Release Channels

2905.2.5
Release Date: Sep 30, 2021

The Stable channel is intended for use in production clusters. Versions of Flatcar Container Linux have been tested as they move through Alpha and Beta channels before being promoted to stable.

2983.1.1
Release Date: Sep 30, 2021

The Beta channel is where Flatcar Container Linux stability is solidified. We encourage including some beta machines in production clusters in order to catch any issues that may arise with your setup.

3005.0.1
Release Date: Sep 30, 2021

The Alpha channel follows a more frequent release cadence and is where new updates are introduced. Users can try the new versions of the Linux kernel, systemd and other core packages.

2605.21.1
amd64
Release Date: Sep 27, 2021

LTS releases will be maintained for an extended lifetime of 18 months. The LTS channel is available to support subscription customers.

Release Notes

Release Date: Sep 30, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.69
systemd - 247

New Stable release 2905.2.5

Changes since Stable 2905.2.4

Security fixes

Bug fixes

  • The Mellanox NIC Linux driver issue introduced in the previous release was fixed (Flatcar#520)

Updates


Release Date: Sep 27, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.67
systemd - 247

New Stable release 2905.2.4

Changes since Stable 2905.2.3

Security fixes

Updates


Release Date: Sep 1, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.61
systemd - 247

New Stable release 2905.2.3

Changes since Stable 2905.2.2

Security fixes

Bug Fixes

Updates


Release Date: Aug 19, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.59
systemd - 247

Changes since Stable 2905.2.1

Security fixes

Bug Fixes

Changes

Updates


Release Date: Aug 4, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.55
systemd - 247

Security fixes

Bug fixes

  • Set the cilium_vxlan interface to be not managed by networkd’s default setup with DHCP as it’s managed by Cilium. (init#43)
  • Disabled SELinux by default on dockerd wrapper script (coreos-overlay#1149)
  • GCE: Granted CAP_NET_ADMIN to set routes for the TCP LB when starting oem-gce.service (coreos-overlay#1146)

Updates


Release Date: Apr 28, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.32
systemd - 247

Release Date: Mar 3, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.19
systemd - 247

Security fixes

Updates


Release Date: Jan 28, 2021  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.4.92
systemd - 246

Security fixes

Bug fixes

  • /etc/iscsi/initiatorname.iscsi is generated by the iscsi-init service (#321)
  • Prevent iscsiadm buffer overflow (#318)

Changes

  • Revert to building docker and containerd with go1.13 instead of go1.15. This reduces the SIGURG log spam (Issue #315 PR #774)
  • The containerd socket is now available in the default location (/run/containerd/containerd.sock) and also as a symlink in the previous location (/run/docker/libcontainerd/docker-containerd.sock) (#771)
  • With the iscsi update, the service unit has changed from iscsid to iscsi (#791)
  • AWS Pro: include scripts to facilitate setup of EKS workers (#794).
  • Missed from earlier notes: with the previous open-iscsi update to 2.1.2, the service unit name changed from iscsid to iscsi (#682)

Updates


Release Date: Jan 12, 2021  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.4.87
systemd - 246

Security fixes

Bug fixes

  • networkd: avoid managing MAC addresses for veth devices (kinvolk/init#33)

Updates


Release Date: Dec 16, 2020  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.4.83
systemd - 246

Security fixes:

Bug fixes:

  • The sysctl net.ipv4.conf.*.rp_filter is set to 0 for the Cilium CNI plugin to work (Flatcar#181)
  • Package downloads in the developer container now use the correct URL again (Flatcar#298)

Changes:

  • The sysctl default config file is now applied under the prefix 60 which allows for custom sysctl config files to take effect when they start with a prefix of 70, 80, or 90 (baselayout#13)
  • Containerd CRI plugin got enabled by default, only the containerd socket path needs to be specified as kubelet parameter for Kubernetes 1.20 to use containerd instead of Docker (Flatcar#283)
  • For users with a custom update server a machine alias setting in update-engine allows to give human-friendly names to client instances (update-engine#8)

Updates:


Release Date: Dec 7, 2020  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.4.81
systemd - 246

Security fixes:

Bug fixes

  • Added systemd-tmpfiles directives for /opt and /opt/bin to ensure that the folders have correct permissions even when /opt/ was once created by containerd (Flatcar#279)
  • Make the automatic filesystem resizing more robust against a race and add more logging (kinvolk/init#31)
  • Allow inactive network interfaces to be bound to a bonding interface, by encoding additional configuration for systemd-networkd-wait-online (afterburn PR #10)
  • Do not configure ccache in Jenkins (scripts PR #100)
  • Azure: Exclude bonded SR-IOV network interfaces with newer drivers from networkd (in addition to the old drivers) to prevent them being configured instead of just the bond interface (init PR#29, bootengine PR#19)

Changes:

  • Update-engine now detects rollbacks and reports them as errors to the update server (PR#6)
  • The zstd tools were added (version 1.4.4)
  • The kernel config CONFIG_PSI was set to support Pressure Stall Information, more information also under https://facebookmicrosites.github.io/psi/docs/overview (Flatcar#162)
  • The kernel config CONFIG_BPF_JIT_ALWAYS_ON was set to use the BPF just-in-time compiler by default for faster execution
  • The kernel config CONFIG_POWER_SUPPLY was set
  • The kernel configs CONFIG_OVERLAY_FS_METACOPY and CONFIG_OVERLAY_FS_REDIRECT_DIR were set. With the first overlayfs will only copy up metadata when a metadata-specific operation like chown/chmod is performed. The full file will be copied up later when the file is opened for write operations. With the second, which is equivalent to setting “redirect_dir=on” in the kernel command-line, overlayfs will copy up the directory first before the actual content (Flatcar#170).
  • Remove unnecessary kernel module nf-conntrack-ipv4 (overlay PR#649)
  • Compress kernel modules with xz (overlay PR#628)
  • Add containerd-runc-shim-v* binaries required by kubelet custom CRI endpoints (overlay PR#623)
  • Equinix Metal (Packet): Exclude unused network interfaces from networkd, disregard the state of the bonded interfaces for the network-online.target and only require the bond interface itself to have at least one active link instead of routable which requires both links to be active (afterburn PR#10)
  • QEMU: Use flatcar.autologin kernel command line parameter for auto login on the console (Flatcar #71)

Updates:


Release Date: Nov 19, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.77
systemd - 245

Security fixes:

Bug fixes:

  • network: Restore KeepConfiguration=dhcp-on-stop (kinvolk/init#30)
  • systemd-stable-245.8: ingest latest fixes on top of upstream release (#1, #2, #3)

Updates:


Release Date: Oct 28, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.72
systemd - 245

Security fixes:

Bug fixes:

  • Ensured that the /etc/coreos to /etc/flatcar symlink always exists, relevant for the Container Linux Config transpiler (ct) when specifying directives for update: or locksmith: while also reformatting the rootfs (baselayout PR#7)

Updates:


Release Date: Sep 30, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.67
systemd - 245

Bug fixes:

  • Enabled missing systemd services (#191, PR #612)
  • Fixed Docker torcx image unpacking error on machines with less than ~600 MB total RAM (#32)
  • Solved adcli Kerberos Active Directory incompatibility (#194)
  • Fixed the makefile path when building kernel modules with the developer container (#195)
  • Removed the /etc/portage/savedconfig/ folder that contained a dump of the firmware config flatcar-linux/coreos-overlay#613

Changes:

  • GCE: Improved oslogin support and added shell aliases to run a Python Docker image (PR #592)

Updates:


Release Date: Sep 22, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.66
systemd - 1.30.0
- 245

Security fixes:

Updates:


Release Date: Sep 16, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.145
systemd - 1.30.0
- 241

Changes:

Updates:


Release Date: Sep 7, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.143
systemd - 1.30.0
- 241

Security fixes:

Updates:


Release Date: Aug 20, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.140
systemd - 1.30.0
- 241

Security fixes:

Bug fixes:

Changes:

Updates:


Release Date: Jun 17, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.128
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

Changes:

  • A source code and licensing overview is available under /usr/share/licenses/INFO

Updates:


Release Date: May 26, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.124
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

Bug fixes:

  • When writing the update kernel, prefer /boot/coreos only if /boot/coreos/vmlinux-* exists (https://github.com/flatcar-linux/update_engine/pull/5)
  • Fixed sysroot-boot initramfs service race which resulted in a warning that this service failed
  • Use the correct BINHOST URLs in the development container to download binary packages

Changes:

  • Support the CoreOS GRUB /boot/coreos/first_boot flag file (https://github.com/flatcar-linux/bootengine/pull/13)
  • Fetch container images in docker format rather than ACI by default in etcd-member.service, flanneld.service, and kubelet-wrapper
  • Use flatcar.autologin kernel command line parameter on Azure and VMware for auto login on the serial console
  • Include conntrack (conntrack-tools)
  • Include journalctl output, pstore kernel crash logs, and coredumpctl list output in the mayday report
  • Update wa-linux-agent to 2.2.46 on Azure
  • Support both coreos.config.* and flatcar.config.* guestinfo variables on VMware OEM

Updates:


Release Date: Mar 31, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.107
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Changes:

Updates:


Release Date: Mar 2, 2020  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.106
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Upstream Container Linux updates

Security fixes:

Updates:


Release Date: Feb 10, 2020  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.95
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Upstream Container Linux updates:

Updates:


Release Date: Dec 18, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.86
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Updates:


Release Date: Dec 5, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.86
systemd - 1.30.0
- 241

Release Date: Nov 21, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.84
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix CFS scheduler throttling highly-threaded I/O-bound applications (#2623)

Updates:


Release Date: Nov 11, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.78
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix time zone for Brazil (#2627)

Updates:


Release Date: Oct 17, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.78
systemd - 1.30.0
- 241

Upstream Container Linux updates:

No changes for stable promotion


Release Date: Sep 5, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.68
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix pam_systemd bug allowing authenticated remote users to perform polkit actions as if locally logged in (CVE-2019-3842)
  • Fix systemd-resolved bug allowing unprivileged users to change DNS settings (CVE-2019-15718)

Bug fixes:

  • Fix GCE agent crash loop in new installs (#2608)

Updates:


Release Date: Aug 30, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.66
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix wget buffer overflow allowing arbitrary code execution (CVE-2019-5953)

Updates:


Release Date: Aug 16, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.65
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:

Flatcar updates

Bug fixes:

Changes:


Release Date: Aug 1, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.56
systemd - 1.30.0
- 241

Release Date: Jul 3, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.50
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix Ignition panic when no guestinfo.(coreos|ignition).config parameters are specified on VMware (coreos/ignition#821)

Updates:


Release Date: Jul 1, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.50
systemd - 1.30.0
- 241

Upstream Container Linux updates:

No changes for stable promotion


Release Date: Jun 19, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.43
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix invalid bzip2 compression of Container Linux release images (#2589)

Release Date: Jun 6, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.43
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix systemd MountFlags=shared option (#2579)

Changes:

  • Pin network interface naming to systemd v238 scheme (#2578)

Release Date: May 16, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.43
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Apr 26, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.34
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:


Release Date: Apr 25, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.34
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:


Release Date: Apr 24, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.34
systemd - 1.30.0
- 241

Upstream Container Linux updates:

No changes for stable promotion


Release Date: Mar 12, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.25
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix systemd crash from a specially-crafted D-Bus message (CVE-2019-6454)

Bug fixes:

  • Fix systemd-journald memory leak (#2564)

Updates:


Release Date: Feb 27, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.23
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:


Release Date: Feb 21, 2019  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.96
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix kernel POSIX timer rearming (#2549)

Release Date: Feb 14, 2019  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.96
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:


Release Date: Jan 30, 2019  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.96
systemd - 1.30.0
- 238

Release Date: Jan 28, 2019  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.88
systemd - 1.30.0
- 238

Upstream Container Linux updates:

No changes for stable promotion


Release Date: Jan 28, 2019  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.88
systemd - 1.30.0
- 238

Upstream Container Linux updates:

No changes for stable promotion

Flatcar updates

Changes:


Release Date: Dec 21, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.84
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Go CPU denial of service in X.509 verification (CVE-2018-16875)
  • Fix PolicyKit always authorizing UIDs greater than INT_MAX (CVE-2018-19788)

Updates:


Release Date: Nov 27, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.81
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Disable containerd CRI plugin to stop it from listening on a TCP port (#2524)

Updates:


Release Date: Nov 8, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.78
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix systemd re-executing with arbitrary supplied state (CVE-2018-15686)
  • Fix systemd race allowing changing file permissions (CVE-2018-15687)
  • Fix systemd-networkd buffer overflow in the dhcp6 client (CVE-2018-15688)

Release Date: Oct 26, 2018  amd64

docker - 18.06.1
ignition - 0.26.0
kernel - 4.14.74
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Git remote code execution during recursive clone (CVE-2018-17456)

Updates:


Release Date: Oct 11, 2018  amd64

docker - 18.06.1
ignition - 0.26.0
kernel - 4.14.67
systemd - 1.30.0
- 238

Flatcar updates

Changes:


Release Date: Sep 14, 2018  amd64

docker - 18.06.1
ignition - 0.26.0
kernel - 4.14.67
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Docker mounting named volumes (#2497)

Release Date: Aug 17, 2018  amd64

docker - 18.03.1
ignition - 0.25.1
kernel - 4.14.63
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Aug 8, 2018  amd64

docker - 18.03.1
ignition - 0.25.1
kernel - 4.14.59
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix failure to mount large ext4 filesystems (#2485)

Release Date: Jul 31, 2018  amd64

docker - 18.03.1
ignition - 0.25.1
kernel - 4.14.59
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix kernel CIFS client (#2480)

Updates:


Release Date: Jul 26, 2018  amd64

docker - 18.03.1
ignition - 0.25.1
kernel - 4.14.55
systemd - 1.30.0
- 238

Upstream Container Linux updates:

No changes for stable promotion


Release Date: Jun 15, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.48
systemd - 1.29.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix TCP connection stalls (#2457)

Release Date: Jun 13, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.48
systemd - 1.29.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Hyper-V network driver regression (#2454)

Updates:


Release Date: Jun 1, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.44
systemd - 1.29.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Git arbitrary code execution when cloning untrusted repositories (CVE-2018-11235)

Bug fixes:

  • Fix failure to set network interface MTU (#2443)

Updates:


Release Date: May 27, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.42
systemd - 1.29.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix inadvertent change of network interface names (#2437)

Release Date: May 26, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.42
systemd - 1.29.0
- 238

Release Date: Apr 25, 2018  amd64

docker - 17.12.1
ignition - 0.22.0
kernel - 4.14.32
systemd - 1.29.0
- 237

Flatcar updates

Initial Flatcar release.

Bug fixes:

Notes:

  • Previous test images have been removed from the release servers. This is due to a new update key being generated using our updated security policy which we included in the first public image.

Upstream Container Linux updates:

Bug fixes:


Release Date: Sep 30, 2021  amd64

docker - 20.10.8
ignition - 0.34.0
kernel - 5.10.69
systemd - 247

New Beta release 2983.1.1

Changes since Beta 2983.1.0

Security fixes

Updates


Release Date: Sep 16, 2021  amd64

docker - 20.10.8
ignition - 0.34.0
kernel - 5.10.63
systemd - 247

New Beta release 2983.1.0

Changes since Beta 2942.1.2

Update to CGroupsV2

As of Alpha version 2969.0.0, Flatcar Container Linux migrates to the unified cgroup hierarchy (aka CGroupsV2)! New nodes will utilize CGroupsV2 by default. Existing nodes remain on CGroupsV1 and need to be manually migrated to CGroupsV2. To learn more about CGroupsV2 on Flatcar Container Linux and the migration guide, please refer to https://kinvolk.io/docs/flatcar-container-linux/latest/container-runtimes/switching-to-unified-cgroups/

Security fixes

Bug Fixes

Changes

  • Added Azure Generation 2 VM support (coreos-overlay#1198)
  • cgroups v2 by default for new nodes (coreos-overlay#931).
  • Upgrade Docker to 20.10 (coreos-overlay#931)
  • Switched Docker ecosystem packages to go1.16 (coreos-overlay#1217)
  • Added lbzip2 binary to the image (coreos-overlay#1221)
  • flatcar-install uses lbzip2 if present, falls back on bzip2 if not (init#46)
  • Added Intel E800 series network adapter driver (coreos-overlay#1237)
  • Enabled ‘audit’ use flag for sys-libs/pam (coreos-overlay#1233)
  • Bumped etcd and flannel to respectively 3.5.0, 0.14.0 to get multiarch images for arm64 support. Note for users of the old etcd v2 support: ETCDCTL_API=2 must be set to use v2 store as well as ETCD_ENABLE_V2=true in the etcd-member.service - this support will be removed in 3.6.0 (coreos-overlay#1179)
  • Switched to zstd compression for the initramfs (coreos-overlay#1136)
  • Support BTRFS in OEM and /usr partitions, but only used it for the OEM partition for now. Ignition configurations that refer to the OEM partition will work with any filesystem format specified, a mismatch is not resulting in a boot error. (coreos-overlay#1106)
  • Switched the arm64 kernel to use a 4k page size instead of 64k
  • Switched dm-verity corruption detection to issue a kernel panic (a panic results in a reboot after 1 minute, this was the case before already) instead of merely failing certain syscalls that try to use the corrupted data
  • Support BTRFS in OEM and /usr partitions, but only used it for the OEM partition for now. Ignition configurations that refer to the OEM partition will work with any filesystem format specified, a mismatch is not resulting in a boot error. (coreos-overlay#1106)
  • Enabled zstd compression for the initramfs and for amd64 also for the kernel because we hit the vmlinuz size limit on the /boot partition
  • Deleted the unused kernel+initramfs vmlinuz file from the /usr partition
  • devcontainer: added support to run on arm64 by switching to an architecture-agnostic partition UUID
  • Enabled ARM64 SDK bootstrap (scripts#134)
  • SDK: enabled experimental ARM64 SDK usage (flatcar-scripts#134) (flatcar-scripts#141)
  • AWS: Added amazon-ssm-agent (coreos-overlay#1162)
  • Azure: Compile OEM contents for all architectures (coreos-overlay#1196)
  • update_engine: add postinstall hook to stay on cgroupv1 (update_engine#13)

