containerd - Debian Package Tracker

general

source: containerd (main)
version: 1.7.24~ds1-10
maintainer: Debian Go Packaging Team (DMD)
uploaders: Reinhard Tartler [DMD] – Tianon Gravi [DMD] – Tim Potter [DMD] – Shengjing Zhu [DMD]
arch: all
std-ver: 4.7.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.4.13~ds1-1~deb11u4
o-o-sec: 1.4.13~ds1-1~deb11u5
oldstable: 1.6.20~ds1-1+deb12u1
stable: 1.7.24~ds1-6
testing: 1.7.24~ds1-10
unstable: 1.7.24~ds1-10

versioned links

1.4.13~ds1-1~deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.4.13~ds1-1~deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.6.20~ds1-1+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.7.24~ds1-6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.7.24~ds1-10: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

containerd
golang-github-containerd-containerd-api-dev
golang-github-containerd-containerd-dev

action needed

Debci reports failed tests high

unstable: pass (log)
The tests ran in 0:03:16
Last run: 2025-11-08T10:31:50.000Z
Previous status: unknown

testing: pass (log)
The tests ran in 0:02:42
Last run: 2025-10-30T13:34:52.000Z
Previous status: unknown

stable: fail (log)
The tests ran in 0:14:39
Last run: 2025-11-09T18:04:36.000Z
Previous status: unknown

Created: 2025-11-09 Last update: 2025-11-10 11:02

A new upstream version is available: 1.7.29 high

A new upstream version 1.7.29 is available, you should consider packaging it.

Created: 2025-11-08 Last update: 2025-11-10 09:01

2 security issues in trixie high

There are 2 open security issues in trixie.

2 important issues:

CVE-2024-25621: containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
CVE-2025-64329: containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

Created: 2025-11-06 Last update: 2025-11-10 06:30

2 security issues in bullseye high

There are 2 open security issues in bullseye.

2 important issues:

CVE-2024-25621: containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
CVE-2025-64329: containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

Created: 2025-11-06 Last update: 2025-11-10 06:30

3 security issues in bookworm high

There are 3 open security issues in bookworm.

2 important issues:

CVE-2024-25621: containerd is an open-source container runtime. Versions 0.1.0 through 1.7.28, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4 and 2.2.0-beta.0 through 2.2.0-rc.1 have an overly broad default permission vulnerability. Directory paths `/var/lib/containerd`, `/run/containerd/io.containerd.grpc.v1.cri` and `/run/containerd/io.containerd.sandbox.controller.v1.shim` were all created with incorrect permissions. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. Workarounds include updating system administrator permissions so the host can manually chmod the directories to not have group or world accessible permissions, or to run containerd in rootless mode.
CVE-2025-64329: containerd is an open-source container runtime. Versions 1.7.28 and below, 2.0.0-beta.0 through 2.0.6, 2.1.0-beta.0 through 2.1.4, and 2.2.0-beta.0 through 2.2.0-rc.1 contain a bug in the CRI Attach implementation where a user can exhaust memory on the host due to goroutine leaks. This issue is fixed in versions 1.7.29, 2.0.7, 2.1.5 and 2.2.0. To workaround this vulnerability, users can set up an admission controller to control accesses to pods/attach resources.

1 issue left for the package maintainer to handle:

CVE-2024-40635: (needs triaging) containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a `UID:GID` larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as root (UID 0). This could cause unexpected behavior for environments that require containers to run as a non-root user. This bug has been fixed in containerd 1.6.38, 1.7.27, and 2.04. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images.

You can find information about how to handle this issue in the security team's documentation.

Created: 2025-03-18 Last update: 2025-11-10 06:30

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

golang-github-containerd-containerd-api-dev could be marked Multi-Arch: foreign

Created: 2025-08-16 Last update: 2025-11-10 11:01

3 open merge requests in Salsa normal

There are 3 open merge requests for this package on Salsa. You should consider reviewing and/or merging these merge requests.

Created: 2025-09-16 Last update: 2025-11-10 02:00

19 new commits since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 5e72d13e5ef9facd3f8398b4bbc29c188f285569
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Nov 7 20:08:14 2025 -0500

    debian/changelog: update

commit 4456f5e45b5cba995331b9bfe8d8dbcc4f3fbc35
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Nov 7 20:07:10 2025 -0500

    fix goroutine leak of container Attach, Closes: #1120343
    
    This is tracked as CVE-2025-64329

commit 44dd36e81027f86f4894819e42e3bc00fc02714e
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Nov 6 20:27:26 2025 -0500

    debian/changelog: update

commit a64c733397de1f0488009277229a67b5fcbba8a1
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Nov 6 20:32:16 2025 -0500

    golang-github-containerd-containerd-api-dev: add ${misc:Depends}

commit 05142900728ac14d1fba0f5266097f2f9c3dbe63
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Nov 6 20:33:00 2025 -0500

    debian/control: Switch to using Static-Build-Using

commit bf475676fee53dbb053ca79faa73d4f7e8b0554f
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Nov 6 20:25:53 2025 -0500

    debian/control: Drop redundant Rules-Requires-Root

commit 9f7d4051907f825587b76a67b0ad85fe84945129
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Nov 6 20:25:43 2025 -0500

    Bump Standards Version, no changes needed

commit 4e531563d31cc0d55f1dc7f6b8b725c5467db514
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Nov 6 20:24:40 2025 -0500

    Backport patch for CVE-2024-25621, Closes: #1120285

commit bf11fa5c213c55f6bffdd9fe996c09891ac361d0
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 10:31:24 2025 -0400

    golang-github-containerd-containerd-api-dev: Add missing Breaks

commit b4a74edb5fbd2cd49fec292b89989a5590a1580e
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 09:34:44 2025 -0400

    debian/changelog: update

commit 81d50e057644a985ad57d78c27cc7751220ea83c
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 09:34:06 2025 -0400

