containerd2: upgrade to 2.3.4 and runc to 1.4.3 by liunan-ms · Pull Request #18777 · microsoft/azurelinux

Nan Liu (liunan-ms) · 2026-09-09T17:20:00Z

Summary

Upgrade containerd2 to 2.3.4.
Upgrade runc to 1.4.3.
Build runc with Go < 1.25 to retain the established pre-systemcrypto toolchain.
Rebase the multi-snapshotter and CVE-2026-56852 patches.
Remove containerd CVE patches fixed upstream.

Validation

Buddy build - 1197196 - Passed
aks-image-build- 1197209 - Passed
aks-pre-release-tests - 1197279 - Passed
aks-core-conformance-tests - 1197293 - Passed
aks-e2e-tests - 1197813 - Passed
Kata
- aks-kata-conformance-tests - 1197295 - Passed
- aks-kata-performance-tests - 1199762 - Passed
HPC
- dev-HPC-Image-Build - 1198698 - Passed
- dev-azureLinux-pre-release-gpu-testing - 1198825 - Passed
ACL - Passed

Update runc to 1.4.3 and build it with Go < 1.25 to retain the established pre-systemcrypto toolchain without an explicit systemcrypto policy opt-out.

Copilot

🟡 Changes recommended

Snapshotter availability can be misdetected or remain stale, causing failed sandbox creation or repeated image pulls.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Upgrades Azure Linux’s container runtime packages and synchronizes patches and supply-chain metadata.

Changes:

Upgrades containerd2 to 2.3.4 and runc to 1.4.3.
Rebases retained patches and removes fixes now provided upstream.
Updates source hashes, signatures, changelogs, and component manifests.

File summaries

File	Description
`SPECS/runc/runc.spec`	Updates runc version, commit, and changelog.
`SPECS/runc/runc.signatures.json`	Updates the runc source signature.
`SPECS/containerd2/multi-snapshotters-support.patch`	Rebases multi-snapshotter support.
`SPECS/containerd2/CVE-2026-56852.patch`	Rebases the retained Unicode normalization fix.
`SPECS/containerd2/CVE-2026-53492.patch`	Removes an upstreamed checkpoint fix.
`SPECS/containerd2/CVE-2026-53489.patch`	Removes upstreamed checkpoint hardening.
`SPECS/containerd2/CVE-2026-53488.patch`	Removes upstreamed label filtering.
`SPECS/containerd2/CVE-2026-50195.patch`	Removes an upstreamed checkpoint fix.
`SPECS/containerd2/CVE-2026-47262.patch`	Removes upstreamed user-file bounds.
`SPECS/containerd2/CVE-2026-42506.patch`	Removes an upstreamed HTML parser fix.
`SPECS/containerd2/CVE-2026-42502.patch`	Removes an upstreamed HTML rendering fix.
`SPECS/containerd2/CVE-2026-39882.patch`	Removes upstreamed OTLP response limits.
`SPECS/containerd2/CVE-2026-33814.patch`	Removes an upstreamed HTTP/2 fix.
`SPECS/containerd2/CVE-2026-27136.patch`	Removes an upstreamed tokenizer fix.
`SPECS/containerd2/CVE-2026-25681.patch`	Removes an upstreamed doctype fix.
`SPECS/containerd2/CVE-2026-25680.patch`	Removes an upstreamed parser performance fix.
`SPECS/containerd2/containerd2.spec`	Updates containerd2 and its patch set.
`SPECS/containerd2/containerd2.signatures.json`	Updates the containerd source signature.
`cgmanifest.json`	Records both upgraded dependencies.