Updates

Changes since Alpha 2983.0.0

Security fixes

Updates


Release Date: Sep 1, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.61
systemd - 247

New Beta release 2942.1.2

Changes since Beta 2942.1.1

Security fixes

Bug Fixes

Updates


Release Date: Aug 19, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.59
systemd - 247

Changes since Beta 2942.1.0

Security fixes

Bug Fixes

Changes

Updates


Release Date: Aug 4, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.55
systemd - 247

Changes since Beta 2920.1.0

Security Fixes

Bug Fixes

  • Added the systemd tag in udev for Azure storage devices, to fix /boot automount (init#41)
  • Disabled SELinux by default on dockerd wrapper script (coreos-overlay#1149)
  • Set the cilium_vxlan interface to be not managed by networkd’s default setup with DHCP as it’s managed by Cilium. (init#43)
  • update_engine_client: Improve feedback when an update is not needed(update_engine#10)
  • GCE: Granted CAP_NET_ADMIN to set routes for the TCP LB when starting oem-gce.service (coreos-overlay#1146)

Changes

Updates

Changes since Alpha 2942.0.0

Security fixes

Bug fixes

  • Set the cilium_vxlan interface to be not managed by networkd’s default setup with DHCP as it’s managed by Cilium. (init#43)
  • Disabled SELinux by default on dockerd wrapper script (coreos-overlay#1149)
  • GCE: Granted CAP_NET_ADMIN to set routes for the TCP LB when starting oem-gce.service (coreos-overlay#1146)

Updates


Release Date: Apr 28, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.32
systemd - 247

Changes since Alpha 2823.0.0:

Security fixes

Bug fixes

Updates

Changes since Beta 2801.1.0:

Security fixes

Bug Fixes

Changes

  • The pam_faillock PAM module was enabled as replacement for the removed pam_tally2 module and will temporarily lock an account if there were login attempts with a wrong password. The faillock command can be used to show the current state. With pam_tally2 there was no limit for wrong password login attempts but with faillock the default is already restricting the attempts. The default behavior was relaxed to allow 5 wrong passwords per two minutes, and a one minute account lock time. This does not apply to logins with an SSH key. (baselayout#17)
  • The etcd and flannel services are now run with Docker and any rkt-based customizations of the etcd-member and flanneld services not supported anymore. Also, because the flanneld service relies on Docker and will restart Docker after applying the new configuration, it is not possible anymore to set Requires=flanneld.service for docker.service and instead it’s enough to have flanneld.service enabled. (coreos-overlay#857)

Updates


Release Date: Feb 18, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.16
systemd - 247

Security fixes

Bug Fixes

Updates


Release Date: Jan 28, 2021  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.9.16
systemd - 246

Security fixes

Bug fixes

  • /etc/iscsi/initiatorname.iscsi is generated by the iscsi-init service (#321)
  • Prevent iscsiadm buffer overflow (#318)

Changes

  • Revert to building docker and containerd with go1.13 instead of go1.15. This reduces the SIGURG log spam (Issue #315 PR #774)
  • The containerd socket is now available in the default location (/run/containerd/containerd.sock) and also as a symlink in the previous location (/run/docker/libcontainerd/docker-containerd.sock) (#771)
  • With the iscsi update, the service unit has changed from iscsid to iscsi (#791)
  • AWS Pro: include scripts to facilitate setup of EKS workers (#794).
  • Missed from earlier notes: with the previous open-iscsi update to 2.1.2, the service unit name changed from iscsid to iscsi (#682)

Updates


Release Date: Jan 12, 2021  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.9.16
systemd - 246

Security fixes

Bug fixes

  • The sysctl net.ipv4.conf.*.rp_filter is set to 0 for the Cilium CNI plugin to work (kinvolk/Flatcar#181)
  • Package downloads in the developer container now use the correct URL again (kinvolk/Flatcar#298)
  • networkd: avoid managing MAC addresses for veth devices (kinvolk/init#33)

Changes

  • The sysctl default config file is now applied under the prefix 60 which allows for custom sysctl config files to take effect when they start with a prefix of 70, 80, or 90 (kinvolk/baselayout#13)
  • Containerd CRI plugin got enabled by default, only the containerd socket path needs to be specified as kubelet parameter for Kubernetes 1.20 to use containerd instead of Docker (kinvolk/Flatcar#283)
  • For users with a custom update server a machine alias setting in update-engine allows to give human-friendly names to client instances (kinvolk/update-engine#8)

Updates


Release Date: Dec 1, 2020  amd64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.9.11
systemd - 246

Security fixes:

  • No changes since Alpha 2705.0.0

Bug fixes:

  • No changes since Alpha 2705.0.0

Changes:

  • No changes since Alpha 2705.0.0

Updates:

  • No changes since Alpha 2705.0.0

Release Date: Nov 19, 2020  amd64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.8.18
systemd - 245

Security fixes:

Bug fixes:

Updates:


Release Date: Oct 16, 2020  amd64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.8.14
systemd - 245

Security fixes:

Bug fixes:

  • Ensured that the /etc/coreos to /etc/flatcar symlink always exists, relevant for the Container Linux Config transpiler (ct) when specifying directives for update: or locksmith: while also reformatting the rootfs (baselayout PR#7)

Updates:


Release Date: Sep 30, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.8.11
systemd - 1.30.0
- 245

Security fixes:

Bug fixes:

  • Enabled missing systemd services (#191, PR #612)
  • Fixed Docker torcx image unpacking error on machines with less than ~600 MB total RAM (#32)
  • Solved adcli Kerberos Active Directory incompatibility (#194)
  • Fixed the makefile path when building kernel modules with the developer container (#195)
  • Removed the /etc/portage/savedconfig/ folder that contained a dump of the firmware config flatcar-linux/coreos-overlay#613

Changes:

  • GCE: Improved oslogin support and added shell aliases to run a Python Docker image (PR #592)

Updates:


Release Date: Sep 16, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.65
systemd - 1.30.0
- 245

Bug fixes:

  • Fix resetting of DNS nameservers in systemd-networkd units (PR#12)

Changes:

  • Disable TX checksum offloading for the IP-in-IP tunl0 interface used by Calico (PR#26). This is a workaround for a Mellanox driver issue, currently tracked in Flatcar#183
  • Set sysctl net.ipv4.conf.(all|*).rp_filter to 0 (instead of the systemd upstream value 2) to be less restrictive which some network solutions rely on (PR#11)
  • flatcar-install allows installation to a multipath drive (PR#24)

Updates:


Release Date: Sep 7, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.62
systemd - 1.30.0
- 245

Security fixes:

Updates:


Release Date: Sep 3, 2020  amd64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.61
systemd - 1.30.0
- 245

Changes from Alpha release 2605.1.0

Changes:


Release Date: Aug 20, 2020  amd64

docker - 19.03.11
ignition - 0.34.0
kernel - 5.4.59
systemd - 1.30.0
- 243

Security fixes:

Bug fixes:

Updates:


Release Date: Jul 23, 2020  amd64

docker - 19.03.11
ignition - 0.34.0
kernel - 5.4.52
systemd - 1.30.0
- 243

Changes since the Alpha release 2513.1.0

Bug Fixes:

Updates:


Release Date: Jun 17, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.128
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

Changes:

  • A source code and licensing overview is available under /usr/share/licenses/INFO

Updates:


Release Date: May 26, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.124
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

Bug fixes:

  • When writing the update kernel, prefer /boot/coreos only if /boot/coreos/vmlinux-* exists (https://github.com/flatcar-linux/update_engine/pull/5)
  • Fixed sysroot-boot initramfs service race which resulted in a warning that this service failed
  • Use the correct BINHOST URLs in the development container to download binary packages

Changes:

  • Support the CoreOS GRUB /boot/coreos/first_boot flag file (https://github.com/flatcar-linux/bootengine/pull/13)
  • Fetch container images in docker format rather than ACI by default in etcd-member.service, flanneld.service, and kubelet-wrapper
  • Use flatcar.autologin kernel command line parameter on Azure and VMware for auto login on the serial console
  • Include conntrack (conntrack-tools)
  • Include journalctl output, pstore kernel crash logs, and coredumpctl list output in the mayday report
  • Update wa-linux-agent to 2.2.46 on Azure
  • Support both coreos.config.* and flatcar.config.* guestinfo variables on VMware OEM

Updates:


Release Date: Mar 31, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.112
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Changes:

Updates:


Release Date: Mar 2, 2020  amd64

docker - 18.06.3
ignition - 0.34.0
kernel - 4.19.106
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Upstream Container Linux updates

Updates:


Release Date: Feb 10, 2020  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.102
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Upstream Container Linux updates:

Security fixes:

  • Fix systemd use-after-free upon receiving crafted D-Bus message from local unprivileged attacker (CVE-2020-1712)

Changes:

  • Enable qede kernel module

Updates:


Release Date: Jan 17, 2020  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.95
systemd - 1.30.0
- 241

Release Date: Dec 18, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.87
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Updates:


Release Date: Dec 5, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.87
systemd - 1.30.0
- 241

Release Date: Nov 21, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.84
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix CFS scheduler throttling highly-threaded I/O-bound applications (#2623)

Updates:


Release Date: Nov 11, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.81
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix time zone for Brazil (#2627)

Updates:


Release Date: Oct 17, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.79
systemd - 1.30.0
- 241

Release Date: Oct 16, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.78
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix kernel crash with CephFS mounts, introduced in 2247.3.0 (#2616)

Updates:


Release Date: Sep 25, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.75
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Sep 13, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.71
systemd - 1.30.0
- 241

Release Date: Sep 5, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.69
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix pam_systemd bug allowing authenticated remote users to perform polkit actions as if locally logged in (CVE-2019-3842)
  • Fix systemd-resolved bug allowing unprivileged users to change DNS settings (CVE-2019-15718)

Bug fixes:

  • Fix GCE agent crash loop in new installs (#2608)

Updates:


Release Date: Aug 30, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.68
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix wget buffer overflow allowing arbitrary code execution (CVE-2019-5953)

Updates:


Release Date: Aug 16, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.65
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:

Flatcar updates

Bug fixes:


Release Date: Aug 8, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.65
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix Linux information leak attack vector via speculative side channel (CVE-2019-1125)

Updates:

Flatcar updates

Changes:


Release Date: Aug 1, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.62
systemd - 1.30.0
- 241

Release Date: Jul 17, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.56
systemd - 1.30.0
- 241

Upstream Container Linux updates:

No changes for beta promotion


Release Date: Jul 3, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.55
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix Ignition panic when no guestinfo.(coreos|ignition).config parameters are specified on VMware (coreos/ignition#821)

Updates:


Release Date: Jul 1, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.55
systemd - 1.30.0
- 241

Release Date: Jun 19, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.50
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix invalid bzip2 compression of Container Linux release images (#2589)

Updates:


Release Date: May 21, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.44
systemd - 1.30.0
- 241

Release Date: May 16, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.43
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: May 8, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.36
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix systemd MountFlags=shared option (#2579)

Changes:

  • Pin network interface naming to systemd v238 scheme (#2578)

Release Date: Apr 24, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.36
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Disable new sticky directory protections for backward compatibility (#2577)

Changes:

  • Enable atlantic kernel module (#2576)

Updates:


Release Date: Apr 17, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.34
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Disable new sticky directory protections for backwards compatibility (#2577)

Changes:

  • Enable atlantic kernel module (#2576)

Updates:


Release Date: Mar 26, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.31
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix systemd presets incorrectly handling escaped unit names (#2569)

Updates:


Release Date: Mar 12, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.28
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix systemd-journald memory leak (#2564)

Updates:


Release Date: Feb 27, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.25
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Linux use-after-free in sockfs_setattr (CVE-2019-8912)
  • Fix systemd crash from a specially-crafted D-Bus message (CVE-2019-6454)

Updates:


Release Date: Feb 21, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.23
systemd - 1.30.0
- 238

Release Date: Feb 14, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.20
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Changes:

  • Revert /sys/bus/rbd/add to Linux 4.14 behavior (#2544)

Updates:


Release Date: Jan 30, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.18
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Jan 18, 2019  amd64

docker - 18.06.1
ignition - 0.29.1
kernel - 4.19.13
systemd - 1.30.0
- 238

Release Date: Dec 21, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.88
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Go CPU denial of service in X.509 verification (CVE-2018-16875)
  • Fix PolicyKit always authorizing UIDs greater than INT_MAX (CVE-2018-19788)

Updates:


Release Date: Dec 6, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.84
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Switch to the LTS Linux version 4.14.84 for the beta channel

Release Date: Nov 21, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.81
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Disable containerd CRI plugin to stop it from listening on a TCP port (#2524)

Updates:


Release Date: Nov 8, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.79
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix systemd re-executing with arbitrary supplied state (CVE-2018-15686)
  • Fix systemd race allowing changing file permissions (CVE-2018-15687)
  • Fix systemd-networkd buffer overflow in the dhcp6 client (CVE-2018-15688)

Changes:

  • Switch to the LTS Linux version 4.14.79 for the beta channel

Release Date: Oct 26, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.78
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Git remote code execution during recursive clone (CVE-2018-17456)

Bug fixes:

  • Fix missing kernel headers (#2505)

Updates:


Release Date: Oct 11, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.74
systemd - 1.30.0
- 238

Flatcar updates

Changes:

Bug fixes:

Upstream Container Linux updates:

Changes:

  • Switch to the LTS Linux version 4.14.74 for the beta channel

Release Date: Sep 14, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.14.69
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Docker mounting named volumes (#2497)

Changes:

  • Switch to the LTS Linux version 4.14.69 for the beta channel

Updates:


Release Date: Sep 5, 2018  amd64

docker - 18.06.1
ignition - 0.26.0
kernel - 4.14.67
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Drop AWS PV images from regions which do not support PV

Updates:


Release Date: Aug 17, 2018  amd64

docker - 18.06.0
ignition - 0.26.0
kernel - 4.14.63
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix PXE systems attempting to mount an ESP (#2491)

Changes:

  • Switch to the LTS Linux version 4.14.63 for the beta channel

Release Date: Aug 8, 2018  amd64

docker - 18.03.1
ignition - 0.26.0
kernel - 4.14.60
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix failure to mount large ext4 filesystems (#2485)

Updates:


Release Date: Jul 31, 2018  amd64

docker - 18.03.1
ignition - 0.26.0
kernel - 4.14.59
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix kernel CIFS client (#2480)

Updates:


Release Date: Jul 26, 2018  amd64

docker - 18.03.1
ignition - 0.26.0
kernel - 4.14.57
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Switch to the LTS Docker version 18.03.1-ce for the beta channel
  • Switch to the LTS Linux version 4.14.57 for the beta channel

Release Date: Jul 13, 2018  amd64

docker - 18.03.1
ignition - 0.25.1
kernel - 4.14.55
systemd - 1.30.0
- 238

Release Date: Jun 22, 2018  amd64

docker - 18.03.1
ignition - 0.25.1
kernel - 4.14.50
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Switch to the LTS Docker version 18.03.1-ce for the beta channel
  • Switch to the LTS Linux version 4.14.50 for the beta channel

Release Date: Jun 15, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.49
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix TCP connection stalls (#2457)

Updates:


Release Date: Jun 13, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.48
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Hyper-V network driver regression (#2454)

Updates:


Release Date: Jun 1, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.47
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Git arbitrary code execution when cloning untrusted repositories (CVE-2018-11235)

Bug fixes:

  • Fix inadvertent change of network interface names (#2437)
  • Fix failure to set network interface MTU (#2443)

Updates:


Release Date: May 26, 2018  amd64

docker - 18.03.1
ignition - 0.24.1
kernel - 4.14.42
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Switch to the LTS Docker version 18.03.1-ce for the beta channel
  • Switch to the LTS Linux version 4.14.42 for the beta channel

Updates:


Release Date: May 11, 2018  amd64

docker - 18.03.1
ignition - 0.24.0
kernel - 4.14.39
systemd - 1.29.0
- 238

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Apr 26, 2018  amd64

docker - 18.03.0
ignition - 0.24.0
kernel - 4.14.35
systemd - 1.29.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix docker2aci tar conversion (#2402)

Changes:

  • Switch to the LTS Linux version 4.14.35 for the beta channel

Release Date: Apr 25, 2018  amd64

docker - 17.12.1
ignition - 0.23.0
kernel - 4.14.30
systemd - 1.29.0
- 237

Flatcar updates

Initial Flatcar release.

