Update module github.com/containerd/containerd to v2

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd	v1.7.3 → v2.4.0

---

Release Notes

containerd/containerd (github.com/containerd/containerd)

v2.4.0: containerd 2.4.0

Compare Source

Welcome to the v2.4.0 release of containerd!

containerd 2.4 is a regular (non-LTS) release with a shorter support window,
intended for users who want to adopt new features sooner. As the release
following the 2.3 LTS, it is the point in the release cycle where previously
deprecated features may be removed, so this release may include breaking
changes; check the notes below and clear any deprecation warnings from your
current version before upgrading.

Users prioritizing stability and a longer support lifecycle should stay on the
2.3 LTS release.

Highlights

Container Runtime Interface (CRI)

• Enable mount manager for image mounts in CRI (#​13542)
• Export sandbox image and CNI directory configuration in CRI plugin info (#​13940)
• Set default runtimeFeatures.UserNamespacesHostNetwork to true (#​13162)
• Support OCI runtime feature introspection for non-runc runtimes (#​13504)

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#​12889)
• Support propagating HTTP 299 warning headers from registries to the resolver (#​12698)
• Use klauspost/compress for gzip layer decompression (#​13560)

Image Storage

• Add client options to fetch all layer content during unpack even when snapshots exist (#​14126)
• Include media type in content create events (#​13833)
• Add forward References to the GC collection context (#​13634)

Node Resource Interface (NRI)

• Expose container image name, digest, and config digest to NRI plugins (#​13960)
• Emit deprecation warnings for plugins using deprecated NRI interfaces (#​13916)

Runtime

• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#​14090)
• Add UpdateSandbox RPC to propagate sandbox controller updates to the shim (#​14105)
• Avoid immediately restarting containers with restart=always policy after they are explicitly stopped (#​13993)
• Pass tracing context from shim to runc and hooks (#​14036)
• Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#​13818)
• Implement Windows named-pipe server and log streaming support in pkg/shim (#​13948)
• Enable log scrubbing by default on Windows (#​13837)
• Allow specifying parent checkpoint directory when checkpointing with runc (#​13699)

Snapshotters

• Add Prometheus metrics for EROFS snapshotter layer content cache (#​13941)
• Support warm image cache for erofs snapshotter (#​13813)
• Add max size label for snapshots (#​13520)

Breaking

• Remove deprecated CRI and tracing configuration options:
  • Remove enable_cdi in CRI runtime configuration (CDI is now always enabled)
  • Remove bin_dir in CRI CNI configuration (use bin_dirs)
  • Remove endpoint, protocol, and insecure in OTLP tracing processor configuration (use standard OTLP environment variables)
  • Remove service_name and sampling_ratio in internal tracing configuration (use standard OpenTelemetry environment variables) (#​14166)
• Remove restore in CreateContainer (#​13871)

Deprecations

• Deprecate containerd.io/runtime-allow-mounts shim annotation in favor of MountCapabilities bootstrap extension (#​14002)
• Remove deprecated shim.Command from pkg (#​13991)
• Deprecate task API address and version fields in runc options and move to CreateTaskRequest (#​13360)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Sebastiaan van Stijn
• Samuel Karp
• Derek McGowan
• Wei Fu
• Akihiro Suda
• Mike Brown
• Paweł Gronowski
• Chris Henzie
• Phil Estes
• Brian Goff
• Austin Vazquez
• ningmingxiao
• Jordan Liggitt
• Akhil Mohan
• Eshaan Mathur
• Krisztian Litkey
• Chris Ayoub
• Kazuyoshi Kato
• Kir Kolyshkin
• Sergey Kanzhelev
• Ahmet Alp Balkan
• Arpit Jain
• Cindy Li
• Damien Grisonnet
• Esteban Ginez
• Gao Xiang
• Harsh Rawat
• Laura Lorenz
• Maksim An
• Oleh Konko
• Philip Laine
• Abhishek Bhunia
• Alan Grosskurth
• Albin Kerouanton
• Alex Lyn
• Aman Raj
• Amir Alavi
• Amit Barve
• Andrew Halaney
• AprilNEA
• Arjun Yogidas
• Ayato Tokubi
• Aysha Afrah Ziya
• Ben Cressey
• Bing Hongtao
• Chris Crone
• Craig Gumbley
• Daniel De Graaf
• Davanum Srinivas
• Dr. Jan-Philip Gehrcke
• Harshal Patel
• Henry Wang
• Hsiu-Chi Tsai
• JP Phillips
• Jing Chen
• Kohei Tokunaga
• LEI WANG
• Martín Fernández
• Mikhail Dmitrichenko
• Nahum Litvin
• Nikolaus Schuetz
• Pablo Garcia Caceres
• Paco Xu
• Robert Cronin
• SaloniRathi
• Shambhavi Srivastava
• Tianon Gravi
• XlabAI
• Yuanliang Zhang
• ayush-panta
• crawfordxx
• cshung
• match man
• s3onghyun
• 归寂
• 徐晓伟

