v2.4.2

Changes

• nerdctl container:
  • Add --device-cgroup-rule to nerdctl run and nerdctl create (#5258, thanks to @takumi12311123)
  • Add --timeout to nerdctl commit for configuring the lease timeout, which was hard-coded to 1h (#5253, thanks to @Luckydog691)
  • Fix --volumes-from to inherit only user mounts, so that the target container's own /dev/shm configuration is not replaced (#5250, thanks to @git-jxj)
  • Exit with status 1 when detaching from nerdctl attach, as Docker does (#5281, thanks to @cvas22)
• Healthcheck:
  • Support --health-start-interval for nerdctl run and nerdctl create, healthcheck.start_interval in Compose, and HEALTHCHECK --start-interval in images (#5229, thanks to @akashchamp)
• nerdctl image:
  • Fix nerdctl image prune --filter until= (empty value) dropping the filter and removing every unused image (#5304, thanks to @ogulcanaydogan)
  • Fix nerdctl rmi -f failing with image ":": already exists when force-removing more than one image used by running containers (#5191, thanks to @ogulcanaydogan)
  • Enable the image verifier of stargz-snapshotter v0.19, so that images with faked DiffIDs are detected (#5264, thanks to @ktock)
• nerdctl network:
  • Reject invalid nerdctl network ls filters (#5226, thanks to @immanuwell)
• nerdctl volume:
  • Reject invalid nerdctl volume ls filters (#5252, thanks to @immanuwell)
• nerdctl compose:
  • Support device_cgroup_rules (#5258, thanks to @takumi12311123)
  • Fix nerdctl compose images to report the pinned image after retagging (#5251, thanks to @git-jxj)
  • Fix nerdctl compose up on Windows by not defaulting --hostname to the service name (#5267, thanks to @0x000NULL)
• nerdctl logs:
  • Fix log rotation failing on Windows while nerdctl logs -f is running (#5266, thanks to @0x000NULL)
• go.mod:
  • Update containerd library to v2.4.2 (#5278)
• nerdctl-full:
  • Update containerd (2.4.2), BuildKit (0.34.1), RootlessKit (3.3.0), stargz-snapshotter (0.19.1) (#5298, #5264, thanks to @ktock)
    • containerd v2.4.2 fixes CVE-2026-95839, GHSA-8647-2jxj-p2rc, GHSA-hc94-p972-ch66

Full changes: https://github.com/containerd/nerdctl/milestone/70?closed=1
Thanks to @0x000NULL @Luckydog691 @akashchamp @cvas22 @git-jxj @immanuwell @ktock @mainguyen0112 @ogulcanaydogan @sarankumar1325 @takumi12311123

Note

Claude was used for drafting this release note

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7 or later.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.4.2-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.4.2-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.4.2-linux-amd64.tar.gz

-rwxr-xr-x root/root  32600226 2026-10-30 11:43 nerdctl
-rwxr-xr-x root/root     23390 2026-10-30 11:42 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      9555 2026-10-30 11:42 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.4.2-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-10-30 11:53 bin/
-rwxr-xr-x 0/0        34819330 2026-10-07 19:18 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-10-30 11:52 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        80918593 2026-10-07 19:18 bin/buildkitd
-rwxr-xr-x 0/0        16866288 2026-10-30 11:51 bin/bypass4netns
-rwxr-xr-x 0/0         6615202 2026-10-30 11:51 bin/bypass4netnsd
-rwxr-xr-x 0/0        40525840 2026-10-30 11:52 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23390 2026-10-30 11:53 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            9555 2026-10-30 11:53 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8138914 2026-10-30 11:52 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        60186784 2026-10-27 07:32 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        24848782 2026-10-30 11:52 bin/ctd-decoder
-rwxr-xr-x 0/0        23195810 2026-10-30 11:51 bin/ctr
-rwxr-xr-x 0/0        34420106 2026-10-30 11:52 bin/ctr-enc
-rwxr-xr-x 0/0        25022624 2026-10-27 07:32 bin/ctr-remote
-rwxr-xr-x 0/0         1695520 2026-10-30 11:52 bin/fuse-overlayfs
-rwxr-xr-x 0/0        11153570 2026-10-30 11:51 bin/gomodjail
-rwxr-xr-x 0/0        32563362 2026-10-30 11:53 bin/nerdctl
-rwxr-xr-x 0/0        43725693 2026-10-30 11:53 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12482633 2026-10-14 01:49 bin/rootlessctl
-rwxr-xr-x 0/0        23959613 2026-10-14 01:49 bin/rootlesskit
-rwxr-xr-x 0/0        14131248 2026-10-30 11:51 bin/runc
-rwxr-xr-x 0/0        59388064 2026-10-27 07:32 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        11448480 2026-10-27 07:32 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-10-30 11:52 bin/tini
drwxr-xr-x 0/0               0 2026-10-30 11:52 lib/
drwxr-xr-x 0/0               0 2026-10-30 11:52 lib/systemd/
drwxr-xr-x 0/0               0 2026-10-30 11:52 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-10-30 11:52 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-10-30 11:50 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-10-30 11:52 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-10-30 11:52 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x ...

v2.4.1

Changes

• nerdctl cp:
  • Fix incompatibility with tar 1.30-13.el8_10 (#5238)
• nerdctl compose:
  • Fix CDI support (#5236, thanks to @addemod)
  • Support cgroup_parent and cgroup service fields (#5230, thanks to @addemod)
• nerdctl network:
  • Fix port forwarding on Windows (#5225, thanks to @webdevsamran)
• nerdctl-full:
  • Update containerd (2.4.1), runc (1.5.2), BuildKit (0.33.1) (#5241)

Full changes: https://github.com/containerd/nerdctl/pulls?q=is%3Apr+state%3Aclosed+milestone%3Av2.4.1
Thanks to @MaxNiia @addemod @webdevsamran

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7 or later.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.4.1-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.4.1-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.4.1-linux-amd64.tar.gz

