feat: Bump containerd and pause for kubernetes 1.36.5 by riadelhajjaji-scality · Pull Request #5157 · scality/metalk8s

riadelhajjaji-scality · 2026-10-12T15:17:18Z

Component: build, containers

Context:

MetalK8s 136.0 ships containerd 2.2.5 and the pause image 3.10.1.
containerd 2.3 is the first containerd LTS release (supported for at
least two years, aligned on the Kubernetes release cycle), and brings
security hardening and bug fixes. The pause 3.10.2 image is the
version expected by Kubernetes 1.36.

Summary:

Bump containerd from 2.2.5
to 2.3.6,
the latest containerd.io RPM available in the docker-ce repository
for EL8 and EL9 (2.3.7 is not packaged yet)
Bump the pause image from 3.10.1 to 3.10.2:
only the Windows image base changes, the Linux image is unchanged.
Its digest is not pinned, as the tag is re-published several times

Upstream changes reviewed against our configuration:

Breaking: commas are no longer allowed in NRI plugin names. NRI is
not used by MetalK8s
seccomp default profile hardening (AF_ALG sockets blocked): our
workloads use the RuntimeDefault profile, none uses AF_ALG sockets
checkpoint restore through CreateContainer disabled by default:
not used by MetalK8s
plugin config migration now runs on load: our config already uses
version = 3
sandbox image references are normalized: our pinned sandbox image
is a fully qualified name

Acceptance criteria:

The CI passes: installation, expansion, upgrade an
Nodes run containerd 2.3.6 (containerd --version)
Pod sandboxes use the pause 3.10.2 image (`crictl

Closes: #MK8S-352

bert-e · 2026-10-12T15:17:22Z

Hello riadelhajjaji-scality,

My role is to assist you with the merge of this
pull request. Please type @bert-e help to get information
on this process, or consult the user documentation.

Available options

name	description	privileged	authored
`/after_pull_request`	Wait for the given pull request id to be merged before continuing with the current one.
`/bypass_author_approval`	Bypass the pull request author's approval	⭐
`/bypass_build_status`	Bypass the build and test status	⭐
`/bypass_commit_size`	Bypass the check on the size of the changeset `TBA`	⭐
`/bypass_incompatible_branch`	Bypass the check on the source branch prefix	⭐
`/bypass_jira_check`	Bypass the Jira issue check	⭐
`/bypass_peer_approval`	Bypass the pull request peers' approval	⭐
`/bypass_leader_approval`	Bypass the pull request leaders' approval	⭐
`/bypass_source_branch_lineage`	Bypass the cross-branch contamination check	⭐
`/approve`	Instruct Bert-E that the author has approved the pull request.		✍️
`/create_pull_requests`	Allow the creation of integration pull requests.
`/create_integration_branches`	Allow the creation of integration branches.
`/no_octopus`	Prevent Wall-E from doing any octopus merge and use multiple consecutive merge instead
`/unanimity`	Change review acceptance criteria from `one reviewer at least` to `all reviewers`
`/wait`	Instruct Bert-E not to run until further notice.

Available commands

name	description	privileged
`/help`	Print Bert-E's manual in the pull request.
`/status`	Print Bert-E's current status in the pull request.
`/clear`	Remove all comments from Bert-E from the history `TBA`
`/retry`	Re-start a fresh build `TBA`
`/build`	Re-start a fresh build `TBA`
`/force_reset`	Delete integration branches & pull requests, and restart merge process from the beginning.
`/reset`	Try to remove integration branches unless there are commits on them which do not appear on the source branch.

Status report is not available.

bert-e · 2026-10-12T15:17:30Z

Waiting for approval

The following approvals are needed before I can proceed with the merge:

the author
2 peers

Peer approvals must include at least 1 approval from the following list:

riadelhajjaji-scality · 2026-10-12T15:20:43Z

/changie Enhanced Bump containerd to 2.3.6 and pause to 3.10.2

bert-e · 2026-10-15T07:04:29Z

Branches have diverged

This pull request's source branch feature/MK8S-352-upgrade-containerd-pause has diverged from
development/136.0 by more than 50 commits.

