Package: containerd
Version: 2.1.9+ds1-1
Severity: normal
Dear team,
this bug tracks moving containerd in unstable from the 2.1.x series to
2.2.x. The short version: upstream has ended support for the 2.1 branch,
and the only way out of the current security situation is to move to
2.2.
WHY NOW
=======
CVE-2026-46680 (#1141499, GHSA-fqw6-gf59-qr4w) is the immediate reason.
It lets a crafted image get around the Kubernetes runAsNonRoot guard by
abusing the numeric User field. Upstream is explicit that the 2.1 branch
is EOL and will not get a fix; the corrected code landed in 1.7.32,
2.0.9, 2.2.4 and 2.3.1. Since unstable already moved past the 1.7 line
and now ships 2.1.9+ds1-1, the realistic path forward is 2.2.x. The
longer we stay on 2.1.x, the longer we carry a publicly known, unfixable
container runtime vulnerability. Even absent this CVE, 2.1 is now
shelved upstream, so it is a dead end for future security support.
RISK
====
containerd backs docker.io, which Depends on containerd (>= 1.4~) and
has substantial popcon. A 2.1 -> 2.2 move is a runtime transition, so I
want to validate it against:
* docker.io integration
* the Kubernetes CRI plugin (k8s / nerdctl users)
* the v2 shim API, which changed between the two series
DEPENDENCIES
============
I compared the go.mod files of the current 2.1.9 and the target 2.2.5.
The following Debian packages look like they may need a version bump.
I want to stress that these were identified by diffing the two go.mod
files; whether each one is strictly required is something to confirm
during the actual build. They are all worth updating regardless, since
they track upstream releases:
golang-github-containerd-cgroups 3.0.5 -> 3.1.2
golang-github-containerd-nri 0.8.0 -> 0.11.0
golang-github-kubernetes-cri-api 0.32.3 -> 0.34.1
golang-k8s-apimachinery 0.33.4 -> 0.34.1
golang-k8s-client-go 0.33.4 -> 0.34.1
golang-k8s-api (indirect) 0.33.4 -> 0.34.1
golang-k8s-apiserver (indirect) 0.33.4 -> 0.34.1
golang-github-checkpoint-restore-checkpointctl 1.3.0 -> 1.4.0
golang-github-intel-goresctrl 0.3.0 -> 0.10.0
golang-github-opencontainers-specs 1.2.1 -> 1.3.0
golang-github-urfave-cli-v2 2.25.7 -> 2.27.7
golang-golang-x-sys 0.45.0 -> 0.46.0
golang-golang-x-sync 0.20.0 -> 0.21.0
golang-tags.cncf-container-device-interface 1.0.1 -> 1.1.0
Related bugs I'm aware of that already ask for some of these updates:
* #1122216 - golang-github-opencontainers-specs: Upload version 1.3.0
to unstable. 1.3.0-1 is in experimental already; getting it to
unstable unblocks this row (and vice versa).
* #1115790 - golang-github-containerd-cgroups FTBFS (minor). Bumping to
3.1.2 presumably supersedes it.
* #1104389 - golang-k8s-apimachinery flaky FTBFS. The 0.34.1 bump
likely addresses it.
* #1140131 - golang-k8s-client-go flaky FTBFS. Likewise, likely
addressed by the 0.34.1 bump.
Two pleasant surprises from the go.mod diff: k8s.io/kubelet is dropped
in 2.2.5, so golang-github-kubernetes-kubelet-dev can come out of
Build-Depends; and containerd/api v1.10.0 is packaged from this very
source (golang-github-containerd-containerd-api-dev), so it follows the
bump automatically. Most remaining go.mod requirements are already
satisfied in unstable (grpc 1.81.1, protobuf 1.36.10, go-jose 4.1.4,
ttrpc 1.2.7, image-spec 1.1.1, cni 1.3.0, plugins 1.9.1,
klauspost-compress 1.19.0, ...).
PLAN
====
1. Push the runtime-spec 1.3.0 series from experimental to unstable
(#1122216), since it appears to be the linchpin for several of the
listed packages.
2. Work through the bumps above, treating the k8s.io/* move to 0.34.1 as
one coordinated change.
3. Update containerd to 2.2.x (2.2.5 or later), rebase the Debian delta,
drop the kubelet build-dep.
4. Verify docker.io and CRI integration via autopkgtests, confirm the v2
shim transition, then aim for migration to testing.
This bug tracks the 2.1 -> 2.2 upgrade; it Blocks #1141499
(CVE-2026-46680).
-- System Information:
Debian Release: forky/sid
APT prefers testing
APT policy: (500, 'testing'), (50, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 7.1.3+deb14-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charset=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
