LoginSign Up
← Back to all sparks
C

containerd

DEVOPS
Velocity5.0

Industry-standard container runtime

containerd.io ↗

containerd is walking checkpoint/restore back across every branch it still supports.

container-runtimelts-branchescrideprecationcheckpoint-restorebackports
◆Current state
Five branches remain in active service and they move as one. The August 12 pair — 2.2.7 and 2.3.4, cut three minutes apart — disables checkpoint restore in CreateContainer by default behind an experimental config flag and formally deprecates it, the same removal the 2.4 beta already made outright. CRIU codepaths now stay dark unless CRIU is installed, and CRI gains non-UTF-8 binary environment variable support.
◆Where it's heading
The project is retiring a feature by degrees rather than at a version boundary: removed in the 2.4 pre-release, defaulted off and deprecated in the maintained lines, with an opt-in escape hatch for anyone who depended on it. That pattern — decide on the development line, then propagate the same decision as a default change everywhere else — is how containerd is handling anything with a security or correctness argument behind it.
◆Prediction
Expect the deprecation to complete in a later 2.4 or 2.5 release with the configuration option removed entirely, and expect the next coordinated patch batch to land on all five branches within the same hour, as every batch this quarter has.

◆Recent moves

  1. 6d ago

    containerd 2.2.7

    The 2.2 branch's copy of the coordinated August batch: checkpoint restore in CreateContainer is off by default and deprecated, CRIU codepaths are disabled when CRIU is absent, and CRI accepts non-UTF-8 binary environment variable values. A default change rather than a fix, which makes this a patch release operators should read before applying.

    View source ↗
  2. 6d ago

    containerd 2.3.4

    The 2.3 LTS twin of the same batch, carrying the identical checkpoint restore default flip and deprecation plus a change to default runtimeFeatures.UserNamespacesHostNetwork to true. As the branch the project points stability-minded users at, this is where the deprecation reaches the largest installed base.

    View source ↗
  3. 8d ago

    containerd 2.4.0-beta.0

    The first beta of the 2.4 line, the non-LTS release where previously deprecated behavior can be removed — this one drops restore from CreateContainer outright. Alongside the breaking change it adds a warm image cache for the erofs snapshotter, media types on content create events, and OCI runtime feature introspection for non-runc runtimes. Substantive, but a pre-release of a short-support line rather than a settled direction.

    View source ↗
  4. 14d ago

    containerd API 1.12.0-beta.0

    The 13th API release for the 1.x line, cut as a beta to align with containerd 2.4. It carries the same media-type and runc checkpoint additions surfacing in the runtime beta, keeping the API package in step with the release it serves.

    View source ↗
  5. 1mo ago

    containerd 2.3.3

    The third patch on the 2.3 LTS line, carrying the CRI fixes that went out across branches the same day plus a Windows temp directory fix for SYSTEM services and better surfacing of OCI error bodies on registry 403s. This is the branch the project points stability-minded users at, so its patches matter most.

    View source ↗
  6. 1mo ago

    containerd 2.2.6

    The 2.2 branch's copy of the same coordinated batch — the NRI nil dereference, the stopped-sandbox CreateContainer rejection, and the mount leak on hook failure — plus a fallback limit that prevented content store pollution during ref resolution. Real fixes for anyone pinned to 2.2, delivered as a backport rather than new work.

    View source ↗