To avoid any integration risks, please re-synchronize them using one of the
following solutions:

Merge origin/development/136.0 into feature/MK8S-352-upgrade-containerd-pause
Rebase feature/MK8S-352-upgrade-containerd-pause onto origin/development/136.0

Note: If you choose to rebase, you may have to ask me to rebuild
integration branches using the reset command.

claude · 2026-10-15T07:05:18Z

The release notes will list two conflicting containerd/pause bumps: the existing unreleased entry Enhanced-20260727-091019-556322168.yaml (2.2.5 / 3.10.1) and the new one (2.3.6 / 3.10.2).
- Update the existing entry to the new versions and remove the duplicate, or delete the old entry.

Review by Claude Code

eg-ayoub · 2026-10-15T10:15:17Z

the claude comment is about backfill changie entries related to dev/134, those are safe to ignore

ezekiel-alexrod

Sorry for back and forth, but adding releases links to the changelog message could be handy too

#5163 (comment)

Missclick and spaghetti brain

Bumped containerd from 2.2.5 to 2.3.6, and the pause image from 3.10.1 to 3.10.2. containerd 2.3 is the first LTS release of containerd (supported for at least two years), aligned on the Kubernetes release cycle. Main changes from 2.2.5 to 2.3.6: - CRI: user namespaces with host networking, sandbox API updates, background stats collector, checkpoint restore through CreateContainer disabled by default (2.3.4) - NRI: many new plugin capabilities (sysctl, rlimits, network devices, seccomp...) - EROFS images and snapshotter improvements - Runtime: seccomp default profile hardening (AF_ALG sockets blocked, 2.3.1), /proc/interrupts and CPU thermal throttle sysfs paths masked in containers (2.3.6), shim and OOM watcher fixes - Security: authentication headers stripped when fetching descriptor URLs (2.3.5) Breaking change upstream: commas are no longer allowed in NRI plugin names. Changes that could impact MetalK8s: - NRI: not used by MetalK8s - seccomp default profile hardening: our workloads run with the RuntimeDefault profile, none uses AF_ALG sockets - checkpoint restore disabled by default: not used by MetalK8s - plugin config migration now runs on load: our config already uses `version = 3` - sandbox image references are normalized: our pinned `sandbox` image is a fully qualified name The pause 3.10.2 image only updates the Windows image base, the Linux image is unchanged. Its digest is not pinned, as the tag is re-published several times. The containerd.io 2.3.6 RPM is available in the docker-ce repository for EL8 and EL9. Ref: MK8S-352

Auto-generated-by: changie-add-changelog

claude · 2026-10-16T07:16:35Z

Two unreleased changelog entries conflict: Enhanced-20260727-091019-556322168.yaml (containerd 2.2.5 / pause 3.10.1) and the new one (2.3.6 / 3.10.2)
- Update the old entry to the new versions and drop the new one, or delete the old entry

Review by Claude Code

g-carre

The changelog conflict is due to 134.0 needing a release => this should not be an issue.
@eg-ayoub can you please check that changie is fine for that ?

riadelhajjaji-scality · 2026-10-19T12:26:47Z

/approve

bert-e · 2026-10-19T12:26:54Z

Branches have diverged

This pull request's source branch feature/MK8S-352-upgrade-containerd-pause has diverged from
development/136.0 by more than 50 commits.

To avoid any integration risks, please re-synchronize them using one of the
following solutions:

Merge origin/development/136.0 into feature/MK8S-352-upgrade-containerd-pause
Rebase feature/MK8S-352-upgrade-containerd-pause onto origin/development/136.0

Note: If you choose to rebase, you may have to ask me to rebuild
integration branches using the reset command.

The following options are set: approve

…nerd-pause

github-actions · 2026-10-19T12:39:52Z

✅ Changelog check passed.

claude · 2026-10-19T12:40:39Z

LGTM

Review by Claude Code

bert-e · 2026-10-19T15:09:40Z

In the queue

The changeset has received all authorizations and has been added to the
relevant queue(s). The queue(s) will be merged in the target development
branch(es) as soon as builds have passed.

The changeset will be merged in:

✔️ development/136.0

The following branches will NOT be impacted:

development/123.0
development/124.0
development/124.1
development/125.0
development/126.0
development/127.0
development/128.0
development/129.0
development/130.0
development/131.0
development/132.0
development/133.0
development/134.0
development/2.0
development/2.1
development/2.10
development/2.11
development/2.2
development/2.3
development/2.4
development/2.5
development/2.6
development/2.7
development/2.8
development/2.9

There is no action required on your side. You will be notified here once
the changeset has been merged. In the unlikely event that the changeset
fails permanently on the queue, a member of the admin team will
contact you to help resolve the matter.

