Kata Containers Files

Survey

Please take the Kata Containers survey:

• https://openinfrafoundation.formstack.com/forms/kata_containers_user_survey

This will help the Kata Containers community understand:

• how you use Kata Containers
• what features and improvements you would like to see in Kata Containers

Libseccomp Notices

The kata-agent binaries inside the Kata Containers images provided with this release are statically linked with the following GNU LGPL-2.1 licensed libseccomp library.

• libseccomp

The kata-agent uses the libseccomp v2.6.0 which is not modified from the upstream version. However, in order to comply with the LGPL-2.1 (§6(a)), we attach the complete source code for the library.

Kata Containers builder images

• agent (on all its different flavours): quay.io/kata-containers/builders:agent-6f787300c-5106e7b34-1.91-x86_64
• Kernel (on all its different flavours): quay.io/kata-containers/builders:kernel-5c0269881-x86_64
• OVMF (on all its different flavours): quay.io/kata-containers/builders:ovmf-e02e22643-x86_64
• QEMU (on all its different flavurs): quay.io/kata-containers/builders:qemu-b2c943931-x86_64
• shim-v2: quay.io/kata-containers/builders:shim-v2-go-1.24.13-rust-1.91-5c0269881-x86_64
• tools: quay.io/kata-containers/builders:tools-0621e65e7-c53910eb1-8025fa045-f6e0a7c33-x86_64
• virtiofsd: quay.io/kata-containers/builders:virtiofsd-1.85.1-musl-2962e14c1-x86_64

Installation

Follow the Kata installation instructions.

