Skip to content

Use containerd 2.3 in all variants - #4989

Open
KCSesh wants to merge 61 commits into
bottlerocket-os:developfrom
KCSesh:export/containerd-2.3/all
Open

Use containerd 2.3 in all variants#4989
KCSesh wants to merge 61 commits into
bottlerocket-os:developfrom
KCSesh:export/containerd-2.3/all

Conversation

@KCSesh

@KCSesh KCSesh commented Oct 29, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Issue number:

Related: #4988

Description of changes:
1. One commit per variant: <variant>: bump to containerd-2.3 (53 commits, one variants/<variant>/Cargo.toml each)

  • 38 variants move from containerd-2.2 to containerd-2.3:
    • aws-k8s-1.33 to 1.36, each with -fips, -nvidia and -nvidia-fips (16);
    • aws-k8s-1.31-nvidia-fips and aws-k8s-1.32-nvidia-fips;
    • vmware-k8s-1.33 to 1.36, each with -fips (8);
    • aws-ecs-3, -fips, -nvidia and -nvidia-fips;
    • aws-ecs-4 and aws-ecs-4-nvidia;
    • aws-mantle-1, -fips, -nvidia and -nvidia-fips;
    • aws-dev and vmware-dev.
  • 15 variants get containerd-2.3 added right after the kernel line; until now they named no containerd and got 1.7 by epoch:
    • aws-k8s-1.31/1.32 (+fips, nvidia);
    • vmware-k8s-1.31/1.32 (+fips);
    • aws-ecs-2 (+fips, nvidia, nvidia-fips);
      • Docker 25 now runs against containerd 2.3. Docker pulls use its own overlay2 graphdriver and /etc/docker registry config, so the schema 1, certs.d and transfer-service items in Use containerd-2.3 in all variants #4988 don't apply to docker pull
    • metal-dev.

2. Keep unprivileged ports/icmp off on the former-1.7 variants

  • Why nvidia-fips is split out: aws-k8s-1.31/1.32-nvidia-fips always ran containerd 2.x and keep true. They used to share the -nvidia defaults package, so they need their own before -nvidia gets the false link. The split comes first, so no commit ever gives them false

Testing done:

containerd config, before vs after.

  • Before: released aws-k8s-1.31 and 1.32 (containerd 1.7.36).
  • After: this change with the required core-kit (containerd 2.3.7).
  • Default settings, plus a second boot with settings.container-runtime.snapshotter = "soci".
  • 1.31 and 1.32 give the same diff.

Effective values that change (containerd config dump, 1.7 keys mapped to their 2.x names):

setting 1.7.36 2.3.7
cri.v1.runtime.enable_unprivileged_ports / _icmp false / false false / false (new defaults)
cri.v1.runtime.enable_cdi false true
nri.v1.nri.disable true false
cri.v1.images.registry.config_path "" (inline mirrors/configs) /etc/containerd/certs.d
cri.v1.images.use_local_image_pull n/a false (transfer service)
cri.v1.runtime.enable_criu n/a true
ttrpc address "" /run/containerd/containerd.sock.ttrpc
config version 2 4 (rendered as 3)
with SOCI: transfer.v1.local.unpack_config overlayfs / walking soci, platform linux
with SOCI: cri.v1.images.disable_snapshot_annotations false true (SOCI gets labels via enable_remote_snapshot_annotations on its proxy plugin)

Removed in 2.x: runtime.v1.linux (the v1 shim), systemd_cgroup, untrusted_workload_runtime, and the inline registry mirrors/configs/auths. No "migrated from version 0" warnings.

aws-k8s-1.31: full containerd config dump before (1.7.36) 
disabled_plugins = ["io.containerd.internal.v1.opt", "io.containerd.snapshotter.v1.aufs", "io.containerd.snapshotter.v1.devmapper", "io.containerd.snapshotter.v1.native", "io.containerd.snapshotter.v1.zfs"]
imports = ["/etc/containerd/config.toml", "/etc/containerd/config.d/001-snapshotter.toml"]
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
temp = ""
version = 2

[cgroup]
  path = ""

[debug]
  address = ""
  format = ""
  gid = 0
  level = ""
  uid = 0

[grpc]
  address = "/run/containerd/containerd.sock"
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  tcp_address = ""
  tcp_tls_ca = ""
  tcp_tls_cert = ""
  tcp_tls_key = ""
  uid = 0

[metrics]
  address = ""
  grpc_histogram = false

[plugins]

  [plugins."io.containerd.gc.v1.scheduler"]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = "0s"
    startup_delay = "100ms"

  [plugins."io.containerd.grpc.v1.cri"]
    cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
    device_ownership_from_security_context = false
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    drain_exec_sync_io_timeout = "0s"
    enable_cdi = false
    enable_selinux = true
    enable_tls_streaming = false
    enable_unprivileged_icmp = false
    enable_unprivileged_ports = false
    ignore_deprecation_warnings = []
    ignore_image_defined_volumes = false
    image_pull_progress_timeout = "5m0s"
    image_pull_with_sync_fs = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
    sandbox_image = "localhost/kubernetes/pause:0.1.0"
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = "4h0m0s"
    stream_server_address = "127.0.0.1"
    stream_server_port = "0"
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = ""

    [plugins."io.containerd.grpc.v1.cri".cni]
      bin_dir = "/opt/cni/bin"
      conf_dir = "/etc/cni/net.d"
      conf_template = ""
      ip_pref = ""
      max_conf_num = 1
      setup_serially = false

    [plugins."io.containerd.grpc.v1.cri".containerd]
      default_runtime_name = "runc"
      disable_snapshot_annotations = true
      discard_unpacked_layers = false
      ignore_blockio_not_enabled_errors = false
      ignore_rdt_not_enabled_errors = false
      no_pivot = false
      snapshotter = "overlayfs"

      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
        base_runtime_spec = ""
        cni_conf_dir = ""
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        privileged_without_host_devices_all_devices_allowed = false
        runtime_engine = ""
        runtime_path = ""
        runtime_root = ""
        runtime_type = ""
        sandbox_mode = ""
        snapshotter = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]