Changes

658 commits

• 647fafa847 Prepare release notes for v2.4.0
• Prepare release notes for api/v1.12.0 (#​14170)
  • 5c4ea21de3 Prepare release notes for api/v1.12.0
• Deprecations and removals for 2.4 (#​14166)
  • 531b3a37b9 tracing: remove deprecated tracing config options
  • ca8579a334 tracing: add tests for otlp exporter and env vars
  • ee024b7c99 tracing: remove deprecated otlp configs
  • f7c654fb4f cri: remove deprecated cni bin_dir
  • 4f7de25abb cri: remove enable_cdi config option
  • 830b48d3fd cri: delay registry config removal to 2.7
• Prepare release notes for v2.4.0-rc.0 (#​14115)
  • c02620e398 Prepare release notes for v2.4.0-rc.0
  • 02c7c97f43 Update release doc for 2.4.0 release
  • 484e5aba58 vendor: github.com/containerd/containerd/api v1.12.0-rc.1
  • 67174d675c mailmap: add Paweł Gronowski
• Update erofs snapshotter to record blob source (#​14107)
  • 697a7571a4 erofs: give a dm-verity device a name unique to its mount
  • f75817eb3b erofs: record where a layer blob is
  • d92088d822 erofs: refuse to apply into a read-only snapshot
  • 8cc0b076a6 erofs: serve layer content cache on parented Prepare
• build(deps): bump the golang-x group with 4 updates (#​14150)
  • 75138b3fda build(deps): bump the golang-x group with 4 updates
• build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 (#​14153)
  • 353342cae6 build(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0
• pkg/oci: mask thermal interrupt info (#​14090)
  • c176f185b0 pkg/oci: mask thermal interrupt info
• vendor: github.com/containerd/nri v0.12.3 (#​14065)
  • 69269c635b vendor: github.com/containerd/nri v0.12.3
• cri: only unmount image volumes when mounting fails (#​14143)
  • d13064937e cri: only unmount image volumes when mounting fails
• migrate to github.com/urfave/cli/v3 (#​14095)
  • f72829f36b migrate to github.com/urfave/cli/v3
• shim-runc-v2: record exit status in bundle (#​14113)
  • 3264a09dff shim-runc-v2: record exit status in bundle
• core/unpack: fetch layers of every config-sharing manifest (#​13966)
  • 3c5d9fefd8 core/unpack: fetch layers of every config-sharing manifest
• time to update cri-tools to v1.37.0 (#​14133)
  • 5c957005ab adding container_threads metric emission for cgroups v1
  • d038c4f1f9 time to update cri-tools to v1.37.0
• update crun to v1.29.1 (#​14136)
  • 64d7857d2b update crun to v1.29.1
• vendor: github.com/containerd/log main, use log.Level consts for log-levels (#​14019)
  • b178103a4f use log.Level consts for log-levels
  • a77089ba8e vendor: github.com/containerd/log v0.2.0
  • 0ca704384f vendor: github.com/containerd/log/otel v0.1.0
• vendor: github.com/moby/sys/userns v0.2.1 (#​14130)
  • f30398314f vendor: github.com/moby/sys/userns v0.2.1
• cri: enable mount manager for image mounts (#​13542)
  • 9224f17d7c cri: enable mount manager for image mounts
• Fix input mutation in mount option helpers (#​13433)
  • 165abaf8fd core/mount: Keep lazy copy for filtered options
  • 674c3a1acb core/mount: Return copied filtered mount options
  • 79455dd4b0 mount: share lazy option filtering
  • b73b82f2af mount: fix shallow copy of Options in RemoveVolatileOption and RemoveIDMapOption
  • 70cfd7796a mount: fix input mutation in readonlyMounts
  • 35e919f329 mount: replace copyMounts with slices.Clone
• cmd: refactor in preparation of urfave/cli/v3 migration (#​14103)
  • 861dc7ed7a cmd: commands.NewClient: explicitly pass context
  • 324866a884 cmd: commands.AppContext: explicitly pass context
  • bd954e4e2c cmd: initialize CLI apps with struct literals
  • ba71234151 cmd: rename cliContext -> cmd in preparation of v3 migration
  • de193f2059 cmd: edit: pass editor name instead of cli.Context
  • 2cc86cb07b cmd: rename some vars that shadowed
  • e6be784a71 cmd: use urfave/cli RunContext
  • 4d13856983 cmd: remove redundant empty slice flag values
  • 211cde9039 cmd: remove uses of urfave/cli.Commands
  • c52e77eccd cmd/ctr: remove unused pluginCmds
• unpack: Add opt-in fetching for existing snapshots (#​14126)