-rwxr-xr-x root/root  32411810 2026-10-02 21:43 nerdctl
-rwxr-xr-x root/root     23390 2026-10-02 21:42 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      9555 2026-10-02 21:42 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.4.1-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-10-02 21:53 bin/
-rwxr-xr-x 0/0        34660561 2026-09-30 14:11 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-10-02 21:51 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        80653239 2026-09-30 14:11 bin/buildkitd
-rwxr-xr-x 0/0        16853776 2026-10-02 21:51 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-10-02 21:51 bin/bypass4netnsd
-rwxr-xr-x 0/0        40488528 2026-10-02 21:51 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23390 2026-10-02 21:53 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            9555 2026-10-02 21:53 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8134818 2026-10-02 21:51 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        24842068 2026-10-02 21:52 bin/ctd-decoder
-rwxr-xr-x 0/0        23171234 2026-10-02 21:51 bin/ctr
-rwxr-xr-x 0/0        34403563 2026-10-02 21:52 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695520 2026-10-02 21:52 bin/fuse-overlayfs
-rwxr-xr-x 0/0        11153570 2026-10-02 21:50 bin/gomodjail
-rwxr-xr-x 0/0        32374946 2026-10-02 21:53 bin/nerdctl
-rwxr-xr-x 0/0        43537253 2026-10-02 21:53 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12470655 2026-09-19 15:34 bin/rootlessctl
-rwxr-xr-x 0/0        24055360 2026-09-19 15:34 bin/rootlesskit
-rwxr-xr-x 0/0        14130968 2026-10-02 21:50 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-10-02 21:52 bin/tini
drwxr-xr-x 0/0               0 2026-10-02 21:51 lib/
drwxr-xr-x 0/0               0 2026-10-02 21:51 lib/systemd/
drwxr-xr-x 0/0               0 2026-10-02 21:52 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-10-02 21:51 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-10-02 21:49 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-10-02 21:52 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-10-02 21:51 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-10-02 21:49 share/
drwxr-xr-x 0/0               0 2026-10-02 21:53 share/doc/
drwxr-xr-x 0/0               0 2026-10-02 21:53 share/doc/nerdctl/
-rw-r--r-- 0/0           12380 2026-10-02 21:42 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-10-02 21:42 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-10-02 21:42 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-10-02 21:42 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-10-02 21:42 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           97589 2026-10-02 21:42 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1945 2026-10-02 21:42 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7903 2026-10-02 21:42 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-10-02 21:42 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-10-02 21:42 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-10-02 21:42 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-10-02 21:42 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8587 2026-10-02 21:42 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            3148 2026-10-02 21:42 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0            1826 2026-10-02 21:42 share/doc/nerdctl/docs/erofs.md
-rw-r--r-- 0/0             906 2026-10-02 21:42 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-10-02 21:42 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-10-02 21:42 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-10-02 21:42 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-10-02 21:42 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-10-02 21:42 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-10-02 21:42 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-10-02 21:42 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-10-02 21:42 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-10-02 21:42 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-10-02 21:42 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-10-02 21:42 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2806 2026-10-02 21:42 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2026-10-02 21:42 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            2215 2026-10-02 21:42 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2026-10-02 21:42 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0           10065 2026-10-02 21:42 share/doc/nerdctl/docs/rootless.md
-rw-r--r-- 0/0            4126 2026-10-02 21:42 share/doc/nerdctl/docs/soci.md
-rw-r--r-- 0/0           11912 2026-10...

v2.4.0

This release improves compatibility with Docker v29.

Changes

Major changes (💡 for highlights):

• nerdctl image:

  • 💡Adopted Docker v29 default nerdctl images output (IMAGE, ID, DISK USAGE, CONTENT SIZE, EXTRA) (#5093, thanks to @ekalinin)
  • Added nerdctl images --tree to show a row per platform an image declares, like docker image ls --tree (#5092, thanks to @ekalinin)
  • Added nerdctl push --all-tags (-a) to push every local tag of a repository (#5133, thanks to @ekalinin)
  • Added nerdctl image convert --erofs {raw|zstd} and aligned EROFS pull/push with containerd (#4927, thanks to @ChengyuZhu6)
  • Added nerdctl save --quiet (-q) to suppress progress output (#5064, thanks to @s3onghyun)
  • Fixed nerdctl image ls <repo> to list all tags of a bare repository name (#5115, thanks to @ankit090701)
  • Added snapshot info to native nerdctl image inspect (#5114, thanks to @ningmingxiao)
  • Pinned the image a container runs to its digest (#5125, thanks to @ekalinin)
  • Truncated the output file of nerdctl save and nerdctl image export (#5160, thanks to @ekalinin)
  • Preserved equals signs in image label filter values (#5163, thanks to @immanuwell)

• nerdctl container:

  • 💡Added --mount type=image (read-only) (#4990, thanks to @mayur-tolexo)
  • Added image-subpath to --mount type=image to mount a relative path inside the image rootfs instead of the whole rootfs (#4993, thanks to @mayur-tolexo)
  • Added --expose and --publish-all (-P) (#5036, thanks to @Mujib-Ahasan)
  • 💡Added support for the Docker v25 recursive read-only (RRO) mount form (#5043)
  • Allocated a free host port from a published port range for a single container port (#4988, thanks to @s3onghyun)
  • Added the volume-nocopy mount option, so existing data in the container is not copied into the volume (#5129, thanks to @jiwahn)
  • Fixed --cpus writing cpuset instead of CFS quota/period (#5067, thanks to @kmaris)
  • Fixed nerdctl run/exec -i hanging when stdin reaches EOF during task creation (#5042)
  • Fixed a foreground stdio deadlock when the internal logging process stops consuming (#5151, thanks to @gsaddict91)
  • Added snapshot info to native nerdctl container inspect (#5118, thanks to @ningmingxiao)
  • Suppressed a spurious hostsstore NotFound warning on container removal (#5098, thanks to @pujitha24)
  • Allowed removing containers that have no network annotations (#5211, thanks to @Arman16-1998)
  • Matched nerdctl ps --filter keys exactly instead of by prefix (#5197, thanks to @immanuwell)

• nerdctl system:

  • 💡 Added nerdctl system df, with --verbose (-v) and --format (#5130, thanks to @ekalinin)

• nerdctl build:

  • Printed the image ID with --quiet when using the containerd worker (#5170, thanks to @locker95)

• nerdctl network:

  • Added --aux-address support for nerdctl network create (#5041, thanks to @mayur-tolexo)
  • Added --ipv4 so --ipv4=false --ipv6 can create IPv6-only networks (#5024, thanks to @mayur-tolexo)
  • Matched each --ip-range to its subnet for dual-stack networks (#5018, thanks to @mayur-tolexo)
  • Stopped injecting ipRange into the CNI config (#5078, thanks to @mayur-tolexo)
  • Keyed Networks in nerdctl inspect by the real CNI network name (#5164, thanks to @larrasket)
  • Combined repeated --filter name= values with OR (#5206, thanks to @immanuwell)
  • Supported big-endian hosts when parsing /proc/net/{tcp,udp} addresses (#5100, thanks to @larrasket)

• nerdctl events:

  • Added label-based filtering (#4999, thanks to @Mujib-Ahasan)
  • Renamed the Status field to Action to match Docker v29 (#5087, thanks to @Akshitguptaa)

• nerdctl login:

  • Accepted equivalent registry hosts in the auth creds callback, and normalized bracketed IPv6 addresses (#5128, thanks to @xianyuwu)

• nerdctl compose:

  • Supported image volumes (services.<SERVICE>.volumes[].type: image) (#5161, thanks to @papidb)
  • Stopped requiring CNI plugins for compose projects that do not use CNI (#5132, thanks to @ravi-arnan)
  • Allowed detached runs with the default interactive setting (#5212, thanks to @immanuwell)
  • Fixed a panic when asserting x-nerdctl-* compose extension types (#5073, thanks to @arpitjain099)

• nerdctl info:

  • Implemented rootless systemd cgroup discovery, removing a hard-coded cgroup path (#5182, thanks to @chemwolf6922)

• nerdctl top:

  • Fix handling stopped and paused containers (#5223, thanks to @immanuwell)

• Healthcheck:

  • Reduced unnecessary function calls (#5048, thanks to @ningmingxiao)

• Logging:

  • Added --log-file ($NERDCTL_LOG_FILE) to append nerdctl's own log to a file, in addition to the standard error (#5147, thanks to @ekalinin)

• Rootless:

  • Enabled IPv6 in the RootlessKit network namespace (#5055, thanks to @Akshitguptaa)

• nerdctl-full:

  • Updated containerd to v2.4.0 and RootlessKit to v3.2.0 (#5144, #5152, #5196, #5209, #5213, #5224, thanks to @ChengyuZhu6 and @haytok)
  • Updated BuildKit to v0.33.0, imgcrypt to v2.0.3, and fuse-overlayfs to v1.18 (#5198)
  • Updated gomodjail to v2.0.1 and enforced its static analysis in CI (#5192)

• Documentation:

  • Documented volume :z and :Z SELinux options (#5140, thanks to @VedantMadane)
  • Corrected the tmpfs path /var/lib/journal to /var/log/journal (#5162, thanks to @MayCXC)
  • Fixed typos in docs (#5146, #5166, thanks to @MsfPablo)

• Misc:

  • Hid internal alias flags from help output (#5025, thanks to @immanuwell)

• CI and tests:

  • Updated CI to Ubuntu 26.04 and Docker 29.6.1, and ran integration tests directly on hosts and Lima guests (#5020, #5021, #5035)
  • Continued migrating container, network, and compose tests to Tigron (#4780, #5014, #5045, #5056, #5058, #5063, #5069, #5070, #5071, #5074, #5085, #5086, #5094, #5120, thanks to @must108, @takumi12311123, @papidb, @Mujib-Ahasan, and @ogulcanaydogan)
  • Published a weekly flaky test dashboard ("Soigneur") and attempted to deflake several tests (#5201, #5217, #5218)
  • Printed daemon logs after integration test failures (#5165, thanks to @loglapa)
  • Dropped an outdated containerd 1.x plugin requirement from the restart tests (#5185, thanks to @webdevsamran)
  • Fixed lint-licenses failing on MPL-2.0 (#5200, thanks to @filipPlevjak)
  • Reported gosocialcheck findings as GitHub Actions annotations, and fixed a zizmor failure (#5208, #5215)

• And more!

Full changes: https://github.com/containerd/nerdctl/milestone/66?closed=1

Thanks to @ChengyuZhu6, @ekalinin, @mayur-tolexo, @immanuwell, @ningmingxiao, @larrasket, @papidb, @haytok, @Mujib-Ahasan, @s3onghyun, @Akshitguptaa, @MsfPablo, @ankit090701, @ravi-arnan, @arpitjain099, @kmaris, @pujitha24, @VedantMadane, @xianyuwu, @jiwahn, @gsaddict91, @locker95, @chemwolf6922, @Arman16-1998, @loglapa, @webdevsamran, @filipPlevjak, @MayCXC, @ogulcanaydogan, @must108, @takumi12311123, @subotac, and @nikolauspschuetz.

Note

Claude Opus 5 was used for updating this release note from v2.4.0-beta.0.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7 or later.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.4.0-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.4.0-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.4.0-linux-amd64.tar.gz

-rwxr-xr-x root/root  32395426 2026-09-20 04:26 nerdctl
-rwxr-xr-x root/root     23390 2026-09-20 04:25 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      9555 2026-09-20 04:25 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.4.0-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-09-20 04:36 bin/
-rwxr-xr-x 0/0        34512200 2026-09-01 12:47 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-09-20 04:34 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-09...

v2.4.0-rc.0

This release improves compatibility with Docker v29.

Changes

Major changes (💡 for highlights):

• nerdctl image:

  • 💡Adopted Docker v29 default nerdctl images output (IMAGE, ID, DISK USAGE, CONTENT SIZE, EXTRA) (#5093, thanks to @ekalinin)
  • Added nerdctl images --tree to show a row per platform an image declares, like docker image ls --tree (#5092, thanks to @ekalinin)
  • Added nerdctl push --all-tags (-a) to push every local tag of a repository (#5133, thanks to @ekalinin)
  • Added nerdctl image convert --erofs {raw|zstd} and aligned EROFS pull/push with containerd (#4927, thanks to @ChengyuZhu6)
  • Added nerdctl save --quiet (-q) to suppress progress output (#5064, thanks to @s3onghyun)
  • Fixed nerdctl image ls <repo> to list all tags of a bare repository name (#5115, thanks to @ankit090701)
  • Added snapshot info to native nerdctl image inspect (#5114, thanks to @ningmingxiao)
  • Pinned the image a container runs to its digest (#5125, thanks to @ekalinin)
  • Truncated the output file of nerdctl save and nerdctl image export (#5160, thanks to @ekalinin)
  • Preserved equals signs in image label filter values (#5163, thanks to @immanuwell)

• nerdctl container:

  • 💡Added --mount type=image (read-only) (#4990, thanks to @mayur-tolexo)
  • Added image-subpath to --mount type=image to mount a relative path inside the image rootfs instead of the whole rootfs (#4993, thanks to @mayur-tolexo)
  • Added --expose and --publish-all (-P) (#5036, thanks to @Mujib-Ahasan)
  • 💡Added support for the Docker v25 recursive read-only (RRO) mount form (#5043)
  • Allocated a free host port from a published port range for a single container port (#4988, thanks to @s3onghyun)
  • Added the volume-nocopy mount option, so existing data in the container is not copied into the volume (#5129, thanks to @jiwahn)
  • Fixed --cpus writing cpuset instead of CFS quota/period (#5067, thanks to @kmaris)
  • Fixed nerdctl run/exec -i hanging when stdin reaches EOF during task creation (#5042)
  • Fixed a foreground stdio deadlock when the internal logging process stops consuming (#5151, thanks to @gsaddict91)
  • Added snapshot info to native nerdctl container inspect (#5118, thanks to @ningmingxiao)
  • Suppressed a spurious hostsstore NotFound warning on container removal (#5098, thanks to @pujitha24)
  • Allowed removing containers that have no network annotations (#5211, thanks to @Arman16-1998)
  • Matched nerdctl ps --filter keys exactly instead of by prefix (#5197, thanks to @immanuwell)

• nerdctl system:

  • Added nerdctl system df, with --verbose (-v) and --format (#5130, thanks to @ekalinin)

• nerdctl build:

  • Printed the image ID with --quiet when using the containerd worker (#5170, thanks to @locker95)

• nerdctl network:

  • Added --aux-address support for nerdctl network create (#5041, thanks to @mayur-tolexo)
  • Added --ipv4 so --ipv4=false --ipv6 can create IPv6-only networks (#5024, thanks to @mayur-tolexo)
  • Matched each --ip-range to its subnet for dual-stack networks (#5018, thanks to @mayur-tolexo)
  • Stopped injecting ipRange into the CNI config (#5078, thanks to @mayur-tolexo)
  • Keyed Networks in nerdctl inspect by the real CNI network name (#5164, thanks to @larrasket)
  • Combined repeated --filter name= values with OR (#5206, thanks to @immanuwell)
  • Supported big-endian hosts when parsing /proc/net/{tcp,udp} addresses (#5100, thanks to @larrasket)

• nerdctl events:

  • Added label-based filtering (#4999, thanks to @Mujib-Ahasan)
  • Renamed the Status field to Action to match Docker v29 (#5087, thanks to @Akshitguptaa)

• nerdctl login:

  • Accepted equivalent registry hosts in the auth creds callback, and normalized bracketed IPv6 addresses (#5128, thanks to @xianyuwu)

• nerdctl compose:

  • Supported image volumes (services.<SERVICE>.volumes[].type: image) (#5161, thanks to @papidb)
  • Stopped requiring CNI plugins for compose projects that do not use CNI (#5132, thanks to @ravi-arnan)
  • Allowed detached runs with the default interactive setting (#5212, thanks to @immanuwell)
  • Fixed a panic when asserting x-nerdctl-* compose extension types (#5073, thanks to @arpitjain099)

• nerdctl info:

  • Implemented rootless systemd cgroup discovery, removing a hard-coded cgroup path (#5182, thanks to @chemwolf6922)

• Healthcheck:

  • Reduced unnecessary function calls (#5048, thanks to @ningmingxiao)

• Logging:

  • Added --log-file ($NERDCTL_LOG_FILE) to append nerdctl's own log to a file, in addition to the standard error (#5147, thanks to @ekalinin)

• Rootless:

  • Enabled IPv6 in the RootlessKit network namespace (#5055, thanks to @Akshitguptaa)

• nerdctl-full:

  • Updated containerd to v2.4.0 and RootlessKit to v3.2.0-beta.0 (#5144, #5152, #5196, #5209, #5213, thanks to @ChengyuZhu6 and @haytok)
  • Updated BuildKit to v0.33.0, imgcrypt to v2.0.3, and fuse-overlayfs to v1.18 (#5198)
  • Updated gomodjail to v2.0.1 and enforced its static analysis in CI (#5192)

• Documentation:

  • Documented volume :z and :Z SELinux options (#5140, thanks to @VedantMadane)
  • Corrected the tmpfs path /var/lib/journal to /var/log/journal (#5162, thanks to @MayCXC)
  • Fixed typos in docs (#5146, #5166, thanks to @MsfPablo)

• Misc:

  • Hid internal alias flags from help output (#5025, thanks to @immanuwell)

• CI and tests:

  • Updated CI to Ubuntu 26.04 and Docker 29.6.1, and ran integration tests directly on hosts and Lima guests (#5020, #5021, #5035)
  • Continued migrating container, network, and compose tests to Tigron (#4780, #5014, #5045, #5056, #5058, #5063, #5069, #5070, #5071, #5074, #5085, #5086, #5094, #5120, thanks to @must108, @takumi12311123, @papidb, @Mujib-Ahasan, and @ogulcanaydogan)
  • Published a weekly flaky test dashboard ("Soigneur") and attempted to deflake several tests (#5201, #5217, #5218)
  • Printed daemon logs after integration test failures (#5165, thanks to @loglapa)
  • Dropped an outdated containerd 1.x plugin requirement from the restart tests (#5185, thanks to @webdevsamran)
  • Fixed lint-licenses failing on MPL-2.0 (#5200, thanks to @filipPlevjak)
  • Reported gosocialcheck findings as GitHub Actions annotations, and fixed a zizmor failure (#5208, #5215)

• And more!

Full changes: https://github.com/containerd/nerdctl/milestone/66?closed=1

Thanks to @ChengyuZhu6, @ekalinin, @mayur-tolexo, @immanuwell, @ningmingxiao, @larrasket, @papidb, @haytok, @Mujib-Ahasan, @s3onghyun, @Akshitguptaa, @MsfPablo, @ankit090701, @ravi-arnan, @arpitjain099, @kmaris, @pujitha24, @VedantMadane, @xianyuwu, @jiwahn, @gsaddict91, @locker95, @chemwolf6922, @Arman16-1998, @loglapa, @webdevsamran, @filipPlevjak, @MayCXC, @ogulcanaydogan, @must108, @takumi12311123, @subotac, and @nikolauspschuetz.

Note

Claude Opus 5 was used for updating this release note from v2.4.0-beta.0.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7 or later.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.4.0-rc.0-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.4.0-rc.0-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.4.0-rc.0-linux-amd64.tar.gz

-rwxr-xr-x root/root  32395426 2026-09-18 05:23 nerdctl
-rwxr-xr-x root/root     23390 2026-09-18 05:22 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      9555 2026-09-18 05:22 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.4.0-rc.0-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-09-18 05:30 bin/
-rwxr-xr-x 0/0        34512200 2026-09-01 12:47 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-09-18 05:29 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0            ...

v2.4.0-beta.0

Changes

This is the first beta release of nerdctl v2.4.0.

This release of nerdctl-full uses a beta release of containerd (v2.4.0-beta.0).

Major changes:

• nerdctl image:

  • Adopted Docker v29 default nerdctl images output (IMAGE, ID, DISK USAGE, CONTENT SIZE, EXTRA) (#5093, thanks to @ekalinin)
  • Added nerdctl push --all-tags (-a) to push every local tag of a repository (#5133, thanks to @ekalinin)
  • Added nerdctl image convert --erofs {raw|zstd} and aligned EROFS pull/push with containerd (#4927)
  • Added nerdctl save --quiet (-q) to suppress progress output (#5064, thanks to @s3onghyun)
  • Fixed nerdctl image ls <repo> to list all tags of a bare repository name (#5115, thanks to @ankit090701)
  • Added snapshot info to native nerdctl image inspect (#5114, thanks to @ningmingxiao)

• nerdctl container:

  • Added --mount type=image (read-only) (#4990, thanks to @mayur-tolexo)
  • Added --expose and --publish-all (-P) (#5036, thanks to @Mujib-Ahasan)
  • Added support for the Docker v25 recursive read-only (RRO) mount form (#5043, thanks to @AkihiroSuda)
  • Allocated a free host port from a published port range for a single container port (#4988, thanks to @s3onghyun)
  • Fixed --cpus writing cpuset instead of CFS quota/period (#5067, thanks to @kmaris)
  • Fixed nerdctl run/exec -i hanging when stdin reaches EOF during task creation (#5042, thanks to @AkihiroSuda)
  • Added snapshot info to native nerdctl container inspect (#5118, thanks to @ningmingxiao)
  • Suppressed a spurious hostsstore NotFound warning on container removal (#5098, thanks to @pujitha24)

• nerdctl network:

  • Added --aux-address support for nerdctl network create (#5041, thanks to @mayur-tolexo)
  • Added --ipv4 so --ipv4=false --ipv6 can create IPv6-only networks (#5024, thanks to @mayur-tolexo)
  • Matched each --ip-range to its subnet for dual-stack networks (#5018, thanks to @mayur-tolexo)
  • Supported big-endian hosts when parsing /proc/net/{tcp,udp} addresses (#5100, thanks to @larrasket)

• nerdctl events:

  • Added label-based filtering (#4999, thanks to @Mujib-Ahasan)
  • Renamed the Status field to Action to match Docker v29 (#5087, thanks to @Akshitguptaa)

• nerdctl compose:

  • Stopped requiring CNI plugins for compose projects that do not use CNI (#5132, thanks to @ravi-arnan)
  • Fixed a panic when asserting x-nerdctl-* compose extension types (#5073, thanks to @arpitjain099)

• Rootless:

  • Enabled IPv6 in the RootlessKit network namespace (#5055, thanks to @Akshitguptaa)

• nerdctl-full:

  • Updated containerd to v2.4.0-beta.0 and RootlessKit to v3.1.0 (#5144, #5152, thanks to @haytok)

• Documentation:

  • Documented volume :z and :Z SELinux options (#5140, thanks to @VedantMadane)
  • Fixed typos in docs (#5146, thanks to @MsfPablo)

• Misc:

  • Hid internal alias flags from help output (#5025, thanks to @immanuwell)

• CI and tests:

  • Updated CI to Ubuntu 26.04 and Docker 29.6.1, and ran integration tests directly on hosts and Lima guests (#5020, #5021, #5035, thanks to @AkihiroSuda)
  • Continued migrating container, network, and compose tests to Tigron (#4780, #5014, #5045, #5056, #5058, #5063, #5069, #5070, #5071, #5074, #5085, #5086, #5094, #5120, thanks to @must108, @takumi12311123, @papidb, @Mujib-Ahasan, and @ogulcanaydogan)

• And more!