        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
          base_runtime_spec = "/etc/containerd/cri-base.json"
          cni_conf_dir = ""
          cni_max_conf_num = 0
          container_annotations = []
          pod_annotations = []
          privileged_without_host_devices = false
          privileged_without_host_devices_all_devices_allowed = false
          runtime_engine = ""
          runtime_path = ""
          runtime_root = ""
          runtime_type = "io.containerd.runc.v2"
          sandbox_mode = ""
          snapshotter = ""

          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
            SystemdCgroup = true

      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
        base_runtime_spec = ""
        cni_conf_dir = ""
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        privileged_without_host_devices_all_devices_allowed = false
        runtime_engine = ""
        runtime_path = ""
        runtime_root = ""
        runtime_type = ""
        sandbox_mode = ""
        snapshotter = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]

    [plugins."io.containerd.grpc.v1.cri".image_decryption]
      key_model = "node"

    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = ""

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]

      [plugins."io.containerd.grpc.v1.cri".registry.headers]

      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]

    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
      tls_cert_file = ""
      tls_key_file = ""

  [plugins."io.containerd.internal.v1.restart"]
    interval = "10s"

  [plugins."io.containerd.internal.v1.tracing"]

  [plugins."io.containerd.metadata.v1.bolt"]
    content_sharing_policy = "shared"

  [plugins."io.containerd.monitor.v1.cgroups"]
    no_prometheus = false

  [plugins."io.containerd.nri.v1.nri"]
    disable = true
    disable_connections = false
    plugin_config_path = "/etc/nri/conf.d"
    plugin_path = "/opt/nri/plugins"
    plugin_registration_timeout = "5s"
    plugin_request_timeout = "2s"
    socket_path = "/var/run/nri/nri.sock"

  [plugins."io.containerd.runtime.v1.linux"]
    no_shim = false
    runtime = "runc"
    runtime_root = ""
    shim = "containerd-shim"
    shim_debug = false

  [plugins."io.containerd.runtime.v2.task"]
    platforms = ["linux/amd64"]
    sched_core = false

  [plugins."io.containerd.service.v1.diff-service"]
    default = ["walking"]
    sync_fs = false

  [plugins."io.containerd.service.v1.tasks-service"]
    blockio_config_file = ""
    rdt_config_file = ""

  [plugins."io.containerd.snapshotter.v1.blockfile"]
    fs_type = ""
    mount_options = []
    root_path = ""
    scratch_file = ""

  [plugins."io.containerd.snapshotter.v1.overlayfs"]
    mount_options = []
    root_path = ""
    sync_remove = false
    upperdir_label = false

  [plugins."io.containerd.tracing.processor.v1.otlp"]

  [plugins."io.containerd.transfer.v1.local"]
    config_path = ""
    max_concurrent_downloads = 3
    max_concurrent_uploaded_layers = 3

    [[plugins."io.containerd.transfer.v1.local".unpack_config]]
      differ = "walking"
      platform = "linux/amd64"
      snapshotter = "overlayfs"

[proxy_plugins]

[stream_processors]

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar"

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar+gzip"

[timeouts]
  "io.containerd.timeout.bolt.open" = "0s"
  "io.containerd.timeout.metrics.shimstats" = "2s"
  "io.containerd.timeout.shim.cleanup" = "5s"
  "io.containerd.timeout.shim.load" = "5s"
  "io.containerd.timeout.shim.shutdown" = "3s"
  "io.containerd.timeout.task.state" = "2s"

[ttrpc]
  address = ""
  gid = 0
  uid = 0
aws-k8s-1.31: full containerd config dump after (2.3.7) 
version = 4
root = '/var/lib/containerd'
state = '/run/containerd'
temp = ''
disabled_plugins = ['io.containerd.internal.v1.opt', 'io.containerd.internal.v1.tracing', 'io.containerd.snapshotter.v1.blockfile', 'io.containerd.snapshotter.v1.devmapper', 'io.containerd.snapshotter.v1.native', 'io.containerd.snapshotter.v1.zfs', 'io.containerd.tracing.processor.v1.otlp']
required_plugins = []
oom_score = 0
imports = ['/etc/containerd/conf.d/*.toml', '/etc/containerd/config.d/*.toml']

[debug]
  level = ''
  format = ''
  log_trace_id = false

[plugins]
  [plugins.'io.containerd.cri.v1.images']
    snapshotter = 'overlayfs'
    disable_snapshot_annotations = true
    discard_unpacked_layers = false
    max_concurrent_downloads = 3
    concurrent_layer_fetch_buffer = 0
    image_pull_progress_timeout = '5m0s'
    image_pull_with_sync_fs = false
    stats_collect_period = 10
    use_local_image_pull = false

    [plugins.'io.containerd.cri.v1.images'.pinned_images]
      sandbox = 'localhost/kubernetes/pause:0.1.0'

    [plugins.'io.containerd.cri.v1.images'.registry]
      config_path = '/etc/containerd/certs.d'

    [plugins.'io.containerd.cri.v1.images'.image_decryption]
      key_model = 'node'

  [plugins.'io.containerd.cri.v1.runtime']
    enable_selinux = true
    selinux_category_range = 1024
    max_container_log_line_size = 16384
    disable_apparmor = false
    restrict_oom_score_adj = false
    disable_proc_mount = false
    unset_seccomp_profile = ''
    tolerate_missing_hugetlb_controller = true
    disable_hugetlb_controller = true
    device_ownership_from_security_context = false
    ignore_image_defined_volumes = false
    netns_mounts_under_state_dir = false
    enable_unprivileged_ports = false
    enable_unprivileged_icmp = false
    enable_cdi = true
    cdi_spec_dirs = ['/etc/cdi', '/var/run/cdi']
    drain_exec_sync_io_timeout = '0s'
    ignore_deprecation_warnings = []
    stats_collect_period = ''
    stats_retention_period = ''
    enable_criu = true
    enable_experimental_restore_via_create = false

    [plugins.'io.containerd.cri.v1.runtime'.containerd]
      default_runtime_name = 'runc'
      ignore_blockio_not_enabled_errors = false
      ignore_rdt_not_enabled_errors = false

      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
          runtime_type = 'io.containerd.runc.v2'
          runtime_path = ''
          pod_annotations = []
          container_annotations = []
          privileged_without_host_devices = false
          privileged_without_host_devices_all_devices_allowed = false
          cgroup_writable = false
          base_runtime_spec = '/etc/containerd/cri-base.json'
          cni_conf_dir = ''
          cni_max_conf_num = 0
          snapshotter = ''
          sandboxer = 'podsandbox'
          io_type = ''

