containerd 2.0.0-rc.2

Welcome to the v2.0.0-rc.2 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

### Highlights

* Preserve Unprivileged locked flags during remount of bind mounts ([#10200](https://github.com/containerd/containerd/pull/10200))
* Add api Go module and move all protos under api ([#10151](https://github.com/containerd/containerd/pull/10151))
* Configure otel from env instead of config.toml ([#8970](https://github.com/containerd/containerd/pull/8970))
* Fix config import relative path glob ([#9746](https://github.com/containerd/containerd/pull/9746))
* Enable NRI by default ([#9744](https://github.com/containerd/containerd/pull/9744))
* Add PluginInfo to introspection API ([#9442](https://github.com/containerd/containerd/pull/9442))
* Remove overlayfs volatile option on temp mounts ([#9555](https://github.com/containerd/containerd/pull/9555))
* Move packages based on contributing guide ([#9365](https://github.com/containerd/containerd/pull/9365))
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
* Use Intel ISA-L's igzip if available ([#9200](https://github.com/containerd/containerd/pull/9200))
* Generalize plugin library ([#9214](https://github.com/containerd/containerd/pull/9214))
* Introduce top level config migration ([#9223](https://github.com/containerd/containerd/pull/9223))
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Use github.com/containerd/log ([#9086](https://github.com/containerd/containerd/pull/9086))
* Add support for image expiration during garbage collection ([#9022](https://github.com/containerd/containerd/pull/9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](https://github.com/containerd/containerd/pull/8792))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))
* Fix deadlock during NRI plugin registration ([containerd/nri#79](https://github.com/containerd/nri/pull/79))
* Fix deadlock when writing to pipe blocks ([containerd/ttrpc#168](https://github.com/containerd/ttrpc/pull/168))

#### Container Runtime Interface (CRI)

* Add support for multiple subscribers to CRI container events ([#9661](https://github.com/containerd/containerd/pull/9661))
* Enable CDI by default ([#9621](https://github.com/containerd/containerd/pull/9621))
* Remove non-sandboxed CRI implementation ([#9228](https://github.com/containerd/containerd/pull/9228))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](https://github.com/containerd/containerd/pull/8287))
* Use sandboxed CRI by default ([#8994](https://github.com/containerd/containerd/pull/8994))
* Implement RuntimeConfig CRI call ([#8722](https://github.com/containerd/containerd/pull/8722))
* Add support for user namespaces (KEP-127) ([#8803](https://github.com/containerd/containerd/pull/8803))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))

#### Image Distribution

* Update unpacker to fetch all provided content ([#10202](https://github.com/containerd/containerd/pull/10202))
* Enable Transfer service API to support plain HTTP ([#10024](https://github.com/containerd/containerd/pull/10024))
* Enable Transfer service to use registry configuration directory ([#9908](https://github.com/containerd/containerd/pull/9908))
* Disable the support for Schema 1 images ([#9765](https://github.com/containerd/containerd/pull/9765))
* Update Transfer service to add OCI descriptors to Progress structure ([#9630](https://github.com/containerd/containerd/pull/9630))
* Update import and export to allow references to missing content  ([#9554](https://github.com/containerd/containerd/pull/9554))
* Add option to perform syncfs after pull ([#9401](https://github.com/containerd/containerd/pull/9401))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](https://github.com/containerd/containerd/pull/8493))

#### Runtime

* Store bootstrap parameters in sandbox metadata ([#9736](https://github.com/containerd/containerd/pull/9736))
* Update apparmor to allow confined runc to kill containers ([#10123](https://github.com/containerd/containerd/pull/10123))
* Support vsock connection to task api ([#9738](https://github.com/containerd/containerd/pull/9738))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Switch runc shim to task service v3 and fix restore ([#9233](https://github.com/containerd/containerd/pull/9233))
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
* Add annotations to CreateSandbox request ([#8960](https://github.com/containerd/containerd/pull/8960))
* Add SandboxMetrics ([#8680](https://github.com/containerd/containerd/pull/8680))
* Publish sandbox events ([#8602](https://github.com/containerd/containerd/pull/8602))
* Remove the CriuPath field from runc's options ([#8279](https://github.com/containerd/containerd/pull/8279))
* Remove support for config.toml `version = 1` ([#8275](https://github.com/containerd/containerd/pull/8275))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))

#### Security Advisories

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)

#### Breaking

* Disable the support for Schema 1 images ([#9765](https://github.com/containerd/containerd/pull/9765))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Move client to subpackage ([#9316](https://github.com/containerd/containerd/pull/9316))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Deprecations

* Postpone removal of deprecated CRI config properties ([#9966](https://github.com/containerd/containerd/pull/9966))
* Deprecate go-plugin configuration option ([#9238](https://github.com/containerd/containerd/pull/9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](https://github.com/containerd/containerd/pull/8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Maksym Pavlenko
* Wei Fu
* Phil Estes
* Sebastiaan van Stijn
* Samuel Karp
* Kazuyoshi Kato
* Rodrigo Campos
* Danny Canter
* Abel Feng
* Gabriel Adrian Samfira
* Kirtana Ashok
* Iceber Gu
* Austin Vazquez
* Krisztian Litkey
* Akhil Mohan
* Kohei Tokunaga
* Mike Brown
* Jin Dong
* Bjorn Neergaard
* rongfu.leng
* Justin Chadwell
* James Sturtevant
* Paul "TBBle" Hampson
* Davanum Srinivas
* Enrico Weigelt
* Brian Goff
* Henry Wang
* Paweł Gronowski
* Hsing-Yu (David) Chen
* Ilya Hanov
* Laura Brehm
* Marat Radchenko
* Cardy.Tang
* Aditi Sharma
* Bryant Biggs
* Evan Lezar
* Jordan Liggitt
* Kay Yan
* Markus Lehtonen
* Nashwan Azhari
* Shingo Omura
* Shuaiyi Zhang
* Vinayak Goyal
* helen
* Alexandru Matei
* Amit Barve
* Anthony Nandaa
* Charity Kathure
* Ed Bartosh
* Etienne Champetier
* James Jenkins
* Kevin Parsons
* Milas Bowman
* Swagat Bora
* yanggang
* Aditya Ramani
* Adrian Reber
* Amir M. Ghazanfari
* Artem Khramov
* Avi Deitcher
* Brad Davidson
* Chen Yiyang
* Christian Muehlhaeuser
* Cory Snider
* Djordje Lukic
* Edgar Lee
* Ethan Lowman
* Jiang Liu
* June Rhodes
* Lucas Rattz
* Mahamed Ali
* Maksim An
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Steve Griffith
* Tony Fang
* VERNOU Cédric
* hang.jiang
* jerryzhuang
* lengrongfu
* ningmingxiao
* roman-kiselenko
* zhanluxianshen
* zounengren
* Aaron Lehmann
* Adrien Delorme
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Angelos Kolaitis
* Antonio Huete Jimenez
* Arash Haghighat
* Ben Foster
* Bin Tang
* Bin Xin
* BinBin He
* Brennan Kinney
* Changqing Li
* ChengenH
* ChengyuZhu6
* Christian Stewart
* Craig Ingram
* Daisy Rong
* David Porter
* Derek Nola
* Eng Zer Jun
* Fabiano Fidêncio
* Fahed Dorgaa
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Jiongchi Yu
* Julien Balestra
* Kern Walster
* Kirill A. Korinsky
* Konstantin Khlebnikov
* Pan Yibo
* Qasim Sarfraz
* Qiutong Song
* Robbie Buxton
* Robert-André Mauchin
* Ruihua Wen
* Shukui Yang
* Talon
* Tianon Gravi
* Tim Hockin
* Tobias Klauser
* Tomáš Virtus
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Xinyang Ge
* Yibo Zhuang
* Yury Gargay
* Zechun Chen
* Zhang Tianyang
* Zoe
* baijia
* charles-chenzz
* chschumacher1994
* guangli.bao
* guangwu
* krglosse
* pigletfly
* rokkiter
* wangxiang
* zhangpeng
* zhaojizhuang
* 吴小白
* 张钰
* 沈陵
* 谭九鼎

### Dependency Changes

* **dario.cat/mergo**                                                              v1.0.0 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Masterminds/semver/v3**                                             v3.2.1 **_new_**
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.2
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.3
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.3.0
* **github.com/checkpoint-restore/checkpointctl**                                  v1.1.0 **_new_**
* **github.com/checkpoint-restore/go-criu/v7**                                     v7.1.0 **_new_**
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/console**                                                v1.0.3 -> v1.0.4
* **github.com/containerd/containerd/api**                                         v1.8.0-rc.0 **_new_**
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/errdefs**                                                v0.1.0 **_new_**
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.6.1
* **github.com/containerd/platforms**                                              v0.2.0 **_new_**
* **github.com/containerd/plugin**                                                 v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.4
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.1.1
* **github.com/containernetworking/cni**                                           v1.1.2 -> v1.2.0
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.4.1
* **github.com/cpuguy83/go-md2man/v2**                                             v2.0.2 -> v2.0.4
* **github.com/distribution/reference**                                            v0.6.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.11.0
* **github.com/felixge/httpsnoop**                                                 v1.0.4 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.1
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.4
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.6.0
* **github.com/gorilla/websocket**                                                 v1.5.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**            v1.0.1 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/v2**                              v2.1.0 **_new_**
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.19.1
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.7.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.8
* **github.com/klauspost/cpuid/v2**                                                v2.0.4 -> v2.2.5
* **github.com/mdlayher/socket**                                                   v0.4.1 **_new_**
* **github.com/mdlayher/vsock**                                                    v1.2.1 **_new_**
* **github.com/minio/sha256-simd**                                                 v1.0.0 -> v1.0.1
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.1
* **github.com/moby/sys/user**                                                     v0.1.0 **_new_**
* **github.com/mxk/go-flowrate**                                                   cca7078d478f **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> v1.2.0
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.2.2 **_new_**
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.19.1
* **github.com/prometheus/client_model**                                           v0.3.0 -> v0.5.0
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.48.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.12.0
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.9.0
* **github.com/urfave/cli/v2**                                                     v2.27.2 **_new_**
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **github.com/xrash/smetrics**                                                    5f08fbb34913 **_new_**
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.10
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.51.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.51.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.26.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.26.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.26.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.26.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.26.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.26.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.26.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.2.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.17.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.24.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.17.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.7.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.20.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.19.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.14.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **google.golang.org/appengine**                                                  v1.6.7 -> v1.6.8
* **google.golang.org/genproto/googleapis/api**                                    6ceb2ff114de **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    8c6c420018be **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.63.2
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.34.1
* **k8s.io/api**                                                                   v0.26.2 -> v0.30.0
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.30.0
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.30.0
* **k8s.io/client-go**                                                             v0.26.2 -> v0.30.0
* **k8s.io/component-base**                                                        v0.26.2 -> v0.30.0
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.30.0
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.120.1
* **k8s.io/kubelet**                                                               v0.30.0 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> 3b25d923346b
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **sigs.k8s.io/structured-merge-diff/v4**                                         v4.2.3 -> v4.4.1
* **tags.cncf.io/container-device-interface**                                      v0.7.2 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.7.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 1.7.17

Welcome to the v1.7.17 release of containerd!

The seventeenth patch release for containerd 1.7 contains various fixes and updates.

### Highlights

* Use LOOP_CONFIGURE when creating loop devices ([#10209](https://github.com/containerd/containerd/pull/10209))
* Update unpacker to fetch all provided content ([#10233](https://github.com/containerd/containerd/pull/10233))
* Preserve CL_UNPRIVILEGED locked flags during remount of bind mounts ([#10210](https://github.com/containerd/containerd/pull/10210))
* Update metadata snapshotter to lease on already exists ([#10198](https://github.com/containerd/containerd/pull/10198))
* Handle unsupported config versions ([#10165](https://github.com/containerd/containerd/pull/10165))
* Fix deadlock when writing to pipe blocks ([containerd/ttrpc#168](https://github.com/containerd/ttrpc/pull/168))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Stefan Berger
* Derek McGowan
* Austin Vazquez
* Alexandru Matei
* Maksym Pavlenko
* Akihiro Suda
* Bryant Biggs
* Kevin Parsons
* Kirtana Ashok
* Phil Estes
* Kazuyoshi Kato
* Kohei Tokunaga
* Swagat Bora

### Changes
<details><summary>43 commits</summary>
<p>

* Prepare release notes for v1.7.17 ([#10235](https://github.com/containerd/containerd/pull/10235))
  * [`114b07b97`](https://github.com/containerd/containerd/commit/114b07b976b0e715c28f82a43d6790ac46bfb53c) Prepare release notes for v1.7.17
* Use LOOP_CONFIGURE when creating loop devices ([#10209](https://github.com/containerd/containerd/pull/10209))
  * [`803aaa680`](https://github.com/containerd/containerd/commit/803aaa6801d808289e9a25a2f05fc9710b2ed39b) Remove internal LoopConfig struct
  * [`7bd3be948`](https://github.com/containerd/containerd/commit/7bd3be9487050fccc29df94bf3f9f005589121bc) Swap internal ioctl implementation with golang.org/x/sys
  * [`a0739dc0e`](https://github.com/containerd/containerd/commit/a0739dc0e800fa002b451ff425cb8aeb9f880d02) Use LOOP_CONFIGURE when creating loop devices
* Update unpacker to fetch all provided content ([#10233](https://github.com/containerd/containerd/pull/10233))
  * [`1573ea598`](https://github.com/containerd/containerd/commit/1573ea598e00c1b942946958ea451062557d74d7) Update ctr image pull all platforms
  * [`32b594f1b`](https://github.com/containerd/containerd/commit/32b594f1b2420fe7633802ee9a2225e9fd7e5c70) Update unpacker to always fetch all
* Update hcsshim tag to v0.11.5 ([#10232](https://github.com/containerd/containerd/pull/10232))
  * [`5a03a3aee`](https://github.com/containerd/containerd/commit/5a03a3aeee0b4be59a556ba145ebe09492812544) Update hcsshim tag to v0.11.5
* Update ttrpc tag to 1.2.4 ([#10221](https://github.com/containerd/containerd/pull/10221))
  * [`9a1eda40f`](https://github.com/containerd/containerd/commit/9a1eda40f8c7cfa1f69642bf66a50a9740fca01f) update ttrpc tag to 1.2.4
* Preserve CL_UNPRIVILEGED locked flags during remount of bind mounts ([#10210](https://github.com/containerd/containerd/pull/10210))
  * [`ad85652fa`](https://github.com/containerd/containerd/commit/ad85652fa17b405b8b6bf97756c65291e97ac5d6) Preserve CL_UNPRIVILEGED locked flags during remount of bind mounts
* Update instrumentation fuzzer with new flag ([#10229](https://github.com/containerd/containerd/pull/10229))
  * [`582f3f43d`](https://github.com/containerd/containerd/commit/582f3f43d5392132d99e6f0cc50e403b7f0d781c) Update instrumentation fuzzer with new flag
* vendor: github.com/containerd/imgcrypt@v1.1.8 ([#10215](https://github.com/containerd/containerd/pull/10215))
  * [`a5d13689b`](https://github.com/containerd/containerd/commit/a5d13689b97f62ca172636bc2360e6c9f36120e2) vendor: github.com/containerd/imgcrypt@v1.1.8
* vendor: golang.org/x/net@v0.23.0 ([#10211](https://github.com/containerd/containerd/pull/10211))
  * [`f853bc129`](https://github.com/containerd/containerd/commit/f853bc1292751ca7c5e12b9a3faa300039e21e34) vendor: golang.org/x/net@v0.23.0
  * [`837972979`](https://github.com/containerd/containerd/commit/837972979fffd6f0624b354bd68b75906ad530cc) vendor: golang.org/x/net@v0.21.0
  * [`56aa87792`](https://github.com/containerd/containerd/commit/56aa877926c7a2a4be0683bc48c05b0b65ae9c8e) vendor: golang.org/x/net@v0.20.0
  * [`4e6335ebd`](https://github.com/containerd/containerd/commit/4e6335ebdf3ba54bf89d652c326b2127dd88639f) vendor: golang.org/x/net@v0.19.0
  * [`1c6c745c6`](https://github.com/containerd/containerd/commit/1c6c745c60acf808c99644e8bafa3a8d367c076c) vendor: golang.org/x/term@v0.17.0
  * [`1077d38c9`](https://github.com/containerd/containerd/commit/1077d38c9fe83db9720e01aea253de8ff3525b3d) vendor: golang.org/x/sys@v0.18.0
* Update tooling to Go 1.21.10, 1.22.3 for net/http bug fixes ([#10207](https://github.com/containerd/containerd/pull/10207))
  * [`c53b635f9`](https://github.com/containerd/containerd/commit/c53b635f927a905ff431a51d12f42f4f5c36d959) Update toolchain to Go 1.21.10 and 1.22.3
* vendor: golang.org/x/crypto@v0.18.0 ([#10204](https://github.com/containerd/containerd/pull/10204))
  * [`4b52104f0`](https://github.com/containerd/containerd/commit/4b52104f0cfbcb4f6ad3cf4f80bc3c34919b03de) vendor: golang.org/x/crypto@v0.18.0
  * [`2f65c83b0`](https://github.com/containerd/containerd/commit/2f65c83b0b80796f7b3b30bebc5354b293c14a74) vendor: golang.org/x/term@v0.16.0
  * [`8a76171f7`](https://github.com/containerd/containerd/commit/8a76171f76de63dce2f85946fdfeb3d3f79cd2fc) vendor: golang.org/x/sys@v0.16.0
  * [`d45778523`](https://github.com/containerd/containerd/commit/d45778523cb2454fcb57a36c5c0c1c447267ca44) vendor: golang.org/x/term@v0.15.0, golang.org/x/text@v0.14.0
  * [`24038de8c`](https://github.com/containerd/containerd/commit/24038de8c1c285f3ebc7c1c81564409703a03ac9) vendor: golang.org/x/sys@v0.15.0
* Update metadata snapshotter to lease on already exists ([#10198](https://github.com/containerd/containerd/pull/10198))
  * [`eb930375c`](https://github.com/containerd/containerd/commit/eb930375ca25680660e424eeefbcab8920543aa2) Add lease test for metadata snapshotter
  * [`9f6c61ab9`](https://github.com/containerd/containerd/commit/9f6c61ab927bb34136636e3e560831e155bea958) Update metadata snapshotter to lease on exists
* Update grpc and image-spec dependencies ([#10180](https://github.com/containerd/containerd/pull/10180))
  * [`24dd403ab`](https://github.com/containerd/containerd/commit/24dd403abb141917934493ee9170bffee14cb305) Update image-spec to v1.1.0
  * [`189b69e24`](https://github.com/containerd/containerd/commit/189b69e247f0f852ef261421d6730beaecb2502b) go.mod: github.com/opencontainers/image-spec v1.1.0-rc3
  * [`388fb336b`](https://github.com/containerd/containerd/commit/388fb336b0a458e2cf64212072743e622a3f44c7) Update grpc to v1.59.0
* Handle unsupported config versions ([#10165](https://github.com/containerd/containerd/pull/10165))
  * [`00347b7fa`](https://github.com/containerd/containerd/commit/00347b7fa50b73d23399c8197c76a1343c901bf3) Add check for unsupported config versions
</p>
</details>