Bug fixes:

Notes:

  • Previous test images have been removed from the release servers. This is due to a new update key being generated using our updated security policy which we included in the first public image.

Upstream Container Linux updates:

Bug fixes:

  • Fix kernel panic with vxlan (#2382)

Release Date: Sep 30, 2021  amd64 arm64

docker - 20.10.8
ignition - 0.34.0
kernel - 5.10.69
systemd - 247

Update to CGroupsV2

As of Alpha version 2969.0.0, Flatcar Container Linux migrates to the unified cgroup hierarchy (aka CGroupsV2)! New nodes will utilize CGroupsV2 by default. Existing nodes remain on CGroupsV1 and need to be manually migrated to CGroupsV2. To learn more about CGroupsV2 on Flatcar Container Linux and the migration guide, please refer to https://kinvolk.io/docs/flatcar-container-linux/latest/container-runtimes/switching-to-unified-cgroups/

New Alpha release 3005.0.1

Changes since Alpha 3005.0.0

Security fixes

Bug fixes

  • The Mellanox NIC Linux driver issue introduced in the previous release was fixed (Flatcar#520)

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Sep 27, 2021  amd64 arm64

docker - 20.10.8
ignition - 0.34.0
kernel - 5.10.67
systemd - 247

Update to CGroupsV2

As of Alpha version 2969.0.0, Flatcar Container Linux migrates to the unified cgroup hierarchy (aka CGroupsV2)! New nodes will utilize CGroupsV2 by default. Existing nodes remain on CGroupsV1 and need to be manually migrated to CGroupsV2. To learn more about CGroupsV2 on Flatcar Container Linux and the migration guide, please refer to https://kinvolk.io/docs/flatcar-container-linux/latest/container-runtimes/switching-to-unified-cgroups/

New Alpha release 3005.0.0

Changes since Alpha 2983.0.0

Security fixes

Bug Fixes

  • Randomize OEM filesystem UUID if mounting fails (init#47)
  • Run emergency.target on ignition/torcx service unit failure in dracut (bootengine#28)

Changes

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Sep 1, 2021  amd64 arm64

docker - 20.10.8
ignition - 0.34.0
kernel - 5.10.61
systemd - 247

New Alpha release 2983.0.0

Update to CGroupsV2

As of Alpha version 2969.0.0, Flatcar Container Linux migrates to the unified cgroup hierarchy (aka CGroupsV2)! New nodes will utilize CGroupsV2 by default. Existing nodes remain on CGroupsV1 and need to be manually migrated to CGroupsV2. To learn more about CGroupsV2 on Flatcar Container Linux and the migration guide, please refer to https://kinvolk.io/docs/flatcar-container-linux/latest/container-runtimes/switching-to-unified-cgroups/

Changes since Alpha 2969.0.0

Security fixes

Bug Fixes

Changes

  • Added Azure Generation 2 VM support (coreos-overlay#1198)
  • Switched Docker ecosystem packages to go1.16 (coreos-overlay#1217)
  • Added lbzip2 binary to the image (coreos-overlay#1221)
  • flatcar-install uses lbzip2 if present, falls back on bzip2 if not (init#46)
  • Added Intel E800 series network adapter driver (coreos-overlay#1237)
  • Enabled ‘audit’ use flag for sys-libs/pam (coreos-overlay#1233)
  • Bumped etcd and flannel to respectively 3.5.0, 0.14.0 to get multiarch images for arm64 support. Note for users of the old etcd v2 support: ETCDCTL_API=2 must be set to use v2 store as well as ETCD_ENABLE_V2=true in the etcd-member.service - this support will be removed in 3.6.0 (coreos-overlay#1179)

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Aug 19, 2021  amd64 arm64

docker - 20.10.7
ignition - 0.34.0
kernel - 5.10.59
systemd - 247

Update to CGroupsV2

Flatcar Container Linux migrates to the unified cgroup hierarchy (aka cgroups v2)! New nodes will utilize cgroups v2 by default. Existing nodes remain on cgroups v1 and need to be manually migrated to cgroups v2. To learn more about the cgroups v2 on Flatcar Container Linux and the migration guide, please refer to https://kinvolk.io/docs/flatcar-container-linux/latest/container-runtimes/switching-to-unified-cgroups/

Security fixes

Bug fixes

Changes

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Aug 4, 2021  amd64 arm64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.55
systemd - 247

Security fixes

Bug fixes

  • Set the cilium_vxlan interface to be not managed by networkd’s default setup with DHCP as it’s managed by Cilium. (init#43)
  • Disabled SELinux by default on dockerd wrapper script (coreos-overlay#1149)
  • Fixed the network-cleanup service race in the initramfs which resulted in a failure being reported
  • GCE: Granted CAP_NET_ADMIN to set routes for the TCP LB when starting oem-gce.service (coreos-overlay#1146)

Changes

  • Switched the arm64 kernel to use a 4k page size instead of 64k
  • Switched dm-verity corruption detection to issue a kernel panic (a panic results in a reboot after 1 minute, this was the case before already) instead of merely failing certain syscalls that try to use the corrupted data
  • Support BTRFS in OEM and /usr partitions, but only used it for the OEM partition for now. Ignition configurations that refer to the OEM partition will work with any filesystem format specified, a mismatch is not resulting in a boot error. (coreos-overlay#1106)
  • Enabled zstd compression for the initramfs and for amd64 also for the kernel because we hit the vmlinuz size limit on the /boot partition
  • Deleted the unused kernel+initramfs vmlinuz file from the /usr partition
  • devcontainer: added support to run on arm64 by switching to an architecture-agnostic partition UUID
  • Enabled ARM64 SDK bootstrap (scripts#134)

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Apr 28, 2021  amd64 arm64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.32
systemd - 247

Security fixes

Bug fixes

Changes

  • Make the hostname setting units optional. Having the hostname units as required by the initrd.target meant that if the unit failed the machine wouldn’t start, disrupting the whole boot. (bootengine#23)
  • Enable using iSCSI netroot devices on Flatcar (bootengine#22)

Updates

Deprecation

  • rkt and kubelet-wrapper are deprecated and removed from Alpha, also from subsequent channels in the future. Please read the removal announcement to know more.

[Alpha only] Note: Please note that ARM images remain experimental for now.


Release Date: Mar 3, 2021  amd64 arm64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.10.19
systemd - 247

Security fixes

Changes

Updates

Deprecation

Note: Please note that ARM images remain experimental for now.


Release Date: Jan 28, 2021  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.10.10
systemd - 247

Security fixes

Bug fixes

  • /etc/iscsi/initiatorname.iscsi is generated by the iscsi-init service (#321)
  • Prevent iscsiadm buffer overflow (#318)

Changes

  • Revert to building docker and containerd with go1.13 instead of go1.15. This reduces the SIGURG log spam (Issue #315 PR #774)
  • The containerd socket is now available in the default location (/run/containerd/containerd.sock) and also as a symlink in the previous location (/run/docker/libcontainerd/docker-containerd.sock) (#771)
  • AWS Pro: include scripts to facilitate setup of EKS workers (#794).
  • Missed from earlier notes: with the previous open-iscsi update to 2.1.2, the service unit name changed from iscsid to iscsi (#682)

Updates

Note: This alpha release includes only AMD64 images.


Release Date: Jan 12, 2021  amd64 arm64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.10.4
systemd - 246

Security fixes

Bug fixes

Changes

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Dec 18, 2020  amd64 arm64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.9.14
systemd - 246

Security fixes

Bug fixes

  • The sysctl net.ipv4.conf.*.rp_filter is set to 0 for the Cilium CNI plugin to work (Flatcar#181)
  • Package downloads in the developer container now use the correct URL again (Flatcar#298)

Changes

  • A symlink vimdiff should not be created, if the USE flag minimal is enabled. (Flatcar/#221)
  • The sysctl default config file is now applied under the prefix 60 which allows for custom sysctl config files to take effect when they start with a prefix of 70, 80, or 90 (baselayout#13)
  • Containerd CRI plugin got enabled by default, only the containerd socket path needs to be specified as kubelet parameter for Kubernetes 1.20 to use containerd instead of Docker (Flatcar#283)
  • For users with a custom update server a machine alias setting in update-engine allows to give human-friendly names to client instances (update-engine#8)
  • Enable BCMGENET as a module on arm64_defconfig-5.9 (coreos-overlay#717)
  • Enable BCM7XXX_PHY as a module on arm64_defconfig-5.9 for Raspberry Pi 4 (coreos-overlay#716)
  • Disable jpeg USE flag from QEMU (coreos-overlay#729)
  • flatcar_production_qemu.sh: Use more CPUs for ARM if available (scripts#91)

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Nov 27, 2020  amd64 arm64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.9.11
systemd - 246

Security fixes

Bug fixes

  • Added systemd-tmpfiles directives for /opt and /opt/bin to ensure that the folders have correct permissions even when /opt/ was once created by containerd (Flatcar#279)

Changes

  • Enabled the kernel config HOTPLUG_PCI_ACPI for arm64 to support attaching EC2 volumes (PR#705)

Updates

Note: Please note that ARM images remain experimental for now.


