has an integer overflow in User ID handling

CVE-2024-40635 / GHSA-265r-hfxg-fhmg / GO-2025-3528

More information

Details

Impact

A bug was found in containerd where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user.

Patches

This bug has been fixed in the following containerd versions:

• 2.0.4 (Fixed in containerd/containerd@1a43cb6)
• 1.7.27 (Fixed in containerd/containerd@05044ec)
• 1.6.38 (Fixed in containerd/containerd@cf158e8)

Users should update to these versions to resolve the issue.

Workarounds

Ensure that only trusted images are used and that only trusted users have permissions to import images.

Credits

The containerd project would like to thank Benjamin Koltermann and emxll for responsibly disclosing this issue in accordance with the containerd security policy.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40635

For more information

If you have any questions or comments about this advisory:

• Open an issue in containerd
• Email us at security@containerd.io

To report a security issue in containerd:

• Report a new vulnerability
• Email us at security@containerd.io

Severity

• CVSS Score: 4.6 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

References

• https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg
• https://nvd.nist.gov/vuln/detail/CVE-2024-40635
• https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da
• https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
• https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a
• https://github.com/containerd/containerd
• https://lists.debian.org/debian-lts-announce/2025/05/msg00005.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

containerd has an integer overflow in User ID handling in github.com/containerd/containerd

CVE-2024-40635 / GHSA-265r-hfxg-fhmg / GO-2025-3528

More information

Details

containerd has an integer overflow in User ID handling in github.com/containerd/containerd

Severity

Unknown

References

• https://github.com/containerd/containerd/security/advisories/GHSA-265r-hfxg-fhmg
• https://github.com/containerd/containerd/commit/05044ec0a9a75232cad458027ca83437aae3f4da
• https://github.com/containerd/containerd/commit/1a43cb6a1035441f9aca8f5666a9b3ef9e70ab20
• https://github.com/containerd/containerd/commit/cf158e884cfe4812a6c371b59e4ea9bc4c46e51a

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

containerd CRI server: Host memory exhaustion through Attach goroutine leak

CVE-2025-64329 / GHSA-m6hq-p25p-ffr2 / GO-2025-4108

More information

Details

Impact

A bug was found in containerd's CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks.

Repetitive calls of CRI Attach (e.g., kubectl attach) could increase the memory usage of containerd.

Patches

This bug has been fixed in the following containerd versions:

• 2.2.0
• 2.1.5
• 2.0.7
• 1.7.29

Users should update to these versions to resolve the issue.

Workarounds

Set up an admission controller to control accesses to pods/attach resources.
e.g., Validating Admission Policy.

Credits

The containerd project would like to thank @​Wheat2018 for responsibly disclosing this issue in accordance with the containerd security policy.

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-64329

For more information

If you have any questions or comments about this advisory:

• Open an issue in containerd
• Email us at security@containerd.io

To report a security issue in containerd:

• Report a new vulnerability

Severity

• CVSS Score: Unknown
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2
• https://nvd.nist.gov/vuln/detail/CVE-2025-64329
• https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df
• https://github.com/containerd/containerd

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd

CVE-2024-25621 / GHSA-pwhc-rpq9-4c8w / GO-2025-4100

More information

Details

containerd affected by a local privilege escalation via wide permissions on CRI directory in github.com/containerd/containerd

Severity

Unknown

References

• https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w
• https://nvd.nist.gov/vuln/detail/CVE-2024-25621
• https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5
• https://github.com/containerd/containerd/blob/main/docs/rootless.md

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd

CVE-2025-64329 / GHSA-m6hq-p25p-ffr2 / GO-2025-4108

More information

Details

containerd CRI server: Host memory exhaustion through Attach goroutine leak in github.com/containerd/containerd

Severity

Unknown

References

• https://github.com/containerd/containerd/security/advisories/GHSA-m6hq-p25p-ffr2
• https://nvd.nist.gov/vuln/detail/CVE-2025-64329
• https://github.com/containerd/containerd/commit/083b53cd6f19b5de7717b0ce92c11bdf95e612df

This data is provided by OSV and the Go Vulnerability Database (CC-BY 4.0).

