Release Notes: Milestone 81

Current Status

Image Family cos-81-lts
Deprecated After Jun 24, 2021
Kernel COS-4.19.188
Kubernetes v1.17.17
Docker v19.03.15
Containerd v1.3.9



Date: Jun 08, 2021
  • Updated runc to v1.0.0_rc95. This resolves CVE-2021-30465.


Date: Jun 07, 2021
  • Fixed CVE-2019-25044 in the Linux kernel.


Date: Jun 01, 2021
  • Updated docker to v19.03.15. This fixed CVE-2021-21285.


Date: Apr 27, 2021
  • LTS Refresh Release.
  • Fixed an authentication error when using go-dbus to connect systemd.
  • Addressed CVE-2020-12049 in dbus.
  • Updated the Linux kernel to v4.19.188.
  • Fixed CVE-2021-23840 and CVE-2021-23841 in openssl.
  • Updated the built-in kubectl/kubelet to 1.17.17.
  • Updated glib to v2.66.7. This resolved CVE-2021-27218 and CVE-2021-27219.
  • Updated curl to v7.74.0. This resolved CVE-2020-8177, CVE-2020-8169,
  • CVE-2020-8285, CVE-2020-8284 and CVE-2020-8286.
  • Upgraded tar to 1.34.
  • Upgraded libgcrypt to v1.9.1. This addresses CVE-2021-3345.


Date: Apr 22, 2021
  • Fixed an out-of-bounds write issue in the Linux kernel.


Date: Apr 05, 2021
  • Updated sqlite to version 3.33.0. This resolves the following CVEs:
    • CVE-2020-13630
    • CVE-2020-9327
    • CVE-2020-13871
    • CVE-2020-11656
    • CVE-2020-11655
    • CVE-2020-15358
    • CVE-2020-13631
    • CVE-2020-13632
    • CVE-2020-13434
    • CVE-2020-9327
    • CVE-2020-13435


Date: Mar 01, 2021
  • Upgraded libgcrypt to v1.9.1. This addresses CVE-2021-3345.


Date: Feb 22, 2021
  • Fixed an issue where firewall initialization would fail because ip6tables was not waiting to claim the xtables lock.


Date: Feb 08, 2021
  • Fixed 32x truesize under-estimation for tiny skbs in the Linux kernel.


Date: Feb 01, 2021
  • Upgraded app-admin/sudo to version 1.9.5_p2. This resolves CVE-2021-3156.


Date: Jan 25, 2021
  • LTS Refresh Release.
  • Updated Docker to v19.03.14.
  • Updated the Linux kernel to upstream/v4.19.167.
  • Updated containerd to v1.3.9.
  • Updated the built-in kubectl/kubelet to v1.17.15.


Date: Jan 11, 2021
  • Created /var/lib/chrony for chrony to work accurately.
  • Fixed CVE-2020-29660 in the Linux kernel.
  • Fixed CVE-2020-29661 in the Linux kernel.


Date: Dec 02, 2020
  • Fixed CVE-2020-15257 in containerd.


Date: Oct 26, 2020
  • Updated the Linux kernel to v4.19.150.


Date: Oct 19, 2020
  • Fixed CVE-2020-14356.


Date: Oct 12, 2020
  • Added PPP loadable modules back, which were removed in cos-81-12871-1185-0.
  • Moved Docker's "registry-mirrors" configuration to the dockerd command line to address Kubernetes cluster provisioning errors.


Date: Oct 08, 2020
  • Fixed an issue in containerd that can cause the Kubelet on master VMs to fail to restart containers in static pods.
  • Moved the configuration of Docker's "registry-mirrors" option from the dockerd command line to /etc/docker/daemon.json. This should allow users to configure a custom registry mirror, which can be useful when responding to recent Docker Hub free tier changes.


Date: Sep 05, 2020
  • Fixed Linux kernel vulnerability CVE-2020-14386 by fixing an integer overflow issue in tpacket_rcv.


