chore(deps): Bump github.com/containerd/containerd/v2 from 2.2.8 to 2.4.0 in /core

[dependabot]

Bumps github.com/containerd/containerd/v2 from 2.2.8 to 2.4.0.

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.4.0

Welcome to the v2.4.0 release of containerd!

containerd 2.4 is a regular (non-LTS) release with a shorter support window, intended for users who want to adopt new features sooner. As the release following the 2.3 LTS, it is the point in the release cycle where previously deprecated features may be removed, so this release may include breaking changes; check the notes below and clear any deprecation warnings from your current version before upgrading.

Users prioritizing stability and a longer support lifecycle should stay on the 2.3 LTS release.

Highlights

Container Runtime Interface (CRI)

• Enable mount manager for image mounts in CRI (#13542)
• Export sandbox image and CNI directory configuration in CRI plugin info (#13940)
• Set default runtimeFeatures.UserNamespacesHostNetwork to true (#13162)
• Support OCI runtime feature introspection for non-runc runtimes (#13504)

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#12889)
• Support propagating HTTP 299 warning headers from registries to the resolver (#12698)
• Use klauspost/compress for gzip layer decompression (#13560)

Image Storage

• Add client options to fetch all layer content during unpack even when snapshots exist (#14126)
• Include media type in content create events (#13833)
• Add forward References to the GC collection context (#13634)

Node Resource Interface (NRI)

• Expose container image name, digest, and config digest to NRI plugins (#13960)
• Emit deprecation warnings for plugins using deprecated NRI interfaces (#13916)

Runtime

• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14090)
• Add UpdateSandbox RPC to propagate sandbox controller updates to the shim (#14105)
• Avoid immediately restarting containers with restart=always policy after they are explicitly stopped (#13993)
• Pass tracing context from shim to runc and hooks (#14036)
• Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13818)
• Implement Windows named-pipe server and log streaming support in pkg/shim (#13948)
• Enable log scrubbing by default on Windows (#13837)
• Allow specifying parent checkpoint directory when checkpointing with runc (#13699)

... (truncated)

Changelog

Sourced from github.com/containerd/containerd/v2's changelog.

Versioning and Release

This document details the versioning and release plan for containerd. Stability is a top goal for this project, and we hope that this document and the processes it entails will help to achieve that. It covers the release process, versioning numbering, backporting, API stability and support horizons.

If you rely on containerd, it would be good to spend time understanding the areas of the API that are and are not supported and how they impact your project in the future.

This document will be considered a living document. Supported timelines, backport targets and API stability guarantees will be updated here as they change.

If there is something that you require or this document leaves out, please reach out by filing an issue.

Releases

Releases of containerd will be versioned using dotted triples, similar to Semantic Version. For the purposes of this document, we will refer to the respective components of this triple as <major>.<minor>.<patch>. The version number may have additional information, such as alpha, beta and release candidate qualifications. Such releases will be considered "pre-releases".

Major and Minor Releases

Major and minor releases of containerd will be made from main. Releases of containerd will be marked with GPG signed tags and announced at https://github.com/containerd/containerd/releases. The tag will be of the format v<major>.<minor>.<patch> and should be made with the command git tag -s v<major>.<minor>.<patch>.

After a minor release, a branch will be created, with the format release/<major>.<minor> from the minor tag. All further patch releases will be done from that branch. For example, once we release v1.0.0, a branch release/1.0 will be created from that tag. All future patch releases will be done against that branch.

Release Cadence

Since containerd v2.3 in April 2026, minor releases are provided on a time basis with a cadence of 4 months. New minor releases are scheduled for April, August, and December of each year. This cadence is synchronized with the Kubernetes release schedule to ensure that new features in containerd can be smoothly adopted by new Kubernetes releases.

The maintainers will maintain a roadmap and milestones for each release, however,

... (truncated)

Commits

• a7fe631 Merge pull request #14169 from samuelkarp/prepare-release-2.4.0
• 647fafa Prepare release notes for v2.4.0
• c6d0192 Merge pull request #14170 from samuelkarp/prepare-api-v1.12.0
• 5c4ea21 Prepare release notes for api/v1.12.0
• 610d8d8 Merge pull request #14166 from samuelkarp/deprecations-and-removals-for-2.4
• 531b3a3 tracing: remove deprecated tracing config options
• ca8579a tracing: add tests for otlp exporter and env vars
• ee024b7 tracing: remove deprecated otlp configs
• f7c654f cri: remove deprecated cni bin_dir
• 4f7de25 cri: remove enable_cdi config option
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)