---

containerd affected by a local privilege escalation via wide permissions on CRI directory

CVE-2024-25621 / GHSA-pwhc-rpq9-4c8w / GO-2025-4100

More information

Details

Impact

An overly broad default permission vulnerability was found in containerd.

• /var/lib/containerd was created with the permission bits 0o711, while it should be created with 0o700
  • Allowed local users on the host to potentially access the metadata store and the content store
• /run/containerd/io.containerd.grpc.v1.cri was created with 0o755, while it should be created with 0o700
  • Allowed local users on the host to potentially access the contents of Kubernetes local volumes. The contents of volumes might include setuid binaries, which could allow a local user on the host to elevate privileges on the host.
• /run/containerd/io.containerd.sandbox.controller.v1.shim was created with 0o711, while it should be created with 0o700

The directory paths may differ depending on the daemon configuration.
When the temp directory path is specified in the daemon configuration, that directory was also created with 0o711, while it should be created with 0o700.

Patches

This bug has been fixed in the following containerd versions:

• 2.2.0
• 2.1.5
• 2.0.7
• 1.7.29

Users should update to these versions to resolve the issue.
These updates automatically change the permissions of the existing directories.

[!NOTE]

/run/containerd and /run/containerd/io.containerd.runtime.v2.task are still created with 0o711.
This is an expected behavior for supporting userns-remapped containers.

Workarounds

The system administrator on the host can manually chmod the directories to not
have group or world accessible permisisons:

chmod 700 /var/lib/containerd
chmod 700 /run/containerd/io.containerd.grpc.v1.cri
chmod 700 /run/containerd/io.containerd.sandbox.controller.v1.shim

An alternative mitigation would be to run containerd in rootless mode.

Credits

The containerd project would like to thank David Leadbeater for responsibly disclosing this issue in accordance with the containerd security policy.

For more information

If you have any questions or comments about this advisory:

• Open an issue in containerd
• Email us at security@containerd.io

To report a security issue in containerd:

• Report a new vulnerability

Severity

• CVSS Score: 7.3 / 10 (High)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

• https://github.com/containerd/containerd/security/advisories/GHSA-pwhc-rpq9-4c8w
• https://nvd.nist.gov/vuln/detail/CVE-2024-25621
• https://github.com/containerd/containerd/commit/7c59e8e9e970d38061a77b586b23655c352bfec5
• https://github.com/containerd/containerd
• https://github.com/containerd/containerd/blob/main/docs/rootless.md

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

containerd/containerd (github.com/containerd/containerd)

v1.7.29: containerd 1.7.29

Compare Source

Welcome to the v1.7.29 release of containerd!

The twenty-ninth patch release for containerd 1.7 contains various fixes
and updates including security patches.

Security Updates

• containerd

  • GHSA-pwhc-rpq9-4c8w
  • GHSA-m6hq-p25p-ffr2

• runc

  • GHSA-qw9x-cqr3-wc7r
  • GHSA-cgrx-mc8f-2prm
  • GHSA-9493-h29p-rfm2

Highlights

Image Distribution

• Update differ to handle zstd media types (#​12018)

Runtime

• Update runc binary to v1.3.3 (#​12480)
• Fix lost container logs from quickly closing io (#​12375)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Derek McGowan
• Akihiro Suda
• Phil Estes
• Austin Vazquez
• Sebastiaan van Stijn
• ningmingxiao
• Maksym Pavlenko
• StepSecurity Bot
• wheat2018