### Changes from containerd/imgcrypt
<details><summary>53 commits</summary>
<p>

* CHANGES: Updated CHANGES document for 1.1.8 release ([containerd/imgcrypt#122](https://github.com/containerd/imgcrypt/pull/122))
  * [`956b4d3`](https://github.com/containerd/imgcrypt/commit/956b4d3fe3ed647032725bf1585f68b2a38b2b13) CHANGES: Updated CHANGES document for 1.1.8 release
* Synchronize enc-ctr with upstream ctr from containerd v1.6.23 and use containerd v1.6.23 in dependency ([containerd/imgcrypt#120](https://github.com/containerd/imgcrypt/pull/120))
  * [`9e8e1c1`](https://github.com/containerd/imgcrypt/commit/9e8e1c1df3660f869c7fbd49135a8cd6bf91fe7c) ctr: Sync code with containerd v1.6.23 ctr
  * [`7d2cca5`](https://github.com/containerd/imgcrypt/commit/7d2cca5efde78e5c5bce11e831d61077cf9166e1) build(deps): bump containerd from 1.6.20 to 1.6.23
* Synchronize enc-ctr with upstream ctr from containerd v1.6.20 ([containerd/imgcrypt#119](https://github.com/containerd/imgcrypt/pull/119))
  * [`0f2559e`](https://github.com/containerd/imgcrypt/commit/0f2559e3c9bb4c80ea422560af2bdb1334d70f88) ctr: Sync code with containerd v1.6.20 ctr
  * [`c48dd78`](https://github.com/containerd/imgcrypt/commit/c48dd787005e197c12e924727ea2b0be75a6e66b) cmd: Copy IntToInt32Array into img package and use it
* Update to ocicrypt 1.1.8 and minimum go 1.20 ([containerd/imgcrypt#118](https://github.com/containerd/imgcrypt/pull/118))
  * [`6d48a4e`](https://github.com/containerd/imgcrypt/commit/6d48a4ecc325e1aaf531110b5aa9beece4eafc4c) build(deps): bump ocicrypt from 1.1.7 to 1.1.8
  * [`1bc94a2`](https://github.com/containerd/imgcrypt/commit/1bc94a206e90d4f79dbb137c922b32b71662c78b) github: Use golangci-lint v1.54.1 and adjust config file
  * [`9065f1d`](https://github.com/containerd/imgcrypt/commit/9065f1da9e4f607df34eff64d6e24530f7b3a136) github: Test with go 1.21 and go 1.20
  * [`74986f3`](https://github.com/containerd/imgcrypt/commit/74986f3687f84523a4612bd7c6975463b68b3b10) go.mod: Require go 1.20
* build(deps): bump google.golang.org/grpc from 1.47.0 to 1.53.0 ([containerd/imgcrypt#117](https://github.com/containerd/imgcrypt/pull/117))
  * [`a2a8273`](https://github.com/containerd/imgcrypt/commit/a2a82731875004f0dd33dff929201456e3f702e1) build(deps): bump google.golang.org/grpc from 1.47.0 to 1.53.0
* test: Test creating and running of container with key file missing ([containerd/imgcrypt#116](https://github.com/containerd/imgcrypt/pull/116))
  * [`286470a`](https://github.com/containerd/imgcrypt/commit/286470a95699ac0cb19a3de79a7a215cafc8f2c7) test: Test creating and running of container with key file missing
* Fix some issues in the test script ([containerd/imgcrypt#115](https://github.com/containerd/imgcrypt/pull/115))
  * [`aa517cc`](https://github.com/containerd/imgcrypt/commit/aa517cc77654cf517cc7bba5529b07da92f033dc) test: Fix order of parameters and remove unnecessary key parameter
  * [`ec72311`](https://github.com/containerd/imgcrypt/commit/ec7231185e276feb10f5b4b974ade62a81d5e9ad) test: Add comments to test case
  * [`2959ec0`](https://github.com/containerd/imgcrypt/commit/2959ec0ec47786956223715812f40eb9e7301786) test: To be able to run testLocalKeys alone add missing env variable
* build(deps): upgrade github.com/containerd/containerd from 1.6.18 to … ([containerd/imgcrypt#112](https://github.com/containerd/imgcrypt/pull/112))
  * [`a7f2760`](https://github.com/containerd/imgcrypt/commit/a7f2760c719863cc015e4638090db4ef23daecd1) build(deps): upgrade github.com/containerd/containerd from 1.6.18 to 1.6.20
* ci: Update golangci-lint to v1.52.2 ([containerd/imgcrypt#113](https://github.com/containerd/imgcrypt/pull/113))
  * [`002abac`](https://github.com/containerd/imgcrypt/commit/002abac5a58aebef74a13bb7e30302b01f07b419) images: Change 'any' to 'anything' to avoid clash with built-in type 'any'
  * [`5780ecc`](https://github.com/containerd/imgcrypt/commit/5780ecc88b4b08c4f1d8e6372869e39ab1fcbf35) images: Replace unused function parameters with '_'
  * [`7dc8592`](https://github.com/containerd/imgcrypt/commit/7dc85928e244990cb3371c63d2a8caae5189b757) ci: Update golangci-lint to v1.52.2
* build(deps): bump github.com/opencontainers/runc from 1.1.2 to 1.1.5 ([containerd/imgcrypt#109](https://github.com/containerd/imgcrypt/pull/109))
  * [`90e4f77`](https://github.com/containerd/imgcrypt/commit/90e4f77bdc085a6f6d426380fa7cf0227ea03173) build(deps): bump github.com/opencontainers/runc from 1.1.2 to 1.1.5
* Abandon go 1.18 (end-of-life) and use 1.19 and 1.20 in tests ([containerd/imgcrypt#110](https://github.com/containerd/imgcrypt/pull/110))
  * [`8fc037f`](https://github.com/containerd/imgcrypt/commit/8fc037fd2de0e6106a3e8da655be22a1d4da719c) tests: Upgrade toml written by test case to version 2
  * [`0b31beb`](https://github.com/containerd/imgcrypt/commit/0b31beb1c7b6391b50ff44d9a71bed452bcebf2d) ci: Run tests with go 1.19 and 1.20 (abandon 1.18)
  * [`523674c`](https://github.com/containerd/imgcrypt/commit/523674c781c15e461afe52d8086deb4dd0d61466) build(deps): Update to minimum required go v1.19
* Update to golang.org/x/net@v0.7.0 and github.com/containers/ocicrypt@v1.1.7 ([containerd/imgcrypt#107](https://github.com/containerd/imgcrypt/pull/107))
  * [`96a2314`](https://github.com/containerd/imgcrypt/commit/96a2314e83ba412568800a7dd84789f59f1310ec) build(deps): Upgrade to github.com/containers/ocicrypt@v1.1.7
  * [`1c50555`](https://github.com/containerd/imgcrypt/commit/1c5055514add4b6715cb4da0a127f8200d0d190a) bulid(deps): Update to golang.org/x/net@v0.7.0
  * [`9645d39`](https://github.com/containerd/imgcrypt/commit/9645d39f070c7f6728ec4e1831fbede7ebd512ec) build(deps): Update to minimum required go v1.18
* build(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.18 ([containerd/imgcrypt#106](https://github.com/containerd/imgcrypt/pull/106))
  * [`8daaa45`](https://github.com/containerd/imgcrypt/commit/8daaa45a63100dc95430fc22eb2b5e95772b245f) build(deps): bump github.com/containerd/containerd from 1.6.12 to 1.6.18
* README: Fix a typo ([containerd/imgcrypt#105](https://github.com/containerd/imgcrypt/pull/105))
  * [`12e84f5`](https://github.com/containerd/imgcrypt/commit/12e84f51fb70e1fb2bcc624206f707b48671b352) README: Fix a typo
* build(deps): bump github.com/containerd/containerd from 1.6.8 to 1.6.12 ([containerd/imgcrypt#103](https://github.com/containerd/imgcrypt/pull/103))
  * [`4e5a73e`](https://github.com/containerd/imgcrypt/commit/4e5a73e393254df6091fc9b3bf54371be778060f) build(deps): bump github.com/containerd/containerd from 1.6.8 to 1.6.12
* Update golangci-lint to v1.50.1 ([containerd/imgcrypt#101](https://github.com/containerd/imgcrypt/pull/101))
  * [`16a071b`](https://github.com/containerd/imgcrypt/commit/16a071b983f1777ff6391be0d44e80370fd58bf9) Update golangci-lint to v1.50.1
* Remove references to package io/ioutil ([containerd/imgcrypt#100](https://github.com/containerd/imgcrypt/pull/100))
  * [`981a3fd`](https://github.com/containerd/imgcrypt/commit/981a3fdd5a755a1521337010bec47874753508cb) Remove references to package io/ioutil
* Update GitHub actions CI workflow ([containerd/imgcrypt#99](https://github.com/containerd/imgcrypt/pull/99))
  * [`06827a1`](https://github.com/containerd/imgcrypt/commit/06827a1d8664a277fed24a41cd1566c197f58814) Update containerd project checks package in CI
  * [`f6a39e1`](https://github.com/containerd/imgcrypt/commit/f6a39e1bcd21af406254aa5da1e7f89f26e914cd) Update GitHub actions packages in CI workflow
  * [`6383351`](https://github.com/containerd/imgcrypt/commit/6383351756ec706b0f6aeea1a9dfc737c71bece7) Update GitHub actions CI workflow OS runner images
* CI/CD: Run CodeQL on PRs and once a month ([containerd/imgcrypt#98](https://github.com/containerd/imgcrypt/pull/98))
  * [`b6e16db`](https://github.com/containerd/imgcrypt/commit/b6e16db881eef08e0bb58d0885bfad8339c97f2f) CI/CD: Run CodeQL on PRs and once a month
</p>
</details>

### Changes from containerd/ttrpc
<details><summary>10 commits</summary>
<p>

* Bump google.golang.org/protobuf from 1.31.0 to 1.33.0 ([containerd/ttrpc#166](https://github.com/containerd/ttrpc/pull/166))
  * [`272c857`](https://github.com/containerd/ttrpc/commit/272c8575a6e6fd169a08ca94a1b77dbce433119c) Bump google.golang.org/protobuf from 1.31.0 to 1.33.0
* Fix deadlock when writing to pipe blocks ([containerd/ttrpc#168](https://github.com/containerd/ttrpc/pull/168))
  * [`1b4f6f8`](https://github.com/containerd/ttrpc/commit/1b4f6f8edba5f374f1afbf10d7666136286806e7) client: Fix deadlock when writing to pipe blocks
* Bump golang.org/x/net from 0.17.0 to 0.23.0 ([containerd/ttrpc#167](https://github.com/containerd/ttrpc/pull/167))
  * [`13b8289`](https://github.com/containerd/ttrpc/commit/13b8289864f297c6fe1f973016012ce1495ee1b9) Bump golang.org/x/net from 0.17.0 to 0.23.0
* Update GitHub Actions CI to resolve deprecation warnings ([containerd/ttrpc#161](https://github.com/containerd/ttrpc/pull/161))
  * [`589a593`](https://github.com/containerd/ttrpc/commit/589a593abc38264094c47baf83bc69b2cff37524) Update GitHub Actions CI to resolve deprecation warnings
* Fix proto3 generation error ([containerd/ttrpc#158](https://github.com/containerd/ttrpc/pull/158))
  * [`73b6a91`](https://github.com/containerd/ttrpc/commit/73b6a9156d6dc4644c94f5a683219ba8aac9fb18) Add optional feature in protobuf compiler
</p>
</details>

### Dependency Changes

* **github.com/Microsoft/go-winio**              v0.6.1 -> v0.6.2
* **github.com/Microsoft/hcsshim**               v0.11.4 -> v0.11.5
* **github.com/containerd/imgcrypt**             v1.1.7 -> v1.1.8
* **github.com/containerd/ttrpc**                v1.2.3 -> v1.2.4
* **github.com/containers/ocicrypt**             v1.1.6 -> v1.1.10
* **github.com/go-jose/go-jose/v3**              v3.0.3 **_new_**
* **github.com/google/uuid**                     v1.3.0 -> v1.3.1
* **github.com/opencontainers/image-spec**       3a7f492d3f1b -> v1.1.0
* **github.com/stefanberger/go-pkcs11uri**       78d3cae3a980 -> 78284954bff6
* **golang.org/x/crypto**                        v0.14.0 -> v0.21.0
* **golang.org/x/mod**                           v0.11.0 -> v0.12.0
* **golang.org/x/net**                           v0.17.0 -> v0.23.0
* **golang.org/x/oauth2**                        v0.10.0 -> v0.11.0
* **golang.org/x/sys**                           v0.13.0 -> v0.18.0
* **golang.org/x/term**                          v0.13.0 -> v0.18.0
* **golang.org/x/text**                          v0.13.0 -> v0.14.0
* **google.golang.org/genproto**                 782d3b101e98 -> b8732ec3820d
* **google.golang.org/genproto/googleapis/api**  782d3b101e98 -> b8732ec3820d
* **google.golang.org/genproto/googleapis/rpc**  cbb8c96f2d6d -> b8732ec3820d
* **google.golang.org/grpc**                     v1.58.3 -> v1.59.0

Previous release can be found at [v1.7.16](https://github.com/containerd/containerd/releases/tag/v1.7.16)

containerd api/v1.8.0-rc.0

Welcome to the api/v1.8.0-rc.0 release of containerd!
*This is a pre-release of containerd*

The first dedicated release for the containerd API. This release continues the 1.x
line of API compatibility with the 9th minor release of the 1.x API.

### Highlights

* Add api Go module and move all protos under api ([#10151](https://github.com/containerd/containerd/pull/10151))
* Add PluginInfo to introspection API ([#9442](https://github.com/containerd/containerd/pull/9442))
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))

#### Image Distribution

* Enable Transfer service API to support plain HTTP ([#10024](https://github.com/containerd/containerd/pull/10024))
* Enable Transfer service to use registry configuration directory ([#9908](https://github.com/containerd/containerd/pull/9908))
* Update Transfer service to add OCI descriptors to Progress structure ([#9630](https://github.com/containerd/containerd/pull/9630))
* Add option to perform syncfs after pull ([#9401](https://github.com/containerd/containerd/pull/9401))

#### Runtime

* Store bootstrap parameters in sandbox metadata ([#9736](https://github.com/containerd/containerd/pull/9736))
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
* Add annotations to CreateSandbox request ([#8960](https://github.com/containerd/containerd/pull/8960))
* Add SandboxMetrics ([#8680](https://github.com/containerd/containerd/pull/8680))
* Publish sandbox events ([#8602](https://github.com/containerd/containerd/pull/8602))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Maksym Pavlenko
* Akihiro Suda
* Wei Fu
* Abel Feng
* Danny Canter
* Phil Estes
* Samuel Karp
* Kohei Tokunaga
* Akhil Mohan
* Bryant Biggs
* Davanum Srinivas
* Iceber Gu
* Kirtana Ashok
* Sebastiaan van Stijn

### Changes
<details><summary>53 commits</summary>
<p>

* Prepare release notes for api/v1.8.0-rc.0 ([#10167](https://github.com/containerd/containerd/pull/10167))
  * [`55fcebffc`](https://github.com/containerd/containerd/commit/55fcebffc76e642e9155eda5e097043f95109e4d) Prepare release notes for api/v1.8.0
* Add api Go module and move all protos under api ([#10151](https://github.com/containerd/containerd/pull/10151))
  * [`2ac2b9c90`](https://github.com/containerd/containerd/commit/2ac2b9c909fb64f4d06958a0ca2f556bec348d05) Make api a Go sub-module
  * [`3e9cace72`](https://github.com/containerd/containerd/commit/3e9cace720cee5eb631c8291d8fb51928dc3fb3b) Move runtimeoptions to api directory
  * [`4a4550777`](https://github.com/containerd/containerd/commit/4a455077722796fd6a63253bc30d2b4c0c379d1d) Move runc options to api directory
* Store bootstrap parameters in sandbox metadata ([#9736](https://github.com/containerd/containerd/pull/9736))
  * [`de38490ed`](https://github.com/containerd/containerd/commit/de38490ed6b8d9cb9cb6ea7cfcd0071e8f27d304) sandbox: merge address and protocol to one url
  * [`f6e0cf189`](https://github.com/containerd/containerd/commit/f6e0cf1894b9211f07d801e1af3166f290969cd7) sandbox: add address info in Start and Status response
* Enable Transfer service API to support plain HTTP ([#10024](https://github.com/containerd/containerd/pull/10024))
  * [`433279438`](https://github.com/containerd/containerd/commit/4332794384253ad85a05a17fe42aa929f62fc72a) Transfer: Registry: Enable plain HTTP
* Enable Transfer service to use registry configuration directory ([#9908](https://github.com/containerd/containerd/pull/9908))
  * [`7a3b7fba5`](https://github.com/containerd/containerd/commit/7a3b7fba59a9ff9e8756976cf6f55117b1814a63) Transfer: Registry: Enable to use registry configuration diretory
* Generate proto services with go-ttrpc ([#7609](https://github.com/containerd/containerd/pull/7609))
  * [`f0e874941`](https://github.com/containerd/containerd/commit/f0e8749411301e99958e0caf545d85bf0112dda4) Add ttrpc generated services
  * [`65031eade`](https://github.com/containerd/containerd/commit/65031eadec262d783db25456a8bbca1eed1956b7) Update protobuild to build ttrpc services
* Add OSVersion to platform protobuf ([#9733](https://github.com/containerd/containerd/pull/9733))
  * [`5aa05481d`](https://github.com/containerd/containerd/commit/5aa05481ddd40138eef79ec4bce2b0232adef354) Add OSVersion to platform protobuf
* Move Message proto to types ([#9742](https://github.com/containerd/containerd/pull/9742))
  * [`0facc8592`](https://github.com/containerd/containerd/commit/0facc85925a114edac4b3b05a871f4ad205f45f1) Fix proto formatting
  * [`7f2d2c4f4`](https://github.com/containerd/containerd/commit/7f2d2c4f44afe090872301cc8614e8fc0d432e9e) Move Message proto to types
* refactor: move plugin/fieldpath to api/types/ ([#9687](https://github.com/containerd/containerd/pull/9687))
  * [`b16e3572a`](https://github.com/containerd/containerd/commit/b16e3572a308be0c58b3c810b1922ec8d444d1f7) refactor: move plugin/fieldpath to api/types/
* Add PluginInfo to introspection API ([#9442](https://github.com/containerd/containerd/pull/9442))
  * [`22d586e51`](https://github.com/containerd/containerd/commit/22d586e515654d3a901c40443fb2b4adcad65827) api/services/instrospection: add PluginInfo
* Update Transfer service to add OCI descriptors to Progress structure ([#9630](https://github.com/containerd/containerd/pull/9630))
  * [`a2472c0b5`](https://github.com/containerd/containerd/commit/a2472c0b5ab17e46ab3f3b000a6fa512a45d7f05) transfer: add OCI descriptors to Progress structure
* Add option to perform syncfs after pull ([#9401](https://github.com/containerd/containerd/pull/9401))
  * [`bd5c602c4`](https://github.com/containerd/containerd/commit/bd5c602c4dc91d19976f2dc222a337ab76716750) api: introduce sync_fs to diff.ApplyRequest
* Containerd v2 module ([#9306](https://github.com/containerd/containerd/pull/9306))
  * [`5fdf55e49`](https://github.com/containerd/containerd/commit/5fdf55e493d68079d22a08de1a7afe522e5838e5) Update go module to github.com/containerd/containerd/v2
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
  * [`57c897f10`](https://github.com/containerd/containerd/commit/57c897f10df48556af799f71c85a91b889df2d70) api/introspection: deprecation warnings in server
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
  * [`d2d434b7d`](https://github.com/containerd/containerd/commit/d2d434b7d6546842b1f791ef17392da99320265d) sandbox: add all sandbox information to Create method
  * [`f372b3501`](https://github.com/containerd/containerd/commit/f372b3501b6096c8228203f9d5d5aae8ff998d61) sandbox: add sandboxer field of sandbox requests
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))
  * [`f8fb2dad3`](https://github.com/containerd/containerd/commit/f8fb2dad39a4b45ce1de59f236e72ee72ad53cf7) api: update image service to support target in delete request
* fix: Add `containerd` to the message type reference ([#9126](https://github.com/containerd/containerd/pull/9126))
  * [`42eee8bf0`](https://github.com/containerd/containerd/commit/42eee8bf05c89524a29f064cb4ce0a460a8c0081) fix: Add `containerd` to the message type reference
* platforms: isolate from errdefs and api dependencies ([#9095](https://github.com/containerd/containerd/pull/9095))
  * [`e916d77c8`](https://github.com/containerd/containerd/commit/e916d77c81b8a61d7a37276e310b4a150b04f4ab) platforms: move ToProto, FromProto to api/types
* Add annotations to CreateSandbox request ([#8960](https://github.com/containerd/containerd/pull/8960))
  * [`939ccbed4`](https://github.com/containerd/containerd/commit/939ccbed427e81eaecd37777ddcb2eac792114e6) Sandbox: Add annotations to CreateSandbox surface
* archive: use 1970-01-01 as the whiteout timestamp ([#8764](https://github.com/containerd/containerd/pull/8764))
  * [`5dedb6d0d`](https://github.com/containerd/containerd/commit/5dedb6d0d2565507f0636254a18fdb7462a9eac3) archive: use 1970-01-01 as the whiteout timestamp
* Add SandboxMetrics ([#8680](https://github.com/containerd/containerd/pull/8680))
  * [`d278d37ca`](https://github.com/containerd/containerd/commit/d278d37caae501ef18fd919e611610c639ad471b) Sandbox: Add Metrics rpc for controller
  * [`d56722ef2`](https://github.com/containerd/containerd/commit/d56722ef2a42953841728f5ed5666da776ce0d8f) Sandbox: Add SandboxMetrics rpc
* Publish sandbox events ([#8602](https://github.com/containerd/containerd/pull/8602))
  * [`65906335b`](https://github.com/containerd/containerd/commit/65906335bf086dfe4ed73fbddb90429047e8aa96) Add sandbox events protos
* Cleanup protobuild config ([#8278](https://github.com/containerd/containerd/pull/8278))
  * [`0bbca7f1b`](https://github.com/containerd/containerd/commit/0bbca7f1bcc29933dfd3cb3c463cc4fb8fbbe036) Cleanup protobuild config
</p>
</details>

### Dependency Changes

* **github.com/containerd/ttrpc**                v1.2.1 -> v1.2.3
* **github.com/containerd/typeurl/v2**           v2.1.0 -> v2.1.1
* **github.com/golang/protobuf**                 v1.5.2 -> v1.5.3
* **github.com/opencontainers/image-spec**       3a7f492d3f1b -> v1.1.0
* **github.com/sirupsen/logrus**                 v1.9.0 -> v1.8.1
* **golang.org/x/net**                           v0.7.0 -> v0.21.0
* **golang.org/x/sys**                           v0.6.0 -> v0.17.0
* **golang.org/x/text**                          v0.7.0 -> v0.14.0
* **google.golang.org/genproto/googleapis/rpc**  c3f982113cda **_new_**
* **google.golang.org/grpc**                     v1.53.0 -> v1.59.0
* **google.golang.org/protobuf**                 v1.28.1 -> v1.33.0

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)

containerd 1.7.16

Welcome to the v1.7.16 release of containerd!

The sixteenth patch release for containerd 1.7 contains various fixes and updates.