Release Date: Nov 20, 2020  amd64 arm64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.9.8
systemd - 246

Security fixes:

Bug fixes:

  • network: Restore KeepConfiguration=dhcp-on-stop (kinvolk/init#30)
  • Make the automatic filesystem resizing more robust against a race and add more logging (kinvolk/init#31)
  • Default again to waiting only for one network interface to be ready with systemd-networkd-wait-online which was missing in the initial systemd 246 update
  • Default again to disabling IP Forwarding in systemd which was missing in the initial systemd 246 update
  • Make systemd detect updates again when the /usr partition changes which was missing in the initial systemd 246 update
  • Default again to set DefaultTasksMax=100% in systemd which was missing in the initial systemd 246 update
  • Default again to disable SELinux permissions checks in systemd which was missing in the initial systemd 246 update

Changes:

  • The zstd tools were added (version 1.4.4)
  • The kernel config CONFIG_PSI was set to support Pressure Stall Information, more information also under https://facebookmicrosites.github.io/psi/docs/overview (Flatcar#162)
  • The kernel config CONFIG_BPF_JIT_ALWAYS_ON was set to use the BPF just-in-time compiler by default for faster execution
  • The kernel config CONFIG_DEBUG_INFO_BTF was set to support BTF metadata (BPF Type Format), one important piece for portability of BPF programs (CO-RE: Compile Once - Run Everywhere) through relocation
  • The kernel config CONFIG_POWER_SUPPLY was set
  • The kernel configs CONFIG_OVERLAY_FS_METACOPY and CONFIG_OVERLAY_FS_REDIRECT_DIR were set. With the first overlayfs will only copy up metadata when a metadata-specific operation like chown/chmod is performed. The full file will be copied up later when the file is opened for write operations. With the second, which is equivalent to setting “redirect_dir=on” in the kernel command-line, overlayfs will copy up the directory first before the actual content (Flatcar#170).

Updates:

  • Linux (5.9.8)
  • Linux firmware (20200918)
  • systemd (246.6)
  • bzip2 (1.0.8)
  • cifs-utils (6.11)
  • dbus-glib (0.110)
  • elfutils (0.178)
  • glib (2.64.5)
  • ntp (4.2.8_p15)
  • open-iscsi (2.1.2)
  • samba (4.11.13)
  • shadow (4.8)
  • sssd (2.3.1)
  • strace (5.9)
  • talloc (2.3.1)
  • tdb (1.4.3)
  • tevent (0.10.2)
  • SDK/developer container: GCC (9.3.0), binutils (2.35), gdb (9.2)
  • SDK: Go (1.15.5)
  • VMware: open-vm-tools (11.2.0)

Release Date: Oct 28, 2020  amd64 arm64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.8.16
systemd - 246

Security fixes:

Bug fixes:

  • Ensured that the /etc/coreos to /etc/flatcar symlink always exists, relevant for the Container Linux Config transpiler (ct) when specifying directives for update: or locksmith: while also reformatting the rootfs (baselayout PR#7)
  • Allow inactive network interfaces to be bound to a bonding interface, by encoding additional configuration for systemd-networkd-wait-online (afterburn PR #10)
  • Azure: Exclude bonded SR-IOV driver mlx5-core from network interfaces managed by systemd-networkd (bootengine PR #19) (init PR #29)
  • Do not configure ccache in Jenkins (scripts PR #100)

Changes:

Updates:

Note: Please note that ARM images remain experimental for now.


Release Date: Oct 16, 2020  amd64 arm64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.8.14
systemd - 246

Security fixes:

Bug fixes:

  • Ensured that the /etc/coreos to /etc/flatcar symlink always exists, relevant for the Container Linux Config transpiler (ct) when specifying directives for update: or locksmith: while also reformatting the rootfs (baselayout PR#7)
  • Azure: Exclude bonded SR-IOV network interfaces with newer drivers from networkd (in addition to the old drivers) to prevent them being configured instead of just the bond interface (init PR#29, bootengine PR#19)

Changes:

  • Compress kernel modules with xz (overlay PR#628)
  • Add containerd-runc-shim-v* binaries required by kubelet custom CRI endpoints (overlay PR#623)
  • AWS arm64: Enable elastic network adapter module (overlay PR#631)
  • Equinix Metal (Packet): Exclude unused network interfaces from networkd, disregard the state of the bonded interfaces for the network-online.target and only require the bond interface itself to have at least one active link instead of routable which requires both links to be active (afterburn PR#10)
  • QEMU: Use flatcar.autologin kernel command line parameter for auto login on the console (Flatcar #71)

Updates:


Release Date: Sep 30, 2020  amd64

docker - 19.03.13
ignition - 0.34.0
kernel - 5.8.11
systemd - 245

Security fixes:

Bug fixes:

  • Enabled missing systemd services (#191, PR #612)
  • Fixed Docker torcx image unpacking error on machines with less than ~600 MB total RAM (#32)
  • Solved adcli Kerberos Active Directory incompatibility (#194)
  • Fixed the makefile path when building kernel modules with the developer container (#195)
  • Removed the /etc/portage/savedconfig/ folder that contained a dump of the firmware config flatcar-linux/coreos-overlay#613

Changes:

  • GCE: Improved oslogin support and added shell aliases to run a Python Docker image (PR #592)

Updates:

Note: Please note that ARM images remain experimental for now.


Release Date: Sep 16, 2020  amd64 arm64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.8.9
systemd - 1.30.0
- 245

Bug fixes:

  • Fix resetting of DNS nameservers in systemd-networkd units (PR#12)

Changes:

  • Disable TX checksum offloading for the IP-in-IP tunl0 interface used by Calico (PR#26). This is a workaround for a Mellanox driver issue, currently tracked in Flatcar#183
  • Set sysctl net.ipv4.conf.(all|*).rp_filter to 0 (instead of the systemd upstream value 2) to be less restrictive which some network solutions rely on (PR#11)
  • Update-engine now detects rollbacks and reports them as errors to the update server (PR#6)
  • flatcar-install allows installation to a multipath drive (PR#24)
  • Support the lockdown kernel command line parameter (PR#533)
  • Update public key to include a new subkey

Updates:

Note: Please note that ARM images remain experimental for now.


Release Date: Sep 1, 2020  amd64 arm64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.61
systemd - 1.30.0
- 245

Bug fixes:

Changes:

  • Mount /sys/fs/bpf into the toolbox container and allow BPF syscalls (PR#544)
  • Support loading BPF programs with tc Flatcar#172

Updates:

Note: Please note that ARM images remain experimental for now.


Release Date: Aug 20, 2020  amd64 arm64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.59
systemd - 1.30.0
- 245

Security fixes:

Bug fixes:

Changes:

Updates:


Release Date: Aug 6, 2020  amd64 arm64

docker - 19.03.12
ignition - 0.34.0
kernel - 5.4.55
systemd - 1.30.0
- 245

Bug Fixes:

Changes:

  • Since version 245 systemd-networkd ignores network unit files with an empty [Match] section. Add a Name=* entry to match all interfaces.
  • Weave network interfaces are excluded from systemd-networkd (flatcar-linux/init#22)
  • Enabled the mmio and vsock virtio kernel modules for Firecracker (flatcar-linux/coreos-overlay#485)
  • Enabled CONFIG_IKHEADERS to expose kernel headers under /sys/kernel/kheaders.tar.xz
  • Vultr support in Ignition (flatcar-linux/ignition#13)
  • VMware OVF settings default to ESXi 6.5 and Linux 3.x

Updates:

Note: Please note that ARM images remain experimental for now.


Release Date: Jun 30, 2020  amd64 arm64

docker - 19.03.11
ignition - 0.34.0
kernel - 5.4.47
systemd - 1.30.0
- 243

Security Fixes:

Bugfixes:

Updates:

Note: Please note that ARM images remain experimental for now.