IMPORTANT

Please do not attempt to modify this pull request.

Any commit you add on the source branch will trigger a new cycle after the
current queue is merged.
Any commit you add on one of the integration branches will be lost.

If you need this pull request to be removed from the queue, please contact a
member of the admin team now.

The following options are set: approve

bert-e · 2026-10-19T17:30:26Z

I have successfully merged the changeset of this pull request
into targetted development branches:

✔️ development/136.0

The following branches have NOT changed:

development/123.0
development/124.0
development/124.1
development/125.0
development/126.0
development/127.0
development/128.0
development/129.0
development/130.0
development/131.0
development/132.0
development/133.0
development/134.0
development/2.0
development/2.1
development/2.10
development/2.11
development/2.2
development/2.3
development/2.4
development/2.5
development/2.6
development/2.7
development/2.8
development/2.9

Please check the status of the associated issue MK8S-352.

Goodbye riadelhajjaji-scality.

riadelhajjaji-scality marked this pull request as ready for review October 15, 2026 07:04

riadelhajjaji-scality requested a review from a team as a code owner October 15, 2026 07:04

claude Bot reviewed Oct 15, 2026

View reviewed changes

Comment thread .changes/unreleased/Enhanced-20261012-152103-687079184.yaml

riadelhajjaji-scality requested review from TeddyAndrieux and eg-ayoub October 15, 2026 07:50

eg-ayoub approved these changes Oct 15, 2026

View reviewed changes

ezekiel-alexrod reviewed Oct 15, 2026

View reviewed changes

Comment thread buildchain/buildchain/versions.py

ezekiel-alexrod previously approved these changes Oct 15, 2026

View reviewed changes

ezekiel-alexrod self-requested a review October 15, 2026 12:33

ezekiel-alexrod reviewed Oct 15, 2026

View reviewed changes

ezekiel-alexrod self-requested a review October 15, 2026 12:57

riadelhajjaji-scality and others added 2 commits October 16, 2026 09:12

changelog: Bump containerd to 2.3.6 and pause to 3.10.2

854a7d5

Auto-generated-by: changie-add-changelog

riadelhajjaji-scality force-pushed the feature/MK8S-352-upgrade-containerd-pause branch from 3ad065b to 854a7d5 Compare October 16, 2026 07:15

riadelhajjaji-scality requested review from a team as code owners October 16, 2026 07:15

riadelhajjaji-scality changed the title ~~feat: Bump containerd and pause for kubernetes 136.0~~ feat: Bump containerd and pause for kubernetes 1.36.5 Oct 16, 2026

g-carre approved these changes Oct 19, 2026

View reviewed changes

Merge branch 'development/136.0' into feature/MK8S-352-upgrade-contai…

8d66b70

…nerd-pause

bert-e merged commit 882e05d into development/136.0 Oct 19, 2026
35 checks passed

bert-e deleted the feature/MK8S-352-upgrade-containerd-pause branch October 19, 2026 17:30

Conversation

riadelhajjaji-scality commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bert-e commented Oct 12, 2026

Hello riadelhajjaji-scality,

Uh oh!

bert-e commented Oct 12, 2026

Waiting for approval

Uh oh!

riadelhajjaji-scality commented Oct 12, 2026

Uh oh!

bert-e commented Oct 15, 2026

Branches have diverged

Uh oh!

Uh oh!

claude Bot commented Oct 15, 2026

Uh oh!

eg-ayoub commented Oct 15, 2026

Uh oh!

Uh oh!

ezekiel-alexrod left a comment

Choose a reason for hiding this comment

Uh oh!

claude Bot commented Oct 16, 2026

Uh oh!

g-carre left a comment

Choose a reason for hiding this comment

Uh oh!

riadelhajjaji-scality commented Oct 19, 2026

Uh oh!

bert-e commented Oct 19, 2026

Branches have diverged

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

claude Bot commented Oct 19, 2026

Uh oh!

bert-e commented Oct 19, 2026

In the queue

Uh oh!

bert-e commented Oct 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

riadelhajjaji-scality commented Oct 12, 2026 •

edited

Loading