### Highlights

* Update AppArmor template to allow confined runc to kill containers ([#10129](https://github.com/containerd/containerd/pull/10129))
* Fix config import relative path glob ([#9834](https://github.com/containerd/containerd/pull/9834))
* Update AppArmor template to better support rootlesskit ([#10116](https://github.com/containerd/containerd/pull/10116))
* Update HTTP fallback to better account for TLS timeout and previous attempts ([#10112](https://github.com/containerd/containerd/pull/10112))
* Add support for HPC port forwarding ([#10008](https://github.com/containerd/containerd/pull/10008))
* Prevent GC from schedule itself with 0 period. ([#10102](https://github.com/containerd/containerd/pull/10102))
* Fix issue with using invalid token to retry fetching layer ([#10065](https://github.com/containerd/containerd/pull/10065))
* Automatically decompress archives for transfer service import ([#9989](https://github.com/containerd/containerd/pull/9989))
* Fix HTTPFallback fails when pushing manifest ([#10044](https://github.com/containerd/containerd/pull/10044))
* Add support for configuring otel from env and config deprecation notice ([#9992](https://github.com/containerd/containerd/pull/9992))
* Fix deadlock during NRI plugin registration ([containerd/nri#79](https://github.com/containerd/nri/pull/79))

#### Build and Release Toolchain

* Update Go to 1.21.9 and 1.22.2 with net/http security fix ([#10115](https://github.com/containerd/containerd/pull/10115))

#### Container Runtime Interface (CRI)

* Fix CRI snapshotter root path when not under containerd root ([#10096](https://github.com/containerd/containerd/pull/10096))
* Fix network creation failure from CreatedAt time as 269 years ago ([#10122](https://github.com/containerd/containerd/pull/10122))
* Include userns info in PodSandboxStatus ([#9865](https://github.com/containerd/containerd/pull/9865))
* Fix default working directory Windows HostProcess containers ([#10071](https://github.com/containerd/containerd/pull/10071))
* Fix ListPodSandboxStats to skip sandboxes with missing tasks ([#10042](https://github.com/containerd/containerd/pull/10042))

#### Deprecations

* Add support for configuring otel from env and config deprecation notice ([#9992](https://github.com/containerd/containerd/pull/9992))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Samuel Karp
* Wei Fu
* Danny Canter
* Kazuyoshi Kato
* Kirtana Ashok
* Maksym Pavlenko
* Phil Estes
* Sebastiaan van Stijn
* Brian Goff
* Rodrigo Campos
* Akihiro Suda
* Angelos Kolaitis
* Bin Tang
* David Porter
* Edgar Lee
* Evan Lezar
* Kirill A. Korinsky
* Kohei Tokunaga
* Maksim An
* Paweł Gronowski
* Tomáš Virtus
* 张钰10307750
* 沈陵

### Changes
<details><summary>50 commits</summary>
<p>

* Add release notes for v1.7.16 ([#10124](https://github.com/containerd/containerd/pull/10124))
  * [`1c623084f`](https://github.com/containerd/containerd/commit/1c623084fbdcfe7c3882047eba1648921814e390) Add release notes for v1.7.16
* Update AppArmor template to allow confined runc to kill containers ([#10129](https://github.com/containerd/containerd/pull/10129))
  * [`18a2c36fa`](https://github.com/containerd/containerd/commit/18a2c36faf47df776df56b4cc9a2defcf4b68897) apparmor: Allow confined runc to kill containers
* Fix config import relative path glob ([#9834](https://github.com/containerd/containerd/pull/9834))
  * [`62e9535f2`](https://github.com/containerd/containerd/commit/62e9535f295f4026d69280107c08c6b6a4eb5417) Fix config import relative path glob
* Fix CRI snapshotter root path when not under containerd root ([#10096](https://github.com/containerd/containerd/pull/10096))
  * [`a8ebceb97`](https://github.com/containerd/containerd/commit/a8ebceb972efdc5ead7535640f531972a95280cb) CRI: "Fix" imageFSPath behavior
  * [`bd423bf84`](https://github.com/containerd/containerd/commit/bd423bf84d2ddef9680f54670a1e6ec2d7a18329) Snapshotters: Export the root path
  * [`8fb6bfa71`](https://github.com/containerd/containerd/commit/8fb6bfa71753481f065e53245707d74473498d78) Add exports to proxy plugin config
  * [`8916e2cf9`](https://github.com/containerd/containerd/commit/8916e2cf9dfa7e1dfe609334540a14a15156bfe6) Add platform config to proxy plugins
* Fix network creation failure from CreatedAt time as 269 years ago ([#10122](https://github.com/containerd/containerd/pull/10122))
  * [`293f5151d`](https://github.com/containerd/containerd/commit/293f5151d44c8a700a7244fed09c37524a89a82a) pod: CreatedAt time will be 269 years ago while creating cri network failed.
* Update AppArmor template to better support rootlesskit ([#10116](https://github.com/containerd/containerd/pull/10116))
  * [`af19e746e`](https://github.com/containerd/containerd/commit/af19e746eca65a536d5dc3d732043c22c4b31101) apparmor: add `signal (receive) peer=/usr/local/bin/rootlesskit,`
* Update Go to 1.21.9 and 1.22.2 with net/http security fix ([#10115](https://github.com/containerd/containerd/pull/10115))
  * [`637d259dd`](https://github.com/containerd/containerd/commit/637d259dd6646d16c71e295e056dec291b506892) update to go1.21.9, go1.22.2
* Update HTTP fallback to better account for TLS timeout and previous attempts ([#10112](https://github.com/containerd/containerd/pull/10112))
  * [`794b0c723`](https://github.com/containerd/containerd/commit/794b0c7239e134d7053daa17842682f0596d55ae) Add deprecated HTTPFallback for package compatibility
  * [`51c649d9d`](https://github.com/containerd/containerd/commit/51c649d9d43d19b0f3f0ac51e331c9e956c337a7) Update HTTPFallback to handle tls handshake timeout
  * [`aa14890ed`](https://github.com/containerd/containerd/commit/aa14890edd027b83800e017261e917c71041c343) Remove empty default tls configuration in ctr
* Add support for HPC port forwarding ([#10008](https://github.com/containerd/containerd/pull/10008))
  * [`3df5d4445`](https://github.com/containerd/containerd/commit/3df5d4445bc6948339bb302d32fa073ae928976b) Add support for HPC port forwarding
* Prevent GC from schedule itself with 0 period. ([#10102](https://github.com/containerd/containerd/pull/10102))
  * [`5c15bf406`](https://github.com/containerd/containerd/commit/5c15bf406da3a40d19ba89c7cd90080047d3793e) Prevent GC from schedule itself with 0 period.
* Include userns info in PodSandboxStatus ([#9865](https://github.com/containerd/containerd/pull/9865))
  * [`b57dc9fd3`](https://github.com/containerd/containerd/commit/b57dc9fd3690f1bd3b11b96dbf17e1a1bd3476e8) cri/server: Add userns tests in PodSandboxStatus
  * [`6e809ef13`](https://github.com/containerd/containerd/commit/6e809ef13a60c2233ec7e3566228b8a37e67968e) cri: Expose userns in PodSandboxStatus rpc
* mod: bump github.com/containerd/nri@v0.6.1 ([#10097](https://github.com/containerd/containerd/pull/10097))
  * [`395a31901`](https://github.com/containerd/containerd/commit/395a31901512bea37d381decbd37da620bb44c66) mod: bump github.com/containerd/nri@v0.6.1
* Fix issue with using invalid token to retry fetching layer ([#10065](https://github.com/containerd/containerd/pull/10065))
  * [`f61de0864`](https://github.com/containerd/containerd/commit/f61de08644b73e7836ac46234b3f6283fc9715dd) fix bug that using invalid token to retry fetching layer
* Bump tags.cncf.io/container-device-interface to v0.7.2 ([#10077](https://github.com/containerd/containerd/pull/10077))
  * [`7a2f49f70`](https://github.com/containerd/containerd/commit/7a2f49f70f1d2cacfededbbf65452d481476bc10) Bump tags.cncf.io/container-device-interface to v0.7.2
* Fix default working directory Windows HostProcess containers ([#10071](https://github.com/containerd/containerd/pull/10071))
  * [`989f1ec54`](https://github.com/containerd/containerd/commit/989f1ec54f6764020447b03020b97592312c5f85) fix default working directory `hostProcess`
* Fix unexpected order of mounts since go 1.19 ([#10063](https://github.com/containerd/containerd/pull/10063))
  * [`9f774e438`](https://github.com/containerd/containerd/commit/9f774e438b9d96a901adb11e580fa03c6264f667) fix(cri): fix unexpected order of mounts since go 1.19
* Automatically decompress archives for transfer service import ([#9989](https://github.com/containerd/containerd/pull/9989))
  * [`2aec52493`](https://github.com/containerd/containerd/commit/2aec52493f3d67b0fd55a2348b69dd831253933f) Automatically decompress archives for transfer service import
* Use different containerd sock address in tests ([#10056](https://github.com/containerd/containerd/pull/10056))
  * [`8c76e7948`](https://github.com/containerd/containerd/commit/8c76e794820b4923c2a4dd1ccb7f7c89031b7d08) Use different containerd sock address in tests
* Fix HTTPFallback fails when pushing manifest ([#10044](https://github.com/containerd/containerd/pull/10044))
  * [`18f4ad5ee`](https://github.com/containerd/containerd/commit/18f4ad5ee0cb65fa99df752e2ce7d4728b19f9f0) remote: Fix HTTPFallback fails when pushing manifest
* Add support for configuring otel from env and config deprecation notice ([#9992](https://github.com/containerd/containerd/pull/9992))
  * [`600ba8612`](https://github.com/containerd/containerd/commit/600ba86122b0a6c5428429097e3e0f82e9b1f121) vendor: revendor OTEL
  * [`9360e3716`](https://github.com/containerd/containerd/commit/9360e37169f2ba3135f7a6f39a3ab7c9231abbd6) Changes to configuring otel from env only
  * [`f2354894f`](https://github.com/containerd/containerd/commit/f2354894f311b0c9c3651ea239b7cdbc1ee05a18) Deprecate otel configs
* Fix ListPodSandboxStats to skip sandboxes with missing tasks ([#10042](https://github.com/containerd/containerd/pull/10042))
  * [`90c309fe2`](https://github.com/containerd/containerd/commit/90c309fe2f6fac7cc620467edf2eeb8b19211067) Add IsNotFound case to ListPodSandboxStats
</p>
</details>

### Changes from containerd/nri
<details><summary>5 commits</summary>
<p>

* Fix deadlock during NRI plugin registration ([containerd/nri#79](https://github.com/containerd/nri/pull/79))
  * [`c4893c7`](https://github.com/containerd/nri/commit/c4893c7e31c35f1b056b5462cb135a9c15f8b8f4) Fix deadlock during NRI plugin registration
* go.mod: github.com/containerd/ttrpc v1.2.3 ([containerd/nri#71](https://github.com/containerd/nri/pull/71))
  * [`02a1d5e`](https://github.com/containerd/nri/commit/02a1d5e23409a3f14efaadc940cf68d37c562272) go.mod: github.com/containerd/ttrpc v1.2.3
  * [`eb3edc4`](https://github.com/containerd/nri/commit/eb3edc4fc0cec888369d0b1c8a254e0f1e19bd77) examples: go mod tidy
</p>
</details>

### Dependency Changes

* **github.com/containerd/nri**                         v0.6.0 -> v0.6.1
* **tags.cncf.io/container-device-interface**           v0.6.2 -> v0.7.2
* **tags.cncf.io/container-device-interface/specs-go**  v0.6.0 -> v0.7.0

Previous release can be found at [v1.7.15](https://github.com/containerd/containerd/releases/tag/v1.7.15)

containerd 2.0.0-rc.r1

Welcome to the v2.0.0-rc.r1 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

### Highlights

* Enable Transfer service to use registry configuration directory ([#9908](https://github.com/containerd/containerd/pull/9908))
* Configure otel from env instead of config.toml ([#8970](https://github.com/containerd/containerd/pull/8970))
* Disable the support for Schema 1 images ([#9765](https://github.com/containerd/containerd/pull/9765))
* Fix config import relative path glob ([#9746](https://github.com/containerd/containerd/pull/9746))
* Enable NRI by default ([#9744](https://github.com/containerd/containerd/pull/9744))
* Add PluginInfo to introspection API ([#9442](https://github.com/containerd/containerd/pull/9442))
* Remove overlayfs volatile option on temp mounts ([#9555](https://github.com/containerd/containerd/pull/9555))
* Move packages based on contributing guide ([#9365](https://github.com/containerd/containerd/pull/9365))
* Update import and export to allow references to missing content  ([#9554](https://github.com/containerd/containerd/pull/9554))
* Add option to perform syncfs after pull ([#9401](https://github.com/containerd/containerd/pull/9401))
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
* Use Intel ISA-L's igzip if available ([#9200](https://github.com/containerd/containerd/pull/9200))
* Generalize plugin library ([#9214](https://github.com/containerd/containerd/pull/9214))
* Introduce top level config migration ([#9223](https://github.com/containerd/containerd/pull/9223))
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Use github.com/containerd/log ([#9086](https://github.com/containerd/containerd/pull/9086))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](https://github.com/containerd/containerd/pull/8493))
* Add support for image expiration during garbage collection ([#9022](https://github.com/containerd/containerd/pull/9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](https://github.com/containerd/containerd/pull/8792))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Container Runtime Interface (CRI)

* Add support for multiple subscribers to CRI container events ([#9661](https://github.com/containerd/containerd/pull/9661))
* Enable CDI by default ([#9621](https://github.com/containerd/containerd/pull/9621))
* Remove non-sandboxed CRI implementation ([#9228](https://github.com/containerd/containerd/pull/9228))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](https://github.com/containerd/containerd/pull/8287))
* Use sandboxed CRI by default ([#8994](https://github.com/containerd/containerd/pull/8994))
* Implement RuntimeConfig CRI call ([#8722](https://github.com/containerd/containerd/pull/8722))
* Add support for user namespaces (KEP-127) ([#8803](https://github.com/containerd/containerd/pull/8803))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))

#### Runtime

* Support vsock connection to task api ([#9738](https://github.com/containerd/containerd/pull/9738))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Switch runc shim to task service v3 and fix restore ([#9233](https://github.com/containerd/containerd/pull/9233))
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
* Remove the CriuPath field from runc's options ([#8279](https://github.com/containerd/containerd/pull/8279))
* Remove support for config.toml `version = 1` ([#8275](https://github.com/containerd/containerd/pull/8275))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))

#### Security Advisories

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)

#### Breaking

* Disable the support for Schema 1 images ([#9765](https://github.com/containerd/containerd/pull/9765))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Move client to subpackage ([#9316](https://github.com/containerd/containerd/pull/9316))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Deprecations

* Postpone removal of deprecated CRI config properties ([#9966](https://github.com/containerd/containerd/pull/9966))
* Deprecate go-plugin configuration option ([#9238](https://github.com/containerd/containerd/pull/9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](https://github.com/containerd/containerd/pull/8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Wei Fu
* Phil Estes
* Maksym Pavlenko
* Sebastiaan van Stijn
* Samuel Karp
* Kazuyoshi Kato
* Rodrigo Campos
* Danny Canter
* Gabriel Adrian Samfira
* Iceber Gu
* Kirtana Ashok
* Abel Feng
* Austin Vazquez
* Krisztian Litkey
* Akhil Mohan
* Kohei Tokunaga
* Mike Brown
* Jin Dong
* Bjorn Neergaard
* rongfu.leng
* Justin Chadwell
* James Sturtevant
* Paul "TBBle" Hampson
* Davanum Srinivas
* Enrico Weigelt
* Brian Goff
* Paweł Gronowski
* Hsing-Yu (David) Chen
* Ilya Hanov
* Laura Brehm
* Marat Radchenko
* Cardy.Tang
* Henry Wang
* Aditi Sharma
* Bryant Biggs
* Evan Lezar
* Jordan Liggitt
* Kay Yan
* Markus Lehtonen
* Nashwan Azhari
* Shingo Omura
* Vinayak Goyal
* helen
* Alexandru Matei
* Amit Barve
* Charity Kathure
* Ed Bartosh
* Etienne Champetier
* James Jenkins
* Milas Bowman
* Shuaiyi Zhang
* yanggang
* Aditya Ramani
* Amir M. Ghazanfari
* Anthony Nandaa
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Christian Muehlhaeuser
* Cory Snider
* Djordje Lukic
* Edgar Lee
* Ethan Lowman
* Jiang Liu
* June Rhodes
* Mahamed Ali
* Maksim An
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Steve Griffith
* Swagat Bora
* Tony Fang
* VERNOU Cédric
* hang.jiang
* jerryzhuang
* lengrongfu
* roman-kiselenko
* zhanluxianshen
* Aaron Lehmann
* Adrian Reber
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Angelos Kolaitis
* Antonio Huete Jimenez
* Arash Haghighat
* Avi Deitcher
* Ben Foster
* Bin Tang
* Bin Xin
* BinBin He
* Brennan Kinney
* ChengenH
* ChengyuZhu6
* Christian Stewart
* Craig Ingram
* Daisy Rong
* David Porter
* Derek Nola
* Eng Zer Jun
* Fahed Dorgaa
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Jiongchi Yu
* Julien Balestra
* Kern Walster
* Kevin Parsons
* Kirill A. Korinsky
* Konstantin Khlebnikov
* Pan Yibo
* Qasim Sarfraz
* Qiutong Song
* Robbie Buxton
* Robert-André Mauchin
* Shukui Yang
* Talon
* Tianon Gravi
* Tim Hockin
* Tobias Klauser
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Yibo Zhuang
* Yury Gargay
* Zechun Chen
* Zhang Tianyang
* Zoe
* baijia
* charles-chenzz
* chschumacher1994
* guangli.bao
* guangwu
* krglosse
* ningmingxiao
* pigletfly
* rokkiter
* wangxiang
* zhangpeng
* zhaojizhuang
* zounengren
* 吴小白
* 张钰
* 沈陵
* 谭九鼎

### Dependency Changes

* **dario.cat/mergo**                                                              v1.0.0 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Masterminds/semver/v3**                                             v3.2.1 **_new_**
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.2
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.3
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.3.0
* **github.com/checkpoint-restore/checkpointctl**                                  v1.1.0 **_new_**
* **github.com/checkpoint-restore/go-criu/v7**                                     v7.1.0 **_new_**
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/console**                                                v1.0.3 -> v1.0.4
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/errdefs**                                                v0.1.0 **_new_**
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.6.1
* **github.com/containerd/platforms**                                              v0.1.1 **_new_**
* **github.com/containerd/plugin**                                                 v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.3
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.1.1
* **github.com/containernetworking/cni**                                           v1.1.2 -> v1.2.0
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.4.1
* **github.com/distribution/reference**                                            v0.6.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.11.0
* **github.com/felixge/httpsnoop**                                                 v1.0.4 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.1
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.4
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.6.0
* **github.com/gorilla/websocket**                                                 v1.5.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**            v1.0.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/v2**                              v2.0.0-rc.3 **_new_**
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.19.0
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.7.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.8
* **github.com/klauspost/cpuid/v2**                                                v2.0.4 -> v2.2.5
* **github.com/mdlayher/socket**                                                   v0.4.1 **_new_**
* **github.com/mdlayher/vsock**                                                    v1.2.1 **_new_**
* **github.com/minio/sha256-simd**                                                 v1.0.0 -> v1.0.1
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.1
* **github.com/moby/sys/user**                                                     v0.1.0 **_new_**
* **github.com/mxk/go-flowrate**                                                   cca7078d478f **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> v1.2.0
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.2.1 **_new_**
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.19.0
* **github.com/prometheus/client_model**                                           v0.3.0 -> v0.5.0
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.48.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.12.0
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.9.0
* **github.com/urfave/cli/v2**                                                     v2.27.1 **_new_**
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **github.com/xrash/smetrics**                                                    039620a65673 **_new_**
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.9
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.50.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.50.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.25.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.25.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.25.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.25.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.25.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.25.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.25.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.1.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.17.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.23.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.17.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.7.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.19.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.18.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.14.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **google.golang.org/appengine**                                                  v1.6.7 -> v1.6.8
* **google.golang.org/genproto/googleapis/api**                                    6ceb2ff114de **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    c3f982113cda **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.63.2
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.33.0
* **k8s.io/api**                                                                   v0.26.2 -> v0.29.2
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.29.2
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.29.2
* **k8s.io/client-go**                                                             v0.26.2 -> v0.29.2
* **k8s.io/component-base**                                                        v0.26.2 -> v0.29.2
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.30.0-alpha.3
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.120.1
* **k8s.io/kubelet**                                                               v0.29.2 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> 3b25d923346b
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **sigs.k8s.io/structured-merge-diff/v4**                                         v4.2.3 -> v4.4.1
* **tags.cncf.io/container-device-interface**                                      v0.7.2 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.7.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 1.7.15

Welcome to the v1.7.15 release of containerd!

The fifteenth patch release for containerd 1.7 contains various fixes; one for a
regression introduced in v1.7.14 in the way process exits were handled.

### Highlights

* Adds mediatype to OCI index record on export ([#9990](https://github.com/containerd/containerd/pull/9990))

#### Runtime

* Fix runc shim to only defer init process exits ([#10037](https://github.com/containerd/containerd/pull/10037))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Austin Vazquez
* Laura Brehm
* Sebastiaan van Stijn
* Talon

### Changes
<details><summary>12 commits</summary>
<p>

* Prepare for v1.7.15 release ([#10039](https://github.com/containerd/containerd/pull/10039))
  * [`4d4759b54`](https://github.com/containerd/containerd/commit/4d4759b54df2a2ce5abb2aaa117ebc1857406380) Prep v1.7.15 release
* Fix runc shim to only defer init process exits ([#10037](https://github.com/containerd/containerd/pull/10037))
  * [`21df46766`](https://github.com/containerd/containerd/commit/21df4676621559e46b46810de3c900d105f10210) runc-shim: only defer init process exits
* Fix compile from version control system (source) use case ([#10012](https://github.com/containerd/containerd/pull/10012))
  * [`2a054213e`](https://github.com/containerd/containerd/commit/2a054213e7d167d697a27bbe8409872c67e8df46) Fix compile from version control system (source) use case
* Adds mediatype to OCI index record on export ([#9990](https://github.com/containerd/containerd/pull/9990))
  * [`6605c47a4`](https://github.com/containerd/containerd/commit/6605c47a4156171580458fa035133f2739046822) adds mediatype to oci index record
* vendor: google.golang.org/protobuf 1.33.0, github.com/golang/protobuf v1.5.4 ([#9975](https://github.com/containerd/containerd/pull/9975))
  * [`e6d91d843`](https://github.com/containerd/containerd/commit/e6d91d843fcc26c04e0d33144211aef965f79295) vendor: github.com/golang/protobuf v1.5.4
  * [`2d136c5f5`](https://github.com/containerd/containerd/commit/2d136c5f5eb7092b458a07e14c53ccb7e5f429f0) build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0
  * [`a1a7af7a3`](https://github.com/containerd/containerd/commit/a1a7af7a39da32ea0e38bb8ddd5b219c9cf6848e) build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0
</p>
</details>

### Dependency Changes

* **github.com/golang/protobuf**  v1.5.3 -> v1.5.4
* **google.golang.org/protobuf**  v1.31.0 -> v1.33.0

Previous release can be found at [v1.7.14](https://github.com/containerd/containerd/releases/tag/v1.7.14)

containerd 1.6.31

Welcome to the v1.6.31 release of containerd!

The thirty-first patch release for containerd 1.6 contains a few fixes, one for
a regression that was introduced in v1.6.30 in the way process exits were handled.