Full changes: https://github.com/containerd/nerdctl/milestone/66?closed=1

Thanks to @ChengyuZhu6, @AkihiroSuda, @ekalinin, @mayur-tolexo, @ningmingxiao, @haytok, @Mujib-Ahasan, @s3onghyun, @immanuwell, @Akshitguptaa, @ankit090701, @ravi-arnan, @arpitjain099, @kmaris, @larrasket, @pujitha24, @VedantMadane, @MsfPablo, @papidb, @ogulcanaydogan, @must108, @takumi12311123, @subotac, and @nikolauspschuetz.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7 or later.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.4.0-beta.0-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.4.0-beta.0-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.4.0-beta.0-linux-amd64.tar.gz

-rwxr-xr-x root/root  32686242 2026-08-23 06:01 nerdctl
-rwxr-xr-x root/root     23381 2026-08-23 06:00 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      9555 2026-08-23 06:00 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.4.0-beta.0-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-08-23 06:11 bin/
-rwxr-xr-x 0/0        34352159 2026-07-16 13:59 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-08-23 06:09 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79620820 2026-07-16 13:59 bin/buildkitd
-rwxr-xr-x 0/0        16853776 2026-08-23 06:09 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-08-23 06:09 bin/bypass4netnsd
-rwxr-xr-x 0/0        40396784 2026-08-23 06:09 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-08-23 06:11 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            9555 2026-08-23 06:11 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         7987362 2026-08-23 06:09 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592723 2026-08-23 06:10 bin/ctd-decoder
-rwxr-xr-x 0/0        22671522 2026-08-23 06:09 bin/ctr
-rwxr-xr-x 0/0        31243738 2026-08-23 06:10 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-08-23 06:10 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7917730 2026-08-23 06:08 bin/gomodjail
-rwxr-xr-x 0/0        32649378 2026-08-23 06:11 bin/nerdctl
-rwxr-xr-x 0/0        40574966 2026-08-23 06:11 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12048966 2026-08-04 09:31 bin/rootlessctl
-rwxr-xr-x 0/0        23498531 2026-08-04 09:31 bin/rootlesskit
-rwxr-xr-x 0/0        15249928 2026-08-23 06:08 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-08-23 06:10 bin/tini
drwxr-xr-x 0/0               0 2026-08-23 06:09 lib/
drwxr-xr-x 0/0               0 2026-08-23 06:09 lib/systemd/
drwxr-xr-x 0/0               0 2026-08-23 06:09 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-08-23 06:09 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-08-23 06:07 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-08-23 06:09 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-08-23 06:09 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rw...

v2.3.5

Changes

• Cherry-picks from main to release/2.3 #5082
  • nerdctl-full: Update containerd (2.3.3), RootlessKit (3.0.2), BuildKit (0.31.2), runc (1.5.1)

Full changes: https://github.com/containerd/nerdctl/milestone/67?closed=1

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.3.5-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.3.5-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.3.5-linux-amd64.tar.gz

-rwxr-xr-x root/root  31334562 2026-07-20 07:58 nerdctl
-rwxr-xr-x root/root     23381 2026-07-20 07:57 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-07-20 07:57 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.3.5-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-07-20 08:07 bin/
-rwxr-xr-x 0/0        34352159 2026-07-16 13:59 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-07-20 08:06 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79620820 2026-07-16 13:59 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-07-20 08:05 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-07-20 08:05 bin/bypass4netnsd
-rwxr-xr-x 0/0        39472016 2026-07-20 08:06 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-07-20 08:07 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-07-20 08:07 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-07-20 08:06 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592589 2026-07-20 08:06 bin/ctd-decoder
-rwxr-xr-x 0/0        22597794 2026-07-20 08:05 bin/ctr
-rwxr-xr-x 0/0        31235564 2026-07-20 08:06 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-07-20 08:06 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-07-20 08:05 bin/gomodjail
-rwxr-xr-x 0/0        31297698 2026-07-20 08:07 bin/nerdctl
-rwxr-xr-x 0/0        39219232 2026-07-20 08:07 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12048966 2026-07-10 15:13 bin/rootlessctl
-rwxr-xr-x 0/0        23474629 2026-07-10 15:13 bin/rootlesskit
-rwxr-xr-x 0/0        15249872 2026-07-20 08:05 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-07-20 08:06 bin/tini
drwxr-xr-x 0/0               0 2026-07-20 08:06 lib/
drwxr-xr-x 0/0               0 2026-07-20 08:06 lib/systemd/
drwxr-xr-x 0/0               0 2026-07-20 08:06 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-07-20 08:06 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-07-20 08:04 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-07-20 08:06 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-07-20 08:06 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-07-20 08:04 share/
drwxr-xr-x 0/0               0 2026-07-20 08:07 share/doc/
drwxr-xr-x 0/0               0 2026-07-20 08:07 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-07-20 07:57 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-07-20 07:57 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-07-20 07:57 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-07-20 07:57 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90939 2026-07-20 07:57 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-07-20 07:57 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-07-20 07:57 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-07-20 07:57 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-07-20 07:57 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-07-20 07:57 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-07-20 07:57 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-07-20 07:57 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-07-20 07:57 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-07-20 07:57 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-07-20 07:57 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-07-20 07:57 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-07-20 07:57 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-07-20 07:57 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-07-20 07:57 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-07-20 07:57 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-07-20 07:57 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-07-20 07:57 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-07-20 07:57 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2805 2026-07-20 07:57 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2026-07-20 07:57 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            2215 2026-07-20 07:57 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2026-07-20 07:57 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0            9388 2026-07-20 07:57 share/doc/nerdctl/docs/rootless.md
-rw-r--r-- 0/0            4126 2026-07-20 07:57 share/doc/nerdctl/docs/soci.md
-rw-r--r-- 0/0           11912 2026-07-20 07:57 share/doc/nerdctl/docs/stargz.md
drwxr-xr-x 0/0               0 2026-07-20 07:57 share/doc/nerdctl/docs/testing/
-rw-r--r-- 0/0            4897 2026-07-20 07:57 share/doc/nerdctl/docs/testing/README.md
-rw-r--r-- 0/0           16694 2026-07-20 07:57 share/doc/nerdctl/docs/testing/tools.md
drwxr-xr-x 0/0               0 2026-07-20 08:07 shar...

v2.3.4

Changes

• nerdctl run:

  • Allow -i and -d together when -t is set (#4989, thanks to @mayur-tolexo)
  • Remove the non-Docker rw option from --mount (#4992, thanks to @mayur-tolexo)

• nerdctl network create

  • Match each gateway to its subnet for dual-stack (#5010, thanks to @mayur-tolexo)

• nerdctl (container|image|network) inspect

  • Fix format errors (#5019, thanks to @immanuwell)

• nerdctl version

  • Show RootlessKit version (#4971, thanks to @amarkdotdev)

• nerdctl-full:

  • update runc (1.5.0), BuildKit (0.31.1) (#5002)

Full changes: https://github.com/containerd/nerdctl/pulls?q=is%3Apr+milestone%3Av2.3.4+is%3Aclosed
Thanks to @amarkdotdev @immanuwell @mayur-tolexo

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.3.4-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.3.4-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.3.4-linux-amd64.tar.gz