  • 2b0302fd85 unpack: Add opt-in fetching for existing snapshots
• integration/client: fix TestContainerExecLargeOutputWithTTY (#​14120)
  • 68f92da9fb integration/client: fix TestContainerExecLargeOutputWithTTY
• vendor: github.com/go-jose/go-jose/v4 v4.1.5 (security) (#​14116)
  • 0c4981cc2e vendor: github.com/go-jose/go-jose/v4 v4.1.5
• Revert "metadata: bound snapshotter Remove during garbage collection" (#​14119)
  • aeb095b175 Revert "metadata: bound snapshotter Remove during garbage collection"
• build(deps): bump azure/login from 3.0.1 to 3.0.2 (#​14114)
  • 2bfdafac7b build(deps): bump azure/login from 3.0.1 to 3.0.2
• pkg/tracing: deprecate Logrushook in favor of log/otel.Logrushook (#​14023)
  • 20fed5179a pkg/tracing: deprecate Logrushook in favor of log/otel.Logrushook
• sandbox: wire Controller.Update through to the shim (#​14105)
  • b971bac19f docs: document optional sandbox updates
  • 40f84371c6 vendor: update containerd api
  • 2ea4ddb32f sandbox: add UpdateSandbox RPC and forward Controller.Update to the shim
• vendor: golang.org/x/crypto v0.56.0 (#​14093)
  • 977cb4bb0a vendor: golang.org/x/crypto v0.56.0
  • 8dd0970b3c Merge commit from fork
  • ff39a97236 cri: cancel ExecSync IO drain on context cancellation
  • 65dcc83dad Merge commit from fork
  • e6ca378dcf archive: skip redundant opaque whiteout walks
• vendor: tags.cncf.io/container-device-interface v1.1.1 (#​14109)
  • d1b8275dc2 vendor: tags.cncf.io/container-device-interface v1.1.1
• vendor: bump go-cni v1.1.14 and containernetworking/cni v1.3.1 (#​14104)
  • 9ca93e5488 vendor: bump go-cni v1.1.14 and containernetworking/cni v1.3.1
• Update Go 1.26.8 and 1.27.1 (#​14087)
  • db128f8955 Update to go1.27.1
  • f257e6b98c Update go1.26 to go1.26.8
  • 43f85c6b53 Update go1.26 to go1.26.7
• gha: Update golangci-lint to v2.13.2 (#​14089)
  • 3c10e5f0be all: Address G702 command execution findings
  • 7797833d8e gha: Update golangci-lint to v2.13.2
  • 2e587fd358 ctr: Use context-aware pprof dialing
  • a0ea6a138b runtime: Preserve context values in background goroutines
  • 2c75374a2f all: Use slices.Backward for reverse iteration
  • b7ae26eea7 all: Use errors.AsType
• runtime: invoke shim.Delete when connection is closed (#​13309)
  • e49a475d4a runtime: invoke shim.Delete when connection is closed
• Fix data races and a deadlock in the byte stream helpers (#​14085)
  • 3914a449d4 Fix data races and a deadlock in the byte stream helpers
• erofs: enable fsview fallback for unsupported features (#​14077)
  • 9d804de10b erofs: enable fsview fallback for unsupported features
• all: fix typos in code comments (#​14082)
  • 93b0eea04b all: fix typos in code comments
• fix: fix incorrect restart=always restart logic (#​13993)
  • 452b4d99cc fix: fix incorrect restart=always restart logic
• add additional tests for toCriSignal contract (#​14073)
  • 961764f6b2 test toCriSignal contract for metadata pre SIGNAL_ prefix
• build(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 in the docker-actions group (#​14067)
  • 6512b4caf1 build(deps): bump docker/setup-buildx-action in the docker-actions group
• build(deps): bump azure/login from 3.0.0 to 3.0.1 (#​13964)
  • 59f415c7d6 build(deps): bump azure/login from 3.0.0 to 3.0.1
• cri: trace image pull result attributes (#​13959)
  • 09997c13a4 cri: trace image pull result attributes
• internal/cri/server: avoid debug log formatting for container spec (#​13972)
  • 30cd464708 internal/cri/server: avoid debug log formatting for container spec
• build(deps): bump github.com/google/certtostore from 1.0.6 to 1.0.7 (#​13919)
  • f07b18490b build(deps): bump github.com/google/certtostore from 1.0.6 to 1.0.7
• vendor: github.com/docker/go-events v0.1.0 (#​14064)
  • 5333ee0952 vendor: github.com/docker/go-events v0.1.0
• chore(deps): go.opentelemetry.io/otel v1.46.0, contrib v0.71.0 (#​14058)
  • bfe115abe8 chore(deps): go.opentelemetry.io/otel v1.46.0, contrib v0.71.0
