What podman-container-tools/podman shipped
Generated by FoxPlug from public activity — not affiliated with Podman.
Week of September 14, 2026
What shipped
- Podman 5.8.7 released with security fixes for CVE-2025-11395 addressing crafted layer tarballs in podman load and symlinks in podman volume import that could overwrite host files. Release
- Podman 6.1.2 released with security fixes for CVE-2025-11395 and related vulnerabilities. Release
- podman image scp now supports --compression-format and --compression-level options to compress archives during transfer, supporting gzip and zstd formats. Pull request #29395
- New libpod REST API endpoint for autoupdate functionality added, matching the capabilities of the CLI version. Pull request #27025
- Fixed compat container update to preserve existing restart policy unless explicitly overridden in the request. Pull request #29795
- Docker-compat network API now includes the IPRange field in IPAM config, mapping from Libpod's LeaseRange. Pull request #28633
- podman exec now forwards signals to the exec session's process group, preventing commands from continuing to run after exec is killed. Pull request #29525
- Health check command behavior fixed to use the health check command for startup health checks when --health-startup-cmd is not present, matching Docker behavior. Pull request #27857
- Documentation added explaining rootless bind-mount access through unmapped parent directories and user namespace ID mapping. Pull request #29375
- CPU real-time scheduler options --cpu-rt-period and --cpu-rt-runtime are now hidden and marked as no-ops since Podman 6 dropped cgroups v1 support. Pull request #29784
Why it matters
Two security releases address a critical vulnerability in image and volume import operations that could overwrite host files. Several improvements enhance container compatibility with Docker APIs and add new features for remote image transfer and API functionality.
Changelog entry
- Security: v5.8.7 released addressing CVE-2025-11395 for crafted layer tarballs and symlinks Release
- Security: v6.1.2 released addressing CVE-2025-11395 and related vulnerabilities Release
- Feature: podman image scp adds --compression-format and --compression-level options Pull request #29395
- Feature: New libpod REST API endpoint for autoupdate functionality Pull request #27025
- Fix: Compat container update preserves restart policy unless explicitly changed Pull request #29795
- Fix: Docker-compat network API includes IPRange field in IPAM config Pull request #28633
- Fix: podman exec now forwards signals to the exec session's process group Pull request #29525
- Fix: Health check command used for startup checks when --health-startup-cmd not set Pull request #27857
- Fix: Compat reports cgroup driver 'none' for rootless with cgroupfs Pull request #29303
- Change: --cpu-rt-period and --cpu-rt-runtime hidden and marked as no-ops Pull request #29784
Podman 5.8.7 and 6.1.2 released with security fixes for CVE-2025-11395. New features include compression for image scp, autoupdate REST API endpoint, and improved Docker API compatibility.
This week brings two security releases addressing CVE-2025-11395 affecting image and volume imports. New features include compression options for podman image scp transfers, an autoupdate endpoint in the libpod REST API, improved Docker API compatibility for networks and container updates, fixed signal forwarding in exec sessions, and better health check behavior matching Docker standards.