Review details

Files reviewed: 19/20 changed files
Comments generated: 2
Review effort level: Balanced

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

 +		if _, ok := image.Snapshotters[snapshotter]; ok || len(image.Snapshotters) == 0 {
-+			return &image, nil
+			return nil
 +		}


 +	snapshotters := make(map[string]struct{})
 +	for label := range info.Labels {
-+		const Prefix = "containerd.io/gc.ref.snapshot."
-+		if strings.HasPrefix(label, Prefix) {
-+			snapshotters[label[len(Prefix):]] = struct{}{}
+		const prefix = "containerd.io/gc.ref.snapshot."
+		if strings.HasPrefix(label, prefix) {
+			snapshotters[label[len(prefix):]] = struct{}{}


aadhar-agarwal · 2026-09-11T20:47:08Z

 ---
- integration/image_pull_timeout_test.go        |  6 ++--
- internal/cri/server/container_status_test.go  |  2 +-
- internal/cri/server/images/image_pull.go      | 18 ++++++-----


issue (blocking): Preserve the previous snapshotter selection for pause-image pulls.

The old patch passed the sandbox’s resolved snapshotter directly to PullImage, keeping pulling and sandbox creation aligned. This rebase removes that argument, so PullImage selects independently.
With an empty runtime handler and no annotation override, pulling falls back to the global snapshotter while sandbox creation honors the default runtime’s snapshotter override. Previously these paths used the same resolved choice; now they can differ.

Good catch, thanks! Fixed it by restoring the original contract: RunPodSandbox resolves the snapshotter once via RuntimeSnapshotter(ctx, ociRuntime) and passes it through ensurePauseImageExists → PullImage, so pulling and sandbox creation stay aligned. Normal kubelet PullImage calls pass "" and keep resolving via snapshotterFromPodSandboxConfig as before, so that path is unchanged.

Rebase the multi-snapshotter and CVE-2026-56852 patches for containerd 2.3.4, and remove CVE patches that are fixed upstream.

microsoft-github-policy-service Bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Sep 9, 2026

Nan Liu (liunan-ms) force-pushed the liunan/containerd_runc_upgrade branch 2 times, most recently from 8e724bd to d7640f8 Compare September 9, 2026 18:42

Nan Liu (liunan-ms) marked this pull request as ready for review September 9, 2026 18:48

Nan Liu (liunan-ms) requested a review from a team as a code owner September 9, 2026 18:48

runc: upgrade to 1.4.3

e2548e7

Update runc to 1.4.3 and build it with Go < 1.25 to retain the established pre-systemcrypto toolchain without an explicit systemcrypto policy opt-out.

Nan Liu (liunan-ms) force-pushed the liunan/containerd_runc_upgrade branch from d7640f8 to 518df92 Compare September 10, 2026 18:03

aadhar-agarwal requested a balanced review from Copilot September 10, 2026 23:05

Copilot started reviewing on behalf of aadhar-agarwal September 10, 2026 23:06 View session

Copilot AI reviewed Sep 10, 2026

View reviewed changes

aadhar-agarwal reviewed Sep 10, 2026

View reviewed changes

Comment thread SPECS/containerd2/containerd2.spec

Nan Liu (liunan-ms) force-pushed the liunan/containerd_runc_upgrade branch from 518df92 to 33c4704 Compare September 10, 2026 23:58

aadhar-agarwal reviewed Sep 11, 2026

View reviewed changes

containerd2: upgrade to 2.3.4

bd59f9f

Rebase the multi-snapshotter and CVE-2026-56852 patches for containerd 2.3.4, and remove CVE patches that are fixed upstream.

Nan Liu (liunan-ms) force-pushed the liunan/containerd_runc_upgrade branch from 33c4704 to bd59f9f Compare September 11, 2026 21:50

Navigation Menu

Uh oh!

containerd2: upgrade to 2.3.4 and runc to 1.4.3 - #18777

containerd2: upgrade to 2.3.4 and runc to 1.4.3#18777
Nan Liu (liunan-ms) wants to merge 2 commits into
3.0-devfrom
liunan/containerd_runc_upgrade

Nan Liu (liunan-ms) commented Sep 9, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

aadhar-agarwal Sep 11, 2026

Uh oh!

Nan Liu (liunan-ms) Sep 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Nan Liu (liunan-ms) commented Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

aadhar-agarwal Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

Nan Liu (liunan-ms) Sep 11, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Nan Liu (liunan-ms) commented Sep 9, 2026 •

edited

Loading