          [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
            BinaryName = ''
            CriuImagePath = ''
            CriuWorkPath = ''
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            Root = ''
            ShimCgroup = ''
            SystemdCgroup = true

    [plugins.'io.containerd.cri.v1.runtime'.cni]
      bin_dir = ''
      bin_dirs = ['/opt/cni/bin']
      conf_dir = '/etc/cni/net.d'
      max_conf_num = 1
      setup_serially = false
      conf_template = ''
      ip_pref = ''
      use_internal_loopback = false

  [plugins.'io.containerd.differ.v1.erofs']
    mkfs_options = []
    enable_tar_index = false
    enable_dmverity = false

  [plugins.'io.containerd.gc.v1.scheduler']
    pause_threshold = 0.02
    deletion_threshold = 0
    mutation_threshold = 100
    schedule_delay = '0s'
    startup_delay = '100ms'

  [plugins.'io.containerd.grpc.v1.cri']
    disable_tcp_service = true
    stream_server_address = '127.0.0.1'
    stream_server_port = '0'
    stream_idle_timeout = '4h0m0s'
    enable_tls_streaming = false

    [plugins.'io.containerd.grpc.v1.cri'.x509_key_pair_streaming]
      tls_cert_file = ''
      tls_key_file = ''

  [plugins.'io.containerd.image-verifier.v1.bindir']
    bin_dir = '/opt/containerd/image-verifier/bin'
    max_verifiers = 10
    per_verifier_timeout = '10s'

  [plugins.'io.containerd.metadata.v1.bolt']
    content_sharing_policy = 'shared'
    no_sync = false

  [plugins.'io.containerd.metrics.v1.grpc-prometheus']
    grpc_histogram = false

  [plugins.'io.containerd.monitor.container.v1.restart']
    interval = '10s'

  [plugins.'io.containerd.monitor.task.v1.cgroups']
    no_prometheus = false

  [plugins.'io.containerd.mount-handler.v1.erofs']

  [plugins.'io.containerd.nri.v1.nri']
    disable = false
    socket_path = '/var/run/nri/nri.sock'
    plugin_path = '/opt/nri/plugins'
    plugin_config_path = '/etc/nri/conf.d'
    plugin_registration_timeout = '5s'
    plugin_request_timeout = '2s'
    disable_connections = false

    [plugins.'io.containerd.nri.v1.nri'.default_validator]
      enable = false
      reject_oci_hook_adjustment = false
      reject_runtime_default_seccomp_adjustment = false
      reject_unconfined_seccomp_adjustment = false
      reject_custom_seccomp_adjustment = false
      reject_namespace_adjustment = false
      reject_sysctl_adjustment = false
      required_plugins = []
      tolerate_missing_plugins_annotation = ''

  [plugins.'io.containerd.runtime.v2.task']
    platforms = ['linux/amd64']

  [plugins.'io.containerd.server.v1.debug']
    address = ''
    uid = 0
    gid = 0

  [plugins.'io.containerd.server.v1.grpc']
    address = '/run/containerd/containerd.sock'
    uid = 0
    gid = 0
    max_recv_message_size = 16777216
    max_send_message_size = 16777216

  [plugins.'io.containerd.server.v1.grpc-tcp']
    address = ''
    tls_ca = ''
    tls_cert = ''
    tls_key = ''
    tls_common_name = ''
    max_recv_message_size = 16777216
    max_send_message_size = 16777216

  [plugins.'io.containerd.server.v1.metrics']
    address = ''

  [plugins.'io.containerd.server.v1.ttrpc']
    address = '/run/containerd/containerd.sock.ttrpc'
    uid = 0
    gid = 0

  [plugins.'io.containerd.service.v1.diff-service']
    default = ['walking']
    sync_fs = false

  [plugins.'io.containerd.service.v1.tasks-service']
    blockio_config_file = ''
    rdt_config_file = ''

  [plugins.'io.containerd.shim.v1.manager']
    env = []
    socket_dir = ''

  [plugins.'io.containerd.snapshotter.v1.erofs']
    root_path = ''
    ovl_mount_options = []
    enable_fsverity = false
    set_immutable = false
    default_size = ''
    dmverity_mode = ''

  [plugins.'io.containerd.snapshotter.v1.overlayfs']
    root_path = ''
    upperdir_label = false
    sync_remove = false
    slow_chown = false
    mount_options = []

  [plugins.'io.containerd.transfer.v1.local']
    max_concurrent_downloads = 3
    concurrent_layer_fetch_buffer = 0
    max_concurrent_uploaded_layers = 3
    check_platform_supported = false
    config_path = ''
    max_concurrent_unpacks = 1

    [[plugins.'io.containerd.transfer.v1.local'.unpack_config]]
      platform = 'linux/amd64'
      snapshotter = 'overlayfs'
      differ = 'walking'
      config_type = ''
      layer_types = []
      optional = false

[cgroup]
  path = ''

[timeouts]
  'io.containerd.timeout.bolt.open' = '0s'
  'io.containerd.timeout.cri.defercleanup' = '1m0s'
  'io.containerd.timeout.metrics.shimstats' = '2s'
  'io.containerd.timeout.shim.cleanup' = '5s'
  'io.containerd.timeout.shim.load' = '5s'
  'io.containerd.timeout.shim.shutdown' = '3s'
  'io.containerd.timeout.task.state' = '2s'

[stream_processors]
  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar']
    accepts = ['application/vnd.oci.image.layer.v1.tar+encrypted']
    returns = 'application/vnd.oci.image.layer.v1.tar'
    path = 'ctd-decoder'
    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']

  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar.gzip']
    accepts = ['application/vnd.oci.image.layer.v1.tar+gzip+encrypted']
    returns = 'application/vnd.oci.image.layer.v1.tar+gzip'
    path = 'ctd-decoder'
    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']
aws-k8s-1.32: full containerd config dump before (1.7.36) 
disabled_plugins = ["io.containerd.internal.v1.opt", "io.containerd.snapshotter.v1.aufs", "io.containerd.snapshotter.v1.devmapper", "io.containerd.snapshotter.v1.native", "io.containerd.snapshotter.v1.zfs"]
imports = ["/etc/containerd/config.toml", "/etc/containerd/config.d/001-snapshotter.toml"]
oom_score = 0
plugin_dir = ""
required_plugins = []
root = "/var/lib/containerd"
state = "/run/containerd"
temp = ""
version = 2