What's Changed

• tests: Remove terminationGracePeriod in manifests by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12350
• tests: policy test improvements by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/12409
• packaging: Delete pause_bundle dir before unpack by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12423
• kata-deploy: Make update strategy configurable for kata-deploy DaemonSet by @nlle in https://github.com/kata-containers/kata-containers/pull/12415
• kata-deploy: nydus: Always start from a clean state by @fidencio in https://github.com/kata-containers/kata-containers/pull/12428
• runtime: tdx QEMU configuration changes by @mythi in https://github.com/kata-containers/kata-containers/pull/12390
• build(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.4.1 by @dependabot[bot] in https://github.com/kata-containers/kata-containers/pull/12426
• kata-deploy: Avoid text file busy error with nydus-snapshotter by @fidencio in https://github.com/kata-containers/kata-containers/pull/12442
• tests: kata-deploy: Wait for RuntimeClass before running E2E by @fidencio in https://github.com/kata-containers/kata-containers/pull/12429
• tests: nvidia: cc: Use sealed secrets for NGC_API_KEY by @fidencio in https://github.com/kata-containers/kata-containers/pull/12424
• runtimes: Sanitize trailing whitespaces by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12433
• shim: Add CRI-O annotation support for device cold plug by @bpradipt in https://github.com/kata-containers/kata-containers/pull/12435
• runtime(-rs): rootfs: Use dm-mod.create kernel parameters for dm-verity protected root filesystems by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12396
• gpu: Install packages for devkit by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12454
• runtime-rs: use FIRMWARETDVFPATH like Go runtime by @mythi in https://github.com/kata-containers/kata-containers/pull/12464
• gpu: Add Agent NUMA Support 1 of N by @zvonkok in https://github.com/kata-containers/kata-containers/pull/12160
• Go bump 1.24.13 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12473
• runtime-rs: Fix stdout empty when exec process by @Apokleos in https://github.com/kata-containers/kata-containers/pull/12376
• docs: add OS_VERSION to rootfs script by @jirimoravcik in https://github.com/kata-containers/kata-containers/pull/12470
• kernel: unify confidential and non-confidential by @fidencio in https://github.com/kata-containers/kata-containers/pull/12468
• runtime: Enable NUMA optionally by @zvonkok in https://github.com/kata-containers/kata-containers/pull/11592
• tests: Clean up superfluous GPU annotation by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12462
• genpolicy: support multiple NVIDIA GPU resource keys via allowlist in vfio settings by @Park-Jiyeonn in https://github.com/kata-containers/kata-containers/pull/12386
• Fix CVE 2026 25541 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12475
• Fix CVE 2026 25727 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12474
• ci: add editorconfig checker by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12448
• versions: Bump rust to 1.91 by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12476
• tools.gatekeeper: Add support to paginate workflows by @ldoktor in https://github.com/kata-containers/kata-containers/pull/12466
• runtime: disable nvdimm for confidential guest by @katexochen in https://github.com/kata-containers/kata-containers/pull/12472
• kata-deploy: rely more on drop-in configs by @fidencio in https://github.com/kata-containers/kata-containers/pull/12456
• tests: Make editorconfig-checker happy by @fidencio in https://github.com/kata-containers/kata-containers/pull/12483
• runtime-rs: Add support configurable network_queues via configuration and annotation by @Apokleos in https://github.com/kata-containers/kata-containers/pull/12408
• runtime-rs: Skip sockets and threads for hotplug_vcpus on Z/P by @BbolroC in https://github.com/kata-containers/kata-containers/pull/12486
• genpolicy: suppress YAML output when --{base64/raw}-out are used by @sespiros in https://github.com/kata-containers/kata-containers/pull/12439
• versions: Tidy up versions file by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12385
• tests/coco: disable k8s-sandbox-vcpus-allocation.bats for TDX by @mythi in https://github.com/kata-containers/kata-containers/pull/12493
• kata-deploy: re-work delete / uninstall by @fidencio in https://github.com/kata-containers/kata-containers/pull/12491
• kata-deploy: use get_kata_containers_original_config_path() for custom runtimes by @fidencio in https://github.com/kata-containers/kata-containers/pull/12498
• build: Tighten upstream download path for ORAS by @manuelh-dev in https://github.com/kata-containers/kata-containers/pull/12480
• tests: Retry k8s deployment by @fidencio in https://github.com/kata-containers/kata-containers/pull/12495
• kata-deploy: use k3s/rke2 base template by @fidencio in https://github.com/kata-containers/kata-containers/pull/12488
• versions: Switch gperf mirror again by @sprt in https://github.com/kata-containers/kata-containers/pull/12506
• ci: add workflow to push ORAS tarball cache by @fidencio in https://github.com/kata-containers/kata-containers/pull/12510
• kata-deploy: add node selector to nvidia runtime classes by @jojimt in https://github.com/kata-containers/kata-containers/pull/12432
• tests: nvidia: Fix genpolicy error when pulling nvcr.io images by @fidencio in https://github.com/kata-containers/kata-containers/pull/12514
• security: x/net update in tools by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12482
• scripts: use temporary GPG home when verifying cached gperf tarball by @fidencio in https://github.com/kata-containers/kata-containers/pull/12522
• ci: tdx: properly skip k8s-sandbox-vcpus-allocation.bats by @fidencio in https://github.com/kata-containers/kata-containers/pull/12519
• kata-deploy: set CRI images runtime_platform snapshotter for containerd v3 by @fidencio in https://github.com/kata-containers/kata-containers/pull/12520
• runtime: refactor hypervisor devices cgroup creation by @balintTobik in https://github.com/kata-containers/kata-containers/pull/11140
• security: Rkyv 0.7.46 bump by @stevenhorsman in https://github.com/kata-containers/kata-containers/pull/12499
• kata-deploy: Temporarily comment GPU specific labels by @fidencio in https://github.com/kata-containers/kata-containers/pull/12523
• infra: fix multi-arch manifest publish by @fidencio in https://github.com/kata-containers/kata-containers/pull/12524
• kata-deploy: disable provenance/SBOM for quay.io compatibility by @fidencio in https://github.com/kata-containers/kata-containers/pull/12528
• agent: Don't pass empty options to mount by @skazi0 in https://github.com/kata-containers/kata-containers/pull/10746
• kata-deploy: Add TEE nodeSelectors for TEE shims when NFD is detected by @fidencio in https://github.com/kata-containers/kata-containers/pull/12521
• kata-deploy: runtime_platform -> runtime_platforms ... plus a few fixes by @fidencio in https://github.com/kata-containers/kata-containers/pull/12530
• qemu: log exit code after failure by @burgerdev in https://github.com/kata-containers/kata-containers/pull/12533
• tests: mariner annotations for k8s-openvpn by @danmihai1 in https://github.com/kata-containers/kata-containers/pull/12449
• versions: bump to Linux v6.18.12 and QEMU v10.2.1 by @mythi in https://github.com/kata-containers/kata-containers/pull/12540
• kata-deploy: preserve symlinks when installing artifacts by @fidencio in https://github.com/kata-containers/kata-containers/pull/12538
• ci: Add integration tests for secret & configmap propagation by @ajaypvictor in https://github.com/kata-containers/kata-containers/pull/12455
• runtime-rs/ch: Fix inverted vcpu/tid mapping in get_ch_vcpu_tids by @chiranjeevi-max in https://github.com/kata-containers/kata-containers/pull/12526
• kata-deploy: enable kata-remote for ppc64le by @Amulyam24 in https://github.com/kata-containers/kata-containers/pull/12546
• genpolicy: allow RO and RW for sysfs with privileged container by @fidencio in https://github.com/kata-containers/kata-containers/pull/12541
• release: Bump version to 3.27.0 by @fidencio in https://github.com/kata-containers/kata-containers/pull/12547

New Contributors

• @nlle made their first contribution in https://github.com/kata-containers/kata-containers/pull/12415
• @jirimoravcik made their first contribution in https://github.com/kata-containers/kata-containers/pull/12470
• @sespiros made their first contribution in https://github.com/kata-containers/kata-containers/pull/12439
• @chiranjeevi-max made their first contribution in https://github.com/kata-containers/kata-containers/pull/12526

Full Changelog: https://github.com/kata-containers/kata-containers/compare/3.26.0...3.27.0