### Highlights

* Adds mediatype to OCI index record on export ([#9991](https://github.com/containerd/containerd/pull/9991))

#### Runtime

* Fix runc shim to only defer init process exits ([#10038](https://github.com/containerd/containerd/pull/10038))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Phil Estes
* Akihiro Suda
* Austin Vazquez
* Laura Brehm
* Maksym Pavlenko
* Sebastiaan van Stijn
* Talon

### Changes
<details><summary>14 commits</summary>
<p>

* Prepare for v1.6.31 release ([#10040](https://github.com/containerd/containerd/pull/10040))
  * [`7f7012bad`](https://github.com/containerd/containerd/commit/7f7012bad7af5275d84ba63b6ba93a4882cd94cd) Prepare for v1.6.31 release
* Fix runc shim to only defer init process exits ([#10038](https://github.com/containerd/containerd/pull/10038))
  * [`5e53da4a1`](https://github.com/containerd/containerd/commit/5e53da4a1403e80339e3d2897dd41cce3842b335) runc-shim: only defer init process exits
* Fix compile from version control system (source) use case ([#10011](https://github.com/containerd/containerd/pull/10011))
  * [`7592f87f0`](https://github.com/containerd/containerd/commit/7592f87f040128b44e1aafef33b0b33c65334209) Fix compile from version control system (source) use case
* Adds mediatype to OCI index record on export ([#9991](https://github.com/containerd/containerd/pull/9991))
  * [`8d415fd0e`](https://github.com/containerd/containerd/commit/8d415fd0ee2d88ae4c53d75acf0707ec9151ea0f) adds mediatype to oci index record
* vendor: google.golang.org/protobuf 1.33.0, github.com/golang/protobuf v1.5.4 ([#9974](https://github.com/containerd/containerd/pull/9974))
  * [`2dbb59b5a`](https://github.com/containerd/containerd/commit/2dbb59b5af8b373085c2dcb272a78d586eeb6bfc) vendor: github.com/golang/protobuf v1.5.4
  * [`069bb78c9`](https://github.com/containerd/containerd/commit/069bb78c9ecc7ac7cab650a3029e745471e2a899) build(deps): bump google.golang.org/protobuf from 1.32.0 to 1.33.0
  * [`68d395cad`](https://github.com/containerd/containerd/commit/68d395cad899fcba32d9c5dcc20b2afe375c7682) build(deps): bump google.golang.org/protobuf from 1.31.0 to 1.32.0
* Backport test release on PR ([#9955](https://github.com/containerd/containerd/pull/9955))
  * [`b3713136d`](https://github.com/containerd/containerd/commit/b3713136d1fccacd55dbcd507739f2b788b29554) CI: test release.yml on every PR
</p>
</details>

### Dependency Changes

* **github.com/golang/protobuf**  v1.5.3 -> v1.5.4
* **google.golang.org/protobuf**  v1.31.0 -> v1.33.0

Previous release can be found at [v1.6.30](https://github.com/containerd/containerd/releases/tag/v1.6.30)

containerd 2.0.0-rc.0

Welcome to the v2.0.0-rc.0 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

### Highlights

* Configure otel from env instead of config.toml ([#8970](https://github.com/containerd/containerd/pull/8970))
* Disable the support for Schema 1 images ([#9765](https://github.com/containerd/containerd/pull/9765))
* Fix config import relative path glob ([#9746](https://github.com/containerd/containerd/pull/9746))
* Enable NRI by default ([#9744](https://github.com/containerd/containerd/pull/9744))
* Add PluginInfo to introspection API ([#9442](https://github.com/containerd/containerd/pull/9442))
* Remove overlayfs volatile option on temp mounts ([#9555](https://github.com/containerd/containerd/pull/9555))
* Move packages based on contributing guide ([#9365](https://github.com/containerd/containerd/pull/9365))
* Update import and export to allow references to missing content  ([#9554](https://github.com/containerd/containerd/pull/9554))
* Add option to perform syncfs after pull ([#9401](https://github.com/containerd/containerd/pull/9401))
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
* Use Intel ISA-L's igzip if available ([#9200](https://github.com/containerd/containerd/pull/9200))
* Generalize plugin library ([#9214](https://github.com/containerd/containerd/pull/9214))
* Introduce top level config migration ([#9223](https://github.com/containerd/containerd/pull/9223))
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Use github.com/containerd/log ([#9086](https://github.com/containerd/containerd/pull/9086))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](https://github.com/containerd/containerd/pull/8493))
* Add support for image expiration during garbage collection ([#9022](https://github.com/containerd/containerd/pull/9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](https://github.com/containerd/containerd/pull/8792))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Container Runtime Interface (CRI)

* Add support for multiple subscribers to CRI container events ([#9661](https://github.com/containerd/containerd/pull/9661))
* Enable CDI by default ([#9621](https://github.com/containerd/containerd/pull/9621))
* Remove non-sandboxed CRI implementation ([#9228](https://github.com/containerd/containerd/pull/9228))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](https://github.com/containerd/containerd/pull/8287))
* Use sandboxed CRI by default ([#8994](https://github.com/containerd/containerd/pull/8994))
* Implement RuntimeConfig CRI call ([#8722](https://github.com/containerd/containerd/pull/8722))
* Add support for user namespaces (KEP-127) ([#8803](https://github.com/containerd/containerd/pull/8803))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))

#### Runtime

* Support vsock connection to task api ([#9738](https://github.com/containerd/containerd/pull/9738))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Switch runc shim to task service v3 and fix restore ([#9233](https://github.com/containerd/containerd/pull/9233))
* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
* Remove the CriuPath field from runc's options ([#8279](https://github.com/containerd/containerd/pull/8279))
* Remove support for config.toml `version = 1` ([#8275](https://github.com/containerd/containerd/pull/8275))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))

#### Security Advisories

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)

#### Breaking

* Disable the support for Schema 1 images ([#9765](https://github.com/containerd/containerd/pull/9765))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Move client to subpackage ([#9316](https://github.com/containerd/containerd/pull/9316))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Deprecations

* Deprecate go-plugin configuration option ([#9238](https://github.com/containerd/containerd/pull/9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](https://github.com/containerd/containerd/pull/8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Wei Fu
* Phil Estes
* Maksym Pavlenko
* Sebastiaan van Stijn
* Samuel Karp
* Kazuyoshi Kato
* Rodrigo Campos
* Danny Canter
* Gabriel Adrian Samfira
* Iceber Gu
* Abel Feng
* Kirtana Ashok
* Austin Vazquez
* Krisztian Litkey
* Akhil Mohan
* Jin Dong
* Mike Brown
* Bjorn Neergaard
* Kohei Tokunaga
* rongfu.leng
* Justin Chadwell
* James Sturtevant
* Paul "TBBle" Hampson
* Davanum Srinivas
* Enrico Weigelt
* Paweł Gronowski
* Brian Goff
* Hsing-Yu (David) Chen
* Ilya Hanov
* Marat Radchenko
* Cardy.Tang
* Henry Wang
* Laura Brehm
* Aditi Sharma
* Bryant Biggs
* Jordan Liggitt
* Kay Yan
* Markus Lehtonen
* Nashwan Azhari
* Shingo Omura
* Vinayak Goyal
* helen
* Alexandru Matei
* Amit Barve
* Charity Kathure
* Ed Bartosh
* Etienne Champetier
* Evan Lezar
* James Jenkins
* Milas Bowman
* yanggang
* Aditya Ramani
* Amir M. Ghazanfari
* Anthony Nandaa
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Christian Muehlhaeuser
* Cory Snider
* Djordje Lukic
* Ethan Lowman
* Jiang Liu
* June Rhodes
* Mahamed Ali
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Shuaiyi Zhang
* Steve Griffith
* Tony Fang
* VERNOU Cédric
* hang.jiang
* jerryzhuang
* lengrongfu
* roman-kiselenko
* Aaron Lehmann
* Adrian Reber
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Angelos Kolaitis
* Antonio Huete Jimenez
* Avi Deitcher
* Ben Foster
* Bin Xin
* BinBin He
* Brennan Kinney
* Christian Stewart
* Craig Ingram
* Daisy Rong
* Derek Nola
* Edgar Lee
* Eng Zer Jun
* Fahed Dorgaa
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Jiongchi Yu
* Julien Balestra
* Kern Walster
* Kevin Parsons
* Kirill A. Korinsky
* Konstantin Khlebnikov
* Maksim An
* Pan Yibo
* Qasim Sarfraz
* Qiutong Song
* Robbie Buxton
* Robert-André Mauchin
* Shukui Yang
* Talon
* Tianon Gravi
* Tim Hockin
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Yibo Zhuang
* Yury Gargay
* Zechun Chen
* Zhang Tianyang
* Zoe
* charles-chenzz
* chschumacher1994
* guangli.bao
* krglosse
* ningmingxiao
* pigletfly
* rokkiter
* wangxiang
* zhangpeng
* zhanluxianshen
* zhaojizhuang
* zounengren
* 吴小白
* 张钰
* 沈陵
* 谭九鼎

### Dependency Changes

* **dario.cat/mergo**                                                              v1.0.0 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.1
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.0
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.2.1
* **github.com/checkpoint-restore/checkpointctl**                                  v1.1.0 **_new_**
* **github.com/checkpoint-restore/go-criu/v7**                                     v7.0.0 **_new_**
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/console**                                                v1.0.3 -> v1.0.4
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/errdefs**                                                v0.1.0 **_new_**
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.6.0
* **github.com/containerd/platforms**                                              v0.1.1 **_new_**
* **github.com/containerd/plugin**                                                 v0.1.0 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.3
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.1.1
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.4.0
* **github.com/distribution/reference**                                            v0.5.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.11.0
* **github.com/felixge/httpsnoop**                                                 v1.0.4 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.1
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.4
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.6.0
* **github.com/gorilla/websocket**                                                 v1.5.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus**            v1.0.0 **_new_**
* **github.com/grpc-ecosystem/go-grpc-middleware/v2**                              v2.0.0-rc.3 **_new_**
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.19.0
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.6.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.7
* **github.com/klauspost/cpuid/v2**                                                v2.0.4 -> v2.2.5
* **github.com/mdlayher/socket**                                                   v0.4.1 **_new_**
* **github.com/mdlayher/vsock**                                                    v1.2.1 **_new_**
* **github.com/minio/sha256-simd**                                                 v1.0.0 -> v1.0.1
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.1
* **github.com/moby/sys/user**                                                     v0.1.0 **_new_**
* **github.com/mxk/go-flowrate**                                                   cca7078d478f **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> v1.2.0
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.1.1 **_new_**
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.19.0
* **github.com/prometheus/client_model**                                           v0.3.0 -> v0.5.0
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.48.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.12.0
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.9.0
* **github.com/urfave/cli/v2**                                                     v2.27.1 **_new_**
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **github.com/xrash/smetrics**                                                    039620a65673 **_new_**
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.9
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.49.0
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.49.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.24.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.24.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.24.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.24.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.24.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.24.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.24.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.1.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.16.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.21.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.16.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.6.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.18.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.17.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.14.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **golang.org/x/tools**                                                           v0.5.0 -> v0.16.1
* **google.golang.org/appengine**                                                  v1.6.7 -> v1.6.8
* **google.golang.org/genproto/googleapis/api**                                    ef4313101c80 **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    ef4313101c80 **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.62.1
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.33.0
* **k8s.io/api**                                                                   v0.26.2 -> v0.29.2
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.29.2
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.29.2
* **k8s.io/client-go**                                                             v0.26.2 -> v0.29.2
* **k8s.io/component-base**                                                        v0.26.2 -> v0.29.2
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.30.0-alpha.3
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.120.1
* **k8s.io/kubelet**                                                               v0.29.2 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> 3b25d923346b
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **sigs.k8s.io/structured-merge-diff/v4**                                         v4.2.3 -> v4.4.1
* **tags.cncf.io/container-device-interface**                                      v0.6.2 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.6.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 1.7.14

Welcome to the v1.7.14 release of containerd!

The fourteenth patch release for containerd 1.7 contains various fixes and updates.

### Highlights

* Update builds to use go 1.21.8 ([#9933](https://github.com/containerd/containerd/pull/9933))
* Fix various timing issues with docker pusher ([#9921](https://github.com/containerd/containerd/pull/9921))
* Register imagePullThroughput and count with MiB ([#9855](https://github.com/containerd/containerd/pull/9855))
* Move high volume event logs to Trace level ([#9823](https://github.com/containerd/containerd/pull/9823))

#### Container Runtime Interface (CRI)

* Handle pod transition states gracefully while listing pod stats ([#9905](https://github.com/containerd/containerd/pull/9905))

#### Runtime

* Update runc-shim to process exec exits before init ([#9928](https://github.com/containerd/containerd/pull/9928))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Wei Fu
* Derek McGowan
* Maksym Pavlenko
* Krisztian Litkey
* Akihiro Suda
* Justin Chadwell
* Sebastiaan van Stijn
* Phil Estes
* Kirtana Ashok
* Akhil Mohan
* Austin Vazquez
* Etienne Champetier
* Jordan Liggitt
* Kohei Tokunaga
* Mike Brown
* Samuel Karp
* Davanum Srinivas
* Edgar Lee
* Henry Wang
* James Sturtevant
* Laura Brehm
* Nashwan Azhari
* Robbie Buxton
* Robert-André Mauchin
* Shukui Yang

### Changes
<details><summary>70 commits</summary>
<p>

* Prepare release notes for v1.7.14 ([#9953](https://github.com/containerd/containerd/pull/9953))
  * [`1babe6b58`](https://github.com/containerd/containerd/commit/1babe6b582911fe90b93fc01491f2f4b130b7a3a) Prepare release notes for v1.7.14
* Backport use Go toolchain in CI matrix to build binaries ([#9951](https://github.com/containerd/containerd/pull/9951))
  * [`a9bbbefcf`](https://github.com/containerd/containerd/commit/a9bbbefcf2feba3eaf1da39b70ed28032a7d8a65) Use the Go toolchain in CI matrix to build binaries
* Update builds to use go 1.21.8 ([#9933](https://github.com/containerd/containerd/pull/9933))
  * [`1ca9a643a`](https://github.com/containerd/containerd/commit/1ca9a643a1ad206f074300e235c959213854fff1) update to go 1.21.8, 1.22.1
* Move inline PS scripts into files ([#9938](https://github.com/containerd/containerd/pull/9938))
  * [`39caf532e`](https://github.com/containerd/containerd/commit/39caf532e7f60ff21050221fda627bab02de2ce8) Move inline PS scripts into files
* Disable OOM set score unpriv test temporarily ([#9944](https://github.com/containerd/containerd/pull/9944))
  * [`630226bb4`](https://github.com/containerd/containerd/commit/630226bb431ec98dbfca279c3416abf5047d9858) Disable OOM set score unpriv test temporarily
* Update runc-shim to process exec exits before init ([#9928](https://github.com/containerd/containerd/pull/9928))
  * [`de7b6bae9`](https://github.com/containerd/containerd/commit/de7b6bae9e2e44676ae63a13ab130812a6db56b6) runc-shim: process exec exits before init
* update to go 1.21.6, test 1.22.0 ([#9860](https://github.com/containerd/containerd/pull/9860))
  * [`3b3e537ea`](https://github.com/containerd/containerd/commit/3b3e537eab7f81e32f34c95833caa2af9bc8753f) Uninstall mingw before attempting upgrade
  * [`9e24388b2`](https://github.com/containerd/containerd/commit/9e24388b209e519d7cc3805b3266b9a4a82e59cc) CI: Explicitly upgrade MinGW on Windows 2019 GitHub runners.
  * [`5b23a4127`](https://github.com/containerd/containerd/commit/5b23a412759f27465906f86196c686cd0925be15) seccomp, apparmor: add go:noinline
  * [`753422ac1`](https://github.com/containerd/containerd/commit/753422ac11e3485b14a62bfdfcc75a0001f3dd70) Drop go 1.20 and build against 1.22
  * [`a2d64218c`](https://github.com/containerd/containerd/commit/a2d64218c5a5abc676556925d63b222dbd606469) Fix windows integration tests
  * [`6379dd6f4`](https://github.com/containerd/containerd/commit/6379dd6f428fc3f55cb4625d7741b84751d42278) Update workflow files to install Go via composite action
  * [`a5c0d061c`](https://github.com/containerd/containerd/commit/a5c0d061cd3a4154f31fd5a5c8a4f77da5da1dcd) Extract a composite action to install Go
* Fix various timing issues with docker pusher ([#9921](https://github.com/containerd/containerd/pull/9921))
  * [`52a1402df`](https://github.com/containerd/containerd/commit/52a1402df64ca286b5084b1b150c4219343ad6d7) copy: prevent potential deadlock if close before fully written
  * [`872746386`](https://github.com/containerd/containerd/commit/872746386237b1076f8449a7f7d3d5a07ed30a42) copy: setError should imply Close
  * [`a8004007a`](https://github.com/containerd/containerd/commit/a8004007a2ababa6ac7dbf508edf1c49faf06110) copy: remove max number of ErrResets
  * [`0465472ed`](https://github.com/containerd/containerd/commit/0465472ed3807b6dcf785d160783019e3fed5cf6) pushWriter: refactor reset pipe logic into separate function
  * [`2577207cc`](https://github.com/containerd/containerd/commit/2577207cc0611f36e582111f88f16fd5ae777068) copy: improve error detection from closed pipes
  * [`d081da86b`](https://github.com/containerd/containerd/commit/d081da86bfc3b1b65efacdefba0e48aadaac4d91) copy: check if writer was closed before setting a pipe
  * [`2a25c085b`](https://github.com/containerd/containerd/commit/2a25c085b21e074667bf6ded0dbb6ebf892a889c) copy: remove wrapping io.NopCloser from push writer pipe
* Register imagePullThroughput and count with MiB ([#9855](https://github.com/containerd/containerd/pull/9855))
  * [`711cebd48`](https://github.com/containerd/containerd/commit/711cebd484d44da363ca451cdaaad0c6ec9810d2) Register imagePullThroughput and count with MiB
* Update golangci-lint to v1.56.1 ([#9900](https://github.com/containerd/containerd/pull/9900))
  * [`926ceb036`](https://github.com/containerd/containerd/commit/926ceb036223d8ac05cd918c7a4c0825bb9c0640) fix golangci-lint errors
  * [`4030ae235`](https://github.com/containerd/containerd/commit/4030ae2350fee10557fe52a5b8f86761afb01a1d) Update golangci-lint to v1.56.1
  * [`6620d6bfd`](https://github.com/containerd/containerd/commit/6620d6bfd7c5e6e8ffc0c6047c3602ac0ab05a16) ci: bump up golangci-lint to v1.55.2
  * [`b16ca72b2`](https://github.com/containerd/containerd/commit/b16ca72b2e1e105e475537a450f0c6509e95ca32) Bump up golangci-lint to v1.54.2
* Handle pod transition states gracefully while listing pod stats ([#9905](https://github.com/containerd/containerd/pull/9905))
  * [`39db3f18b`](https://github.com/containerd/containerd/commit/39db3f18b29ab9efb671404a1030628af560c614) adjust test cases to run for windows
  * [`579d8b463`](https://github.com/containerd/containerd/commit/579d8b463bd9cdcdc4425ac7279033056c1d0433) [cri] Handle Windows pod transitions gracefully
* Backport GitHub actions package updates ([#9876](https://github.com/containerd/containerd/pull/9876))
  * [`8d6f0f2ae`](https://github.com/containerd/containerd/commit/8d6f0f2aecd6962163fbaac6f6d2bbb6e12e9c85) build(deps): bump golangci/golangci-lint-action from 3 to 4
  * [`7929592b9`](https://github.com/containerd/containerd/commit/7929592b96e2e4e2e0150a890048f612b623fb7d) build(deps): bump actions/upload-artifact from 3 to 4
  * [`e11de777d`](https://github.com/containerd/containerd/commit/e11de777dcfdf5914b102830d66e6fbed6ceea7d) build(deps): bump crazy-max/ghaction-github-runtime from 2 to 3
  * [`2b40a4074`](https://github.com/containerd/containerd/commit/2b40a40741dfa865683f25d76ac4e03457449ecc) build(deps): bump actions/checkout from 3 to 4
  * [`22feefa57`](https://github.com/containerd/containerd/commit/22feefa570111de80812a493685fb767c3a6c6b4) build(deps): bump actions/setup-go from 3 to 5
  * [`b96aa4012`](https://github.com/containerd/containerd/commit/b96aa4012d4a491869f26f570f9dfbbf1835eb70) build(deps): bump actions/upload-artifact from 1 to 3
  * [`97763f91d`](https://github.com/containerd/containerd/commit/97763f91d6e8013d5c1e2c5ad7214cd956808742) build(deps): bump docker/setup-buildx-action from 2 to 3
  * [`6875bb14f`](https://github.com/containerd/containerd/commit/6875bb14f1841de6d89c689a2e393697c1e6c89c) build(deps): bump github/codeql-action from 2 to 3
  * [`87f9adb6b`](https://github.com/containerd/containerd/commit/87f9adb6b9ed2bd9a0b72879c5a9bc5eb1b51586) build(deps): bump actions/download-artifact from 3 to 4
* .github: windows should use fix critool version ([#9874](https://github.com/containerd/containerd/pull/9874))
  * [`d9c099a9a`](https://github.com/containerd/containerd/commit/d9c099a9ac39956aee0a720be8b3b6af8861351b) .github: windows should use fix critool version
* ci: update crun version to 1.14.3 ([#9850](https://github.com/containerd/containerd/pull/9850))
  * [`dc594b01d`](https://github.com/containerd/containerd/commit/dc594b01d28d3a6a896b66274fb75b1f54aecaa3) ci: update crun version to 1.14.3
* Add WithMetaStore to overlay snapshotter and missing unpacker.Wait for image import ([#9837](https://github.com/containerd/containerd/pull/9837))
  * [`8fe0b26f1`](https://github.com/containerd/containerd/commit/8fe0b26f198163fb88a6bd194382c502d5756fb1) Add missing unpacker.Wait for image import
  * [`31ea2d7d9`](https://github.com/containerd/containerd/commit/31ea2d7d9114fee156f37dc9e6f38538aca58447) Add WithMetaStore to overlay snapshotter to allow bringing your own
* Move high volume event logs to Trace level ([#9823](https://github.com/containerd/containerd/pull/9823))
  * [`982e0cffb`](https://github.com/containerd/containerd/commit/982e0cffbeb31768655ba1ed89620e27551fc49f) Move high volume event logs to Trace level
* cri: propagate deprecation list to runtime status ([#9818](https://github.com/containerd/containerd/pull/9818))
  * [`c79ffa277`](https://github.com/containerd/containerd/commit/c79ffa2773d29e81f7a905fc1242301c5ee7e556) cri: propagate deprecation list to runtime status
* ctr: print deprecation warnings on every invocation ([#9820](https://github.com/containerd/containerd/pull/9820))
  * [`eaebe23de`](https://github.com/containerd/containerd/commit/eaebe23de407600ff81b9466165294eacc3575f5) ctr: print deprecation warnings on every invocation
* bug fix: make sure cri image is pinned when it is pulled outside cri ([#9784](https://github.com/containerd/containerd/pull/9784))
  * [`26c057423`](https://github.com/containerd/containerd/commit/26c057423c614deb0c510ceea84ed22bbe4f7f1d) bug fix: make sure cri image is pinned when it is pulled outside cri
* go.{mod,sum}: update NRI dependency, fixing a potential fd double close error. ([#9783](https://github.com/containerd/containerd/pull/9783))
  * [`d3e997556`](https://github.com/containerd/containerd/commit/d3e9975563f4dd2182526188f6c2331a192a07d5) go.{mod,sum}: update NRI dependency, re-vendor.
* Add option to perform syncfs after pull ([#9769](https://github.com/containerd/containerd/pull/9769))
  * [`ea0a92ec3`](https://github.com/containerd/containerd/commit/ea0a92ec30c9e61bd45b777a27ee4849b1716522) *: introduce image_pull_with_sync_fs in CRI
  * [`4caf44032`](https://github.com/containerd/containerd/commit/4caf44032b61ecef0c2e38eb38395a3969377296) api: introduce sync_fs to diff.ApplyRequest
* Move certain debug logs to trace logs ([#9761](https://github.com/containerd/containerd/pull/9761))
  * [`3f75af7bf`](https://github.com/containerd/containerd/commit/3f75af7bf20fc6d1456e282e31c51d32d086b9ec) Move certain debug logs to trace logs
</p>
</details>