[cgroup]
  path = ""

[debug]
  address = ""
  format = ""
  gid = 0
  level = ""
  uid = 0

[grpc]
  address = "/run/containerd/containerd.sock"
  gid = 0
  max_recv_message_size = 16777216
  max_send_message_size = 16777216
  tcp_address = ""
  tcp_tls_ca = ""
  tcp_tls_cert = ""
  tcp_tls_key = ""
  uid = 0

[metrics]
  address = ""
  grpc_histogram = false

[plugins]

  [plugins."io.containerd.gc.v1.scheduler"]
    deletion_threshold = 0
    mutation_threshold = 100
    pause_threshold = 0.02
    schedule_delay = "0s"
    startup_delay = "100ms"

  [plugins."io.containerd.grpc.v1.cri"]
    cdi_spec_dirs = ["/etc/cdi", "/var/run/cdi"]
    device_ownership_from_security_context = true
    disable_apparmor = false
    disable_cgroup = false
    disable_hugetlb_controller = true
    disable_proc_mount = false
    disable_tcp_service = true
    drain_exec_sync_io_timeout = "0s"
    enable_cdi = false
    enable_selinux = true
    enable_tls_streaming = false
    enable_unprivileged_icmp = false
    enable_unprivileged_ports = false
    ignore_deprecation_warnings = []
    ignore_image_defined_volumes = false
    image_pull_progress_timeout = "5m0s"
    image_pull_with_sync_fs = false
    max_concurrent_downloads = 3
    max_container_log_line_size = 16384
    netns_mounts_under_state_dir = false
    restrict_oom_score_adj = false
    sandbox_image = "localhost/kubernetes/pause:0.1.0"
    selinux_category_range = 1024
    stats_collect_period = 10
    stream_idle_timeout = "4h0m0s"
    stream_server_address = "127.0.0.1"
    stream_server_port = "0"
    systemd_cgroup = false
    tolerate_missing_hugetlb_controller = true
    unset_seccomp_profile = ""

    [plugins."io.containerd.grpc.v1.cri".cni]
      bin_dir = "/opt/cni/bin"
      conf_dir = "/etc/cni/net.d"
      conf_template = ""
      ip_pref = ""
      max_conf_num = 1
      setup_serially = false

    [plugins."io.containerd.grpc.v1.cri".containerd]
      default_runtime_name = "runc"
      disable_snapshot_annotations = true
      discard_unpacked_layers = false
      ignore_blockio_not_enabled_errors = false
      ignore_rdt_not_enabled_errors = false
      no_pivot = false
      snapshotter = "overlayfs"

      [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime]
        base_runtime_spec = ""
        cni_conf_dir = ""
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        privileged_without_host_devices_all_devices_allowed = false
        runtime_engine = ""
        runtime_path = ""
        runtime_root = ""
        runtime_type = ""
        sandbox_mode = ""
        snapshotter = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.default_runtime.options]

      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]

        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
          base_runtime_spec = "/etc/containerd/cri-base.json"
          cni_conf_dir = ""
          cni_max_conf_num = 0
          container_annotations = []
          pod_annotations = []
          privileged_without_host_devices = false
          privileged_without_host_devices_all_devices_allowed = false
          runtime_engine = ""
          runtime_path = ""
          runtime_root = ""
          runtime_type = "io.containerd.runc.v2"
          sandbox_mode = ""
          snapshotter = ""

          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
            SystemdCgroup = true

      [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime]
        base_runtime_spec = ""
        cni_conf_dir = ""
        cni_max_conf_num = 0
        container_annotations = []
        pod_annotations = []
        privileged_without_host_devices = false
        privileged_without_host_devices_all_devices_allowed = false
        runtime_engine = ""
        runtime_path = ""
        runtime_root = ""
        runtime_type = ""
        sandbox_mode = ""
        snapshotter = ""

        [plugins."io.containerd.grpc.v1.cri".containerd.untrusted_workload_runtime.options]

    [plugins."io.containerd.grpc.v1.cri".image_decryption]
      key_model = "node"

    [plugins."io.containerd.grpc.v1.cri".registry]
      config_path = ""

      [plugins."io.containerd.grpc.v1.cri".registry.auths]

      [plugins."io.containerd.grpc.v1.cri".registry.configs]

      [plugins."io.containerd.grpc.v1.cri".registry.headers]

      [plugins."io.containerd.grpc.v1.cri".registry.mirrors]

    [plugins."io.containerd.grpc.v1.cri".x509_key_pair_streaming]
      tls_cert_file = ""
      tls_key_file = ""

  [plugins."io.containerd.internal.v1.restart"]
    interval = "10s"

  [plugins."io.containerd.internal.v1.tracing"]

  [plugins."io.containerd.metadata.v1.bolt"]
    content_sharing_policy = "shared"

  [plugins."io.containerd.monitor.v1.cgroups"]
    no_prometheus = false

  [plugins."io.containerd.nri.v1.nri"]
    disable = true
    disable_connections = false
    plugin_config_path = "/etc/nri/conf.d"
    plugin_path = "/opt/nri/plugins"
    plugin_registration_timeout = "5s"
    plugin_request_timeout = "2s"
    socket_path = "/var/run/nri/nri.sock"

  [plugins."io.containerd.runtime.v1.linux"]
    no_shim = false
    runtime = "runc"
    runtime_root = ""
    shim = "containerd-shim"
    shim_debug = false

  [plugins."io.containerd.runtime.v2.task"]
    platforms = ["linux/amd64"]
    sched_core = false

  [plugins."io.containerd.service.v1.diff-service"]
    default = ["walking"]
    sync_fs = false

  [plugins."io.containerd.service.v1.tasks-service"]
    blockio_config_file = ""
    rdt_config_file = ""

  [plugins."io.containerd.snapshotter.v1.blockfile"]
    fs_type = ""
    mount_options = []
    root_path = ""
    scratch_file = ""

  [plugins."io.containerd.snapshotter.v1.overlayfs"]
    mount_options = []
    root_path = ""
    sync_remove = false
    upperdir_label = false

  [plugins."io.containerd.tracing.processor.v1.otlp"]