• vendor: tags.cncf.io/container-device-interface 73444d1 (#​14060)
  • ea60594619 vendor: tags.cncf.io/container-device-interface 73444d1
• plugins: remove some stray logrus imports (#​14057)
  • b845501327 plugins: remove some stray logrus imports
• snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#​14012)
  • 988f113ab7 snapshots/erofs: test the advertised erofs feature platform
  • 5e083f8d43 erofs: advertise the erofs OS feature platform from the snapshotter
• build(deps): bump github.com/prometheus/client_golang from 1.24.0 to 1.24.1 (#​13883)
  • 5e89a2c119 build(deps): bump github.com/prometheus/client_golang
• Prepare api/v1.12.0-rc.0 release (#​14047)
  • d767f44b52 Prepare api/v1.12.0-rc.0 release
• update kubernetes to v1.37.0 (#​14051)
  • 67336d701d modifies criSignalToOCIStopSignal to remove the extra cri SIGNAL_ prefixes
  • 00ecad3d7a resolve lint issue upstreamcri.NewRemoteImageService() is deprecated
  • ee09726316 fix for cri api Signal_ to Signal_SIGNAL_
  • 52be09ef1c update kubernetes to v1.37.0
• Pass tracing context from shim to runc and hooks (#​14036)
  • 0b4ed79573 integration: add e2e test to verify trace context propagation
  • 5c25750dd5 shim: propagate trace context to runc and OCI hooks
  • beb23bc68d vendor: add go.opentelemetry.io/contrib/propagators/envcar v0.70.0
• runtime: make task.Delete API retriable (#​14020)
  • 24dc6900ec runtime: make task.Delete API retriable
• vendor: google.golang.org/grpc v1.83.2 (#​14042)
  • 89ba8063e1 vendor: google.golang.org/grpc v1.83.2
• vendor: tags.cncf.io/container-device-interface 0427870 (#​14043)
  • ab451b6de8 vendor: tags.cncf.io/container-device-interface 0427870
• Shim mount handler protocol (#​14002)
  • fbd9f37c2d docs: document the transform suffix rule
  • aedbd24669 docs: document the shim mount capability
  • 1ff0c13859 runtime/v2: migrate early adopters of the deprecated annotation
  • d3cc320650 runtime/v2: propagate shim mount capabilities to sandbox members
  • e8963fc32b runtime/v2: negotiate mount capabilities from shim bootstrap
  • 0b641f0099 mount: honor a claimed transform as a chain suffix
  • 8ba69faf06 mount: extract activation planning
  • 00967ecf03 mount: add WithAllowTransform activate option
  • 6d9307f346 runtime/v2: decode the whole bootstrap result from JSON
  • 65b4eb916e vendor: use local api module and update vendored api
  • a72247425b api: add shim mount capabilities
  • 329998caa9 runtime/v2: remove the runtime-allow-mounts annotation
• vendor: github.com/docker/go-metrics v0.1.0 (#​14041)
  • b44bea515c vendor: github.com/docker/go-metrics v0.1.0
• chore(api): update github.com/sirupsen/logrus v1.10.2 (#​14037)
  • a28910b14f chore(api): update github.com/sirupsen/logrus v1.10.2
• Update CI to include Go 1.27 (#​14033)
  • 8d32443320 Update CI to include Go 1.27
• vendor: github.com/containerd/go-runc v1.2.1 (#​14038)
  • 704ca21342 vendor: github.com/containerd/go-runc v1.2.1
• erofs: instrument warm up cache (#​13941)
  • 81c272b28d erofs: instrument the layer content cache and applies
• Remove shim.Command form pkg (#​13991)
  • 55c39f2516 Move shim.Command to runtime
• pkg/tracing: handle error and typed-nil Stringer attributes (#​14013)
  • 442969ef0e pkg/tracing: handle error and typed-nil Stringer attributes
• docker fetcher: strip sensitive headers on descriptor URLs (#​12889)
  • 51cf999e92 core/remotes/docker: normalize descriptor URL origins
  • 5b3ce72589 core/remotes/docker: strip sensitive headers on desc.urls fetch
• metadata: bound snapshotter Remove during garbage collection (#​13799)
  • a9d5caf7fc metadata: bound snapshotter Remove during garbage collection
• build(deps): bump github.com/checkpoint-restore/checkpointctl from 1.5.0 to 1.6.0 (#​14009)
  • 64f05273e3 build(deps): bump github.com/checkpoint-restore/checkpointctl
• build(deps): bump github.com/moby/sys/userns from 0.1.0 to 0.2.0 in the moby-sys group (#​14008)
  • 0880064dea build(deps): bump github.com/moby/sys/userns in the moby-sys group