### Changes from containerd/nri
<details><summary>23 commits</summary>
<p>

* socketpair_windows: remove implementation for now ([containerd/nri#69](https://github.com/containerd/nri/pull/69))
  * [`e47f09b`](https://github.com/containerd/nri/commit/e47f09b2abe155cf5c0caaf7d0df7651447d2660) socketpair_windows: remove implementation for now
* adaptation, stub: allow extra ttrpc client and server options. ([containerd/nri#67](https://github.com/containerd/nri/pull/67))
  * [`45b9e3f`](https://github.com/containerd/nri/commit/45b9e3f1437fff2bb9bc26d89da34ee1b298cc86) plugins: update dependencies.
  * [`f600cf6`](https://github.com/containerd/nri/commit/f600cf681e94c8f8b65dead5e57fe0981571bea9) go.{mod,sum}: update dependencies.
  * [`13ee978`](https://github.com/containerd/nri/commit/13ee97879885d8fe4c0dbbf5c0a04716a8654247) pkg/stub: add support for extra ttrpc options.
  * [`c4e2f81`](https://github.com/containerd/nri/commit/c4e2f81f94b35bee5b9d35c80f28490b6f3ebb76) pkg/adaptation: add support for extra ttrpc options.
* socketpair_unix: avoid double close(), set FD_CLOEXEC ([containerd/nri#66](https://github.com/containerd/nri/pull/66))
  * [`5d0b52b`](https://github.com/containerd/nri/commit/5d0b52bc45c998c5fcb1a60a7289f86d9c92f836) sockerpair_unix: avoid double close(), set FD_CLOEXEC
* Task: fix typo in godoc ([containerd/nri#61](https://github.com/containerd/nri/pull/61))
  * [`ae7840b`](https://github.com/containerd/nri/commit/ae7840bf9910649194e1a556b8cc7a66bc19d817) Task: fix typo in godoc
* Take pkg/hooks from github.com/containers/common (carry 46) ([containerd/nri#55](https://github.com/containerd/nri/pull/55))
  * [`b4ac58c`](https://github.com/containerd/nri/commit/b4ac58c1a5b0cffa51448ed060095dd5dc6f4b54) Take pkg/hooks from github.com/containers/common
* gha: remove GOPATH and workingdir, update actions/setup-go@v4, actions/checkout@v4 ([containerd/nri#53](https://github.com/containerd/nri/pull/53))
  * [`ee96969`](https://github.com/containerd/nri/commit/ee969691b8e4bdc2b7c3e384b22c203fcf948ab7) gha: update actions/checkout@v4
  * [`7b33fbf`](https://github.com/containerd/nri/commit/7b33fbf7685a7c0d27d186f89f6027373e54e3f0) gha: update actions/setup-go@v4
  * [`e33ac3e`](https://github.com/containerd/nri/commit/e33ac3e43394ead24dbb4a407dd76c00c5780737) gha: remove working-dir and GOPATH
* remove containerd as dependency ([containerd/nri#51](https://github.com/containerd/nri/pull/51))
  * [`da8a7e5`](https://github.com/containerd/nri/commit/da8a7e53614c60c106f824caf3d120ea582a0cbe) remove containerd as dependency
* make plugins/ulimit-adjuster a separate module ([containerd/nri#54](https://github.com/containerd/nri/pull/54))
  * [`934815e`](https://github.com/containerd/nri/commit/934815e56ede6d603d1b17cbce86ad98a973eaf1) make plugins/ulimit-adjuster a separate module
* scripts: fix protobuf URL on arm64 ([containerd/nri#52](https://github.com/containerd/nri/pull/52))
  * [`9b43daa`](https://github.com/containerd/nri/commit/9b43daaeceae6750053c5693a15edc59819886b9) scripts: fix protobuf URL on arm64
</p>
</details>

### Changes from containerd/ttrpc
<details><summary>21 commits</summary>
<p>

* Fix streaming with empty payloads ([containerd/ttrpc#157](https://github.com/containerd/ttrpc/pull/157))
  * [`44ca009`](https://github.com/containerd/ttrpc/commit/44ca0096e1b2b638ead24b4898cc34aa3b603926) Add comment
  * [`6615f15`](https://github.com/containerd/ttrpc/commit/6615f159bad5b522b7322408fcf5ae8bb58b0843) Fix linter
  * [`dea99e9`](https://github.com/containerd/ttrpc/commit/dea99e9d052d7b86500e6e3f9e6a214d2111d1a9) Fix handling of empty payloads
  * [`336fc1b`](https://github.com/containerd/ttrpc/commit/336fc1b6b472ea8df89cd109b7e8dfb99fe8828e) Add integration test to reproduce issue with empty payloads
* Bump google.golang.org/grpc from 1.57.0 to 1.57.1 ([containerd/ttrpc#156](https://github.com/containerd/ttrpc/pull/156))
  * [`1e51c46`](https://github.com/containerd/ttrpc/commit/1e51c4681df2ab54ad15226a125228ac7639d2e0) Bump google.golang.org/grpc from 1.57.0 to 1.57.1
* Bump golang.org/x/net from 0.10.0 to 0.17.0 ([containerd/ttrpc#155](https://github.com/containerd/ttrpc/pull/155))
  * [`bea960d`](https://github.com/containerd/ttrpc/commit/bea960d9fea8eb25d11ff5e024c734e46a9a6c3e) Bump golang.org/x/net from 0.10.0 to 0.17.0
* Implement support for unary interceptor chaining. ([containerd/ttrpc#152](https://github.com/containerd/ttrpc/pull/152))
  * [`40f227d`](https://github.com/containerd/ttrpc/commit/40f227ddbb9e05bf4d04179991f809df0546c6f6) server: implement UnaryServerInterceptor chaining.
  * [`f984c9b`](https://github.com/containerd/ttrpc/commit/f984c9b178e595292d4a6934ce229c9854c2fe77) client: implement UnaryClientInterceptor chaining.
* Fix grammar in comment for UserOnCloseWait. ([containerd/ttrpc#153](https://github.com/containerd/ttrpc/pull/153))
  * [`8ca4110`](https://github.com/containerd/ttrpc/commit/8ca4110ebc91819c5b0e2f17c9ded818b2462c50) Fix comment for UserOnCloseWait.
* Bump genproto dependency ([containerd/ttrpc#154](https://github.com/containerd/ttrpc/pull/154))
  * [`a2fbc14`](https://github.com/containerd/ttrpc/commit/a2fbc14815b5a707579072aa0edaa59bdaf762f9) go.mod: google.golang.org/genproto/googleapis/rpc v0.0.0-20230731190214-cbb8c96f2d6d
  * [`cf2b85d`](https://github.com/containerd/ttrpc/commit/cf2b85de12df0368cf0c6a24446b25c079caf0f5) go.mod: bump to supported go version
* server_test: wait for OnClose in TestClientEOF. ([containerd/ttrpc#150](https://github.com/containerd/ttrpc/pull/150))
  * [`e0cd801`](https://github.com/containerd/ttrpc/commit/e0cd8011167557f2ddb1b976e604cfd94d8b393d) server_test: wait for OnClose in TestClientEOF.
* .github: give more slack for build+tests. ([containerd/ttrpc#151](https://github.com/containerd/ttrpc/pull/151))
  * [`8d47846`](https://github.com/containerd/ttrpc/commit/8d4784675e72e1880aa5bb9c817875891e670d41) .github: give more slack for build+tests.
</p>
</details>

### Dependency Changes

* **github.com/containerd/nri**                  v0.4.0 -> v0.6.0
* **github.com/containerd/ttrpc**                v1.2.2 -> v1.2.3
* **google.golang.org/genproto/googleapis/rpc**  782d3b101e98 -> cbb8c96f2d6d

Previous release can be found at [v1.7.13](https://github.com/containerd/containerd/releases/tag/v1.7.13)

containerd 1.6.30

Welcome to the v1.6.30 release of containerd!

The thirtieth patch release for containerd 1.6 contains various fixes and updates
as well as a build fix which prevented the v1.6.29 tag from being released.

### Highlights

* Update builds to go 1.21.8 ([#9945](https://github.com/containerd/containerd/pull/9945))
* Fix config import relative path glob ([#9835](https://github.com/containerd/containerd/pull/9835))
* Move high volume event logs to Trace level ([#9824](https://github.com/containerd/containerd/pull/9824))
* Move certain debug logs to trace logs ([#9762](https://github.com/containerd/containerd/pull/9762))

#### Container Runtime Interface (CRI)

* Add timeout to drain exec io ([#9768](https://github.com/containerd/containerd/pull/9768))
* Propagate deprecation list to runtime status ([#9819](https://github.com/containerd/containerd/pull/9819))
* Fix image pinning when image is not pulled through cri ([#9785](https://github.com/containerd/containerd/pull/9785))

#### Runtime

* Update runc-shim to process exec exits before init ([#9927](https://github.com/containerd/containerd/pull/9927))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Akihiro Suda
* Derek McGowan
* Wei Fu
* Maksym Pavlenko
* Phil Estes
* Kirtana Ashok
* Mike Brown
* Akhil Mohan
* Angelos Kolaitis
* Austin Vazquez
* Henry Wang
* Laura Brehm
* Nashwan Azhari
* Sebastiaan van Stijn
* Tony Fang

### Changes
<details><summary>59 commits</summary>
<p>

* Prepare v1.6.30 ([#9952](https://github.com/containerd/containerd/pull/9952))
  * [`8268fc6e9`](https://github.com/containerd/containerd/commit/8268fc6e90f2305410609abf34559ec2f5966c78) Prepare release notes for v1.6.30
  * [`614ca2e12`](https://github.com/containerd/containerd/commit/614ca2e12193ae80afc11beb5a55fc2ae05c8915) Revert go version environment removal
* Prepare release notes for v1.6.29 ([#9950](https://github.com/containerd/containerd/pull/9950))
  * [`9ef6d9d03`](https://github.com/containerd/containerd/commit/9ef6d9d03d8d4124d4e8e28399fef28c137fcc2e) Add release notes for v1.6.29.toml
* use a composite action to install Go ([#9949](https://github.com/containerd/containerd/pull/9949))
  * [`cfbbb510c`](https://github.com/containerd/containerd/commit/cfbbb510c23672daf7711a9afd548801dd741c4a) Use the Go toolchain in CI matrix to build binaries
  * [`f015dbc5a`](https://github.com/containerd/containerd/commit/f015dbc5a3d1f5a6eaefc561130ee5bb05e0d6c5) use composite action in ci workflow
* Update builds to go 1.21.8 ([#9945](https://github.com/containerd/containerd/pull/9945))
  * [`ccf3eb6a2`](https://github.com/containerd/containerd/commit/ccf3eb6a2de426c9cfbb9409c330df79d3dbba0c) update to go 1.21.8, 1.22.1
* Backport easy go install and update go ([#9890](https://github.com/containerd/containerd/pull/9890))
  * [`f6475ea59`](https://github.com/containerd/containerd/commit/f6475ea597b713a27e0b31e5723f3cd315b39eeb) Drop go 1.20 and build against 1.22
  * [`7c45ad092`](https://github.com/containerd/containerd/commit/7c45ad0923f0ea267cb9b66a65dea6fff4e0ff0b) Extract a composite action to install Go
  * [`4f7305414`](https://github.com/containerd/containerd/commit/4f73054149a36ba97263af8ee72e302c7a226906) update to go1.21.6, go1.20.13
  * [`da5a36c37`](https://github.com/containerd/containerd/commit/da5a36c3700ac1142c2451137a362d4c92d1897d) Use testify
  * [`afe6efee3`](https://github.com/containerd/containerd/commit/afe6efee30df36c16dae3f1afe87a8e324a9b031) Revert container_stats_test.go change which caused Windows CRI integration test failure
  * [`370ef115f`](https://github.com/containerd/containerd/commit/370ef115f0e1875bce98326cce4aafd2a953c30b) container_stats_test.go: avoid checking snapshot size
  * [`935720b8c`](https://github.com/containerd/containerd/commit/935720b8c065bddd2dc4372a76225ab0290b449c) Move inline PS scripts into files
  * [`74bae5af8`](https://github.com/containerd/containerd/commit/74bae5af8c853f52b65666682db7d31e9e8d2f02) Uninstall mingw before attempting upgrade
  * [`9b9500bb0`](https://github.com/containerd/containerd/commit/9b9500bb0d45ac1e669a3319039acf7c8359e885) CI: Explicitly upgrade MinGW on Windows 2019 GitHub runners.
  * [`4814f9e48`](https://github.com/containerd/containerd/commit/4814f9e483fc2a0f897cf553ac67b882bc133fbe) seccomp, apparmor: add go:noinline
* Disable OOM set score unpriv test temporarily ([#9943](https://github.com/containerd/containerd/pull/9943))
  * [`c7c8ce6bc`](https://github.com/containerd/containerd/commit/c7c8ce6bcf73cc608b6987f0729f40f93ce443c4) Disable OOM set score unpriv test temporarily
* Update runc-shim to process exec exits before init ([#9927](https://github.com/containerd/containerd/pull/9927))
  * [`65915f0a2`](https://github.com/containerd/containerd/commit/65915f0a2c0b4d1cb590f39c6cc3b78e7bb75fcb) runc-shim: process exec exits before init
* Backport GitHub actions package updates ([#9877](https://github.com/containerd/containerd/pull/9877))
  * [`e552c8898`](https://github.com/containerd/containerd/commit/e552c889875ecb7fe2e8f5dadac77765f2988932) build(deps): bump golangci/golangci-lint-action from 3 to 4
  * [`888ae152c`](https://github.com/containerd/containerd/commit/888ae152c6eb25eee5b4b533c5fd2f8c3448b609) build(deps): bump actions/cache from 3 to 4
  * [`dd913a0de`](https://github.com/containerd/containerd/commit/dd913a0defb4aa139fe2ab719cf37850ad5c7898) build(deps): bump actions/upload-artifact from 3 to 4
  * [`a250c101a`](https://github.com/containerd/containerd/commit/a250c101afdebcaa7016e50df7670d25e3427700) build(deps): bump actions/download-artifact from 3 to 4
  * [`7c8fd2255`](https://github.com/containerd/containerd/commit/7c8fd2255deaee02ab957a2b05914d01498a7870) build(deps): bump github/codeql-action from 2 to 3
  * [`f325e559e`](https://github.com/containerd/containerd/commit/f325e559e0d93a7990ef1302533d20484d59a50b) build(deps): bump docker/setup-buildx-action from 2 to 3
  * [`1bae160de`](https://github.com/containerd/containerd/commit/1bae160de37a9b37cd8d995e1ffa54247c14f21c) build(deps): bump crazy-max/ghaction-github-runtime from 2 to 3
  * [`3c81dc13b`](https://github.com/containerd/containerd/commit/3c81dc13b45d917e802223b5f80c4559a3b7d969) build(deps): bump actions/upload-artifact from 1 to 3
  * [`9b3b80eea`](https://github.com/containerd/containerd/commit/9b3b80eea1f68de6db0dde7578395995314520e5) build(deps): bump actions/setup-go from 3 to 5
  * [`6b74818d8`](https://github.com/containerd/containerd/commit/6b74818d8908a66ba7ab668f486f1de9c84b1239) build(deps): bump actions/checkout from 3 to 4
* Fix config import relative path glob ([#9835](https://github.com/containerd/containerd/pull/9835))
  * [`0f2068a70`](https://github.com/containerd/containerd/commit/0f2068a70e0824ef7fb13c3e21763428bc58ad40) Fix config import relative path glob
* ci: update crun version to 1.14.3 ([#9851](https://github.com/containerd/containerd/pull/9851))
  * [`89d00db95`](https://github.com/containerd/containerd/commit/89d00db952fbfa9a1425be30895e9615a9d3215f) ci: update crun version to 1.14.3
* Add timeout to drain exec io ([#9768](https://github.com/containerd/containerd/pull/9768))
  * [`aac488730`](https://github.com/containerd/containerd/commit/aac488730fb6b4fec37cdc98d2b834e7033b60ca) *: fix code style issue
  * [`2a38c7e2e`](https://github.com/containerd/containerd/commit/2a38c7e2ebc9e5f1dcca25cb70535e0886e8c620) cri: add config ut for invalid drain io timeout value
  * [`ce213431f`](https://github.com/containerd/containerd/commit/ce213431fd3d413861d705b3d2d28fa83b281e39) integration: add testcase to drain exec IO in time
  * [`b5d52efca`](https://github.com/containerd/containerd/commit/b5d52efca8c1c5494c8ab72c615a4d6ed190b159) cri: disable drain-exec-IO if it is empty timeout
  * [`85bed5863`](https://github.com/containerd/containerd/commit/85bed5863f5313bedd5e6c2319d677124b44cdf5) *: update drainExecSyncIO docs and validate the timeout
  * [`0438e477c`](https://github.com/containerd/containerd/commit/0438e477c35faad18e6b7f3a6b7d8a8f787f5efc) *: add DrainExecSyncIOTimeout config and disable as by default
  * [`fb262317c`](https://github.com/containerd/containerd/commit/fb262317cd66e9f9c2ce12389b658ce042e410cc) *: fix typo and skip exec-io-drain-testcase in win
  * [`f50c9922b`](https://github.com/containerd/containerd/commit/f50c9922b1cc96e8829936509b2bf49ceaa4e5c1) pkg/cri/server: add timeout to drain exec io
* Move high volume event logs to Trace level ([#9824](https://github.com/containerd/containerd/pull/9824))
  * [`99fa35e70`](https://github.com/containerd/containerd/commit/99fa35e7015d487c210d82862b4c807a913d50f2) Move high volume event logs to Trace level
* Propagate deprecation list to runtime status ([#9819](https://github.com/containerd/containerd/pull/9819))
  * [`3785deac4`](https://github.com/containerd/containerd/commit/3785deac4fab3aa30be9a55812dc78b2e1841e29) cri: propagate deprecation list to runtime status
* ctr: print deprecation warnings on every invocation ([#9821](https://github.com/containerd/containerd/pull/9821))
  * [`b7a0b1b8e`](https://github.com/containerd/containerd/commit/b7a0b1b8ed895d1737c7a558cff4dae7f9f7e7df) ctr: print deprecation warnings on every invocation
* Fix image pinning when image is not pulled through cri ([#9785](https://github.com/containerd/containerd/pull/9785))
  * [`2d43994fb`](https://github.com/containerd/containerd/commit/2d43994fb921722002a5043724c6624bfb9d87f0) bug fix: make sure cri image is pinned when it is pulled outside cri
* Move certain debug logs to trace logs ([#9762](https://github.com/containerd/containerd/pull/9762))
  * [`195ef7691`](https://github.com/containerd/containerd/commit/195ef7691ea85cfbcb54693017a6195beddb55dc) Move certain debug logs to trace logs
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v1.6.28](https://github.com/containerd/containerd/releases/tag/v1.6.28)

containerd 1.6.29

Welcome to the v1.6.29 release of containerd!

The twenty-ninth patch release for containerd 1.6 contains various fixes and updates.