Changes

38 commits

• 442cb34bd Merge commit from fork
• 0450f046e Fix directory permissions
• e5cb6ddb7 Merge commit from fork
• c575d1b5f fix goroutine leak of container Attach
• Prepare release notes for v1.7.29 (#​12486)
  • 1fc2daaf3 Prepare release notes for v1.7.29
• Update runc binary to v1.3.3 (#​12480)
  • 3f5f9f872 runc: Update runc binary to v1.3.3
• Update GHA images and bump Go 1.24.9; 1.25.3 (#​12471)
  • 667409fb6 ci: bump Go 1.24.9, 1.25.3
  • 294f8c027 Update GHA runners to use latest images for basic binaries build
  • cf66b4141 Update GHA runners to use latest image for most jobs
  • fa3e6fa18 pkg/epoch: extract parsing SOURCE_DATE_EPOCH to a function
  • ac334bffc pkg/epoch: fix tests on macOS
  • d04b8721f pkg/epoch: replace some fmt.Sprintfs with strconv
• CI: update Fedora to 43 (#​12450)
  • 5cfedbf52 CI: update Fedora to 43
• CI: skip ubuntu-24.04-arm on private repos (#​12429)
  • cf99a012d CI: skip ubuntu-24.04-arm on private repos
• runc:Update runc binary to v1.3.1 (#​12276)
  • 4c77b8d07 runc:Update runc binary to v1.3.1
• Fix lost container logs from quickly closing io (#​12375)
  • d30024db2 bugfix:fix container logs lost because io close too quickly
• ci: bump Go 1.24.8 (#​12362)
  • f4b3d96f3 ci: bump Go 1.24.8
  • 334fd8e4b update golangci-lint to v1.64.2
  • 8a67abc4c Drop inactivated linter exportloopref
  • e4dbf08f0 build(deps): bump golangci/golangci-lint-action from 6.3.2 to 6.5.0
  • d7db2ba06 build(deps): bump golangci/golangci-lint-action from 6.2.0 to 6.3.2
  • d7182888f build(deps): bump golangci/golangci-lint-action from 6.1.1 to 6.2.0
  • 4be6c7e3b build(deps): bump actions/cache from 4.1.2 to 4.2.0
  • a2e097e86 build(deps): bump actions/checkout from 4.2.1 to 4.2.2
  • 6de404d11 build(deps): bump actions/cache from 4.1.1 to 4.1.2
  • 038a25584 [StepSecurity] ci: Harden GitHub Actions
• Update differ to handle zstd media types (#​12018)
  • eaeb4b6ac Update differ to handle zstd media types
• ci: bump Go 1.23.12, 1.24.6 (#​12188)
  • 83c535339 ci: bump Go 1.23.12, 1.24.6

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.7.28

v1.7.28: containerd 1.7.28

Compare Source

Welcome to the v1.7.28 release of containerd!

The twenty-eighth patch release for containerd 1.7 contains various fixes
and updates.

Highlights

Image Distribution

• Refresh OAuth tokens when they expire during registry operations (#​11721)
• Set default differ for the default unpack config of transfer service (#​11689)

Runtime

• Update runc binary to v1.3.0 (#​11800)
• Remove invalid error log when stopping container after containerd restart (#​11620)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Akhil Mohan
• Akihiro Suda
• Austin Vazquez
• Maksym Pavlenko
• Phil Estes
• Derek McGowan
• Kirtana Ashok
• Henry Wang
• Iain Macdonald
• Jin Dong
• Swagat Bora
• Wei Fu
• Yang Yang
• madraceee