• build(deps): bump the k8s group across 1 directory with 2 updates (#​14007)
  • b86bc4be52 build(deps): bump the k8s group across 1 directory with 2 updates
• Bump go-runc to 1.2.0 (#​14006)
  • 10cf7114e6 Bump go-runc to 1.2.0
• vendor: tags.cncf.io/container-device-interface 05ae4b5 (#​14004)
  • 1448bcd8f0 vendor: tags.cncf.io/container-device-interface 05ae4b5
• build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2 (#​13965)
  • 0db88d7f83 build(deps): bump actions/attest-build-provenance from 4.1.1 to 4.2.2
• internal/cri/server: remove remaining uses of k8s.io/utils (#​14003)
  • 10e82fac8d internal/cri/server: remove remaining uses of k8s.io/utils
• vendor: github.com/sirupsen/logrus v1.10.1 (#​13294)
  • f511928a11 vendor: github.com/sirupsen/logrus v1.10.1
• vendor: github.com/containerd/platforms v1.0.0-rc.5 (#​14001)
  • 0d797891bb vendor: github.com/containerd/platforms v1.0.0-rc.5
• vendor: github.com/stretchr/testify v1.12.1 (#​13973)
  • c351cf4682 vendor: github.com/stretchr/testify v1.12.1
• internal/cri/server/events: use testing/synctest (#​13997)
  • f7e8f30a05 internal/cri/server/events: use testing/synctest
• pkg/shim: Report bootstrap API mismatch on startup (#​13910)
  • 85385a4c33 pkg/shim: Report bootstrap API mismatch on startup
• internal/cri/bandwidth: remove dead code (#​13996)
  • fcb54dc5fa internal/cri/bandwidth: remove dead code
• pkg/oci: resolve rootfs symlinks for user lookup (#​13818)
  • a8fc3a0172 pkg/oci: resolve rootfs symlinks for user lookup
• Revert "add check on version of drop in configs" (#​13939)
  • c8da81e49b ensure that the final config version is the higest in the config list
  • a8ed546687 Revert "add check on version of drop in configs"
• shim: use PublisherOpts when creating new publisher (#​13989)
  • 014e20a87f shim: apply PublisherOpts
• script/setup: update critools to v1.36.0 (#​13992)
  • 920978fd61 script/setup: update critools to v1.36.0
• build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#​13962)
  • da7420a420 build(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2
• update runhcs to v0.15.0-rc.4 (#​13984)
  • 4ad9d13181 update runhcs to v0.15.0-rc.4
• vendor: github.com/Microsoft/hcsshim v0.15.0-rc.4 (#​13985)
  • 972ef71c84 vendor: github.com/Microsoft/hcsshim v0.15.0-rc.4
  • 6e6518a155 vendor: go.opentelemetry.io/otel v1.45.0, go.opentelemetry.io/contrib v0.70.0
  • 9023b7eb12 vendor: google.golang.org/protobuf v1.36.12
  • ee2255275b vendor: google.golang.org/genproto/* 6ac0973
  • 389f75a955 vendor: google.golang.org/grpc v1.83.1
  • 444ecd0be0 vendor: github.com/go-logr/logr v1.4.4
  • 26c040fb40 vendor: github.com/felixge/httpsnoop v1.1.0
  • d1df90fb51 vendor: golang.org/x/mod v0.40.0
  • e994dd627a vendor: golang.org/x/net v0.58.0
  • 4fb52e086c vendor: golang.org/x/crypto v0.55.0
  • 99178d1e2e vendor: golang.org/x/text v0.41.0
  • f6b36c43af vendor: golang.org/x/mod v0.39.0
• cri, nri: record resolved image name and digest in container metadata (#​13960)
  • 203578e2eb cri,nri: record resolved image name and digest in container metadata
  • 8c4ccd2984 build: bump github.com/containerd/nri
• Export config in CRI plugin (#​13940)
  • 93f38adbca Export config in CRI plugin
• runtime: invoke Shutdown after every task deletion (#​13958)
  • 402eb3166e runtime: invoke Shutdown after every task deletion
• implement Windows support for the shim server (#​13948)
  • 3bb3d8b7c6 address copilot comments
  • 983dcf4987 [pkg/shim] Implement Windows-specific unimplemented methods
• fix(runtime): apply load timeout to load shim (#​13954)
  • fd29ff1073 fix(runtime): bound shim loading with the load timeout
• Update Go to 1.26.6 (#​13957)
  • b665fde220 Update Go to 1.26.6
• cri: add tracing spans for image pull and sandbox setup paths (#​12628)
  • 0d8883b6dc client: trace image pull stages
• ctr: drain exec output before cleanup (#​13931)
  • 3778cc36f4 ctr: drain exec output before cleanup
• snapshots/erofs: protect snapshot staging from cleanup (#​13932)