Release Date: Jun 17, 2020  amd64 arm64

docker - 19.03.8
ignition - 0.34.0
kernel - 5.4.46
systemd - 1.30.0
- 243

Flatcar updates

Security fixes:

Changes:

  • A source code and licensing overview is available under /usr/share/licenses/INFO

Updates:


Release Date: May 26, 2020  amd64 arm64

docker - 19.03.8
ignition - 0.34.0
kernel - 5.4.41
systemd - 1.30.0
- 243

Flatcar updates

Security fixes:

Bug fixes:

  • Revert adding the SELinux use flag for docker-runc until a regression is solved
  • When writing the update kernel, prefer /boot/coreos only if /boot/coreos/vmlinux-* exists (https://github.com/flatcar-linux/update_engine/pull/5)
  • Fixed sysroot-boot initramfs service race which resulted in a warning that this service failed

Changes:

  • Support the CoreOS GRUB /boot/coreos/first_boot flag file (https://github.com/flatcar-linux/bootengine/pull/13)
  • Fetch container images in docker format rather than ACI by default in etcd-member.service, flanneld.service, and kubelet-wrapper
  • Add wireguard kernel module from wireguard-linux-compat
  • Include wg (wireguard-tools)
  • Enable regex support for jq
  • Use flatcar.autologin kernel command line parameter on Azure for auto login on the serial console

Updates:


Release Date: Apr 30, 2020  amd64 arm64

docker - 19.03.8
ignition - 0.34.0
kernel - 5.4.35
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Updates:


Release Date: Apr 15, 2020  amd64 arm64

docker - 19.03.8
ignition - 0.34.0
kernel - 4.19.113
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Changes:

Updates:


Release Date: Mar 5, 2020  amd64 arm64

docker - 19.03.5
ignition - 0.34.0
kernel - 4.19.106
systemd - 1.30.0
- 241

Flatcar updates

Bug fixes:

Updates:


Release Date: Feb 17, 2020  amd64 arm64

docker - 19.03.5
ignition - 0.34.0
kernel - 4.19.102
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

  • Fix stack-based buffer overflow in sudo (CVE-2019-18634)
  • Fix incorrect access control leading to privileges escalation in runc (CVE-2019-19921)
  • Fix systemd use-after-free upon receiving crafted D-Bus message from local unprivileged attacker (CVE-2020-1712)

Bug fixes:

Changes:

Updates:


Release Date: Jan 21, 2020  amd64 arm64

docker - 19.03.5
ignition - 0.34.0
kernel - 4.19.97
systemd - 1.30.0
- 241

Release Date: Dec 20, 2019  amd64 arm64

docker - 19.03.5
ignition - 0.33.0
kernel - 4.19.89
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

  • Fix a denial-of-service issue via malicious access to /dev/kvm (CVE-2019-19332)

Bug fixes:

Updates:


Release Date: Dec 9, 2019  amd64 arm64

docker - 19.03.5
ignition - 0.33.0
kernel - 4.19.87
systemd - 1.30.0
- 241

Flatcar updates

It is the first release done for both amd64 and arm64.

Bug fixes:

Updates:


Release Date: Dec 5, 2019  amd64

docker - 19.03.5
ignition - 0.33.0
kernel - 4.19.87
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

Bug fixes:

Updates:


Release Date: Nov 25, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.84
systemd - 1.30.0
- 241

Flatcar updates

Security fixes:

Bug fixes:

  • Fix CFS scheduler throttling highly-threaded I/O-bound applications (#2623)
  • Fix time zone for Brazil (#2627)

Updates:


Release Date: Nov 11, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.81
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix CFS scheduler throttling highly-threaded I/O-bound applications (#2623)
  • Fix time zone for Brazil (#2627)

Updates:


Release Date: Oct 23, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.80
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Changes:

  • Pin rkt to Go 1.12

Updates:


Release Date: Oct 17, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.79
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix sudo allowing a user to run commands as root if configured to permit the user to run commands as everyone other than root (CVE-2019-14287)

Bug fixes:

  • Fix kernel crash with CephFS mounts, introduced in 2275.0.0 (#2616)

Updates:


Release Date: Oct 16, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.78
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix kernel crash with CephFS mounts, introduced in 2275.0.0 (#2616)

Updates:


Release Date: Sep 25, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.75
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Sep 13, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.71
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix systemd-resolved bug allowing unprivileged users to change DNS settings (CVE-2019-15718)

Bug fixes:

  • Fix GCE agent crash loop in new installs (#2608)

Updates:


Release Date: Sep 5, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.69
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix systemd-resolved bug allowing unprivileged users to change DNS settings (CVE-2019-15718)

Bug fixes:

  • Fix GCE agent crash loop in new installs (#2608)

Updates:


Release Date: Aug 30, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.68
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Aug 16, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.65
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:

Flatcar updates

Bug fixes:


Release Date: Aug 8, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.65
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix Linux information leak attack vector via speculative side channel (CVE-2019-1125)

Updates:

Flatcar updates

Changes:


Release Date: Aug 1, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.62
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix Ignition fetching from S3 URLs when network is slow to start (ignition#826)

Updates:


Release Date: Jul 17, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.58
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Fix Docker device or resource busy error when creating overlay mounts, introduced in 2191.0.0

Updates:


Release Date: Jul 3, 2019  amd64

docker - 18.06.3
ignition - 0.33.0
kernel - 4.19.56
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix Ignition panic when no guestinfo.(coreos|ignition).config parameters are specified on VMware (coreos/ignition#821)

Updates:


Release Date: Jul 1, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.55
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Temporarily revert bunzip2 change in 2163.0.0 causing decompression failures for invalid archives created by older versions of lbzip2, including Container Linux release images (#2589)

Updates:


Release Date: Jun 19, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.50
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Jun 12, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.47
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Bug fixes:

  • Temporarily revert bunzip2 change in 2163.0.0 causing decompression failures for invalid archives created by older versions of lbzip2, including Container Linux release images (#2589)

Release Date: Jun 6, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.47
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix curl TFTP buffer overflow with non-default block size (CVE-2019-5436)

Updates:


Release Date: May 21, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.44
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Updates:


Release Date: May 16, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.43
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: May 8, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.37
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix systemd MountFlags=shared option (#2579)

Changes:

  • Use Amazon’s recommended NVMe timeout for new EC2 installs (#2484)
  • Pin network interface naming to systemd v238 scheme (#2578)
  • Enable XDP sockets (#2580)

Updates:


Release Date: May 3, 2019  amd64

docker - 18.06.3
ignition - 0.32.0
kernel - 4.19.36
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Disable new sticky directory protections for backward compatibility (#2577)

Changes:

  • Enable atlantic kernel module (#2576)

Updates:


Release Date: Apr 9, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.34
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Mar 26, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.31
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

  • Fix OpenSSH scp allowing remote servers to change target directory permissions (CVE-2018-20685)
  • Fix OpenSSH outputting ANSI control codes from remote servers (CVE-2019-6109, CVE-2019-6110)
  • Fix OpenSSH scp allowing remote servers to overwrite arbitrary files (CVE-2019-6111)
  • Fix OpenSSL side-channel timing attack (CVE-2018-5407)
  • Fix OpenSSL padding oracle attack in misbehaving applications (CVE-2019-1559)
  • Fix ntp ntpd denial of service by authenticated user (CVE-2019-8936)
  • Fix ntp buffer overflow in ntpq and ntpdc (CVE-2018-12327)

Bug fixes:

  • Fix systemd presets incorrectly handling escaped unit names (#2569)

Updates:


Release Date: Mar 12, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.28
systemd - 1.30.0
- 241

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix systemd-journald memory leak (#2564)

Changes:

  • Enable vhost_vsock kernel module (#2563)

Updates:


Release Date: Feb 27, 2019  amd64

docker - 18.06.3
ignition - 0.31.0
kernel - 4.19.25
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Feb 14, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.20
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Changes:

  • Revert /sys/bus/rbd/add to Linux 4.14 behavior (#2544)
  • Add a new subkey for signing release images

Updates:


Release Date: Jan 30, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.18
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Updates:


Release Date: Jan 18, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.15
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Changes:

  • Add ip_vs_mh kernel module (#2542)

Updates:


Release Date: Jan 18, 2019  amd64

docker - 18.06.1
ignition - 0.30.0
kernel - 4.19.13
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix monitoring process events over netlink (#2537)

Updates:


Release Date: Dec 21, 2018  amd64

docker - 18.06.1
ignition - 0.29.1
kernel - 4.19.9
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Go CPU denial of service in X.509 verification (CVE-2018-16875)
  • Fix PolicyKit always authorizing UIDs greater than INT_MAX (CVE-2018-19788)