Changes

57 commits

• Prepare release notes for v1.7.28 (#​12134)
  • b01b809f8 Prepare release notes for v1.7.28
• ci: bump Go 1.23.11, 1.24.5 (#​12117)
  • ce2373176 ci: bump Go 1.23.11, 1.24.5
• Backport windows test fixes (#​12121)
  • 3c06bcc4d Fix intermittent test failures on Windows CIs
  • c6c0c6854 Remove WS2025 from CIs due to regression
• ci: use fedora 39 archive (#​12123)
  • 6d7e021cf ci: use fedora/39-cloud-base image from archive
• update runners to ubuntu 24.04 (#​11802)
  • c362e18cc CI: install OVMF for Vagrant
  • 1d99bec21 CI: fix "Unable to find a source package for vagrant" error
  • dafa3c48d add debian sources for ubuntu-24
  • b03301d85 partial: enable ubuntu 24 runners
  • 13fbc5f97 update release runners to ubuntu 24.04
• go.mod: golang.org/x/* latest (#​12096)
  • da5d1a371 go.mod: golang.org/x/* latest
• Remove additional fuzzers from instrumentation repo (#​12099)
  • 5fef123ba Remove additional fuzzers from CI
• backport windows runner and golang toolchain updates (#​11972)
  • a35978f5a ci: bump golang [1.23.10, 1.24.4] in build and release
  • df035aa3e ci: bump golang [1.23.9, 1.24.3] in build and release
  • 2a6d9fc71 use go1.23.8 as the default go version
  • 15d4d6eba update to go 1.24.2, 1.23.8
  • 1613a3b1a Enable CIs to run on WS2022 and WS2025
• test: added runc v1 tests using vagrant (#​11896)
  • 60e73122c test: added runc v1 tests using vagrant
• Revert "disable portmap test in ubuntu-22 to make CI happy" (#​11803)
  • 10e1b515e Revert "Disable port mapping tests in CRI-in-UserNS"
  • 7a680e884 fix unbound SKIP_TEST variable error
  • e5f8cc995 Revert "disable portmap test in ubuntu-22 to make CI happy"
• Update runc binary to v1.3.0 (#​11800)
  • b001469c7 Update runc binary to v1.3.0
• Refresh OAuth tokens when they expire during registry operations (#​11721)
  • a6421da84 remotes/docker/authorizer.go: invalidate auth tokens when they expire.
• [CI] Fix vagrant (#​11739)
  • effc49e8b Fix vagrant setup
• Fix CI (#​11722)
  • d3e7dd716 Skip criu on Arms
  • 7cf9ebe94 Disable port mapping tests in CRI-in-UserNS
  • 42657a4ed disable portmap test in ubuntu-22 to make CI happy
  • b300fd37b add option to skip tests in critest
  • 6f4ffad27 Address cgroup mountpoint does not exist
  • cef298331 Update Ubuntu to 24
  • 2dd9be16e ci: update GitHub Actions release runner to ubuntu-24.04
• Set default differ for the default unpack config of transfer service (#​11689)
  • e40e59e4e Set default differ for the default unpack config of transfer service
• silence govulncheck false positives (#​11679)
  • ff097d5a4 silence govulncheck false positives
• vendor: github.com/go-jose/go-jose/v3 v3.0.4 (#​11619)
  • 52dd4dc51 vendor: github.com/go-jose/go-jose/v3 v3.0.4
• Remove invalid error log when stopping container after containerd restart (#​11620)
  • 24f41d2d5 use shimCtx for fifo copy
• Update runc binary to v1.2.6 (#​11584)
  • 1e1e78ad7 Update runc binary to v1.2.6
• Use RWMutex in NSMap and reduce lock area (#​11556)
  • 9a8d1d44a Use RWMutex in NSMap and reduce lock area

Dependency Changes

• github.com/go-jose/go-jose/v3 v3.0.3 -> v3.0.4
• golang.org/x/crypto v0.31.0 -> v0.40.0
• golang.org/x/mod v0.17.0 -> v0.26.0
• golang.org/x/net v0.33.0 -> v0.42.0
• golang.org/x/oauth2 v0.11.0 -> v0.30.0
• golang.org/x/sync v0.10.0 -> v0.16.0
• golang.org/x/sys v0.28.0 -> v0.34.0
• golang.org/x/term v0.27.0 -> v0.33.0
• golang.org/x/text v0.21.0 -> v0.27.0
• golang.org/x/time 90d013b -> v0.12.0

Previous release can be found at v1.7.27

v1.7.27: containerd 1.7.27

Compare Source

Welcome to the v1.7.27 release of containerd!

The twenty-seventh patch release for containerd 1.7 contains various fixes
and updates.

Highlights

• Fix integer overflow in User ID handling (GHSA-265r-hfxg-fhmg)
• Update image type checks to avoid unnecessary logs for attestations (#​11538)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Jin Dong
• Akhil Mohan
• Derek McGowan
• Maksym Pavlenko
• Paweł Gronowski
• Phil Estes
• Akihiro Suda
• Craig Ingram
• Krisztian Litkey
• Samuel Karp