  • e940b5ac18 snapshots/erofs: protect snapshot staging from cleanup
• build(deps): bump docker/login-action from 4.4.0 to 4.6.0 in the docker-actions group across 1 directory (#​13886)
  • 3dd83f6774 build(deps): bump docker/login-action
• build(deps): bump the codeql-actions group with 3 updates (#​13922)
  • cd9113b9d5 build(deps): bump the codeql-actions group with 3 updates
• build(deps): bump actions/stale from 10.4.0 to 11.0.0 (#​13923)
  • c013c7df4d build(deps): bump actions/stale from 10.4.0 to 11.0.0
• nri,deprecation: record and emit warnings for NRI deprecations. (#​13916)
  • bf0111a9cc nri,deprecation: emit warnings for old NRI plugins.
• Add more context to the shim delete error (#​13912)
  • 29058e6501 Add more context to the shim delete error
• Remove dependency on github.com/opencontainers/runtime-tools (#​13519)
  • e01c004cc6 Remove dependency on github.com/opencontainers/runtime-tools
• Set the default of runtimeFeatures.UserNamespacesHostNetwork to true (#​13162)
  • a909c305c4 Set the default of runtimeFeatures.UserNamespacesHostNetwork to true
• docs: update erofs docs (#​13907)
  • 0d21db6bf5 docs: reflow the erofs tar index mode section
  • a23e4a127a docs: document the erofs layer content cache
• unpack: don't drop topHalf errors in parallel mode (#​13902)
  • a35da471f3 unpack: don't drop topHalf errors in parallel mode
• cri: fix container_start_time_seconds unit conversion (#​13897)
  • 71bc89b288 cri: fix container_start_time_seconds unit conversion
• remotes/docker: Propagate registry warnings to the resolver (#​12698)
  • 80975e2c75 remotes/docker: Propagate registry warnings to resolver
• bump selinux to v1.15.1, use SetProcessKind (#​13395)
  • ba3a464b8d bump oc/selinux to v1.15.1, use SetProcessKind
  • 4167499888 deps: bump oc/selinux to v1.14.1
• erofs: allow multiple cache directories (#​13900)
  • 7df6bb0a67 erofs: allow multiple layer content cache directories
• Update api version to v1.12.0-beta.0 (#​13906)
  • a272df5685 Update api version to v1.12.0-beta.0
• build(deps): bump the codeql-actions group with 3 updates (#​13885)
  • 406c8dc44a build(deps): bump the codeql-actions group with 3 updates
• Prepare release notes for api/v1.12.0-beta.0 (#​13899)
  • 0ff04dc3f7 Prepare release notes for api/v1.12.0-beta.0
• erofs: enable parallel unpack with content cache (#​13826)
  • 257a5900b0 core/unpack: detect staged layers via read-only mounts
  • 1e001e6dfe erofs: make the layer content cache work with parallel unpack
• cri: skip failed container instead of dropping entire sandbox metrics (#​13896)
  • 34524e8a68 cri: skip failed container instead of dropping entire sandbox metrics
• ctr: register EROFS fsview (#​13891)
  • 0d37ad2683 ctr: register EROFS fsview
• Prepare release notes for v2.4.0-beta.0 (#​13865)
  • f46e608b9b Prepare release notes for v2.4.0-beta.0
• cri: remove restore in CreateContainer (#​13871)
  • 91be73ba62 cri: remove restore in CreateContainer
• integration: build the whiteout-test image locally (#​13735)
  • f418688f2c integration: build the whiteout-test image locally
• docs/security: update security report triage criteria (#​13873)
  • fdf814c21a docs/security: update security report triage criteria
• snapshots/erofs: keep lowers stacked above a merged fsmeta (#​13860)
  • 01f5087866 snapshots/erofs: keep lowers stacked above a merged fsmeta
• build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3 (#​13862)
  • fbbe206722 build(deps): bump github.com/containerd/imgcrypt/v2 from 2.0.2 to 2.0.3
• workflows/stale: exempt priority and status labels (#​13869)
  • 565606decf workflows/stale: exempt priority and status labels
• cri: deprecate restore in CreateContainer (#​13838)
  • a3f99ba690 cri: deprecate restore in CreateContainer
• internal/oom: Fix memory leak by removing watcher from map on Stop (#​13856)
  • 7f9455628a internal/oom: Fix memory leak by removing watcher from map on Stop
• build(deps): bump github.com/klauspost/compress fr