-rwxr-xr-x root/root  31334562 2026-06-29 08:36 nerdctl
-rwxr-xr-x root/root     23381 2026-06-29 08:35 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-29 08:35 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.3.4-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-06-29 08:44 bin/
-rwxr-xr-x 0/0        34345100 2026-06-24 17:16 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-06-29 08:43 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79608020 2026-06-24 17:16 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-06-29 08:43 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-06-29 08:43 bin/bypass4netnsd
-rwxr-xr-x 0/0        39463824 2026-06-29 08:43 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-06-29 08:44 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-06-29 08:44 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-06-29 08:43 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592005 2026-06-29 08:44 bin/ctd-decoder
-rwxr-xr-x 0/0        22585506 2026-06-29 08:43 bin/ctr
-rwxr-xr-x 0/0        31234900 2026-06-29 08:44 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-06-29 08:44 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-06-29 08:42 bin/gomodjail
-rwxr-xr-x 0/0        31297698 2026-06-29 08:44 bin/nerdctl
-rwxr-xr-x 0/0        39219232 2026-06-29 08:44 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12041664 2026-05-27 10:30 bin/rootlessctl
-rwxr-xr-x 0/0        23473018 2026-05-27 10:30 bin/rootlesskit
-rwxr-xr-x 0/0        15245480 2026-06-29 08:42 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-06-29 08:44 bin/tini
drwxr-xr-x 0/0               0 2026-06-29 08:43 lib/
drwxr-xr-x 0/0               0 2026-06-29 08:43 lib/systemd/
drwxr-xr-x 0/0               0 2026-06-29 08:43 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-06-29 08:43 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-06-29 08:42 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-06-29 08:43 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-06-29 08:43 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-06-29 08:42 share/
drwxr-xr-x 0/0               0 2026-06-29 08:44 share/doc/
drwxr-xr-x 0/0               0 2026-06-29 08:44 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-06-29 08:35 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-06-29 08:35 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-06-29 08:35 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-06-29 08:35 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-06-29 08:35 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90939 2026-06-29 08:35 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-06-29 08:35 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-06-29 08:35 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-06-29 08:35 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-06-29 08:35 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-06-29 08:35 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-06-29 08:35 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-06-29 08:35 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-06-29 08:35 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-06-29 08:35 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-06-29 08:35 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-06-29 08:35 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-06-29 08:35 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-06-29 08:35 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-06-29 08:35 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-06-29 08:35 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-06-29 08:35 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-06-29 08:35 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-06-29 08:35 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-06-29 08:35 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-06-29 08:35 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2805 2026-06-29 08:35 share/doc/nerdctl/docs/nydus.md
-rw-r--r-- 0/0            3277 2026-06-29 08:35 share/doc/nerdctl/docs/ocicrypt.md
-rw-r--r-- 0/0            2215 2026-06-29 08:35 share/doc/nerdctl/docs/overlaybd.md
-rw-r--r-- 0/0           15657 2026-06-29 08:35 share/doc/nerdctl/docs/registry.md
-rw-r--r-- 0/0            9388 2026-06-29 08:35 share/doc/nerdctl/docs/rootless.md
-rw-r--r-- 0/0            4...

v2.3.3

Changes

• nerdctl compose run:

  • Honor --workdir (#4986, thanks to @immanuwell)

• nerdctl network inspect:

  • Support pseudo networks (#4953, thanks to @immanuwell)

• nerdctl container inspect:

  • Suppress warning message on a stopped container (#4967, thanks to @haytok)

• Misc:

  • Remove duplicated defaults from help output (#4972, thanks to @immanuwell)

• go.mod:

  • Update containerd library to v2.3.2 and use the new WithImageConfigLabels function (#4985, #4982)
    • Fixes CVE-2026-53488 "image-config LABEL flows to host-root command execution from an image pull" (affected nerdctl as well as CRI)

• nerdctl-full:

  • Update containerd to v2.3.2 (#4976)
    • Fixes CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262
  • Update BuildKit to v0.31.0 (#4983)

Full changes: https://github.com/containerd/nerdctl/milestone/63?closed=1
Thanks to @haytok @immanuwell @opjt

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.3.3-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.3.3-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.3.3-linux-amd64.tar.gz

-rwxr-xr-x root/root  31322274 2026-06-19 10:30 nerdctl
-rwxr-xr-x root/root     23381 2026-06-19 10:29 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-19 10:29 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.3.3-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-06-19 10:39 bin/
-rwxr-xr-x 0/0        34344956 2026-06-16 17:37 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-06-19 10:38 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        79597466 2026-06-16 17:37 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-06-19 10:37 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-06-19 10:37 bin/bypass4netnsd
-rwxr-xr-x 0/0        39463824 2026-06-19 10:38 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-06-19 10:39 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-06-19 10:39 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-06-19 10:38 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592005 2026-06-19 10:38 bin/ctd-decoder
-rwxr-xr-x 0/0        22585506 2026-06-19 10:37 bin/ctr
-rwxr-xr-x 0/0        31234900 2026-06-19 10:38 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-06-19 10:38 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-06-19 10:37 bin/gomodjail
-rwxr-xr-x 0/0        31285410 2026-06-19 10:39 bin/nerdctl
-rwxr-xr-x 0/0        39206944 2026-06-19 10:39 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12041664 2026-05-27 10:30 bin/rootlessctl
-rwxr-xr-x 0/0        23473018 2026-05-27 10:30 bin/rootlesskit
-rwxr-xr-x 0/0        17096920 2026-06-19 10:37 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-06-19 10:38 bin/tini
drwxr-xr-x 0/0               0 2026-06-19 10:38 lib/
drwxr-xr-x 0/0               0 2026-06-19 10:38 lib/systemd/
drwxr-xr-x 0/0               0 2026-06-19 10:38 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-06-19 10:38 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-06-19 10:36 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-06-19 10:38 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-06-19 10:38 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-06-19 10:36 share/
drwxr-xr-x 0/0               0 2026-06-19 10:39 share/doc/
drwxr-xr-x 0/0               0 2026-06-19 10:39 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-06-19 10:29 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-06-19 10:29 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-06-19 10:29 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-06-19 10:29 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-06-19 10:29 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90862 2026-06-19 10:29 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-06-19 10:29 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-06-19 10:29 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-06-19 10:29 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-06-19 10:29 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-06-19 10:29 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-06-19 10:29 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-06-19 10:29 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-06-19 10:29 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-06-19 10:29 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-06-19 10:29 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-06-19 10:29 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-06-19 10:29 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-06-19 10:29 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-06-19 10:29 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-06-19 10:29 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-06-19 10:29 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-06-19 10:29 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-06-19 10:29 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0            2426 2026-06-19 10:29 share/doc/nerdctl/docs/multi-platform.md
-rw-r--r-- 0/0            2960 2026-06-19 10:29 share/doc/nerdctl/docs/notation.md
-rw-r--r-- 0/0            2805 202...

v2.3.2

Changes

Major changes:

• nerdctl container:
  • Showed Pid as 0 for stopped containers in nerdctl container inspect (#4965, thanks to @haytok)
  • Chunked mounts metadata to prevent max label size crashes (#4945, thanks to @Skywalkr-dev)
• nerdctl image:
  • Added the overlaybd vsize option (#4960, thanks to @fourierrr)
  • Fixed nerdctl load failures (#4888, thanks to @ningmingxiao)
• nerdctl network:
  • Fixed a panic when statting an invalid CNI config path (#4890, thanks to @immanuwell)
• nerdctl ps:
  • Showed container health status in the STATUS column (#4933, thanks to @haytok)
• nerdctl run:
  • Rejected / as the -v destination for Docker compatibility (#4954, thanks to @haytok)
• nerdctl healthcheck:
  • Released exec process resources after probes (#4911, thanks to @haytok)
  • Cleaned up transient units on container exit and start (#4935, thanks to @haytok)
• nerdctl-full:
  • Updated kubo to v0.42.0, soci-snapshotter to v0.14.1, nydus to v2.4.3, fuse-overlayfs to v1.17, and runc to v1.4.3 (#4962, thanks to @AkihiroSuda)
• CI and tests:
  • Continued migrating container tests to Tigron (#4897, #4900, #4898, #4916, thanks to @ogulcanaydogan and @opjt)
  • Migrated compose run tests to the nerdtest framework (#4845, #4911, thanks to @sathiraumesh and @haytok)
  • Replaced Vagrant with Lima for FreeBSD tests (#4952, thanks to @AkihiroSuda)
  • Fixed syslog test timing and startup behavior (#4898, thanks to @ogulcanaydogan)
• Documentation:
  • Updated the Windows installation section in README.md (#4949, thanks to @ofek)
  • Fixed a typo and a missing import in tools.md (#4917, thanks to @opjt)