### Highlights

* Update builds to go 1.21.8 ([#9945](https://github.com/containerd/containerd/pull/9945))
* Fix config import relative path glob ([#9835](https://github.com/containerd/containerd/pull/9835))
* Move high volume event logs to Trace level ([#9824](https://github.com/containerd/containerd/pull/9824))
* Move certain debug logs to trace logs ([#9762](https://github.com/containerd/containerd/pull/9762))

#### Container Runtime Interface (CRI)

* Add timeout to drain exec io ([#9768](https://github.com/containerd/containerd/pull/9768))
* Propagate deprecation list to runtime status ([#9819](https://github.com/containerd/containerd/pull/9819))
* Fix image pinning when image is not pulled through cri ([#9785](https://github.com/containerd/containerd/pull/9785))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Akihiro Suda
* Wei Fu
* Maksym Pavlenko
* Derek McGowan
* Phil Estes
* Kirtana Ashok
* Mike Brown
* Akhil Mohan
* Angelos Kolaitis
* Austin Vazquez
* Henry Wang
* Laura Brehm
* Nashwan Azhari
* Sebastiaan van Stijn
* Tony Fang

### Changes
<details><summary>56 commits</summary>
<p>

* Prepare release notes for v1.6.29 ([#9950](https://github.com/containerd/containerd/pull/9950))
  * [`9ef6d9d03`](https://github.com/containerd/containerd/commit/9ef6d9d03d8d4124d4e8e28399fef28c137fcc2e) Add release notes for v1.6.29.toml
* use a composite action to install Go ([#9949](https://github.com/containerd/containerd/pull/9949))
  * [`cfbbb510c`](https://github.com/containerd/containerd/commit/cfbbb510c23672daf7711a9afd548801dd741c4a) Use the Go toolchain in CI matrix to build binaries
  * [`f015dbc5a`](https://github.com/containerd/containerd/commit/f015dbc5a3d1f5a6eaefc561130ee5bb05e0d6c5) use composite action in ci workflow
* Update builds to go 1.21.8 ([#9945](https://github.com/containerd/containerd/pull/9945))
  * [`ccf3eb6a2`](https://github.com/containerd/containerd/commit/ccf3eb6a2de426c9cfbb9409c330df79d3dbba0c) update to go 1.21.8, 1.22.1
* Backport easy go install and update go ([#9890](https://github.com/containerd/containerd/pull/9890))
  * [`f6475ea59`](https://github.com/containerd/containerd/commit/f6475ea597b713a27e0b31e5723f3cd315b39eeb) Drop go 1.20 and build against 1.22
  * [`7c45ad092`](https://github.com/containerd/containerd/commit/7c45ad0923f0ea267cb9b66a65dea6fff4e0ff0b) Extract a composite action to install Go
  * [`4f7305414`](https://github.com/containerd/containerd/commit/4f73054149a36ba97263af8ee72e302c7a226906) update to go1.21.6, go1.20.13
  * [`da5a36c37`](https://github.com/containerd/containerd/commit/da5a36c3700ac1142c2451137a362d4c92d1897d) Use testify
  * [`afe6efee3`](https://github.com/containerd/containerd/commit/afe6efee30df36c16dae3f1afe87a8e324a9b031) Revert container_stats_test.go change which caused Windows CRI integration test failure
  * [`370ef115f`](https://github.com/containerd/containerd/commit/370ef115f0e1875bce98326cce4aafd2a953c30b) container_stats_test.go: avoid checking snapshot size
  * [`935720b8c`](https://github.com/containerd/containerd/commit/935720b8c065bddd2dc4372a76225ab0290b449c) Move inline PS scripts into files
  * [`74bae5af8`](https://github.com/containerd/containerd/commit/74bae5af8c853f52b65666682db7d31e9e8d2f02) Uninstall mingw before attempting upgrade
  * [`9b9500bb0`](https://github.com/containerd/containerd/commit/9b9500bb0d45ac1e669a3319039acf7c8359e885) CI: Explicitly upgrade MinGW on Windows 2019 GitHub runners.
  * [`4814f9e48`](https://github.com/containerd/containerd/commit/4814f9e483fc2a0f897cf553ac67b882bc133fbe) seccomp, apparmor: add go:noinline
* Disable OOM set score unpriv test temporarily ([#9943](https://github.com/containerd/containerd/pull/9943))
  * [`c7c8ce6bc`](https://github.com/containerd/containerd/commit/c7c8ce6bcf73cc608b6987f0729f40f93ce443c4) Disable OOM set score unpriv test temporarily
* runc-shim: process exec exits before init ([#9927](https://github.com/containerd/containerd/pull/9927))
  * [`65915f0a2`](https://github.com/containerd/containerd/commit/65915f0a2c0b4d1cb590f39c6cc3b78e7bb75fcb) runc-shim: process exec exits before init
* Backport GitHub actions package updates ([#9877](https://github.com/containerd/containerd/pull/9877))
  * [`e552c8898`](https://github.com/containerd/containerd/commit/e552c889875ecb7fe2e8f5dadac77765f2988932) build(deps): bump golangci/golangci-lint-action from 3 to 4
  * [`888ae152c`](https://github.com/containerd/containerd/commit/888ae152c6eb25eee5b4b533c5fd2f8c3448b609) build(deps): bump actions/cache from 3 to 4
  * [`dd913a0de`](https://github.com/containerd/containerd/commit/dd913a0defb4aa139fe2ab719cf37850ad5c7898) build(deps): bump actions/upload-artifact from 3 to 4
  * [`a250c101a`](https://github.com/containerd/containerd/commit/a250c101afdebcaa7016e50df7670d25e3427700) build(deps): bump actions/download-artifact from 3 to 4
  * [`7c8fd2255`](https://github.com/containerd/containerd/commit/7c8fd2255deaee02ab957a2b05914d01498a7870) build(deps): bump github/codeql-action from 2 to 3
  * [`f325e559e`](https://github.com/containerd/containerd/commit/f325e559e0d93a7990ef1302533d20484d59a50b) build(deps): bump docker/setup-buildx-action from 2 to 3
  * [`1bae160de`](https://github.com/containerd/containerd/commit/1bae160de37a9b37cd8d995e1ffa54247c14f21c) build(deps): bump crazy-max/ghaction-github-runtime from 2 to 3
  * [`3c81dc13b`](https://github.com/containerd/containerd/commit/3c81dc13b45d917e802223b5f80c4559a3b7d969) build(deps): bump actions/upload-artifact from 1 to 3
  * [`9b3b80eea`](https://github.com/containerd/containerd/commit/9b3b80eea1f68de6db0dde7578395995314520e5) build(deps): bump actions/setup-go from 3 to 5
  * [`6b74818d8`](https://github.com/containerd/containerd/commit/6b74818d8908a66ba7ab668f486f1de9c84b1239) build(deps): bump actions/checkout from 3 to 4
* Fix config import relative path glob ([#9835](https://github.com/containerd/containerd/pull/9835))
  * [`0f2068a70`](https://github.com/containerd/containerd/commit/0f2068a70e0824ef7fb13c3e21763428bc58ad40) Fix config import relative path glob
* ci: update crun version to 1.14.3 ([#9851](https://github.com/containerd/containerd/pull/9851))
  * [`89d00db95`](https://github.com/containerd/containerd/commit/89d00db952fbfa9a1425be30895e9615a9d3215f) ci: update crun version to 1.14.3
* Add timeout to drain exec io ([#9768](https://github.com/containerd/containerd/pull/9768))
  * [`aac488730`](https://github.com/containerd/containerd/commit/aac488730fb6b4fec37cdc98d2b834e7033b60ca) *: fix code style issue
  * [`2a38c7e2e`](https://github.com/containerd/containerd/commit/2a38c7e2ebc9e5f1dcca25cb70535e0886e8c620) cri: add config ut for invalid drain io timeout value
  * [`ce213431f`](https://github.com/containerd/containerd/commit/ce213431fd3d413861d705b3d2d28fa83b281e39) integration: add testcase to drain exec IO in time
  * [`b5d52efca`](https://github.com/containerd/containerd/commit/b5d52efca8c1c5494c8ab72c615a4d6ed190b159) cri: disable drain-exec-IO if it is empty timeout
  * [`85bed5863`](https://github.com/containerd/containerd/commit/85bed5863f5313bedd5e6c2319d677124b44cdf5) *: update drainExecSyncIO docs and validate the timeout
  * [`0438e477c`](https://github.com/containerd/containerd/commit/0438e477c35faad18e6b7f3a6b7d8a8f787f5efc) *: add DrainExecSyncIOTimeout config and disable as by default
  * [`fb262317c`](https://github.com/containerd/containerd/commit/fb262317cd66e9f9c2ce12389b658ce042e410cc) *: fix typo and skip exec-io-drain-testcase in win
  * [`f50c9922b`](https://github.com/containerd/containerd/commit/f50c9922b1cc96e8829936509b2bf49ceaa4e5c1) pkg/cri/server: add timeout to drain exec io
* Move high volume event logs to Trace level ([#9824](https://github.com/containerd/containerd/pull/9824))
  * [`99fa35e70`](https://github.com/containerd/containerd/commit/99fa35e7015d487c210d82862b4c807a913d50f2) Move high volume event logs to Trace level
* Propagate deprecation list to runtime status ([#9819](https://github.com/containerd/containerd/pull/9819))
  * [`3785deac4`](https://github.com/containerd/containerd/commit/3785deac4fab3aa30be9a55812dc78b2e1841e29) cri: propagate deprecation list to runtime status
* ctr: print deprecation warnings on every invocation ([#9821](https://github.com/containerd/containerd/pull/9821))
  * [`b7a0b1b8e`](https://github.com/containerd/containerd/commit/b7a0b1b8ed895d1737c7a558cff4dae7f9f7e7df) ctr: print deprecation warnings on every invocation
* Fix image pinning when image is not pulled through cri ([#9785](https://github.com/containerd/containerd/pull/9785))
  * [`2d43994fb`](https://github.com/containerd/containerd/commit/2d43994fb921722002a5043724c6624bfb9d87f0) bug fix: make sure cri image is pinned when it is pulled outside cri
* Move certain debug logs to trace logs ([#9762](https://github.com/containerd/containerd/pull/9762))
  * [`195ef7691`](https://github.com/containerd/containerd/commit/195ef7691ea85cfbcb54693017a6195beddb55dc) Move certain debug logs to trace logs
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v1.6.28](https://github.com/containerd/containerd/releases/tag/v1.6.28)

containerd 1.7.13

Welcome to the v1.7.13 release of containerd!

The thirteenth patch release for containerd 1.7 updates the runc binary
in the release builds to address CVE-2024-21626

### Notable Updates

* **Update runc binary to v1.1.12** ([GHSA-xr7r-f8xq-vfvv](https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv))
* **Update seccomp profile for new syscalls added since Linux 5.16** ([#9693](https://github.com/containerd/containerd/pull/9693))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Evan Lezar
* Paweł Gronowski
* Phil Estes
* Wei Fu

### Changes
<details><summary>9 commits</summary>
<p>

* Prepare v1.7.13 and update runc to v1.1.12 ([#9724](https://github.com/containerd/containerd/pull/9724))
  * [`b97e611b9`](https://github.com/containerd/containerd/commit/b97e611b9b931225f2385d5fcc31873577464edd) Prepare release notes for v1.7.13
  * [`2e7fa14db`](https://github.com/containerd/containerd/commit/2e7fa14db7f4448751280520fef2c628ed07b0eb) Update runc binary to v1.1.12
* [release/1.7] seccomp: kernel 6.7 ([#9693](https://github.com/containerd/containerd/pull/9693))
  * [`1bed37871`](https://github.com/containerd/containerd/commit/1bed3787162521aeb179895c29f7cc6a6bcd8013) seccomp: kernel 6.7
* [release/1.7] Update container-device-interface to v0.6.2 ([#9685](https://github.com/containerd/containerd/pull/9685))
  * [`14628d4aa`](https://github.com/containerd/containerd/commit/14628d4aaa1138f2fd10f23d26f3810ba5d65ab2) Update container-device-interface to v0.6.2
* [release/1.7] content: Add InfoReaderProvider ([#9658](https://github.com/containerd/containerd/pull/9658))
  * [`836477930`](https://github.com/containerd/containerd/commit/836477930ed9e6a81980b5bd2150f638cb39adf6) content: Add InfoReaderProvider
</p>
</details>

### Dependency Changes

* **tags.cncf.io/container-device-interface**           v0.6.2 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**  v0.6.0 **_new_**

Previous release can be found at [v1.7.12](https://github.com/containerd/containerd/releases/tag/v1.7.12)

containerd 1.6.28

Welcome to the v1.6.28 release of containerd!

The twenty-eighth patch release for containerd 1.6 updates the runc binary
in the release builds to address CVE-2024-21626

### Notable Updates

* **Update runc binary to v1.1.12** ([GHSA-xr7r-f8xq-vfvv](https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv))
* **Update seccomp profile for new syscalls added since Linux 5.16** ([#9694](https://github.com/containerd/containerd/pull/9694))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Andrey Epifanov
* Derek McGowan
* Akihiro Suda
* Maksym Pavlenko
* Phil Estes
* Shengjing Zhu
* Wei Fu

### Changes
<details><summary>13 commits</summary>
<p>

*  Prepare v1.6.28 and update runc to v1.1.12 ([#9723](https://github.com/containerd/containerd/pull/9723))
  * [`570c7c637`](https://github.com/containerd/containerd/commit/570c7c637745c9a5d41309c51193107a25768200) Prepare release notes for v1.6.28
  * [`b20b9f86b`](https://github.com/containerd/containerd/commit/b20b9f86b583b11a7fac34e6c682bc7633c74237) Update runc binary to v1.1.12
* [release/1.6] upgrade OpenTelemetry to v1.21.0 / v0.46.0 (CVE-2023-47108) etc. ([#9707](https://github.com/containerd/containerd/pull/9707))
  * [`19500722a`](https://github.com/containerd/containerd/commit/19500722aec045da29536401fa4c76dfc5ef0cbe) [release/1.6] vendor: golang.org/x/crypto v0.18.0
  * [`919928f6b`](https://github.com/containerd/containerd/commit/919928f6b006e563d1a1c57af36e29b570dd726a) [release/1.6] vendor: golang.org/x/term v0.16.0
  * [`7d6a4d23b`](https://github.com/containerd/containerd/commit/7d6a4d23b182e419c0cfa732c369d7f4c90c7a02) [release/1.6] vendor: golang.org/x/sys v0.16.0
  * [`16ac018ae`](https://github.com/containerd/containerd/commit/16ac018ae3efaa0389678a47d0135c739a93cbae) [release/1.6] vendor: upgrade OpenTelemetry to v1.21.0 / v0.46.0
* [release/1.6] seccomp: kernel 6.7 ([#9694](https://github.com/containerd/containerd/pull/9694))
  * [`f44628305`](https://github.com/containerd/containerd/commit/f44628305d7cdccfd1f7b8996b39846db5c4f035) seccomp: kernel 6.7
* [release/1.6] carry #9557 - enable ARM CI ([#9636](https://github.com/containerd/containerd/pull/9636))
  * [`65e1656f2`](https://github.com/containerd/containerd/commit/65e1656f2755727770f2adc90df8b972e7a513f2) cri: fix integration test on cgroupsv2 system
  * [`9cf1e1a39`](https://github.com/containerd/containerd/commit/9cf1e1a39ca17328c973a7d2ed2969e4f98993cc) *: enable ARM64 runner
</p>
</details>

### Dependency Changes

* **github.com/go-logr/logr**                                                      v1.2.2 -> v1.3.0
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.3.1
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.28.0 -> v0.46.0
* **go.opentelemetry.io/otel**                                                     v1.3.0 -> v1.21.0
* **go.opentelemetry.io/otel/metric**                                              v1.21.0 **_new_**
* **go.opentelemetry.io/otel/sdk**                                                 v1.3.0 -> v1.21.0
* **go.opentelemetry.io/otel/trace**                                               v1.3.0 -> v1.21.0
* **golang.org/x/crypto**                                                          v0.14.0 -> v0.18.0
* **golang.org/x/net**                                                             v0.17.0 -> v0.18.0
* **golang.org/x/oauth2**                                                          v0.10.0 -> v0.11.0
* **golang.org/x/sys**                                                             v0.13.0 -> v0.16.0
* **golang.org/x/term**                                                            v0.13.0 -> v0.16.0
* **golang.org/x/text**                                                            v0.13.0 -> v0.14.0
* **google.golang.org/grpc**                                                       v1.58.3 -> v1.59.0

Previous release can be found at [v1.6.27](https://github.com/containerd/containerd/releases/tag/v1.6.27)

containerd 2.0.0-beta.2

Welcome to the v2.0.0-beta.2 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

### Highlights

* Add PluginInfo to introspection API ([#9442](https://github.com/containerd/containerd/pull/9442))
* Remove overlayfs volatile option on temp mounts ([#9555](https://github.com/containerd/containerd/pull/9555))
* Move packages based on contributing guide ([#9365](https://github.com/containerd/containerd/pull/9365))
* Update import and export to allow references to missing content  ([#9554](https://github.com/containerd/containerd/pull/9554))
* Add option to perform syncfs after pull ([#9401](https://github.com/containerd/containerd/pull/9401))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
* Switch runc shim to task service v3 and fix restore ([#9233](https://github.com/containerd/containerd/pull/9233))
* Use Intel ISA-L's igzip if available ([#9200](https://github.com/containerd/containerd/pull/9200))
* Generalize plugin library ([#9214](https://github.com/containerd/containerd/pull/9214))
* Introduce top level config migration ([#9223](https://github.com/containerd/containerd/pull/9223))
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Use github.com/containerd/log ([#9086](https://github.com/containerd/containerd/pull/9086))
* Add support for image expiration during garbage collection ([#9022](https://github.com/containerd/containerd/pull/9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](https://github.com/containerd/containerd/pull/8792))
* Remove the CriuPath field from runc's options ([#8279](https://github.com/containerd/containerd/pull/8279))
* Remove support for config.toml `version = 1` ([#8275](https://github.com/containerd/containerd/pull/8275))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Container Runtime Interface (CRI)

* Enable CDI by default ([#9621](https://github.com/containerd/containerd/pull/9621))
* Remove non-sandboxed CRI implementation ([#9228](https://github.com/containerd/containerd/pull/9228))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](https://github.com/containerd/containerd/pull/8493))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](https://github.com/containerd/containerd/pull/8287))
* Use sandboxed CRI by default ([#8994](https://github.com/containerd/containerd/pull/8994))
* Implement RuntimeConfig CRI call ([#8722](https://github.com/containerd/containerd/pull/8722))
* Add support for user namespaces (KEP-127) ([#8803](https://github.com/containerd/containerd/pull/8803))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))

#### Runtime

* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))

#### Security Advisories

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)

#### Breaking

* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Move client to subpackage ([#9316](https://github.com/containerd/containerd/pull/9316))
* Remove `LimitNOFILE` from `containerd.service` ([#8924](https://github.com/containerd/containerd/pull/8924))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Deprecations

* Deprecate go-plugin configuration option ([#9238](https://github.com/containerd/containerd/pull/9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](https://github.com/containerd/containerd/pull/8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Wei Fu
* Phil Estes
* Sebastiaan van Stijn
* Samuel Karp
* Maksym Pavlenko
* Kazuyoshi Kato
* Rodrigo Campos
* Danny Canter
* Gabriel Adrian Samfira
* Iceber Gu
* Abel Feng
* Akhil Mohan
* Jin Dong
* Bjorn Neergaard
* Kirtana Ashok
* Kohei Tokunaga
* Austin Vazquez
* rongfu.leng
* Mike Brown
* Paul "TBBle" Hampson
* Krisztian Litkey
* James Sturtevant
* Enrico Weigelt
* Paweł Gronowski
* Ilya Hanov
* Marat Radchenko
* Cardy.Tang
* Hsing-Yu (David) Chen
* Justin Chadwell
* Brian Goff
* Bryant Biggs
* Davanum Srinivas
* Henry Wang
* Kay Yan
* Laura Brehm
* Markus Lehtonen
* Nashwan Azhari
* Shingo Omura
* Vinayak Goyal
* helen
* Aditi Sharma
* Charity Kathure
* Ed Bartosh
* Evan Lezar
* James Jenkins
* Milas Bowman
* yanggang
* Aditya Ramani
* Amit Barve
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Cory Snider
* Djordje Lukic
* Ethan Lowman
* Jiang Liu
* Jordan Liggitt
* June Rhodes
* Mahamed Ali
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Shuaiyi Zhang
* Steve Griffith
* VERNOU Cédric
* hang.jiang
* jerryzhuang
* lengrongfu
* Aaron Lehmann
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Alexandru Matei
* Amir M. Ghazanfari
* Anthony Nandaa
* Antonio Huete Jimenez
* Avi Deitcher
* Ben Foster
* Bin Xin
* BinBin He
* Brennan Kinney
* Craig Ingram
* Daisy Rong
* Edgar Lee
* Eng Zer Jun
* Etienne Champetier
* Fahed Dorgaa
* Gary McDonald
* Iain Macdonald
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Jiongchi Yu
* Kern Walster
* Kevin Parsons
* Konstantin Khlebnikov
* Maksim An
* Pan Yibo
* Qasim Sarfraz
* Qiutong Song
* Robbie Buxton
* Robert-André Mauchin
* Shukui Yang
* Tianon Gravi
* Tony Fang
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Yibo Zhuang
* Yury Gargay
* charles-chenzz
* chschumacher1994
* guangli.bao
* krglosse
* ningmingxiao
* pigletfly
* rokkiter
* roman-kiselenko
* roman-kiselenko
* wangxiang
* zhangpeng
* zhaojizhuang
* zounengren
* 吴小白
* 张钰
* 沈陵

### Dependency Changes

* **cloud.google.com/go/compute/metadata**                                         v0.2.3 **_new_**
* **dario.cat/mergo**                                                              v1.0.0 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.1
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.0-rc.2
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.2.1
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/errdefs**                                                v0.1.0 **_new_**
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.5.0
* **github.com/containerd/platforms**                                              v0.1.1 **_new_**
* **github.com/containerd/plugin**                                                 7ec69893e1e7 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.2
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.1.1
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.4.0
* **github.com/distribution/reference**                                            v0.5.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.10.2
* **github.com/felixge/httpsnoop**                                                 v1.0.3 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.1
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.3
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.5.0
* **github.com/grpc-ecosystem/go-grpc-middleware**                                 v1.3.0 -> v1.4.0
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.16.2
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.6.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.4
* **github.com/klauspost/cpuid/v2**                                                v2.0.4 -> v2.2.5
* **github.com/minio/sha256-simd**                                                 v1.0.0 -> v1.0.1
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.1
* **github.com/moby/sys/user**                                                     v0.1.0 **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0-rc5
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> 4fec88fd00a4
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.1.1 **_new_**
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.17.0
* **github.com/prometheus/client_model**                                           v0.3.0 -> 9a2bf3000d16
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.44.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.11.1
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.8.4
* **github.com/urfave/cli**                                                        v1.22.12 -> v1.22.14
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.8
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.46.1
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.45.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.21.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.19.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.19.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.19.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.21.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.21.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.21.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.0.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.14.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.19.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.13.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.6.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.16.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.15.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.14.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **golang.org/x/tools**                                                           v0.5.0 -> v0.16.0
* **google.golang.org/appengine**                                                  v1.6.7 -> v1.6.8
* **google.golang.org/genproto/googleapis/api**                                    d307bd883b97 **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    995d672761c0 **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.60.1
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.32.0
* **k8s.io/api**                                                                   v0.26.2 -> v0.28.4
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.28.4
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.28.2
* **k8s.io/client-go**                                                             v0.26.2 -> v0.28.4
* **k8s.io/component-base**                                                        v0.26.2 -> v0.28.4
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.28.2
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.100.1
* **k8s.io/kubelet**                                                               v0.28.2 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> d93618cff8a2
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd
* **tags.cncf.io/container-device-interface**                                      v0.6.2 **_new_**
* **tags.cncf.io/container-device-interface/specs-go**                             v0.6.0 **_new_**

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 2.0.0-beta.1

Welcome to the v2.0.0-beta.1 release of containerd!
*This is a pre-release of containerd*

The first major release of containerd 2.x focuses on the continued stability of
containerd's core feature set with an easy upgrade from containerd 1.x. This
release includes the stabilization of new features added in the last 1.x release
as well as the removal of features which were deprecated in 1.x. The goal is to
support the vast community of containerd users well into the future along with
their ever increasing deployment footprints and variety of use cases.

