containerd v2.0.10

The v2.0.10 release is primarily a security and stability-focused update. It addresses two specific vulnerabilities and improves the runtime's robustness by hardening label propagation and updating critical underlying dependencies like runc and the Go compiler.

Critical Security Patches for containerd Core — This update addresses two high-profile security vulnerabilities (CVE-2026-53488 and CVE-2026-47262) that could potentially compromise the container runtime. Staying updated is critical for maintaining the integrity of your production environment and protecting against known exploits.

Restriction of Reserved Label Propagation from Images — Ensures that internal or reserved labels within image configurations do not unintentionally leak or propagate into the container runtime. This maintains clean container metadata and prevents potential configuration conflicts.

Update runc to v1.3.6 and Go to Latest Toolchains — By upgrading the underlying container executor and the Go runtime, containerd benefits from the latest performance improvements and upstream security fixes, ensuring a more stable and secure foundation for your workloads.