  [plugins."io.containerd.transfer.v1.local"]
    config_path = ""
    max_concurrent_downloads = 3
    max_concurrent_uploaded_layers = 3

    [[plugins."io.containerd.transfer.v1.local".unpack_config]]
      differ = "walking"
      platform = "linux/amd64"
      snapshotter = "overlayfs"

[proxy_plugins]

[stream_processors]

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar"

  [stream_processors."io.containerd.ocicrypt.decoder.v1.tar.gzip"]
    accepts = ["application/vnd.oci.image.layer.v1.tar+gzip+encrypted"]
    args = ["--decryption-keys-path", "/etc/containerd/ocicrypt/keys"]
    env = ["OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf"]
    path = "ctd-decoder"
    returns = "application/vnd.oci.image.layer.v1.tar+gzip"

[timeouts]
  "io.containerd.timeout.bolt.open" = "0s"
  "io.containerd.timeout.metrics.shimstats" = "2s"
  "io.containerd.timeout.shim.cleanup" = "5s"
  "io.containerd.timeout.shim.load" = "5s"
  "io.containerd.timeout.shim.shutdown" = "3s"
  "io.containerd.timeout.task.state" = "2s"

[ttrpc]
  address = ""
  gid = 0
  uid = 0
aws-k8s-1.32: full containerd config dump after (2.3.7) 
version = 4
root = '/var/lib/containerd'
state = '/run/containerd'
temp = ''
disabled_plugins = ['io.containerd.internal.v1.opt', 'io.containerd.internal.v1.tracing', 'io.containerd.snapshotter.v1.blockfile', 'io.containerd.snapshotter.v1.devmapper', 'io.containerd.snapshotter.v1.native', 'io.containerd.snapshotter.v1.zfs', 'io.containerd.tracing.processor.v1.otlp']
required_plugins = []
oom_score = 0
imports = ['/etc/containerd/conf.d/*.toml', '/etc/containerd/config.d/*.toml']

[debug]
  level = ''
  format = ''
  log_trace_id = false

[plugins]
  [plugins.'io.containerd.cri.v1.images']
    snapshotter = 'overlayfs'
    disable_snapshot_annotations = true
    discard_unpacked_layers = false
    max_concurrent_downloads = 3
    concurrent_layer_fetch_buffer = 0
    image_pull_progress_timeout = '5m0s'
    image_pull_with_sync_fs = false
    stats_collect_period = 10
    use_local_image_pull = false

    [plugins.'io.containerd.cri.v1.images'.pinned_images]
      sandbox = 'localhost/kubernetes/pause:0.1.0'

    [plugins.'io.containerd.cri.v1.images'.registry]
      config_path = '/etc/containerd/certs.d'

    [plugins.'io.containerd.cri.v1.images'.image_decryption]
      key_model = 'node'

  [plugins.'io.containerd.cri.v1.runtime']
    enable_selinux = true
    selinux_category_range = 1024
    max_container_log_line_size = 16384
    disable_apparmor = false
    restrict_oom_score_adj = false
    disable_proc_mount = false
    unset_seccomp_profile = ''
    tolerate_missing_hugetlb_controller = true
    disable_hugetlb_controller = true
    device_ownership_from_security_context = true
    ignore_image_defined_volumes = false
    netns_mounts_under_state_dir = false
    enable_unprivileged_ports = false
    enable_unprivileged_icmp = false
    enable_cdi = true
    cdi_spec_dirs = ['/etc/cdi', '/var/run/cdi']
    drain_exec_sync_io_timeout = '0s'
    ignore_deprecation_warnings = []
    stats_collect_period = ''
    stats_retention_period = ''
    enable_criu = true
    enable_experimental_restore_via_create = false

    [plugins.'io.containerd.cri.v1.runtime'.containerd]
      default_runtime_name = 'runc'
      ignore_blockio_not_enabled_errors = false
      ignore_rdt_not_enabled_errors = false

      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
          runtime_type = 'io.containerd.runc.v2'
          runtime_path = ''
          pod_annotations = []
          container_annotations = []
          privileged_without_host_devices = false
          privileged_without_host_devices_all_devices_allowed = false
          cgroup_writable = false
          base_runtime_spec = '/etc/containerd/cri-base.json'
          cni_conf_dir = ''
          cni_max_conf_num = 0
          snapshotter = ''
          sandboxer = 'podsandbox'
          io_type = ''

          [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
            BinaryName = ''
            CriuImagePath = ''
            CriuWorkPath = ''
            IoGid = 0
            IoUid = 0
            NoNewKeyring = false
            Root = ''
            ShimCgroup = ''
            SystemdCgroup = true

    [plugins.'io.containerd.cri.v1.runtime'.cni]
      bin_dir = ''
      bin_dirs = ['/opt/cni/bin']
      conf_dir = '/etc/cni/net.d'
      max_conf_num = 1
      setup_serially = false
      conf_template = ''
      ip_pref = ''
      use_internal_loopback = false

  [plugins.'io.containerd.differ.v1.erofs']
    mkfs_options = []
    enable_tar_index = false
    enable_dmverity = false

  [plugins.'io.containerd.gc.v1.scheduler']
    pause_threshold = 0.02
    deletion_threshold = 0
    mutation_threshold = 100
    schedule_delay = '0s'
    startup_delay = '100ms'

  [plugins.'io.containerd.grpc.v1.cri']
    disable_tcp_service = true
    stream_server_address = '127.0.0.1'
    stream_server_port = '0'
    stream_idle_timeout = '4h0m0s'
    enable_tls_streaming = false

    [plugins.'io.containerd.grpc.v1.cri'.x509_key_pair_streaming]
      tls_cert_file = ''
      tls_key_file = ''

  [plugins.'io.containerd.image-verifier.v1.bindir']
    bin_dir = '/opt/containerd/image-verifier/bin'
    max_verifiers = 10
    per_verifier_timeout = '10s'

  [plugins.'io.containerd.metadata.v1.bolt']
    content_sharing_policy = 'shared'
    no_sync = false

  [plugins.'io.containerd.metrics.v1.grpc-prometheus']
    grpc_histogram = false

  [plugins.'io.containerd.monitor.container.v1.restart']
    interval = '10s'

  [plugins.'io.containerd.monitor.task.v1.cgroups']
    no_prometheus = false

  [plugins.'io.containerd.mount-handler.v1.erofs']