### Highlights

* Move packages based on contributing guide ([#9365](https://github.com/containerd/containerd/pull/9365))
* Update import and export to allow references to missing content  ([#9554](https://github.com/containerd/containerd/pull/9554))
* *: enable ARM64 runner ([#9456](https://github.com/containerd/containerd/pull/9456))
* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Expose usage of deprecated features ([#9258](https://github.com/containerd/containerd/pull/9258))
* Switch runc shim to task service v3 and fix restore ([#9233](https://github.com/containerd/containerd/pull/9233))
* Use Intel ISA-L's igzip if available ([#9200](https://github.com/containerd/containerd/pull/9200))
* Generalize plugin library ([#9214](https://github.com/containerd/containerd/pull/9214))
* Introduce top level config migration ([#9223](https://github.com/containerd/containerd/pull/9223))
* Add image delete target ([#8989](https://github.com/containerd/containerd/pull/8989))
* Use github.com/containerd/log ([#9086](https://github.com/containerd/containerd/pull/9086))
* Add support for image expiration during garbage collection ([#9022](https://github.com/containerd/containerd/pull/9022))
* Reduce the contention between ref lock and boltdb lock in content store ([#8792](https://github.com/containerd/containerd/pull/8792))
* Remove the CriuPath field from runc's options ([#8279](https://github.com/containerd/containerd/pull/8279))
* Remove support for config.toml `version = 1` ([#8275](https://github.com/containerd/containerd/pull/8275))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Container Runtime Interface (CRI)

* Enable CDI by default ([#9621](https://github.com/containerd/containerd/pull/9621))
* Remove non-sandboxed CRI implementation ([#9228](https://github.com/containerd/containerd/pull/9228))
* Add image verifier transfer service plugin system based on a binary directory ([#8493](https://github.com/containerd/containerd/pull/8493))
* Add support for userns in stateless and stateful pods with idmap mounts (KEP-127, k8s >= 1.27) ([#8287](https://github.com/containerd/containerd/pull/8287))
* Use sandboxed CRI by default ([#8994](https://github.com/containerd/containerd/pull/8994))
* Implement RuntimeConfig CRI call ([#8722](https://github.com/containerd/containerd/pull/8722))
* Add support for user namespaces (KEP-127) ([#8803](https://github.com/containerd/containerd/pull/8803))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))

#### Runtime

* Add sandboxer configuration and move sandbox controllers to plugins ([#8268](https://github.com/containerd/containerd/pull/8268))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))

#### Security Advisories

* [medium] RAPL accessible to a container [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)

#### Breaking

* Update RuntimeDefault seccomp profile to disallow io_uring related syscalls ([#9320](https://github.com/containerd/containerd/pull/9320))
* Move client to subpackage ([#9316](https://github.com/containerd/containerd/pull/9316))
* Remove CRI v1alpha2 ([#8276](https://github.com/containerd/containerd/pull/8276))
* Remove `io.containerd.runtime.v1.linux` and `io.containerd.runc.v1` ([#8262](https://github.com/containerd/containerd/pull/8262))
* Remove "containerd.io/restart.logpath" label ([#8264](https://github.com/containerd/containerd/pull/8264))
* Remove `aufs` snapshotter ([#8263](https://github.com/containerd/containerd/pull/8263))

#### Deprecations

* Deprecate go-plugin configuration option ([#9238](https://github.com/containerd/containerd/pull/9238))
* CNI conf_template in CRI is no longer deprecated ([#8637](https://github.com/containerd/containerd/pull/8637))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Derek McGowan
* Akihiro Suda
* Wei Fu
* Phil Estes
* Sebastiaan van Stijn
* Samuel Karp
* Maksym Pavlenko
* Kazuyoshi Kato
* Rodrigo Campos
* dependabot[bot]
* Danny Canter
* Gabriel Adrian Samfira
* Iceber Gu
* Abel Feng
* Jin Dong
* Bjorn Neergaard
* Kirtana Ashok
* Kohei Tokunaga
* Austin Vazquez
* rongfu.leng
* Akhil Mohan
* Mike Brown
* Paul "TBBle" Hampson
* Krisztian Litkey
* Enrico Weigelt
* James Sturtevant
* Paweł Gronowski
* Ilya Hanov
* Marat Radchenko
* Cardy.Tang
* Hsing-Yu (David) Chen
* Justin Chadwell
* Brian Goff
* Bryant Biggs
* Davanum Srinivas
* Henry Wang
* Kay Yan
* Laura Brehm
* Markus Lehtonen
* Nashwan Azhari
* Shingo Omura
* Vinayak Goyal
* helen
* Aditi Sharma
* Charity Kathure
* Ed Bartosh
* James Jenkins
* Milas Bowman
* Aditya Ramani
* Amit Barve
* Artem Khramov
* Brad Davidson
* Chen Yiyang
* Cory Snider
* Djordje Lukic
* Ethan Lowman
* Jiang Liu
* Jordan Liggitt
* June Rhodes
* Mahamed Ali
* Michael Crosby
* Peteris Rudzusiks
* Sam Edwards
* Samruddhi Khandale
* Shuaiyi Zhang
* Steve Griffith
* VERNOU Cédric
* hang.jiang
* jerryzhuang
* lengrongfu
* Aaron Lehmann
* Alex Couture-Beil
* Alex Ellis
* Alex Rodriguez
* Alexandru Matei
* Amir M. Ghazanfari
* Anthony Nandaa
* Antonio Huete Jimenez
* Avi Deitcher
* Ben Foster
* Bin Xin
* BinBin He
* Brennan Kinney
* Craig Ingram
* Daisy Rong
* Edgar Lee
* Eng Zer Jun
* Etienne Champetier
* Evan Lezar
* Fahed Dorgaa
* Gary McDonald
* Iceber Gu
* James Lakin
* Jan Dubois
* Jaroslav Jindrak
* Jiongchi Yu
* Kern Walster
* Kevin Parsons
* Konstantin Khlebnikov
* Maksim An
* Pan Yibo
* Qasim Sarfraz
* Qiutong Song
* Robbie Buxton
* Robert-André Mauchin
* Shukui Yang
* Tianon Gravi
* Tony Fang
* Tõnis Tiigi
* Wang Xinwen
* William Chen
* Yibo Zhuang
* charles-chenzz
* chschumacher1994
* guangli.bao
* ningmingxiao
* pigletfly
* rokkiter
* roman-kiselenko
* wangxiang
* zhangpeng
* zhaojizhuang
* zounengren
* 吴小白
* 沈陵

### Dependency Changes

* **cloud.google.com/go/compute/metadata**                                         v0.2.3 **_new_**
* **dario.cat/mergo**                                                              v1.0.0 **_new_**
* **github.com/AdaLogics/go-fuzz-headers**                                         1f10f66a31bf -> ced1acdcaa24
* **github.com/AdamKorcz/go-118-fuzz-build**                                       5330a85ea652 -> 8075edf89bb0
* **github.com/Microsoft/go-winio**                                                v0.6.0 -> v0.6.1
* **github.com/Microsoft/hcsshim**                                                 v0.10.0-rc.7 -> v0.12.0-rc.2
* **github.com/cenkalti/backoff/v4**                                               v4.2.0 -> v4.2.1
* **github.com/cilium/ebpf**                                                       v0.9.1 -> v0.11.0
* **github.com/container-orchestrated-devices/container-device-interface**         v0.5.4 -> v0.6.1
* **github.com/containerd/cgroups/v3**                                             v3.0.1 -> v3.0.3
* **github.com/containerd/continuity**                                             v0.3.0 -> v0.4.3
* **github.com/containerd/go-runc**                                                v1.0.0 -> v1.1.0
* **github.com/containerd/log**                                                    v0.1.0 **_new_**
* **github.com/containerd/nri**                                                    v0.3.0 -> v0.5.0
* **github.com/containerd/plugin**                                                 7ec69893e1e7 **_new_**
* **github.com/containerd/ttrpc**                                                  v1.2.1 -> v1.2.2
* **github.com/containerd/typeurl/v2**                                             v2.1.0 -> v2.1.1
* **github.com/containernetworking/plugins**                                       v1.2.0 -> v1.4.0
* **github.com/distribution/reference**                                            v0.5.0 **_new_**
* **github.com/emicklei/go-restful/v3**                                            v3.10.1 -> v3.10.2
* **github.com/felixge/httpsnoop**                                                 v1.0.3 **_new_**
* **github.com/fsnotify/fsnotify**                                                 v1.6.0 -> v1.7.0
* **github.com/go-logr/logr**                                                      v1.2.3 -> v1.4.1
* **github.com/golang/protobuf**                                                   v1.5.2 -> v1.5.3
* **github.com/google/go-cmp**                                                     v0.5.9 -> v0.6.0
* **github.com/google/uuid**                                                       v1.3.0 -> v1.5.0
* **github.com/grpc-ecosystem/go-grpc-middleware**                                 v1.3.0 -> v1.4.0
* **github.com/grpc-ecosystem/grpc-gateway/v2**                                    v2.7.0 -> v2.16.2
* **github.com/intel/goresctrl**                                                   v0.3.0 -> v0.6.0
* **github.com/klauspost/compress**                                                v1.16.0 -> v1.17.4
* **github.com/klauspost/cpuid/v2**                                                v2.0.4 -> v2.2.5
* **github.com/minio/sha256-simd**                                                 v1.0.0 -> v1.0.1
* **github.com/moby/sys/mountinfo**                                                v0.6.2 -> v0.7.1
* **github.com/moby/sys/user**                                                     v0.1.0 **_new_**
* **github.com/opencontainers/image-spec**                                         3a7f492d3f1b -> v1.1.0-rc5
* **github.com/opencontainers/runtime-spec**                                       v1.1.0-rc.1 -> 4fec88fd00a4
* **github.com/opencontainers/runtime-tools**                                      946c877fa809 -> 2e043c6bd626
* **github.com/pelletier/go-toml/v2**                                              v2.1.1 **_new_**
* **github.com/prometheus/client_golang**                                          v1.14.0 -> v1.17.0
* **github.com/prometheus/client_model**                                           v0.3.0 -> 9a2bf3000d16
* **github.com/prometheus/common**                                                 v0.37.0 -> v0.44.0
* **github.com/prometheus/procfs**                                                 v0.8.0 -> v0.11.1
* **github.com/sirupsen/logrus**                                                   v1.9.0 -> v1.9.3
* **github.com/stretchr/testify**                                                  v1.8.2 -> v1.8.4
* **github.com/urfave/cli**                                                        v1.22.12 -> v1.22.14
* **github.com/vishvananda/netns**                                                 2eb08e3e575f -> v0.0.4
* **go.etcd.io/bbolt**                                                             v1.3.7 -> v1.3.8
* **go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc**  v0.40.0 -> v0.46.1
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**                v0.45.0 **_new_**
* **go.opentelemetry.io/otel**                                                     v1.14.0 -> v1.21.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace**                            v1.14.0 -> v1.19.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc**              v1.14.0 -> v1.19.0
* **go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp**              v1.14.0 -> v1.19.0
* **go.opentelemetry.io/otel/metric**                                              v0.37.0 -> v1.21.0
* **go.opentelemetry.io/otel/sdk**                                                 v1.14.0 -> v1.21.0
* **go.opentelemetry.io/otel/trace**                                               v1.14.0 -> v1.21.0
* **go.opentelemetry.io/proto/otlp**                                               v0.19.0 -> v1.0.0
* **golang.org/x/exp**                                                             aacd6d4b4611 **_new_**
* **golang.org/x/mod**                                                             v0.7.0 -> v0.14.0
* **golang.org/x/net**                                                             v0.7.0 -> v0.19.0
* **golang.org/x/oauth2**                                                          v0.4.0 -> v0.13.0
* **golang.org/x/sync**                                                            v0.1.0 -> v0.6.0
* **golang.org/x/sys**                                                             v0.6.0 -> v0.16.0
* **golang.org/x/term**                                                            v0.5.0 -> v0.15.0
* **golang.org/x/text**                                                            v0.7.0 -> v0.14.0
* **golang.org/x/time**                                                            90d013bbcef8 -> v0.3.0
* **golang.org/x/tools**                                                           v0.5.0 -> v0.16.0
* **google.golang.org/appengine**                                                  v1.6.7 -> v1.6.8
* **google.golang.org/genproto/googleapis/api**                                    d307bd883b97 **_new_**
* **google.golang.org/genproto/googleapis/rpc**                                    995d672761c0 **_new_**
* **google.golang.org/grpc**                                                       v1.53.0 -> v1.60.1
* **google.golang.org/protobuf**                                                   v1.28.1 -> v1.32.0
* **k8s.io/api**                                                                   v0.26.2 -> v0.28.4
* **k8s.io/apimachinery**                                                          v0.26.2 -> v0.28.4
* **k8s.io/apiserver**                                                             v0.26.2 -> v0.28.2
* **k8s.io/client-go**                                                             v0.26.2 -> v0.28.4
* **k8s.io/component-base**                                                        v0.26.2 -> v0.28.4
* **k8s.io/cri-api**                                                               v0.26.2 -> v0.28.2
* **k8s.io/klog/v2**                                                               v2.90.1 -> v2.100.1
* **k8s.io/kubelet**                                                               v0.28.2 **_new_**
* **k8s.io/utils**                                                                 a5ecb0141aa5 -> d93618cff8a2
* **sigs.k8s.io/json**                                                             f223a00ba0e2 -> bc3834ca7abd

Previous release can be found at [v1.7.0](https://github.com/containerd/containerd/releases/tag/v1.7.0)
### Which file should I download?
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.

containerd 1.6.27

Welcome to the v1.6.27 release of containerd!

The twenty-seventh patch release for containerd 1.6 contains various fixes and updates.

### Notable Updates

* **Improve `/etc/group` handling when appending groups** ([#9543](https://github.com/containerd/containerd/pull/9543))
* **Update runc binary to v1.1.11** ([#9597](https://github.com/containerd/containerd/pull/9597))
* **Remove runc import** ([#9606](https://github.com/containerd/containerd/pull/9606))
* **Update shim pidfile permissions to 0644** ([#9613](https://github.com/containerd/containerd/pull/9613))
* **Update Go version to 1.20.13** ([#9625](https://github.com/containerd/containerd/pull/9625))

### Deprecation Warnings

* **Emit deprecation warning for CRIU config usage** ([#9448](https://github.com/containerd/containerd/pull/9448))
* **Emit deprecation warning for some CRI configs** ([#9447](https://github.com/containerd/containerd/pull/9447))
* **Emit deprecation warning for `containerd.io/restart.logpath` label usage** ([#9572](https://github.com/containerd/containerd/pull/9572))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Akihiro Suda
* Derek McGowan
* Sebastiaan van Stijn
* Djordje Lukic
* Jaroslav Jindrak
* Kay Yan
* Maksym Pavlenko
* Phil Estes
* Wei Fu
* ruiwen-zhao

### Changes
<details><summary>26 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.27 ([#9631](https://github.com/containerd/containerd/pull/9631))
  * [`d0edecf28`](https://github.com/containerd/containerd/commit/d0edecf28b51b35cfb549e3d18467bd2087fb0e7) Prepare release notes for v1.6.27
* [release/1.6] update to go1.20.13, test go1.21.6 ([#9625](https://github.com/containerd/containerd/pull/9625))
  * [`32a515211`](https://github.com/containerd/containerd/commit/32a515211d03771e3a35bf7bcb4b114bf1131ada) update to go1.20.13, test go1.21.6
* [release/1.6 backport] shim: Create pid-file with 0644 permissions ([#9613](https://github.com/containerd/containerd/pull/9613))
  * [`37de14d95`](https://github.com/containerd/containerd/commit/37de14d9562db48f9b66f37b10fa3e704455ae25) shim: Create pid-file with 0644 permissions
* [release/1.6 backport] remove github.com/opencontainers/runc dependency ([#9606](https://github.com/containerd/containerd/pull/9606))
  * [`3938d63de`](https://github.com/containerd/containerd/commit/3938d63de4737668ccec1f5eaf552c58a5d32057) remove github.com/opencontainers/runc dependency
* [release/1.6 backport] update runc binary to v1.1.11 ([#9597](https://github.com/containerd/containerd/pull/9597))
  * [`9a9b11f73`](https://github.com/containerd/containerd/commit/9a9b11f733f778ce6171396d0c95e2b68cca5e21) update runc binary to v1.1.11
* [release/1.6 backport] go.mod: dario.cat/mergo v1.0.0 ([#9570](https://github.com/containerd/containerd/pull/9570))
  * [`6cd8e17ab`](https://github.com/containerd/containerd/commit/6cd8e17aba91d9f46f9e1a27b6381744e6cafe48) go.mod: dario.cat/mergo v1.0.0
  * [`4f8ff5154`](https://github.com/containerd/containerd/commit/4f8ff5154abd2127d148fb11ca54feb6f0fb47af) go.mod: github.com/imdario/mergo v0.3.13
* [release/1.6] restart: containerd.io/restart.logpath warning ([#9572](https://github.com/containerd/containerd/pull/9572))
  * [`d24d263a4`](https://github.com/containerd/containerd/commit/d24d263a42f51dca398070be1f8268fd53fe6cc9) restart: containerd.io/restart.logpath warning
* [release/1.6 backport] WithAppendAdditionalGroups: better /etc/group handling ([#9543](https://github.com/containerd/containerd/pull/9543))
  * [`9489c0eb0`](https://github.com/containerd/containerd/commit/9489c0eb0e7e51d90a0c2b5b4f5cbe23936d95ca) WithAppendAdditionalGroups: better /etc/group handling
* [release/1.6] cri: add deprecation warnings for deprecated CRI configs ([#9547](https://github.com/containerd/containerd/pull/9547))
  * [`713065793`](https://github.com/containerd/containerd/commit/713065793592c0f877c81712a6f310f3d730bf07) deprecation: fix missing spaces in warnings
  * [`de0cc92a7`](https://github.com/containerd/containerd/commit/de0cc92a793b84118356715503243a2b9664dfa5) cri: add deprecation warning for runtime_root
  * [`833b94149`](https://github.com/containerd/containerd/commit/833b94149b6fd4faa6d4719ef7926257f5b2b098) cri: add deprecation warning for rutnime_engine
  * [`47de3d63d`](https://github.com/containerd/containerd/commit/47de3d63df0e5ffa522dfc2b6cb5b2d472879f28) cri: add deprecation warning for default_runtime
  * [`d421b8fda`](https://github.com/containerd/containerd/commit/d421b8fda9d0d303e1b90a13f378e6fffe7d9187) cri: add warning for untrusted_workload_runtime
  * [`802cb64b0`](https://github.com/containerd/containerd/commit/802cb64b00aab14d0f2edb45c9b89eef0016dc1c) cri: add warning for old form of systemd_cgroup
* [release/1.6] Add warning for CRIU config usage ([#9546](https://github.com/containerd/containerd/pull/9546))
  * [`f8447466c`](https://github.com/containerd/containerd/commit/f8447466ccd8277083fefeb6db91194c4559ed0b) Add warning for CRIU config usage
</p>
</details>

### Dependency Changes

* **dario.cat/mergo**           v1.0.0 **_new_**
* **github.com/moby/sys/user**  v0.1.0 **_new_**

Previous release can be found at [v1.6.26](https://github.com/containerd/containerd/releases/tag/v1.6.26)

containerd 1.7.12

Welcome to the v1.7.12 release of containerd!

The twelfth patch release for containerd 1.7 contains various fixes and updates.

