Kata Containers Files

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.5.5 which is not modified from the upstream version. However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-5f68b343b-7420194ea-1.85.1-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-ca4f96ed0-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-5cabce1a2-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-4c006c707-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.23.10-rust-1.85.1-7e9e9263d-x86_64
• tools: quay.io/kata-containers/builders:tools-2fe9df16c-222393375-222393375-75ac09bab-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-1cf1a332a-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• tests: update container image for ci and unit test by @Redent0r in https://github.com/kata-containers/kata-containers/pull/11443
• build(deps): bump rustix in various components by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/11378
• osbuilder: Update image-builder base to f42 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11440
• workflow: Remove code injection in helm login by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11331
• ci: Update dependabot ignore list by @RuoqingHe in https://github.com/kata-containers/kata-containers/pull/11431
• ci: Remove duplicated rust-vmm dependencies by @RuoqingHe in https://github.com/kata-containers/kata-containers/pull/11448
• workflows: Pin action hashes by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11420
• build(deps): bump the clap group across 6 directories with 1 update by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/11405
• genpolicy: prevent corruption of the layer cache file by @charludo in https://github.com/kata-containers/kata-containers/pull/11426
• tests: k8s-policy-rc: print pod descriptions by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/11444
• runtime-rs: Implement Initdata Spec Support in runtime-rs for CoCo by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11181
• ci/static-checks: use oras cache for regorus by @katexochen in https://github.com/kata-containers/kata-containers/pull/11424
• runtime-rs: add the blockfile based rootfs support by @lifupan in https://github.com/kata-containers/kata-containers/pull/11466
• runtime-rs: fix the issue return the wrong volume by @lifupan in https://github.com/kata-containers/kata-containers/pull/11467
• versions: Bump protobuf to 3.7.2 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11441
• ci: Add scorecard action by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11462
• runtime-rs: Support shared fs with "none" on non-tee platforms by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11468
• runtime-rs: Add the memory and vcpu hotplug for cloud-hypervisor by @lifupan in https://github.com/kata-containers/kata-containers/pull/11422
• ci: Run zizmor for GHA security analysis by @sprt in https://github.com/kata-containers/kata-containers/pull/11392
• runtime-rs: Set default_maxvcpus to 0 by @fidencio in https://github.com/kata-containers/kata-containers/pull/11469
• runtime: improve EROFS snapshotter support by @hsiangkao in https://github.com/kata-containers/kata-containers/pull/11434
• tools: kata-monitor: update go version used to build in Dockerfile by @Redent0r in https://github.com/kata-containers/kata-containers/pull/11471
• versions: Bump guest-components by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11461
• runtime-rs: Fix calculation of odd memory sizes by @fidencio in https://github.com/kata-containers/kata-containers/pull/11470
• runtime-rs: Add GPU annotations for remote hypervisor by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11474
• version: Bump nydus-snapshotter by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11484
• build: Allow passing IMAGE_SIZE_ALIGNMENT_MB as an env var by @fidencio in https://github.com/kata-containers/kata-containers/pull/11481
• workflows: Skip weekly coco stability tests by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11479
• runtime-rs: support setting create_container timeout with request_timeout_ms for image pulling in guest by @Apokleos in https://github.com/kata-containers/kata-containers/pull/10693
• runtime-rs: Fix noise with frequently appearing in unstaged changes by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11490
• genpolicy: add validation for storages by @arc9693 in https://github.com/kata-containers/kata-containers/pull/11248
• gha: Eliminate use of force-skip-ci label by @sprt in https://github.com/kata-containers/kata-containers/pull/11499
• test: fix broken testing code in libs by @zhaodiaoer in https://github.com/kata-containers/kata-containers/pull/11423
• kata-agent: mount.rs: Fix warning of test by @teawater in https://github.com/kata-containers/kata-containers/pull/11509
• runtime-rs: make the resize_vcpu api support sync by @lifupan in https://github.com/kata-containers/kata-containers/pull/11510
• security: ci: Fixes for Zizmor GHA security scanning by @sprt in https://github.com/kata-containers/kata-containers/pull/11475
• runtime-rs: refactor and fix the implementation of guest-pull by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11482
• gpu: NVRC static build by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11517
• Remove atty dependency by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11506
• gpu: Update runtimeClasses for correct podoverhead by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11336
• tools: port the dragonball kernel patch to 6.12.x by @lifupan in https://github.com/kata-containers/kata-containers/pull/11513
• tests: runtimeclasses: Adjust gpu runtimeclasses by @fidencio in https://github.com/kata-containers/kata-containers/pull/11530