  [plugins.'io.containerd.nri.v1.nri']
    disable = false
    socket_path = '/var/run/nri/nri.sock'
    plugin_path = '/opt/nri/plugins'
    plugin_config_path = '/etc/nri/conf.d'
    plugin_registration_timeout = '5s'
    plugin_request_timeout = '2s'
    disable_connections = false

    [plugins.'io.containerd.nri.v1.nri'.default_validator]
      enable = false
      reject_oci_hook_adjustment = false
      reject_runtime_default_seccomp_adjustment = false
      reject_unconfined_seccomp_adjustment = false
      reject_custom_seccomp_adjustment = false
      reject_namespace_adjustment = false
      reject_sysctl_adjustment = false
      required_plugins = []
      tolerate_missing_plugins_annotation = ''

  [plugins.'io.containerd.runtime.v2.task']
    platforms = ['linux/amd64']

  [plugins.'io.containerd.server.v1.debug']
    address = ''
    uid = 0
    gid = 0

  [plugins.'io.containerd.server.v1.grpc']
    address = '/run/containerd/containerd.sock'
    uid = 0
    gid = 0
    max_recv_message_size = 16777216
    max_send_message_size = 16777216

  [plugins.'io.containerd.server.v1.grpc-tcp']
    address = ''
    tls_ca = ''
    tls_cert = ''
    tls_key = ''
    tls_common_name = ''
    max_recv_message_size = 16777216
    max_send_message_size = 16777216

  [plugins.'io.containerd.server.v1.metrics']
    address = ''

  [plugins.'io.containerd.server.v1.ttrpc']
    address = '/run/containerd/containerd.sock.ttrpc'
    uid = 0
    gid = 0

  [plugins.'io.containerd.service.v1.diff-service']
    default = ['walking']
    sync_fs = false

  [plugins.'io.containerd.service.v1.tasks-service']
    blockio_config_file = ''
    rdt_config_file = ''

  [plugins.'io.containerd.shim.v1.manager']
    env = []
    socket_dir = ''

  [plugins.'io.containerd.snapshotter.v1.erofs']
    root_path = ''
    ovl_mount_options = []
    enable_fsverity = false
    set_immutable = false
    default_size = ''
    dmverity_mode = ''

  [plugins.'io.containerd.snapshotter.v1.overlayfs']
    root_path = ''
    upperdir_label = false
    sync_remove = false
    slow_chown = false
    mount_options = []

  [plugins.'io.containerd.transfer.v1.local']
    max_concurrent_downloads = 3
    concurrent_layer_fetch_buffer = 0
    max_concurrent_uploaded_layers = 3
    check_platform_supported = false
    config_path = ''
    max_concurrent_unpacks = 1

    [[plugins.'io.containerd.transfer.v1.local'.unpack_config]]
      platform = 'linux/amd64'
      snapshotter = 'overlayfs'
      differ = 'walking'
      config_type = ''
      layer_types = []
      optional = false

[cgroup]
  path = ''

[timeouts]
  'io.containerd.timeout.bolt.open' = '0s'
  'io.containerd.timeout.cri.defercleanup' = '1m0s'
  'io.containerd.timeout.metrics.shimstats' = '2s'
  'io.containerd.timeout.shim.cleanup' = '5s'
  'io.containerd.timeout.shim.load' = '5s'
  'io.containerd.timeout.shim.shutdown' = '3s'
  'io.containerd.timeout.task.state' = '2s'

[stream_processors]
  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar']
    accepts = ['application/vnd.oci.image.layer.v1.tar+encrypted']
    returns = 'application/vnd.oci.image.layer.v1.tar'
    path = 'ctd-decoder'
    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']

  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar.gzip']
    accepts = ['application/vnd.oci.image.layer.v1.tar+gzip+encrypted']
    returns = 'application/vnd.oci.image.layer.v1.tar+gzip'
    path = 'ctd-decoder'
    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']
aws-k8s-1.31: rendered /etc/containerd/config.toml diff 
@@ -1,12 +1,14 @@
-version = 2
+version = 3
 root = "/var/lib/containerd"
 state = "/run/containerd"
 disabled_plugins = [
     "io.containerd.internal.v1.opt",
-    "io.containerd.snapshotter.v1.aufs",
+    "io.containerd.internal.v1.tracing",
+    "io.containerd.snapshotter.v1.blockfile",
     "io.containerd.snapshotter.v1.devmapper",
     "io.containerd.snapshotter.v1.native",
     "io.containerd.snapshotter.v1.zfs",
+    "io.containerd.tracing.processor.v1.otlp",
 ]
 
 imports = ["/etc/containerd/config.d/*.toml"]
@@ -14,21 +16,37 @@
 [grpc]
 address = "/run/containerd/containerd.sock"
 
-[plugins."io.containerd.grpc.v1.cri"]
+[plugins."io.containerd.cri.v1.images"]
+use_local_image_pull = false
+
+# Pause container image is specified here, shares the same image as kubelet's pod-infra-container-image
+[plugins."io.containerd.cri.v1.images".pinned_images]
+sandbox = "localhost/kubernetes/pause:0.1.0"
+
+[plugins."io.containerd.cri.v1.runtime"]
 device_ownership_from_security_context = false
 enable_selinux = true
-# Pause container image is specified here, shares the same image as kubelet's pod-infra-container-image
-sandbox_image = "localhost/kubernetes/pause:0.1.0"
+enable_unprivileged_ports = false
+enable_unprivileged_icmp = false
 
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+[plugins."io.containerd.transfer.v1.local"]
+concurrent_layer_fetch_buffer = 0
+
+[[plugins."io.containerd.transfer.v1.local".unpack_config]]
+snapshotter = "overlayfs"
+differ = "walking"
+platform = "linux/amd64"
+
+[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runc]
 runtime_type = "io.containerd.runc.v2"
 base_runtime_spec = "/etc/containerd/cri-base.json"
 
-[plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
+[plugins."io.containerd.cri.v1.runtime".containerd.runtimes.runc.options]
 SystemdCgroup = true
 
-[plugins."io.containerd.grpc.v1.cri".cni]
-bin_dir = "/opt/cni/bin"
+[plugins."io.containerd.cri.v1.runtime".cni]
+bin_dirs = [ "/opt/cni/bin" ]
 conf_dir = "/etc/cni/net.d"
 