Changes

20 commits

• 05044ec0a Merge commit from fork
• 11504c3fc validate uid/gid
• Prepare release notes for v1.7.27 (#​11540)
  • 1be04be6c Prepare release notes for v1.7.27
• Update image type checks to avoid unnecessary logs for attestations (#​11538)
  • 82b5c43fe core/remotes: Handle attestations in MakeRefKey
  • 2c670e79b core/images: Ignore attestations when traversing children
• update build to go1.23.7, test go1.24.1 (#​11515)
  • a39863c9f update build to go1.23.7, test go1.24.1
• Remove hashicorp/go-multierror dependency and fix CI (#​11499)
  • 49537b3a7 e2e: use the shim bundled with containerd artifact
  • fe490b76f Bump up github.com/intel/goresctrl to 0.5.0
  • 13fc9d313 update containerd/project-checks to 1.2.1
  • 585699c94 Remove unnecessary joinError unwrap
  • 4b9df59be Remove hashicorp/go-multierror
• go.{mod,sum}: bump CDI deps to v0.8.1. (#​11422)
  • 5ba28f8dc go.{mod,sum}: bump CDI deps to v0.8.1, re-vendor.
• CI: arm64-8core-32gb -> ubuntu-24.04-arm (#​11437)
  • 85f10bd92 CI: arm64-8core-32gb -> ubuntu-24.04-arm
  • 561ed520e increase xfs base image size to 300Mb

Dependency Changes

• github.com/intel/goresctrl v0.3.0 -> v0.5.0
• github.com/prometheus/client_golang v1.14.0 -> v1.16.0
• github.com/prometheus/common v0.37.0 -> v0.42.0
• github.com/prometheus/procfs v0.8.0 -> v0.10.1
• k8s.io/apimachinery v0.26.2 -> v0.27.4
• sigs.k8s.io/json f223a00 -> bc3834c
• tags.cncf.io/container-device-interface v0.7.2 -> v0.8.1
• tags.cncf.io/container-device-interface/specs-go v0.7.0 -> v0.8.0

Previous release can be found at v1.7.26

v1.7.26: containerd 1.7.26

Compare Source

Welcome to the v1.7.26 release of containerd!

The twenty-sixth patch release for containerd 1.7 contains various fixes
and updates.

Highlights

• Add support for syncfs after unpack (#​11267)
• Update runc binary to v1.2.5 (#​11395)
• Fix race between serve and immediate shutdown on the server (containerd/ttrpc#175)
• Reject oversized messages from the sender (containerd/ttrpc#171)

Container Runtime Interface (CRI)

• Fix fatal concurrency error in port forwarding (#​11306)

Node Resource Interface (NRI)

• Fix initial sync race when registering NRI plugins (#​11326)
• Add API support for reading Pod IPs (containerd/nri#119)
• Fix plugin sync to use multiple messages if ttrpc max message limit is hit (containerd/nri#111)
• Update API to pass configured timeouts to plugins. (containerd/nri#109)
• Fix mount removal in adjustments (containerd/nri#107)
• Close plugin if initial synchronization fails (containerd/nri#103)
• Add support for adjusting OOM score (containerd/nri#94)
• Add API support for NRI-native CDI injection (containerd/nri#98)
• Add support for pids cgroup (containerd/nri#76)

Runtime

• Fix console TTY leak in runc shim (#​11250)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Krisztian Litkey
• Mike Brown
• Samuel Karp
• Wei Fu
• Phil Estes
• Derek McGowan
• Iceber Gu
• Akhil Mohan
• Antonio Ojea
• Austin Vazquez
• Henry Wang
• Jin Dong
• Xiaojin Zhang
• ningmingxiao
• AbdelrahmanElawady
• Akihiro Suda
• Antti Kervinen
• Jing Xu
• Jitang Lei
• Justin Alvarez
• Lei Liu
• Maksym Pavlenko
• Yang Yang
• Yuhang Wei
• cormick
• jingtao.liang