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

This change is 

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 40 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.20 -> 1.24.3
github.com/containerd/typeurl/v2	v2.1.1 -> v2.2.3
github.com/prometheus/client_golang	v1.16.0 -> v1.23.2
github.com/urfave/cli/v2	v2.25.7 -> v2.27.7
github.com/AdaLogics/go-fuzz-headers	v0.0.0-20230811130428-ced1acdcaa24 -> v0.0.0-20240806141605-e8a1dd7889d6
github.com/Microsoft/go-winio	v0.6.1 -> v0.6.2
github.com/Microsoft/hcsshim	v0.10.0 -> v0.14.0-rc.1
github.com/cespare/xxhash/v2	v2.2.0 -> v2.3.0
github.com/containerd/cgroups/v3	v3.0.2 -> v3.1.0
github.com/containerd/continuity	v0.4.1 -> v0.4.5
github.com/go-logr/logr	v1.2.4 -> v1.4.3
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/golang/protobuf	v1.5.3 -> v1.5.4
github.com/google/go-cmp	v0.5.9 -> v0.7.0
github.com/google/uuid	v1.3.1 -> v1.6.0
github.com/klauspost/compress	v1.16.7 -> v1.18.1
github.com/moby/sys/mountinfo	v0.6.2 -> v0.7.2
github.com/moby/sys/sequential	v0.5.0 -> v0.6.0
github.com/moby/sys/signal	v0.7.0 -> v0.7.1
github.com/opencontainers/image-spec	v1.1.0-rc4 -> v1.1.1
github.com/opencontainers/runc	v1.1.9 -> v1.2.3
github.com/opencontainers/runtime-spec	v1.1.0 -> v1.2.1
github.com/opencontainers/selinux	v1.11.0 -> v1.12.0
github.com/prometheus/client_model	v0.4.0 -> v0.6.2
github.com/prometheus/common	v0.44.0 -> v0.66.1
github.com/prometheus/procfs	v0.11.1 -> v0.16.1
github.com/stretchr/testify	v1.8.4 -> v1.11.1
github.com/xrash/smetrics	v0.0.0-20201216005158-039620a65673 -> v0.0.0-20240521201337-686a1a2994c1
go.opentelemetry.io/otel	v1.16.0 -> v1.37.0
go.opentelemetry.io/otel/metric	v1.16.0 -> v1.37.0
golang.org/x/mod	v0.12.0 -> v0.29.0
golang.org/x/net	v0.14.0 -> v0.44.0
golang.org/x/sync	v0.3.0 -> v0.17.0
golang.org/x/sys	v0.11.0 -> v0.37.0
golang.org/x/text	v0.12.0 -> v0.29.0
golang.org/x/time	v0.3.0 -> v0.14.0
golang.org/x/tools	v0.12.0 -> v0.37.0
google.golang.org/genproto	v0.0.0-20230821184602-ccc8af3d0e93 -> v0.0.0-20231211222908-989df2bf70f3
google.golang.org/genproto/googleapis/rpc	v0.0.0-20230821184602-ccc8af3d0e93 -> v0.0.0-20250804133106-a7a43d27e69b
google.golang.org/grpc	v1.57.0 -> v1.76.0
google.golang.org/protobuf	v1.31.0 -> v1.36.10