• runtime-rs: add initdata annotation for remote hypervisor by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11528
• workflows: adopting azure/setup-kubectl by @wainersm in https://github.com/kata-containers/kata-containers/pull/11523
• runtime: Fix rootlessDir not correctly set in rootless VMM mode by @StevenFryto in https://github.com/kata-containers/kata-containers/pull/11527
• Sev deprecation by @arvindskumar99 in https://github.com/kata-containers/kata-containers/pull/11380
• versions: bump opa 1.5.1 -> 1.6.0 by @katexochen in https://github.com/kata-containers/kata-containers/pull/11494
• runtime/runtime-rs: Set shared_fs to none for IBM SEL in config file by @BbolroC in https://github.com/kata-containers/kata-containers/pull/11537
• tests: k0s: Always use latest version, apart from CRI-O tests by @fidencio in https://github.com/kata-containers/kata-containers/pull/11529
• libs: Remove lockfile for libs by @RuoqingHe in https://github.com/kata-containers/kata-containers/pull/11545
• runtime-rs: Add vfio support with coldplug for cloud-hypervisor by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11540
• runtime-rs: Switch tempdir to tempfile by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11549
• gh: Fix released VERSION file by @fidencio in https://github.com/kata-containers/kata-containers/pull/11554
• runtime-rs: Change default block device driver from virtio-scsi to virtio-blk-* by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11491
• tests/k8s: instrument some tests for debugging by @wainersm in https://github.com/kata-containers/kata-containers/pull/11519
• runtime-rs | trace-forwarder: Bump chrono crate version by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11550
• versions: Bump idna crate to >= 1.0.3 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11521
• mem-agent: Update to https://github.com/teawater/mem-agent/tree/kata-20250627 by @teawater in https://github.com/kata-containers/kata-containers/pull/11480
• Rust advisory fixes pre 3.19.0 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11555
• ci: Make qemu-coco-dev for s390x (zVSI) required again by @BbolroC in https://github.com/kata-containers/kata-containers/pull/11564
• gpu: Add proper TDX config path by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11568
• Remove gpu admin tools by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11567
• runtime-rs: Fix initdata length field missing when create block by @Apokleos in https://github.com/kata-containers/kata-containers/pull/11557
• build: Fix cache for nvidia-gpu-initrd builds by @fidencio in https://github.com/kata-containers/kata-containers/pull/11571
• deps(chore): update guest-components and trustee by @Xynnn007 in https://github.com/kata-containers/kata-containers/pull/11569
• kernel: debug config by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11082
• gpu: Fix kata deploy.sh by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11335
• runk: Fix build errors by @Tim-Zhang in https://github.com/kata-containers/kata-containers/pull/11575
• agent: fix the issue of parent writer pipe fd leak by @lifupan in https://github.com/kata-containers/kata-containers/pull/11504
• deps(chore): bump guest-components to candidate v0.14.0 by @Xynnn007 in https://github.com/kata-containers/kata-containers/pull/11577
• OVMF: Making comment in versions.yaml for SEV-SNP by @arvindskumar99 in https://github.com/kata-containers/kata-containers/pull/11573
• shellcheck: fix kernel/build.sh by @zvonkok in https://github.com/kata-containers/kata-containers/pull/10961
• workflow: Add osv-scanner action by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11580
• workflow: Fix osv-scanner action by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11581
• build(deps): bump nix to 0.26.4 in agent, libs, runtime-rs by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/11450
• More crate bumps for security remediations by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11572
• runtime-rs: Fix the issue of blocking socket with Tokio by @justxuewei in https://github.com/kata-containers/kata-containers/pull/11578
• agent: update the processes hashmap to use exec_id as primary key by @Ankita13-code in https://github.com/kata-containers/kata-containers/pull/11313
• kernel: fix enable kernel debug by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11584
• ci: cache: Tag agent-ctl cache by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/11493
• helm: add nodeSelector support to kata-deploy chart by @gmintoco in https://github.com/kata-containers/kata-containers/pull/11558
• qemu: tdx: Fix binary path for non-gpu TDX by @fidencio in https://github.com/kata-containers/kata-containers/pull/11589
• chore: Update protobuf to fix CVE-2025-53605 by @Tim-Zhang in https://github.com/kata-containers/kata-containers/pull/11576
• release: Bump version to 3.19.0 by @fidencio in https://github.com/kata-containers/kata-containers/pull/11596
• release: Copy the VERSION file to the tarball by @fidencio in https://github.com/kata-containers/kata-containers/pull/11597

New Contributors

• @charludo made their first contribution in https://github.com/kata-containers/kata-containers/pull/11426
• @zhaodiaoer made their first contribution in https://github.com/kata-containers/kata-containers/pull/11423
• @StevenFryto made their first contribution in https://github.com/kata-containers/kata-containers/pull/11527
• @gmintoco made their first contribution in https://github.com/kata-containers/kata-containers/pull/11558

Full Changelog: https://github.com/kata-containers/kata-containers/compare/3.18.0...3.19.0