Changes

24 commits

• Prepare release notes for v1.7.26 (#​11356)
  • ceba197f5 Prepare release notes for v1.7.26
• Upgrade x/net to 0.33.0 to fix vulnerability GHSA-w32m-9786-jp63 (#​11434)
  • 3486bc8dd Upgrade x/net to 0.33.0
• update build to go1.23.6, test go1.24.0 (#​11419)
  • 9025d3075 update build to go1.23.6, test go1.24.0
• Update install-imgcrypt to allow change install repo (#​11358)
  • 83eaab482 Update install-imgcrypt to allow change install repo
• Add support for syncfs after unpack (#​11267)
  • 8bc21cba7 support to syncfs after pull by using diff plugin
• Update runc binary to v1.2.5 (#​11395)
  • 27c472acf Update runc binary to v1.2.5
• Move run.skip-dirs to issues.exclude-dirs in golangci-lint config (#​11400)
  • 8d8034b66 move skip-dirs to issues.exclude-dirs
• Fix initial sync race when registering NRI plugins (#​11326)
  • 11af05177 cri,nri: block NRI plugin sync. during event processing.
  • d4036cd3d go.{mod,sum}: bump NRI to v0.8.0, re-vendor.
• Fix console TTY leak in runc shim (#​11250)
  • c3e24e024 Add integ test to check tty leak
  • 4e45a463d fix master tty leak due to leaking init container object
• Fix fatal concurrency error in port forwarding (#​11306)
  • 0fe9f0b52 fix fatal error: concurrent map iteration and map write
• update build to go1.22.11, test go1.23.5 (#​11298)
  • 441b92636 update build to go1.22.11, test go1.23.5

Changes from containerd/nri

77 commits

• Add API support for reading Pod IPs (containerd/nri#119)
  • eaf78a9 api: support Pod IPs
• generate: do not set OOMScoreAdj if no adjustment (containerd/nri#116)
• 07bfc18 wip: generate: add test for oom score adj
• b5fc359 generate: do not set OOMScoreAdj if no adjustment
• device-injector: remove unreachable code. (containerd/nri#115)
  • 235aa11 chore: remove unreachable code and fmt files
• Fix plugin sync to use multiple messages if ttrpc max message limit is hit (containerd/nri#111)
  • 159f575 template: dump pod/container count in sync message.
  • bf267e3 stub: collect/handle split sync messages.
  • ed78ae9 adaptation: use multiple sync messages if necessary.
  • 6fd59d6 api: add support for multiple sync messages.
  • a7fcccc mux: split oversized messages.
  • 5fe9b06 mux: fix maximum allowed message size.
  • 693d64e go.{mod,sum}, plugins: update ttrpc and NRI deps.
• Update API to pass configured timeouts to plugins. (containerd/nri#109)
  • 320e4e7 adaptation: tests for runtime version, timeouts.
  • f86d982 api,adaptation,stub: let plugin know configured timeouts.
  • cfcd2af Makefile: fix ginkgo-tests target.
  • 8cd9504 adaptation: block plugin sync/registration in test suite.
  • 966ac92 adaptation: implement plugin synchronization blocks.
• ci: verify that code generation works and results match (containerd/nri#113)
  • f74ce31 ci: verify code generation and generated files in repo
• deps: bump gingko to v2.19.1, golang to v1.21.x. (containerd/nri#110)
  • e4d5c36 ci: stop testing with golang 1.20.x.
  • 6578149 go.{mod,sum}: bump golang requirement to 1.21.
  • 442e812 go.{mod,sum}: update to ginkgo v2.19.1.
• sync sandboxes and containers after starting the pre-installed plugins (containerd/nri#43)
  • eada085 ignore pre-installed plugins that did not sync successfully
  • b881bc4 sync sandboxes and containers after starting the pre-installed plugins
• Fix mount removal in adjustments (containerd/nri#107)
  • 3880f1d adaptation: add test case for mount removal.
  • 0d3b376 adaptation: fix mount removal in adjustments.
• codespell: add codespell config, workflow, fix spelling errors. (containerd/nri#105)
  • df84c47 .github: add codespell workflow.
  • a03dc93 pkg,plugins,.codespellrc: add codespellrc, fix spelling.
• Close plugin if initial synchronization fails (containerd/nri#103)
  • 4aec208 adaptation: log plugin as connected and synchronized.
  • 4e60cd0 adaptation: close plugin if initial synchronization fails.
• Reset source path of api.pb.go to pkg/api/api.proto (containerd/nri#104)
  • 1cc026f Reset source path of api.pb.go to pkg/api/api.proto
• Add support for adjusting OOM score (containerd/nri#94)
  • efcb2da NRI plugins support adjust oom_score_adj
• Add API support for NRI-native CDI injection (containerd/nri#98)
  • 8783973 device-injector: clarify precedence of annotations.
  • 4eb7075 pkg/adaptation: fix grammatical mistakes in comments.
  • 4bd8da8 device-injector: add support for CDI injection.
  • 44773bd runtime-tools/generate: add support CDI injection.
  • 65282fe adaptation: add CDI device injection unit test.
  • 01f3b7a adaptation: add support for native CDI injection.
  • f1aa58f api: add support for native CDI device injection.
• types: Fix a typo (containerd/nri#101)
  • 8434439 types: Fix a typo
• Add support for pids cgroup (containerd/nri#76)
  • 1719502 support pids cgroup
• stub: support restart after stub stopped (containerd/nri#91)
  • 242661f stub: support re-start after stub stopped
• stop closed plugins that will be removed (containerd/nri#89)
  • ba398fa stop closed plugins that will be removed
• plugins/device-injector: fix a small typo in README.md. (containerd/nri#97)
  • f96a550 device-injector: small grammar fix in README.md.
• plugins/template: fix a typo in a comment. (containerd/nri#96)
  • 5680921 plugins/template: fix typo in a comment.
• go.{mod,sum}, .github: bump minimum golang version to 1.20. (containerd/nri#88)
  • 2c3608d .golangci.yml: silence dot-import errors for tests.
  • 8f56974 pkg/{adaptation,api,net,stub}: fix linter errors.
  • e863892 .github: bump golangci-lint to v1.58.0.
  • 674cb41 .github: bump setup-go to v5.
  • 9106283 .github: test with golang 1.20.x, 1.21.x, 1.22.3 in CI.
  • a9778ad plugins: bump golang version to 1.20.
  • 8e86065 go.{mod.sum}: bump golang version to 1.20.
• network device injector plugin (containerd/nri#82)
  • ff774e6 network device injector plugin
• Modify hook-injector plugin to monitor directories to match cri-o (containerd/nri#84)
  • 06841c2 Modify hook-injector plugin to monitor directories to match cri-o
• docs: fix broken link to sample plugins in README.md (containerd/nri#81)
  • 2791e93 docs: fix broken link to sample plugins in README.md