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 41 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.20 -> 1.26.6
github.com/containerd/typeurl/v2	v2.1.1 -> v2.3.0
github.com/prometheus/client_golang	v1.16.0 -> v1.24.1
github.com/urfave/cli/v2	v2.25.7 -> v2.27.7
github.com/AdaLogics/go-fuzz-headers	v0.0.0-20230811130428-ced1acdcaa24 -> v0.0.0-20240806141605-e8a1dd7889d6
github.com/Microsoft/go-winio	v0.6.1 -> v0.6.3-0.20251027160822-ad3df93bed29
github.com/Microsoft/hcsshim	v0.10.0 -> v0.15.0-rc.4
github.com/cespare/xxhash/v2	v2.2.0 -> v2.3.0
github.com/containerd/cgroups/v3	v3.0.2 -> v3.1.3
github.com/containerd/continuity	v0.4.1 -> v0.5.0
github.com/docker/go-events	v0.0.0-20190806004212-e31b211e4f1c -> v0.1.0
github.com/go-logr/logr	v1.2.4 -> v1.4.4
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/golang/protobuf	v1.5.3 -> v1.5.4
github.com/google/go-cmp	v0.5.9 -> v0.7.0
github.com/google/uuid	v1.3.1 -> v1.6.0
github.com/klauspost/compress	v1.16.7 -> v1.20.0
github.com/moby/sys/mountinfo	v0.6.2 -> v0.7.2
github.com/moby/sys/signal	v0.7.0 -> v0.7.1
github.com/opencontainers/image-spec	v1.1.0-rc4 -> v1.1.1
github.com/opencontainers/runc	v1.1.9 -> v1.4.3
github.com/opencontainers/runtime-spec	v1.1.0 -> v1.3.0
github.com/opencontainers/selinux	v1.11.0 -> v1.15.1
github.com/prometheus/client_model	v0.4.0 -> v0.6.2
github.com/prometheus/common	v0.44.0 -> v0.70.1
github.com/prometheus/procfs	v0.11.1 -> v0.21.1
github.com/sirupsen/logrus	v1.9.3 -> v1.10.2
github.com/stretchr/testify	v1.8.4 -> v1.12.1
github.com/xrash/smetrics	v0.0.0-20201216005158-039620a65673 -> v0.0.0-20240521201337-686a1a2994c1
go.opentelemetry.io/otel	v1.16.0 -> v1.46.0
go.opentelemetry.io/otel/metric	v1.16.0 -> v1.46.0
golang.org/x/mod	v0.12.0 -> v0.41.0
golang.org/x/net	v0.14.0 -> v0.58.0
golang.org/x/sync	v0.3.0 -> v0.23.0
golang.org/x/sys	v0.11.0 -> v0.48.0
golang.org/x/text	v0.12.0 -> v0.41.0
golang.org/x/time	v0.3.0 -> v0.16.0
golang.org/x/tools	v0.12.0 -> v0.49.0
google.golang.org/genproto	v0.0.0-20230821184602-ccc8af3d0e93 -> v0.0.0-20231211222908-989df2bf70f3
google.golang.org/genproto/googleapis/rpc	v0.0.0-20230821184602-ccc8af3d0e93 -> v0.0.0-20260825221802-da73d73af1c5
google.golang.org/grpc	v1.57.0 -> v1.83.2
google.golang.org/protobuf	v1.31.0 -> v1.36.12