-
+[plugins."io.containerd.cri.v1.images".registry]
+config_path = "/etc/containerd/certs.d"
SOCI drop-in /etc/containerd/config.d/001-snapshotter.toml, before (1.7.36) and after (2.3.7) 
# before: containerd 1.7.36, CRI plugin config (snapshot annotations on for SOCI)
[plugins."io.containerd.grpc.v1.cri".containerd]
snapshotter = "soci"
disable_snapshot_annotations = false
# Plug soci snapshotter into containerd
[proxy_plugins.soci]
capabilities = ["remap-ids"]
type = "snapshot"
address = "/run/soci-snapshotter/soci-snapshotter.sock"
[proxy_plugins.soci.exports]
root = "/var/lib/soci-snapshotter"
# after: containerd 2.3.7, CRI images + transfer-service unpack, labels via the proxy plugin
version = 3
[plugins."io.containerd.cri.v1.images"]
snapshotter = "soci"

[[plugins."io.containerd.transfer.v1.local".unpack_config]]
platform = "linux"
snapshotter = "soci"

# Plug soci snapshotter into containerd
[proxy_plugins.soci]
capabilities = ["remap-ids"]
type = "snapshot"
address = "/run/soci-snapshotter/soci-snapshotter.sock"
[proxy_plugins.soci.exports]
root = "/var/lib/soci-snapshotter"
enable_remote_snapshot_annotations = "true"

Kubernetes e2e quick suite on EKS:

NAME                        TYPE  STATE    PASSED  FAILED  SKIPPED  LAST UPDATE
x86-64-aws-k8s-131-quick    Test  passed   4       0       6600     2026-10-23T06:12:02
aarch64-aws-k8s-131-quick   Test  passed   4       0       6600     2026-10-23T06:11:48
x86-64-aws-k8s-132-quick    Test  passed   4       0       6619     2026-10-23T06:12:13
aarch64-aws-k8s-132-quick   Test  passed   4       0       6619     2026-10-23T06:12:28
x86-64-aws-k8s-133-quick    Test  passed   4       0       6728     2026-10-23T06:15:37
aarch64-aws-k8s-133-quick   Test  passed   4       0       6728     2026-10-23T06:15:41
x86-64-aws-k8s-137-quick    Test  passed   6       0       3203     2026-10-23T22:05:17
aarch64-aws-k8s-137-quick   Test  passed   6       0       3203     2026-10-23T22:05:07

Node tests on EKS:

TEST                                       VARIANTS                                            ARCH             NODES   RESULT
pod runs                                   aws-k8s-1.31, 1.32, 1.33                            x86_64, aarch64  2 each  pass
pod runs, nodes reused by a second run     aws-k8s-1.31, 1.32                                  x86_64, aarch64  2 each  pass
pod runs with SOCI (parallel-pull-unpack)  aws-k8s-1.31, 1.32                                  x86_64, aarch64  2 each  pass
SOCI host check (pause + images in soci)   aws-k8s-1.31, 1.32                                  x86_64, aarch64  2 each  pass
SOCI + registry mirror + credentials       aws-k8s-1.31, 1.32                                  x86_64, aarch64  2 each  pass
pod runs + nvidia-smi in a GPU pod         aws-k8s-1.31-nvidia, 1.32-nvidia, 1.32-nvidia-fips  x86_64, aarch64  2 each  pass

Registry mirrors and credentials on containerd 2.3.7 (aws-k8s-1.31/1.32): a * mirror with endpoints zeta then alpha, a docker.io mirror, and credentials for one registry.

# _default/hosts.toml keeps the configured order
[host."https://zeta.example.invalid"] ... [host."https://alpha.example.invalid"]
# the registry with credentials keeps the * mirror
/etc/containerd/certs.d/registry.example.com/hosts.toml
/etc/containerd/certs.d/registry.example.com/credentials.toml
# docker.io pulls are served by the mirror (ctr and CRI), into the soci snapshotter
snapshots soci: 7, overlayfs: 0

SOCI pause image import on 1.31/1.32, before vs after the core-kit fix. Before: a released aws-k8s-1.32-nvidia-fips (containerd 2.2.9) with the old import.

# before, snapshotter = soci: import fails, kubelet's ExecStartPre fails (31x), kubelet never runs
ctr: failed to prepare extraction snapshot "extract-686471205-61pX sha256:93250…": unable to get image ref from labels
kubelet.service: Control process exited, code=exited, status=1/FAILURE

# after, snapshotter = soci (containerd 2.3.7)
ACTIVE_SNAPSHOTTER="soci"
unpacking localhost/kubernetes/pause:0.1.0 (sha256:71c14f9c…)...done
      7 containerd.io/gc.ref.snapshot.soci
snapshots overlayfs: 0

In-place update and rollback, aws-k8s-1.31 on EKS. A real update through a TUF repo, from 1.7.36 to 2.3.7, then signpost rollback-to-inactive, then a second update. Each step ran a pod test, and a long-lived Deployment ran throughout.

# 1. baseline
Bottlerocket OS 1.68.0 (aws-k8s-1.31), containerd 1.7.36
meta.db dbVersion = 3
enable_unprivileged_ports = false, enable_unprivileged_icmp = false
node Ready, pod test: pass

# 2. apiclient update apply --reboot
Bottlerocket OS 1.68.1 (aws-k8s-1.31), containerd 2.3.7
meta.db dbVersion = 4
"enable-unprivileged-ports": false, "enable-unprivileged-icmp": false   # new default filled into the existing datastore
enable_unprivileged_ports = false, enable_unprivileged_icmp = false     # effective
node Ready 35s after reboot, long-lived pods recovered, pod test: pass

# 3. signpost rollback-to-inactive + reboot
Bottlerocket OS 1.68.0 (aws-k8s-1.31), containerd 1.7.36
meta.db dbVersion = 4 (one-way migration; 1.7 opens it fine)
node Ready, long-lived pods recovered, pod test: pass
overlayfs snapshots: 48 before and after

# 4. update again
containerd 2.3.7; stale sandboxes left by 1.7 are cleaned up at startup:
level=warning msg="failed to get sandbox <id> from sandbox store" error="bucket \"<id>\" not found: not found"
level=info msg="RemovePodSandbox \"<id>\" returns successfully"
node Ready, pod test: pass