Date: Aug 20, 2020
  • Reverted the change that enforcing kernel modules must be signed.
  • Removed cos-extensions utility. Users should use [cos-gpu-installer]( to install GPU drivers on COS milestone 81.
  • Enabled utmp in systemd to allow creation of utmp files.
  • Upgraded default GPU driver version to 450.51.06.


Date: Aug 07, 2020
  • Fixed CVE-2020-14308, CVE-2020-14311 and CVE-2020-15705 in grub.
  • Disabled CONFIG_PPP to mitigate Linux Kernel CVE-2020-14416.
  • Added the cos-extensions-manager package. Click here to learn more about cos-extensions.
  • Updated docker-credential-gcr to v2.0.2.


Date: July 30, 2020
  • Removed the metrics daemon to address an issue where it would periodically cause CPU usage spikes in some cases.
  • Changed kernel command line to enforce kernel module must be signed.


Date: July 24, 2020
  • Updated node problem detector to 0.8.1


Date: July 13, 2020
  • Added rsync back into the image, which was removed in cos-dev-77-12293-0-0.
  • Mount /var/lib/containerd with exec option.
  • Fixed CVE-2019-9169.
  • Enabled support for Confidential VMs.


Date: June 17, 2020
  • Made dioread_nolock non-default.


Date: June 16, 2020
  • Updated toolbox base container image to include security patches.


Date: June 16, 2020
  • Updated the built-in kubectl/kubelet to v1.17.6 to fix a bug that could result in the inability to start a cluster.


Date: May 28, 2020
  • Fixed a few OS Login CVEs: CVE-2020-8903, CVE-2020-8907, CVE-2020-8933.


Date: May 27, 2020
  • Upgraded sys-libs/libseccomp to version 2.4.2-r1 to fix CVE-2019-9893.


Date: May 07, 2020
  • Added package sys-apps/acl.


Date: Apr 29, 2020
  • Fixed a kernel bug where eBPF programs can cause softlockups.


Date: Apr 29, 2020
  • Disabled `accept_ra` on all interfaces by default.


Date: Apr 05, 2020
  • Upgraded the Linux kernel to v4.19.112.
  • Backported systemd patch ba0d56f55 to address an issue that resulted in leaked mount units.
  • Upgraded dev-db/sqlite to 3.31.1.
  • Moved kernel repository to
  • Backported necessary ext4 patches and made dioread_nolock default.

cos-81-12871-59-0 (vs Milestone 77)

Date: Mar 27, 2020

New features

  • Added support for new Google Compute Engine virtual network interface (GVNIC).
  • Added support for AMD's Secure Encrypted Virtualization.
  • Added support to implement SCSI devices in user space.
  • Added support for snapshotting any block device without massive copying.
  • Enhanced security by reducing the predictability of the kernel slab allocator against heap overflows and providing a lightweight support for detecting buffer overflow.
  • Added chrony package for time synchronization.
  • Disabled multicast protocol LLMNR and MDNS by default.

Package updates

  • Upgraded docker to v19.03.6.
  • Upgraded containerd to v1.3.2.
  • Upgraded runc to v1.0.0.
  • Upgraded docker-credential-gcr to v2.0.0.
  • Upgraded the built-in kubectl/kubelet to v1.17.3.
  • Upgraded node-problem-detector to v0.8.0.
  • Upgraded cos-toolbox to 20191218-00.
  • Upgraded openssl to 1.0.2u.
  • Upgraded oslogin to v20190315.
  • Upgraded compute-image-packages to v20190801.

Bug fixes

  • Changed the MTU of the default docker network to 1460 to make it consistent with Google Compute Engine's default MTU value.
  • Fixed a regression that blocks user-level statically defined tracking probes (requires a semaphore) to work.
  • Fixed vulnerability in glibc (CVE-2019-19126).