### Notable Updates

* **Fix on dialer function for Windows** ([#9501](https://github.com/containerd/containerd/pull/9501))
* **Improve `/etc/group` handling when appending groups** ([#9544](https://github.com/containerd/containerd/pull/9544))
* **Update shim pidfile permissions to 0644** ([#9548](https://github.com/containerd/containerd/pull/9548))
* **Update runc binary to v1.1.11** ([#9596](https://github.com/containerd/containerd/pull/9596))
* **Allow import and export to reference missing content** ([#9600](https://github.com/containerd/containerd/pull/9600))
* **Remove runc import** ([#9605](https://github.com/containerd/containerd/pull/9605))
* **Update Go version to 1.20.13** ([#9624](https://github.com/containerd/containerd/pull/9624))

### Deprecation Warnings

* **Emit deprecation warning for `containerd.io/restart.logpath` label usage** ([#9567](https://github.com/containerd/containerd/pull/9567))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Akihiro Suda
* Sebastiaan van Stijn
* Wei Fu
* Derek McGowan
* Paweł Gronowski
* Jaroslav Jindrak
* Maksym Pavlenko
* Samuel Karp
* Anthony Nandaa
* Bjorn Neergaard
* Djordje Lukic
* Kay Yan

### Changes
<details><summary>34 commits</summary>
<p>

* [release/1.7] Prepare release notes for v1.7.12 ([#9632](https://github.com/containerd/containerd/pull/9632))
  * [`775d544fe`](https://github.com/containerd/containerd/commit/775d544fe51cb3bb9ed735fdf3e56ec45a84d78a) Prepare release notes for v1.7.12
* [release/1.7] update to go1.20.13, test go1.21.6 ([#9624](https://github.com/containerd/containerd/pull/9624))
  * [`a5dc5b894`](https://github.com/containerd/containerd/commit/a5dc5b894d2bd9bc8bff7c95bdde7564747b138f) update to go1.20.13, test go1.21.6
* [release/1.7] shim: Create pid-file and address with 0644 permissions ([#9548](https://github.com/containerd/containerd/pull/9548))
  * [`8d82242eb`](https://github.com/containerd/containerd/commit/8d82242eb525f87b91bbc2c2499559855dd363cf) shim: Create address file with 0644 permissions
  * [`260963a35`](https://github.com/containerd/containerd/commit/260963a354d972201ffe9a6ce882f1c0e9b319d9) shim: Create pid-file with 0644 permissions
* [release/1.7 backport] switch back from golang.org/x/sys/execabs to os/exec (go1.19) ([#9602](https://github.com/containerd/containerd/pull/9602))
  * [`872af82f5`](https://github.com/containerd/containerd/commit/872af82f572a2f2ff17107dd714c61b0eee2081a) remove remaining uses of golang.org/x/sys/execabs
  * [`2ad2a2e83`](https://github.com/containerd/containerd/commit/2ad2a2e835f27417749c1a0adc47f58e9cae8aa7) switch back from golang.org/x/sys/execabs to os/exec (go1.19)
* [release/1.7] update to CDI v0.6.1, and remove github.com/opencontainers/runc dependency ([#9605](https://github.com/containerd/containerd/pull/9605))
  * [`9251072f7`](https://github.com/containerd/containerd/commit/9251072f784dccd9016109c0864ff11c836c9af7) remove github.com/opencontainers/runc dependency
  * [`4e67213d4`](https://github.com/containerd/containerd/commit/4e67213d4fa02a64b7bb9ed689d68cfc0c4d104a) vendor: github.com/cncf-tags/container-device-interface v0.6.1
  * [`e0ee0be0d`](https://github.com/containerd/containerd/commit/e0ee0be0df3d3e3a951e24f616f2afc92e665c23) go.mod: github.com/opencontainers/runtime-spec v1.1.0
  * [`02be2236a`](https://github.com/containerd/containerd/commit/02be2236a26ac6d72a0d5375e61ddd648fa1261c) go.mod: github.com/.../container-device-interface v0.6.0
  * [`91f953bb4`](https://github.com/containerd/containerd/commit/91f953bb476936d13881781a83b491216d21e3e1) go.mod: github.com/opencontainers/runtime-spec v1.1.0-rc.2
* [release/1.7 backport] import/export: Support references to missing content  ([#9600](https://github.com/containerd/containerd/pull/9600))
  * [`6089b05d9`](https://github.com/containerd/containerd/commit/6089b05d9300c231b2f15cfd50426b97e1f77050) images/Export: Revert signature change
  * [`6b4b760c3`](https://github.com/containerd/containerd/commit/6b4b760c39b3b63755138357d72e0acedb3bee4e) integration/import-export: Add WithSkipMissing tests
  * [`abb3c5ef9`](https://github.com/containerd/containerd/commit/abb3c5ef943148198998a94c44d74cd01e00ad5e) export: Copy distribution source labels to manifest annotations
  * [`9609f04f6`](https://github.com/containerd/containerd/commit/9609f04f6bb9fd203b3955d561d976f34b0d4f4f) import/export: Support references to missing content
  * [`42b60d865`](https://github.com/containerd/containerd/commit/42b60d865296ef1bda5c0f981ef06844e1f58c5d) images/archive: use mediatype helpers
* [release/1.7 backport] update runc binary to v1.1.11 ([#9596](https://github.com/containerd/containerd/pull/9596))
  * [`23516a99c`](https://github.com/containerd/containerd/commit/23516a99c6fc64812a3719ea54004e1a92e9e61d) update runc binary to v1.1.11
* [release/1.7 backport] go.mod: dario.cat/mergo v1.0.0 ([#9569](https://github.com/containerd/containerd/pull/9569))
  * [`428714e32`](https://github.com/containerd/containerd/commit/428714e320b12dd1474c836fa15e79f824edfe2a) go.mod: dario.cat/mergo v1.0.0
* [release/1.7] restart: containerd.io/restart.logpath warning ([#9567](https://github.com/containerd/containerd/pull/9567))
  * [`03fed557e`](https://github.com/containerd/containerd/commit/03fed557e38f3cfeca0652607100c40c86806288) restart: containerd.io/restart.logpath warning
* [release 1.7] backport: fix on dialer function for windows ([#9501](https://github.com/containerd/containerd/pull/9501))
  * [`68d237392`](https://github.com/containerd/containerd/commit/68d2373926bc0a9dcc2fb6cdf49dd2188a327b9f) fix(pkg/dialer): minor fix on dialer function for windows
* [release/1.7] *: enable ARM64 runner ([#9502](https://github.com/containerd/containerd/pull/9502))
  * [`c63165123`](https://github.com/containerd/containerd/commit/c63165123374eaba96616b6ecdd2bb34aaae8e36) *: enable ARM64 runner
* [release/1.7 backport] WithAppendAdditionalGroups: better /etc/group handling ([#9544](https://github.com/containerd/containerd/pull/9544))
  * [`55e570844`](https://github.com/containerd/containerd/commit/55e570844473d689572d68cff7f7bcc5bdcba2ce) WithAppendAdditionalGroups: better /etc/group handling
</p>
</details>

### Dependency Changes

* **dario.cat/mergo**                                                       v1.0.0 **_new_**
* **github.com/container-orchestrated-devices/container-device-interface**  v0.5.4 -> v0.6.1
* **github.com/moby/sys/user**                                              v0.1.0 **_new_**
* **github.com/opencontainers/runtime-spec**                                v1.1.0-rc.1 -> v1.1.0

Previous release can be found at [v1.7.11](https://github.com/containerd/containerd/releases/tag/v1.7.11)

containerd 1.7.11

Welcome to the v1.7.11 release of containerd!

The eleventh patch release for containerd 1.7 contains various fixes and updates including
one security issue.

### Notable Updates

* **Fix Windows default path overwrite issue** ([#9440](https://github.com/containerd/containerd/pull/9440))
* **Update push to always inherit distribution sources from parent** ([#9452](https://github.com/containerd/containerd/pull/9452))
* **Update shim to use net dial for gRPC shim sockets** ([#9458](https://github.com/containerd/containerd/pull/9458))
* **Fix otel version incompatibility** ([#9483](https://github.com/containerd/containerd/pull/9483))
* **Fix Windows snapshotter blocking snapshot GC on remove failure** ([#9482](https://github.com/containerd/containerd/pull/9482))
* **Mask `/sys/devices/virtual/powercap` path in runtime spec and deny in default apparmor profile** ([GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c))

### Deprecation Warnings

* **Emit deprecation warning for AUFS snapshotter** ([#9436](https://github.com/containerd/containerd/pull/9436))
* **Emit deprecation warning for v1 runtime** ([#9450](https://github.com/containerd/containerd/pull/9450))
* **Emit deprecation warning for deprecated CRI configs** ([#9469](https://github.com/containerd/containerd/pull/9469))
* **Emit deprecation warning for CRI v1alpha1 usage** ([#9479](https://github.com/containerd/containerd/pull/9479))
* **Emit deprecation warning for CRIU config in CRI** ([#9481](https://github.com/containerd/containerd/pull/9481))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Derek McGowan
* Phil Estes
* Bjorn Neergaard
* Danny Canter
* Sebastiaan van Stijn
* ruiwen-zhao
* Akihiro Suda
* Amit Barve
* Charity Kathure
* Maksym Pavlenko
* Milas Bowman
* Paweł Gronowski
* Wei Fu

### Changes
<details><summary>39 commits</summary>
<p>

* [release/1.7] Prepare release notes for v1.7.11 ([#9491](https://github.com/containerd/containerd/pull/9491))
  * [`dfae68bc3`](https://github.com/containerd/containerd/commit/dfae68bc3e614a091d0a468c9026da370e3de0d9) Prepare release notes for v1.7.11
* [release/1.7] update to go1.20.12, test go1.21.5 ([#9352](https://github.com/containerd/containerd/pull/9352))
  * [`0d314401d`](https://github.com/containerd/containerd/commit/0d314401d9b9ad470153dc3d09f6d9cd7d527697) update to go1.20.12, test go1.21.5
  * [`1ec1ae2c6`](https://github.com/containerd/containerd/commit/1ec1ae2c6b6458b5d000af1ec6263b4ee337cd58) update to go1.20.11, test go1.21.4
* Github Security Advisory [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)
  * [`cb804da21`](https://github.com/containerd/containerd/commit/cb804da2101074c769a2a327597c9595b38bb4f0) contrib/apparmor: deny /sys/devices/virtual/powercap
  * [`40162a576`](https://github.com/containerd/containerd/commit/40162a576232b7d95325f85334590ea295d2ed2e) oci/spec: deny /sys/devices/virtual/powercap
* [release/1.7] Don't block snapshot garbage collection on Remove failures ([#9482](https://github.com/containerd/containerd/pull/9482))
  * [`ed7c6895b`](https://github.com/containerd/containerd/commit/ed7c6895bd3b33ccc7cfbc8cbd43f6a31333328a) Don't block snapshot garbage collection on Remove failures
* [release/1.7] Add warning for CRIU config usage ([#9481](https://github.com/containerd/containerd/pull/9481))
  * [`1fdefdd22`](https://github.com/containerd/containerd/commit/1fdefdd2242fcf704a11f1d6b5149e056ce98ed3) Add warning for CRIU config usage
* [release/1.7] Fix otel version incompatibility ([#9483](https://github.com/containerd/containerd/pull/9483))
  * [`f8f659e66`](https://github.com/containerd/containerd/commit/f8f659e66c6ec56fef092dced085d129c0e67176) Add HTTP client update function to tracing library
  * [`807ddd658`](https://github.com/containerd/containerd/commit/807ddd658b4cd6c0325204e7a19a4561a10906d2) fix(tracing): use latest version of semconv
* [release/1.7] Add cri-api v1alpha2 usage warning to all api calls ([#9479](https://github.com/containerd/containerd/pull/9479))
  * [`dc45bc838`](https://github.com/containerd/containerd/commit/dc45bc8381fa2cd903e871c81ce7b4c08e82ca3b) Add cri-api v1alpha2 usage warning to all api calls
* [release/1.7] cri: add deprecation warnings for deprecated CRI configs ([#9469](https://github.com/containerd/containerd/pull/9469))
  * [`9d1bad62e`](https://github.com/containerd/containerd/commit/9d1bad62e16f31e0b06c75e1007a623879529a6d) deprecation: fix missing spaces in warnings
  * [`51a604c07`](https://github.com/containerd/containerd/commit/51a604c0733437f4b7a20aa5ec1e6d4b4f0ab96e) cri: add deprecation warning for runtime_root
  * [`8040e74bf`](https://github.com/containerd/containerd/commit/8040e74bf8e6c25c02bb461b82f482cff24ce611) cri: add deprecation warning for rutnime_engine
  * [`99adc40eb`](https://github.com/containerd/containerd/commit/99adc40eb28db7cb93c378ff8bceb8e77559ae09) cri: add deprecation warning for default_runtime
  * [`afef7ec64`](https://github.com/containerd/containerd/commit/afef7ec646910ce1db3e824bfe17848428f3b47b) cri: add warning for untrusted_workload_runtime
  * [`6220dc190`](https://github.com/containerd/containerd/commit/6220dc1909883119a960bc96c496ae2361b94749) cri: add warning for old form of systemd_cgroup
* [release/1.7] runtime/v2: net.Dial gRPC shim sockets before trying grpc ([#9458](https://github.com/containerd/containerd/pull/9458))
  * [`80f96cd18`](https://github.com/containerd/containerd/commit/80f96cd188949bd9fa16256a8ff0b858ef692f20) runtime/v2: net.Dial gRPC shim sockets before trying grpc
* [release/1.7] tasks: emit warning for v1 runtime and runc v1 runtime ([#9450](https://github.com/containerd/containerd/pull/9450))
  * [`f471bb2b8`](https://github.com/containerd/containerd/commit/f471bb2b8e5a902ad8901c7c0db85ecead8c1730) tasks: emit warning for runc v1 runtime
  * [`329e1d487`](https://github.com/containerd/containerd/commit/329e1d487e7cc5c2773a2472df56b6eb75ae9194) tasks: emit warning for v1 runtime
* [release/1.7] push: always inherit distribution sources from parent ([#9452](https://github.com/containerd/containerd/pull/9452))
  * [`4464fde12`](https://github.com/containerd/containerd/commit/4464fde12985d98a9edbf124c54afa1156415572) push: always inherit distribution sources from parent
* [release/1.7] Update tar tests to run on Darwin ([#9451](https://github.com/containerd/containerd/pull/9451))
  * [`7e069ee25`](https://github.com/containerd/containerd/commit/7e069ee25868e5c8a67610720f8280c3451a3103) Update tar tests to run on Darwin
* [release/1.7] ctr: Add sandbox flag to ctr run ([#9449](https://github.com/containerd/containerd/pull/9449))
  * [`5fc0e4e61`](https://github.com/containerd/containerd/commit/5fc0e4e6151dafa4d5ca8837f3d99b6a8e816866) ctr: Add sandbox flag to ctr run
* [release/1.7] Windows default path overwrite fix ([#9440](https://github.com/containerd/containerd/pull/9440))
  * [`31fe03764`](https://github.com/containerd/containerd/commit/31fe03764c436677a1db9be24c25f7c11780eceb) Fix windows default path overwrite issue
* [release/1.7] snapshots: emit deprecation warning for aufs ([#9436](https://github.com/containerd/containerd/pull/9436))
  * [`625b35e4b`](https://github.com/containerd/containerd/commit/625b35e4bb26ee021713f2692143bf37f9a98bdd) snapshots: emit deprecation warning for aufs
</p>
</details>

### Dependency Changes

* **github.com/felixge/httpsnoop**                                   v1.0.3 **_new_**
* **go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp**  v0.45.0 **_new_**

Previous release can be found at [v1.7.10](https://github.com/containerd/containerd/releases/tag/v1.7.10)

containerd 1.6.26

Welcome to the v1.6.26 release of containerd!

The twenty-sixth patch release for containerd 1.6 contains various fixes and updates.

### Notable Updates

* **Fix windows default path overwrite issue** ([#9441](https://github.com/containerd/containerd/pull/9441))
* **Update push to inherit distribution sources from parent** ([#9453](https://github.com/containerd/containerd/pull/9453))
* **Mask `/sys/devices/virtual/powercap` path in runtime spec and deny in default apparmor profile** ([GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c))

### Deprecation Warnings

* **Emit deprecation warning for AUFS snapshotter usage** ([#9448](https://github.com/containerd/containerd/pull/9448))
* **Emit deprecation warning for v1 runtime usage** ([#9468](https://github.com/containerd/containerd/pull/9468))
* **Emit deprecation warning for CRI v1alpha1 usage** ([#9468](https://github.com/containerd/containerd/pull/9468))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Samuel Karp
* Derek McGowan
* Kohei Tokunaga
* Phil Estes
* Bjorn Neergaard
* Sebastiaan van Stijn
* Brian Goff
* Charity Kathure
* Kazuyoshi Kato
* Milas Bowman
* Wei Fu
* ruiwen-zhao

### Changes
<details><summary>30 commits</summary>
<p>

* [release/1.6] Prepare release notes for v1.6.26 ([#9490](https://github.com/containerd/containerd/pull/9490))
  * [`ac5c5d3e0`](https://github.com/containerd/containerd/commit/ac5c5d3e03ab3c5b8103a1c0bd9931389f7a8fcf) Prepare release notes for v1.6.26
* Github Security Advisory [GHSA-7ww5-4wqc-m92c](https://github.com/containerd/containerd/security/advisories/GHSA-7ww5-4wqc-m92c)
  * [`02f07fe19`](https://github.com/containerd/containerd/commit/02f07fe1994a3ddda3626c1ede2e32bc82b8e426) contrib/apparmor: deny /sys/devices/virtual/powercap
  * [`c94577e78`](https://github.com/containerd/containerd/commit/c94577e78d2924ddeb90d1601e31b50ee3acac48) oci/spec: deny /sys/devices/virtual/powercap
* [release/1.6] update to go1.20.12, test go1.21.5 ([#9472](https://github.com/containerd/containerd/pull/9472))
  * [`7cbdfc92e`](https://github.com/containerd/containerd/commit/7cbdfc92ef38f789f1a2773fa6fac405d361a6cc) update to go1.20.12, test go1.21.5
  * [`024b1cce6`](https://github.com/containerd/containerd/commit/024b1cce6b27f10e00bb9bde33a5fe9563545f8d) update to go1.20.11, test go1.21.4
* [release/1.6] Add cri-api v1alpha2 usage warning to all api calls ([#9484](https://github.com/containerd/containerd/pull/9484))
  * [`64e56bfde`](https://github.com/containerd/containerd/commit/64e56bfde95828660971673d20952f275cc2c0ba) Add cri-api v1alpha2 usage warning to all api calls
* [release/1.6] tasks: emit warning for v1 runtime and runc v1 runtime ([#9468](https://github.com/containerd/containerd/pull/9468))
  * [`efefd3bf3`](https://github.com/containerd/containerd/commit/efefd3bf334b5df0e97bff0be61ba906a9b3b528) tasks: emit warning for runc v1 runtime
  * [`7825689b4`](https://github.com/containerd/containerd/commit/7825689b4c4d68cc1cc3c6dd072c2c2ec7b2d88e) tasks: emit warning for v1 runtime
* [release/1.6] snapshots: emit deprecation warning for aufs ([#9448](https://github.com/containerd/containerd/pull/9448))
  * [`7cfe7052f`](https://github.com/containerd/containerd/commit/7cfe7052f4a2ad97e4e8032469aef588d2f0858c) snapshots: emit deprecation warning for aufs
* [release/1.6] cherry-pick/backport: Update golangci lint ([#9455](https://github.com/containerd/containerd/pull/9455))
  * [`a1ae572a2`](https://github.com/containerd/containerd/commit/a1ae572a2778bf599e93929f5145f707b667f508) Fix linter error with updated linter
  * [`b638791d6`](https://github.com/containerd/containerd/commit/b638791d66b2e34f044f04736632995446b79314) ci: bump up golangci-lint to v1.55.0
  * [`2370a2842`](https://github.com/containerd/containerd/commit/2370a2842318833b16a8274835374d0811c2ed28) Fix linter issues for golangci-lint 1.54.2
  * [`8a65e2e31`](https://github.com/containerd/containerd/commit/8a65e2e31b6710f94be64c7fada727bd2569d16f) Bump up golangci-lint to v1.54.2
  * [`969f8feb2`](https://github.com/containerd/containerd/commit/969f8feb2e0932a9f9c69f1696e552fcdcd2b31b) Bump up golangci-lint to v1.52.2
* [release/1.6] push: inherit distribution sources from parent ([#9453](https://github.com/containerd/containerd/pull/9453))
  * [`66959fdf5`](https://github.com/containerd/containerd/commit/66959fdf50d16520a84fb14c9467c0d87b7f0274) push: inherit distribution sources from parent
  * [`b4dcffcfb`](https://github.com/containerd/containerd/commit/b4dcffcfbff2694796a04243728700b37dc78d8e) content: add InfoProvider interface
  * [`bef4145c1`](https://github.com/containerd/containerd/commit/bef4145c141ad2c37e7797b4dc53b8e429b368ae) Change PushContent to require only Provider
* [release/1.6] Bump google.golang.org/grpc to v1.58.3 ([#9408](https://github.com/containerd/containerd/pull/9408))
  * [`a5fc21060`](https://github.com/containerd/containerd/commit/a5fc21060b5254be9ca28e63c1c5a7364b551ca5) vendor: google.golang.org/grpc v1.58.3
  * [`4fa05b3d8`](https://github.com/containerd/containerd/commit/4fa05b3d83488e4bc81241db1a65ca00fedec45d) Upgrade github.com/klauspost/compress from v1.11.13 to v1.15.9
* [release/1.6] Windows default path overwrite fix ([#9441](https://github.com/containerd/containerd/pull/9441))
  * [`ede0ad5e1`](https://github.com/containerd/containerd/commit/ede0ad5e12826d574623a79b71bb1fbc49e75172) Fix windows default path overwrite issue
</p>
</details>

### Dependency Changes

* **cloud.google.com/go/compute/metadata**  v0.2.3 **_new_**
* **github.com/cespare/xxhash/v2**          v2.1.2 -> v2.2.0
* **github.com/golang/protobuf**            v1.5.2 -> v1.5.3
* **github.com/klauspost/compress**         v1.11.13 -> v1.15.9
* **go.opencensus.io**                      v0.23.0 -> v0.24.0
* **golang.org/x/oauth2**                   2bc19b11175f -> v0.10.0
* **golang.org/x/sync**                     v0.1.0 -> v0.3.0
* **google.golang.org/grpc**                v1.50.1 -> v1.58.3
* **google.golang.org/protobuf**            v1.28.1 -> v1.31.0

Previous release can be found at [v1.6.25](https://github.com/containerd/containerd/releases/tag/v1.6.25)

containerd 1.7.10

Welcome to the v1.7.10 release of containerd!

The tenth patch release for containerd 1.7 contains various fixes and updates.
### Notable Updates
* **Enhance container image unpack client logs** ([#9379](https://github.com/containerd/containerd/pull/9379))
* **cri: fix using the pinned label to pin image** ([#9381](https://github.com/containerd/containerd/pull/9381))
* **fix: ImagePull should close http connection if there is no available data to read.** ([#9409](https://github.com/containerd/containerd/pull/9409))

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

### Contributors

* Wei Fu
* Iceber Gu
* Austin Vazquez
* Derek McGowan
* Phil Estes
* Samuel Karp
* ruiwen-zhao

### Changes
<details><summary>11 commits</summary>
<p>

* Add release notes for v1.7.10 ([#9426](https://github.com/containerd/containerd/pull/9426))
  * [`a995fe3a8`](https://github.com/containerd/containerd/commit/a995fe3a81a933c984ba13dc8bef0271d1aca171) Add release notes for v1.7.10
* [release/1.7] fix: ImagePull should close http connection if there is no available data to read. ([#9409](https://github.com/containerd/containerd/pull/9409))
  * [`206806128`](https://github.com/containerd/containerd/commit/206806128917276994f0949dc599e4c8b8ad8f14) remotes/docker: close connection if no more data
  * [`328493962`](https://github.com/containerd/containerd/commit/32849396263f9c68f7c4f43a2abc1319488546de) integration: reproduce #9347
  * [`d1aab27cb`](https://github.com/containerd/containerd/commit/d1aab27cbd8ae75d90ad962a256d6af092dcf451) fix: deflake TestCRIImagePullTimeout/HoldingContentOpenWriter
* [release/1.7] cri: fix using the pinned label to pin image ([#9381](https://github.com/containerd/containerd/pull/9381))
  * [`a2b16d7f9`](https://github.com/containerd/containerd/commit/a2b16d7f9cd44f81ebdcffe92dee107b2ebdca8a) cri: fix update of pinned label for images
  * [`8dc861844`](https://github.com/containerd/containerd/commit/8dc8618442ad99a254de79200c89eb12284dac6e) cri: fix using the pinned label to pin image
* [release/1.7] Enhance container image unpack client logs ([#9379](https://github.com/containerd/containerd/pull/9379))
  * [`5930a3750`](https://github.com/containerd/containerd/commit/5930a3750c5db69abf7668e4df003aae8f0beace) Enhance container image unpack client logs
</p>
</details>

### Dependency Changes

This release has no dependency changes

Previous release can be found at [v1.7.9](https://github.com/containerd/containerd/releases/tag/v1.7.9)