Images survive an update or rollback without a re-pull. An image pulled on one containerd version is run on the other by a Job with imagePullPolicy: Never:

python:3.13-slim pulled on 2.3.7 (bytes read=11922462) -> rollback to 1.7.36: 0 PullImage, job never-a Complete ("ok")
redis:7.4-alpine pulled on 1.7.36 (bytes read=16252728) -> update to 2.3.7: 0 PullImage, job never-b Complete ("redis-cli 7.4.11")

ECS (aws-ecs-2, docker-engine 25.0.18 on containerd 2.3):

# boot check, containerd 2.3.7, x86_64 and aarch64: pass, no failed units
$ docker run --rm public.ecr.aws/docker/library/busybox true
rc=0
# aws-ecs-2-nvidia aarch64 (containerd 2.3.6 build): logs, --cpus, -p and the GPU
logs: hello-from-logs
cpu.max: 50000 100000
docker port: 80/tcp -> 0.0.0.0:18080
--runtime nvidia: GPU 0: NVIDIA T4G
# aws-ecs-2-fips / -nvidia-fips: fips_enabled=1, GODEBUG=fips140=on in containerd, dockerd and the shim

ECS test suite containerd 2.3.7, all ECS variants:

NAME                       TYPE  STATE    PASSED  FAILED  SKIPPED  FLAKY
x86-64-aws-ecs-2-    Test  passed   79      0       78       0
aarch64-aws-ecs-2-   Test  passed   74      0       83       0
x86-64-aws-ecs-2-nvidia    Test  passed   78      0       79       0
x86-64-aws-ecs-3-    Test  passed   78      0       78       3
aarch64-aws-ecs-3-   Test  passed   75      0       81       3
x86-64-aws-ecs-3-nvidia    Test  passed   73      0       83       3
x86-64-aws-ecs-4-    Test  passed   78      0       78       3
aarch64-aws-ecs-4-   Test  passed   75      0       81       3
x86-64-aws-ecs-4-nvidia    Test  passed   75      0       81       3

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

@KCSesh KCSesh changed the title Export/containerd 2.3/all Use containerd 2.3 in all variants Oct 29, 2026
@KCSesh
KCSesh force-pushed the export/containerd-2.3/all branch from b9cb3b9 to b9b9bb2 Compare October 29, 2026 20:47
This was referenced Oct 29, 2026
Open
Open
Open
Open
@KCSesh
KCSesh marked this pull request as ready for review October 29, 2026 21:32
KCSesh added 23 commits October 30, 2026 20:32
@KCSesh
aws-dev: bump to containerd-2.3
4ee79a7 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-2-fips: bump to containerd-2.3
6c78ece 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-2-nvidia-fips: bump to containerd-2.3
8d8b6c0 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-2-nvidia: bump to containerd-2.3
c7edf86 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-2: bump to containerd-2.3
f8ba88f 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-3-fips: bump to containerd-2.3
1e4c3eb 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-3-nvidia-fips: bump to containerd-2.3
90f488a 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-3-nvidia: bump to containerd-2.3
13149ee 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-3: bump to containerd-2.3
a660ee7 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-4-nvidia: bump to containerd-2.3
16c9631 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-ecs-4: bump to containerd-2.3
e8093d0 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.31-fips: bump to containerd-2.3
32e2983 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.31-nvidia-fips: bump to containerd-2.3
7c766f9 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.31-nvidia: bump to containerd-2.3
59248fb 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.31: bump to containerd-2.3
583ec01 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.32-fips: bump to containerd-2.3
11b38cd 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.32-nvidia-fips: bump to containerd-2.3
385c7c4 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.32-nvidia: bump to containerd-2.3
530856f 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.32: bump to containerd-2.3
0558d1c 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.33-fips: bump to containerd-2.3
08ec819 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.33-nvidia-fips: bump to containerd-2.3
3b82ef5 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.33-nvidia: bump to containerd-2.3
c85d43e 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.33: bump to containerd-2.3
ecf99bf 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
KCSesh added 29 commits October 30, 2026 20:33
@KCSesh
aws-k8s-1.36-nvidia-fips: bump to containerd-2.3
f9f8c57 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.36-nvidia: bump to containerd-2.3
ed933ed 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.36: bump to containerd-2.3
00e34ff 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-mantle-1-fips: bump to containerd-2.3
7b6f27c 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-mantle-1-nvidia-fips: bump to containerd-2.3
6819dd3 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-mantle-1-nvidia: bump to containerd-2.3
a94ce96 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-mantle-1: bump to containerd-2.3
775b7a6 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
metal-dev: bump to containerd-2.3
739b0c7 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-dev: bump to containerd-2.3
76d96f1 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.31-fips: bump to containerd-2.3
1af9091 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.31: bump to containerd-2.3
6e6f0b8 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.32-fips: bump to containerd-2.3
c01e357 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.32: bump to containerd-2.3
ea6eae9 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.33-fips: bump to containerd-2.3
4339833 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.33: bump to containerd-2.3
34aabc0 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.34-fips: bump to containerd-2.3
eee5446 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.34: bump to containerd-2.3
9d07e7d 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.35-fips: bump to containerd-2.3
1484589 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.35: bump to containerd-2.3
1ded6e1 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.36-fips: bump to containerd-2.3
eeba05a 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.36: bump to containerd-2.3
02b80a9 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
settings-defaults: split out aws-k8s-1.31-nvidia-fips defaults
65aa7aa 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
settings-defaults: split out aws-k8s-1.32-nvidia-fips defaults
d1fd2e7 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
shared-defaults: add container-runtime-unprivileged-default-false
48c7e84 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.31: keep unprivileged ports/icmp off
2c8624f 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.31-nvidia: keep unprivileged ports/icmp off
f74679b 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.32: keep unprivileged ports/icmp off
ebefdbb 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
aws-k8s-1.32-nvidia: keep unprivileged ports/icmp off
5a9a1c7 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
vmware-k8s-1.32: keep unprivileged ports/icmp off
b4ab635 
Signed-off-by: Kyle Sessions <kssessio@amazon.com>
@KCSesh
KCSesh force-pushed the export/containerd-2.3/all branch from b9b9bb2 to b4ab635 Compare October 30, 2026 21:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@KCSesh