Changes from containerd/ttrpc

11 commits

• Add MD.Clone function (containerd/ttrpc#177)
  • 430f734 Add MD.Clone
• Fix race between serve and immediate shutdown on the server (containerd/ttrpc#175)
  • c4d96d5 server: fix Serve() vs. immediate Shutdown() race.
  • ed6c3ba server_test: add Serve()/Shutdown() race test.
• Reject oversized messages from the sender (containerd/ttrpc#171)
  • b5cd6e4 channel: allow discovery of overflown message size.
  • d8c00df channel_test: update oversize message test.
  • de273bf channel: reject oversized messages on the sender side.
• server_test: fix error message in TestOversizeCall. (containerd/ttrpc#170)
  • 84e1784 server_test: fix error message in TestOversizeCall.

Dependency Changes

• github.com/containerd/nri v0.6.1 -> v0.8.0
• github.com/containerd/ttrpc v1.2.5 -> v1.2.7
• github.com/go-logr/logr v1.3.0 -> v1.4.2
• golang.org/x/net v0.25.0 -> v0.33.0

Previous release can be found at v1.7.25

v1.7.25: containerd 1.7.25

Compare Source

Welcome to the v1.7.25 release of containerd!

The twenty-fifth patch release for containerd 1.7 contains various fixes
and updates.

Highlights

• Update runc binary to v1.2.4 (#​11238)
• Fix proto conflicts and update to 1.8 API (#​11184)

Container Runtime Interface (CRI)

• Fix ip_pref configuration option (#​11223)

Runtime

• Fix panic due to nil dereference cgroups v2 (#​11099)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Akihiro Suda
• Derek McGowan
• Sebastiaan van Stijn
• Wei Fu
• Maksym Pavlenko
• Akhil Mohan
• Henry Wang
• Jin Dong
• Phil Estes
• Sam Edwards
• Samuel Karp
• Brian Goff
• David Son
• Kohei Tokunaga
• Pierre Gimalac
• Yang Yang
• bo.jiang

Changes

32 commits

• Prepare release notes for v1.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.