Skip to content

Upgrade containerd2 to 2.1.7#16665

Open
jykanase wants to merge 5 commits intomicrosoft:3.0-devfrom
Kanishk-Bansal:topic_containerd2-3.0
Open

Upgrade containerd2 to 2.1.7#16665
jykanase wants to merge 5 commits intomicrosoft:3.0-devfrom
Kanishk-Bansal:topic_containerd2-3.0

Conversation

@jykanase
Copy link
Copy Markdown
Contributor

@jykanase jykanase commented Apr 14, 2026

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge

Summary
  • Upgrade containerd2 to 2.1.7
  • containerd2.signatures.json — Update source tarball hash
  • cgmanifest.json — Update version and download URL
  • skipping the test "TestCgroupNamespace" because the kernel doesn’t support cgroup namespaces.
  • multi-snapshotters-support.patch — Rebase for 2.1.7
  • Removed 10 CVE patches now fixed upstream in 2.1.7:
    • CVE-2024-25621.patch
    • CVE-2024-40635.patch
    • CVE-2024-45338.patch
    • CVE-2025-22872.patch
    • CVE-2025-27144.patch
    • CVE-2025-47291.patch
    • CVE-2025-47911.patch
    • CVE-2025-58190.patch
    • CVE-2025-64329.patch
    • fix-credential-leak-in-cri-errors.patch
Change Log
  • Removed 10 CVE patches now fixed upstream in 2.1.7
Does this affect the toolchain?

NO

Associated issues
  • #xxxx
Links to CVEs
Test Methodology
Screenshot 2026-04-15 143956

@jykanase jykanase requested a review from a team as a code owner April 14, 2026 09:35
@microsoft-github-policy-service microsoft-github-policy-service bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Apr 14, 2026
@Kanishk-Bansal Kanishk-Bansal changed the title Upgrade containerd2 to 2.1.6 Upgrade containerd2 to 2.1.6 Apr 14, 2026
Copy link
Copy Markdown
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix the Release: 3%{?dist} to Release: 1%{?dist}

Copy link
Copy Markdown
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

make the patch numbers start from 0

@Kanishk-Bansal Kanishk-Bansal self-requested a review April 14, 2026 09:55
@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Full Build

@acortelyou
Copy link
Copy Markdown
Member

lgtm, also: #16652

Comment thread SPECS/containerd2/containerd2.spec
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com>
@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Buddy Build

Comment thread SPECS/containerd2/multi-snapshotters-support.patch
Comment thread SPECS/containerd2/containerd2.spec Outdated
Comment thread SPECS/containerd2/containerd2.spec Outdated
Signed-off-by: Kanishk Bansal <kanbansal@microsoft.com>
@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Build

Copy link
Copy Markdown

@cpuguy83 cpuguy83 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This LGTM but I would recommend updating to 2.1.7 which just came out today.

@jykanase jykanase changed the title Upgrade containerd2 to 2.1.6 Upgrade containerd2 to 2.1.7 Apr 15, 2026
export BUILDTAGS="-mod=vendor"
make VERSION="%{version}" REVISION="%{commit_hash}" test
#skipping the test "TestCgroupNamespace" because the kernel doesn’t support cgroup namespaces.
make VERSION="%{version}" REVISION="%{commit_hash}" test TESTFLAGS='-run ^Test.* -skip TestCgroupNamespace'
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

skipping the test "TestCgroupNamespace" because the kernel doesn’t support cgroup namespaces.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Kanishk-Bansal
Copy link
Copy Markdown
Contributor

Buddy Build

@Kanishk-Bansal Kanishk-Bansal self-requested a review April 15, 2026 11:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3.0-dev PRs Destined for AzureLinux 3.0 Packaging

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants