containerd v2.2.6

The v2.2.6 patch release focuses on hardening the Container Runtime Interface (CRI) and Image Distribution layers. Key updates address resource leakage during failed sandbox operations, prevent crashes in NRI networking, and protect the image content store from pollution during ref resolution.

Prevent mount leaks during pod sandbox setup failures — This prevents dangling mounts on the host system when sandbox setup fails. For Kubernetes operators, this ensures host resources remain clean and prevents stability issues caused by leaking mounts over time.

Fix NRI crash during pod teardown and container exit — This eliminates a potential panic (crash) when managing network resources via the Node Resource Interface (NRI) during high-churn scenarios like container exits or sandbox teardowns.

Strict validation for container creation in sandboxes — By enforcing that a sandbox must be running before a container can be created within it, containerd prevents inconsistent states that can lead to deployment failures in orchestration layers like Kubernetes.

Protect content store from pollution during image resolution — This prevents the local content store from being cluttered with incorrect data by tightening how the runtime resolves image references. It ensures local image storage remains healthy and predictable.