Full changes: https://github.com/containerd/nerdctl/milestone/62?closed=1
Thanks to @AkihiroSuda, @haytok, @fourierrr, @Skywalkr-dev, @ningmingxiao, @immanuwell, @ogulcanaydogan, @opjt, @sathiraumesh and @ofek.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.3.2-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.3.2-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.3.2-linux-amd64.tar.gz

-rwxr-xr-x root/root  31117474 2026-06-15 14:34 nerdctl
-rwxr-xr-x root/root     23381 2026-06-15 14:33 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-15 14:33 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.3.2-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-06-15 14:42 bin/
-rwxr-xr-x 0/0        34502474 2026-05-13 11:39 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-06-15 14:41 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        78723496 2026-05-13 11:39 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-06-15 14:41 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-06-15 14:41 bin/bypass4netnsd
-rwxr-xr-x 0/0        39455632 2026-06-15 14:41 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-06-15 14:42 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-06-15 14:42 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-06-15 14:41 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592005 2026-06-15 14:42 bin/ctd-decoder
-rwxr-xr-x 0/0        22577314 2026-06-15 14:41 bin/ctr
-rwxr-xr-x 0/0        31234900 2026-06-15 14:42 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1695448 2026-06-15 14:42 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-06-15 14:40 bin/gomodjail
-rwxr-xr-x 0/0        31080610 2026-06-15 14:42 bin/nerdctl
-rwxr-xr-x 0/0        39002144 2026-06-15 14:42 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12041664 2026-05-27 10:30 bin/rootlessctl
-rwxr-xr-x 0/0        23473018 2026-05-27 10:30 bin/rootlesskit
-rwxr-xr-x 0/0        17096920 2026-06-15 14:40 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-06-15 14:42 bin/tini
drwxr-xr-x 0/0               0 2026-06-15 14:41 lib/
drwxr-xr-x 0/0               0 2026-06-15 14:41 lib/systemd/
drwxr-xr-x 0/0               0 2026-06-15 14:41 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-06-15 14:41 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-06-15 14:39 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-06-15 14:41 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-06-15 14:41 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-06-15 14:39 share/
drwxr-xr-x 0/0               0 2026-06-15 14:42 share/doc/
drwxr-xr-x 0/0               0 2026-06-15 14:42 share/doc/nerdctl/
-rw-r--r-- 0/0           12145 2026-06-15 14:33 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-06-15 14:33 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-06-15 14:33 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-06-15 14:33 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-06-15 14:33 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90862 2026-06-15 14:33 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-06-15 14:33 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-06-15 14:33 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-06-15 14:33 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-06-15 14:33 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-06-15 14:33 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-06-15 14:33 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-06-15 14:33 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-06-15 14:33 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-06-15 14:33 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-06-15 14:33 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-06-15 14:33 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            55...

v2.3.1

Changes

This is the release of nerdctl v2.3.1.

This is a patch release for v2.3.0. It promotes the v2.3.x line to a GA release by updating nerdctl-full to use the stable containerd v2.3.1 instead of the beta containerd build used in v2.3.0.

Major changes:

• nerdctl compose:
  • Added support for the Compose healthcheck field in service configs (#4869, thanks to @opjt)
  • Added support for passing service names to nerdctl compose down (#4901, thanks to @ysedira)
• nerdctl network:
  • Fixed a panic when statting an invalid CNI config path (#4890, thanks to @immanuwell)
• nerdctl-full:
  • Updated containerd to v2.3.1, BuildKit to v0.30.0, and gomodjail to v0.3.2 (#4887, #4922)
• Documentation:
  • Fixed the spelling of the --sig-proxy flag in the command reference (#4903, thanks to @MukundaKatta)
  • Removed a stray quote from the --interactive flag documentation (#4904, thanks to @MukundaKatta)
• CI and tests:
  • Added zizmor workflow linting and fixed reported workflow issues (#4909, thanks to @omribz156)
  • Continued migrating container tests to Tigron (#4863, #4865, thanks to @opjt)

Full changes: https://github.com/containerd/nerdctl/milestone/61?closed=1
Thanks to @ChengyuZhu6, @opjt, @immanuwell, @ysedira, @MukundaKatta, and @omribz156.

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3.
Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.3.1-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.3.1-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

tar Cxzvvf /usr/local/bin nerdctl-2.3.1-linux-amd64.tar.gz

-rwxr-xr-x root/root  31604898 2026-05-21 14:25 nerdctl
-rwxr-xr-x root/root     23381 2026-05-21 14:24 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-05-21 14:24 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