    Update changelog for 1.7.24~ds1-8 release

commit f41303d7a9bbd6ddd2ff7fb221932a2d3f710833
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 08:44:17 2025 -0400

    silence lintian error

commit 9abb7a38afd2434d601d1111f0962912bc991977
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 08:40:52 2025 -0400

    golang-github-containerd-containerd-api-dev: Add missing Replaces

commit dc206b387e8c0ad50f00ad4dd8a1ae7e2f1ec58f
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 07:00:18 2025 -0400

    fixup2 patch to fix incus autopkgtest

commit 1443df2e1729c55dd748aadc3e3aca51a8de855f
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Fri Aug 15 06:21:51 2025 -0400

    fixup patch to fix incus autopkgtest

commit 24b3230dcf6633a4ea32c47c469e49281dc326e9
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Aug 14 21:52:57 2025 -0400

    autopkgtest: redirect stderr to stdout

commit e4befc30e06ec3ed1a9b3d74da2fe6f4bd2992ff
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Aug 14 21:52:10 2025 -0400

    oci/utils_unix_test.go: Cover for incus/lxd test failures

commit 3b0810edfa48266e25efd4686785afcc1124e1ac
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Thu Aug 14 18:53:38 2025 -0400

    autopkgtests: require qemu, add procps

commit 3d19088c712f7875e2eb987a8fedf7a4d46712cc
Author: Reinhard Tartler <siretart@tauware.de>
Date:   Wed Aug 13 20:51:27 2025 -0400

    Unbreak builds without arch-indep packages

Created: 2025-08-14 Last update: 2025-11-10 02:00

lintian reports 5 warnings normal

Lintian reports 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2025-11-08 Last update: 2025-11-08 15:30

debian/patches: 8 patches to forward upstream low

Among the 14 debian patches available in version 1.7.24~ds1-10 of the package, we noticed the following issues:

8 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2025-11-08 08:00

news

[rss feed]

[2025-11-10] containerd 1.7.24~ds1-10 MIGRATED to testing (Debian testing watch)
[2025-11-08] Accepted containerd 1.7.24~ds1-10 (source) into unstable (Reinhard Tartler)
[2025-11-07] Accepted containerd 1.7.24~ds1-9 (source) into unstable (Reinhard Tartler)
[2025-08-20] containerd 1.7.24~ds1-8 MIGRATED to testing (Debian testing watch)
[2025-08-15] Accepted containerd 1.7.24~ds1-8 (source) into unstable (Reinhard Tartler)
[2025-08-14] Accepted containerd 1.7.24~ds1-7 (all amd64 source) into experimental (Debian FTP Masters) (signed by: Reinhard Tartler)
[2025-05-15] containerd 1.7.24~ds1-6 MIGRATED to testing (Debian testing watch)
[2025-05-04] Accepted containerd 1.4.13~ds1-1~deb11u5 (source) into oldstable-security (Andreas Henriksson)
[2025-04-29] Accepted containerd 1.7.24~ds1-6 (source) into unstable (Andreas Henriksson)
[2025-04-14] containerd 1.7.24~ds1-5 MIGRATED to testing (Debian testing watch)
[2025-04-08] Accepted containerd 1.7.24~ds1-5 (source) into unstable (Tianon Gravi)
[2025-02-03] Accepted containerd 1.6.20~ds1-1+deb12u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Jonathan Wiltshire)
[2024-12-24] containerd 1.7.24~ds1-4 MIGRATED to testing (Debian testing watch)
[2024-12-21] Accepted containerd 1.7.24~ds1-4 (source) into unstable (Reinhard Tartler)
[2024-12-20] Accepted containerd 1.7.24~ds1-3 (source) into unstable (Reinhard Tartler)
[2024-12-20] Accepted containerd 1.7.24~ds1-2 (source) into unstable (Reinhard Tartler)
[2024-12-13] Accepted containerd 1.7.24~ds1-1 (source) into unstable (Reinhard Tartler)
[2024-11-06] containerd 1.7.23~ds2-1 MIGRATED to testing (Debian testing watch)
[2024-11-02] Accepted containerd 1.7.23~ds2-1 (source) into unstable (Reinhard Tartler)
[2024-11-01] Accepted containerd 1.7.23~ds1-3 (source) into unstable (Reinhard Tartler)
[2024-10-31] Accepted containerd 1.7.23~ds1-2 (source) into unstable (Reinhard Tartler)
[2024-10-29] Accepted containerd 1.7.23~ds1-1 (source) into experimental (Reinhard Tartler)
[2024-10-01] containerd 1.7.22~ds1-1 MIGRATED to testing (Debian testing watch)
[2024-09-28] Accepted containerd 1.7.22~ds1-1 (source) into unstable (Reinhard Tartler)
[2024-09-05] containerd 1.7.20~ds2-2 MIGRATED to testing (Debian testing watch)
[2024-09-04] Accepted containerd 1.7.21~ds2-1 (source) into experimental (Reinhard Tartler)
[2024-09-02] Accepted containerd 1.7.20~ds2-2 (source) into unstable (Reinhard Tartler)
[2024-09-01] Accepted containerd 1.7.20~ds2-1 (source) into experimental (Reinhard Tartler)
[2024-08-15] containerd 1.7.18~ds2-1 MIGRATED to testing (Debian testing watch)
[2024-08-08] Accepted containerd 1.7.18~ds2-1 (source) into unstable (Shengjing Zhu)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 5)
buildd: logs, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
screenshots
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.7.24~ds1-10ubuntu1
2 bugs
patches for 1.7.24~ds1-10ubuntu1