Bug fixes:

  • Fix AWS, Azure, and GCE disk aliases in the initramfs for Ignition (#2531)

Updates:


Release Date: Dec 6, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.19.6
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Updates:


Release Date: Nov 21, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.19.2
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Disable containerd CRI plugin to stop it from listening on a TCP port (#2524)
  • Fix curl buffer overrun in NTLM authentication code (CVE-2018-14618)
  • Fix OpenSSL TLS client denial of service (CVE-2018-0732)
  • Fix OpenSSL timing side channel in DSA signature generation (CVE-2018-0734)
  • Fix OpenSSL timing side channel via SMT port contention (CVE-2018-5407)

Updates:


Release Date: Nov 8, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.19.1
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix systemd re-executing with arbitrary supplied state (CVE-2018-15686)
  • Fix systemd race allowing changing file permissions (CVE-2018-15687)
  • Fix systemd-networkd buffer overflow in the dhcp6 client (CVE-2018-15688)

Bug fixes:

  • Add AWS and GCE disk aliases in the initramfs for Ignition (#2481)
  • Add compatibility nf_conntrack_ipv4 kernel module to fix kube-proxy IPVS on Linux 4.19 (#2518)

Updates:


Release Date: Oct 26, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.19.0
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix missing kernel headers (#2505)

Updates:


Release Date: Oct 11, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.18.12
systemd - 1.30.0
- 238

Flatcar updates

Changes:

Bug fixes:

Upstream Container Linux updates:

Updates:


Release Date: Oct 1, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.18.9
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Google Compute Engine OS Login activation (#2503)

Updates:


Release Date: Sep 14, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.18.7
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Docker mounting named volumes (#2497)
  • Fix Azure disk detection in Ignition (#2481)

Changes:

  • Add support for Google Compute Engine OS Login
  • Enable support for Mellanox Ethernet switches

Updates:


Release Date: Aug 29, 2018  amd64

docker - 18.06.1
ignition - 0.28.0
kernel - 4.18.5
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Add CIFS userspace utilities (#571)
  • Drop AWS PV images from regions which do not support PV

Updates:


Release Date: Aug 17, 2018  amd64

docker - 18.06.0
ignition - 0.27.0
kernel - 4.17.15
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix PXE systems attempting to mount an ESP (#2491)

Updates:


Release Date: Aug 8, 2018  amd64

docker - 18.06.0
ignition - 0.26.0
kernel - 4.17.12
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix failure to mount large ext4 filesystems (#2485)

Updates:


Release Date: Jul 31, 2018  amd64

docker - 18.06.0
ignition - 0.26.0
kernel - 4.17.11
systemd - 1.30.0
- 238

Release Date: Jul 26, 2018  amd64

docker - 18.06.0
ignition - 0.26.0
kernel - 4.17.9
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Changes:

  • Add torcx remotes support

Updates:


Release Date: Jul 5, 2018  amd64

docker - 18.05.0
ignition - 0.26.0
kernel - 4.17.3
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Changes:

  • Reads of /dev/urandom early in boot will block until entropy pool is fully initialized
  • Support friendly AWS EBS NVMe device names (#2399)

Updates:


Release Date: Jun 22, 2018  amd64

docker - 18.05.0
ignition - 0.26.0
kernel - 4.16.16
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Hyper-V network driver regression (#2454)

Changes:

Updates:


Release Date: Jun 13, 2018  amd64

docker - 18.05.0
ignition - 0.25.1
kernel - 4.16.14
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix Hyper-V network driver regression (#2454)

Release Date: Jun 12, 2018  amd64

docker - 18.05.0
ignition - 0.25.1
kernel - 4.16.14
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix failure to set network interface MTU (#2443)
  • Fix inadvertent change of network interface names (#2437)
  • Fix Docker bind mounts from root filesystem (#2440)

Changes:

  • Update VMware virtual hardware version to 11 (ESXi > 6.0)

Updates:


Release Date: Jun 1, 2018  amd64

docker - 18.05.0
ignition - 0.25.1
kernel - 4.16.13
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

  • Fix Git arbitrary code execution when cloning untrusted repositories (CVE-2018-11235)

Bug fixes:

  • Fix failure to set network interface MTU (#2443)

Updates:


Release Date: May 27, 2018  amd64

docker - 18.05.0
ignition - 0.25.1
kernel - 4.16.10
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix inadvertent change of network interface names (#2437)
  • Fix Docker bind mounts from root filesystem (#2440)

Release Date: May 26, 2018  amd64

docker - 18.05.0
ignition - 0.25.1
kernel - 4.16.10
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Changes:

  • Enable QLogic FCoE offload support (#2367)
  • Enable hardware RNG kernel drivers (#2430)
  • Add notrap to ntpd default access restrictions (#2220)
  • Allow booting default GRUB menu entry if GRUB password is enabled (#1597)
  • coreos-install -i no longer modifies grub.cfg (#2291)
  • QEMU wrapper script now enables VirtIO RNG device

Updates:


Release Date: May 11, 2018  amd64

docker - 18.04.0
ignition - 0.24.0
kernel - 4.16.7
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Bug fixes:

  • Fix GRUB free magic error on existing systems (#2400)

Changes:

  • Support storing sudoers in SSSD and LDAP
  • No longer publish Oracle Cloud release images

Updates:


Release Date: Apr 26, 2018  amd64

docker - 18.04.0
ignition - 0.24.0
kernel - 4.16.3
systemd - 1.30.0
- 238

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Pass /etc/machine-id from the host to the kubelet
  • Fix docker2aci tar conversion (#2402)
  • Switch /boot from FAT16 to FAT32 (#2246)

Changes:

  • Make Ignition failures more visible on the console

Updates:


Release Date: Apr 25, 2018  amd64

docker - 18.03.0
ignition - 0.24.0
kernel - 4.15.15
systemd - 1.29.0
- 238

Flatcar updates

Initial Flatcar release.

Notes:

  • Previous test images have been removed from the release servers. This is due to a new update key being generated using our updated security policy which we included in the first public image.

Upstream Container Linux updates:

Security fixes:

Bug fixes:

  • Fix GRUB crash at boot (#2284)

Updates:


Release Date: Sep 27, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.4.147
systemd - 246

New LTS release 2605.21.1

Changes since LTS 2605.20.1

Security fixes

Updates


Release Date: Sep 1, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.4.143
systemd - 246

New LTS release 2605.20.1

Changes since LTS 2605.19.1

Security fixes

Updates


Release Date: Aug 19, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.4.141
systemd - 246

Changes since LTS 2605.18.1

Security fixes

Updates


Release Date: Jul 28, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.4.134
systemd - 246

Release Date: Apr 28, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.4.114
systemd - 246

Security fixes

Bug fixes

Updates


Release Date: Mar 2, 2021  amd64

docker - 19.03.15
ignition - 0.34.0
kernel - 5.4.101
systemd - 246

Security fixes

Bug fixes

  • login message (motd): filter out bullet point when parsing failed units (baselayout#16)
  • tcsd.service: use correct file permissions (coreos-overlay#809)
  • Use LTS 2021 as OS codename instead of the wrong LTS 2020 name
  • Flatcar Pro for AWS: flatcar-eks: add missing mkdir and update to latest versions (coreos-overlay#817)

Updates


Release Date: Feb 2, 2021  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.4.92
systemd - 246

Security fixes

Bug fixes

  • networkd: avoid managing MAC addresses for veth devices (kinvolk/init#33)
  • /etc/iscsi/initiatorname.iscsi is generated by the iscsi-init service (#321)
  • Prevent iscsiadm buffer overflow (#318)
  • Revert to building docker and containerd with go1.13 instead of go1.15. This reduces the SIGURG log spam (#315)

Changes

  • The containerd socket is now available in the default location (/run/containerd/containerd.sock) and also as a symlink in the previous location (/run/docker/libcontainerd/docker-containerd.sock) (#771)
  • With the iscsi update, the service unit has changed from iscsid to iscsi (#791)
  • AWS Pro: include scripts to facilitate setup of EKS workers (#794)

Updates


Release Date: Dec 16, 2020  amd64

docker - 19.03.14
ignition - 0.34.0
kernel - 5.4.83
systemd - 246

Changes:

  • The Linux kernel is compiled with FIPS support
  • Containerd CRI plugin got enabled by default, only the containerd socket path needs to be specified as kubelet parameter for Kubernetes 1.20 to use containerd instead of Docker (Flatcar#283)

Updates:

  • Linux (5.4.83)
  • Docker (19.03.14)
  • containerd (1.4.3)
  • systemd (246.6)

Latest Posts