tar Cxzvvf /usr/local nerdctl-full-2.3.1-linux-amd64.tar.gz

drwxr-xr-x 0/0               0 2026-05-21 14:33 bin/
-rwxr-xr-x 0/0        34502474 2026-05-13 11:39 bin/buildctl
-rwxr-xr-x 0/0        29909144 2025-05-12 13:10 bin/buildg
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-bandwidth -> ../libexec/cni/bandwidth
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-bridge -> ../libexec/cni/bridge
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-dhcp -> ../libexec/cni/dhcp
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-dummy -> ../libexec/cni/dummy
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-firewall -> ../libexec/cni/firewall
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-host-device -> ../libexec/cni/host-device
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-host-local -> ../libexec/cni/host-local
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-ipvlan -> ../libexec/cni/ipvlan
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-loopback -> ../libexec/cni/loopback
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-macvlan -> ../libexec/cni/macvlan
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-portmap -> ../libexec/cni/portmap
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-ptp -> ../libexec/cni/ptp
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-sbr -> ../libexec/cni/sbr
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-static -> ../libexec/cni/static
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-tap -> ../libexec/cni/tap
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-tuning -> ../libexec/cni/tuning
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-vlan -> ../libexec/cni/vlan
lrwxrwxrwx 0/0               0 2026-05-21 14:32 bin/buildkit-cni-vrf -> ../libexec/cni/vrf
-rwxr-xr-x 0/0        78723496 2026-05-13 11:39 bin/buildkitd
-rwxr-xr-x 0/0        16853648 2026-05-21 14:31 bin/bypass4netns
-rwxr-xr-x 0/0         6607010 2026-05-21 14:31 bin/bypass4netnsd
-rwxr-xr-x 0/0        39455632 2026-05-21 14:32 bin/containerd
-rwxr-xr-x 0/0        12079288 2025-11-06 01:44 bin/containerd-fuse-overlayfs-grpc
-rwxr-xr-x 0/0           23381 2026-05-21 14:33 bin/containerd-rootless-setuptool.sh
-rwxr-xr-x 0/0            8639 2026-05-21 14:33 bin/containerd-rootless.sh
-rwxr-xr-x 0/0         8458402 2026-05-21 14:32 bin/containerd-shim-runc-v2
-rwxr-xr-x 0/0        55267512 2026-01-21 14:59 bin/containerd-stargz-grpc
-rwxr-xr-x 0/0        23592203 2026-05-21 14:33 bin/ctd-decoder
-rwxr-xr-x 0/0        22577314 2026-05-21 14:32 bin/ctr
-rwxr-xr-x 0/0        31235586 2026-05-21 14:33 bin/ctr-enc
-rwxr-xr-x 0/0        23417016 2026-01-21 14:59 bin/ctr-remote
-rwxr-xr-x 0/0         1885808 2026-05-21 14:33 bin/fuse-overlayfs
-rwxr-xr-x 0/0         7913634 2026-05-21 14:31 bin/gomodjail
-rwxr-xr-x 0/0        31568034 2026-05-21 14:33 bin/nerdctl
-rwxr-xr-x 0/0        39489638 2026-05-21 14:33 bin/nerdctl.gomodjail
-rwxr-xr-x 0/0        12034560 2026-04-09 19:03 bin/rootlessctl
-rwxr-xr-x 0/0        23451213 2026-04-09 19:03 bin/rootlesskit
-rwxr-xr-x 0/0        17088688 2026-05-21 14:31 bin/runc
-rwxr-xr-x 0/0        53829816 2026-01-21 14:59 bin/stargz-fuse-manager
-rwxr-xr-x 0/0        10821816 2026-01-21 14:59 bin/stargz-store-helper
-rwxr-xr-x 0/0          870496 2026-05-21 14:33 bin/tini
drwxr-xr-x 0/0               0 2026-05-21 14:32 lib/
drwxr-xr-x 0/0               0 2026-05-21 14:32 lib/systemd/
drwxr-xr-x 0/0               0 2026-05-21 14:32 lib/systemd/system/
-rw-r--r-- 0/0            1309 2026-05-21 14:32 lib/systemd/system/buildkit.service
-rw-r--r-- 0/0            1248 2026-05-21 14:30 lib/systemd/system/containerd.service
-rw-r--r-- 0/0             312 2026-05-21 14:32 lib/systemd/system/stargz-snapshotter.service
drwxr-xr-x 0/0               0 2026-05-21 14:32 libexec/
drwxr-xr-x 0/0               0 2026-03-16 14:18 libexec/cni/
-rw-r--r-- 0/0           11357 2026-03-16 14:18 libexec/cni/LICENSE
-rw-r--r-- 0/0            2343 2026-03-16 14:18 libexec/cni/README.md
-rwxr-xr-x 0/0         5042926 2026-03-16 14:18 libexec/cni/bandwidth
-rwxr-xr-x 0/0         5698763 2026-03-16 14:18 libexec/cni/bridge
-rwxr-xr-x 0/0        13725422 2026-03-16 14:18 libexec/cni/dhcp
-rwxr-xr-x 0/0         5251069 2026-03-16 14:18 libexec/cni/dummy
-rwxr-xr-x 0/0         5702145 2026-03-16 14:18 libexec/cni/firewall
-rwxr-xr-x 0/0         5159967 2026-03-16 14:18 libexec/cni/host-device
-rwxr-xr-x 0/0         4350778 2026-03-16 14:18 libexec/cni/host-local
-rwxr-xr-x 0/0         5274322 2026-03-16 14:18 libexec/cni/ipvlan
-rwxr-xr-x 0/0         4302030 2026-03-16 14:18 libexec/cni/loopback
-rwxr-xr-x 0/0         5307111 2026-03-16 14:18 libexec/cni/macvlan
-rwxr-xr-x 0/0         5108385 2026-03-16 14:18 libexec/cni/portmap
-rwxr-xr-x 0/0         5475470 2026-03-16 14:18 libexec/cni/ptp
-rwxr-xr-x 0/0         4525826 2026-03-16 14:18 libexec/cni/sbr
-rwxr-xr-x 0/0         3776708 2026-03-16 14:18 libexec/cni/static
-rwxr-xr-x 0/0         5453308 2026-03-16 14:18 libexec/cni/tap
-rwxr-xr-x 0/0         4389084 2026-03-16 14:18 libexec/cni/tuning
-rwxr-xr-x 0/0         5267679 2026-03-16 14:18 libexec/cni/vlan
-rwxr-xr-x 0/0         4685012 2026-03-16 14:18 libexec/cni/vrf
drwxr-xr-x 0/0               0 2026-05-21 14:30 share/
drwxr-xr-x 0/0               0 2026-05-21 14:33 share/doc/
drwxr-xr-x 0/0               0 2026-05-21 14:33 share/doc/nerdctl/
-rw-r--r-- 0/0           12036 2026-05-21 14:24 share/doc/nerdctl/README.md
drwxr-xr-x 0/0               0 2026-05-21 14:24 share/doc/nerdctl/docs/
-rw-r--r-- 0/0            3953 2026-05-21 14:24 share/doc/nerdctl/docs/build.md
-rw-r--r-- 0/0            2570 2026-05-21 14:24 share/doc/nerdctl/docs/builder-debug.md
-rw-r--r-- 0/0            4779 2026-05-21 14:24 share/doc/nerdctl/docs/cni.md
-rw-r--r-- 0/0           90467 2026-05-21 14:24 share/doc/nerdctl/docs/command-reference.md
-rw-r--r-- 0/0            1829 2026-05-21 14:24 share/doc/nerdctl/docs/compose.md
-rw-r--r-- 0/0            7592 2026-05-21 14:24 share/doc/nerdctl/docs/config.md
-rw-r--r-- 0/0            9128 2026-05-21 14:24 share/doc/nerdctl/docs/cosign.md
-rw-r--r-- 0/0            5660 2026-05-21 14:24 share/doc/nerdctl/docs/cvmfs.md
drwxr-xr-x 0/0               0 2026-05-21 14:24 share/doc/nerdctl/docs/dev/
-rw-r--r-- 0/0           12701 2026-05-21 14:24 share/doc/nerdctl/docs/dev/auditing_dockerfile.md
-rw-r--r-- 0/0            8586 2026-05-21 14:24 share/doc/nerdctl/docs/dev/store.md
-rw-r--r-- 0/0            2879 2026-05-21 14:24 share/doc/nerdctl/docs/dir.md
-rw-r--r-- 0/0             906 2026-05-21 14:24 share/doc/nerdctl/docs/experimental.md
-rw-r--r-- 0/0           14757 2026-05-21 14:24 share/doc/nerdctl/docs/faq.md
-rw-r--r-- 0/0             884 2026-05-21 14:24 share/doc/nerdctl/docs/freebsd.md
-rw-r--r-- 0/0            5585 2026-05-21 14:24 share/doc/nerdctl/docs/gpu.md
-rw-r--r-- 0/0            3419 2026-05-21 14:24 share/doc/nerdctl/docs/healthchecks.md
drwxr-xr-x 0/0               0 2026-05-21 14:24 share/doc/nerdctl/docs/images/
-rw-r--r-- 0/0            1540 2026-05-21 14:24 share/doc/nerdctl/docs/images/nerdctl-white.svg
-rw-r--r-- 0/0            1462 2026-05-21 14:24 share/doc/nerdctl/docs/images/nerdctl.svg
-rw-r--r-- 0/0          684421 2026-05-21 14:24 share/doc/nerdctl/docs/images/rootlessKit-network-design.png
-rw-r--r-- 0/0           14462 2026-05-21 14:24 share/doc/nerdctl/docs/ipfs.md
-rw-r--r-- 0/0          ...