Container-Optimized OS Release Notes: Milestone 93

Stay organized with collections Save and categorize content based on your preferences.

cos-93-16623-227-38

Date Kernel Docker Containerd GPU Drivers
Sep 26, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03(R470),v510.47.03

Fixed CVE-2022-2905 in the Linux kernel.

cos-93-16623-227-37

Date Kernel Docker Containerd GPU Drivers
Sep 19, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03(R470),v510.47.03

Updated cos-gpu-installer to v2.0.27. This resolves the issue where multiple installers can be started in the same VM.

Updated app-arch/gzip to v1.12. This resolves CVE-2022-1271.

Fixed CVE-2022-3028 and CVE-2022-39188 in the Linux kernel.

cos-93-16623-227-33

Date Kernel Docker Containerd GPU Drivers
Sep 12, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03(R470),v510.47.03

Upgraded the GPU driver version in the "latest" track to v510.47.03.

Updated cos-gpu-installer to v2.0.26. This resolves the compatibility issue with K80 GPU devices. When an incompatible driver version (R510+) is chosen in an instance with K80 GPU, the installer will automatically fall back to an available R470 driver version.

Fixed an issue causing zero verifier for FILE_SYNC and DATA_SYNC WRITEs.

Fixed a scenario of high contention state of the system in case filesystem is almost full and processes is trying to write content.

Fixed memory leak in the seccomp subsystem.

Updated gnutls to v3.7.7 fixing CVE-2022-2509.

Upgraded libtirpc to v1.3.3 fixing CVE-2021-46828.

Fixed CVE-2022-36946, CVE-2021-4037 in the Linux kernel.

cos-93-16623-227-24

Date Kernel Docker Containerd GPU Drivers
Sep 06, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03

Updated gnutls to v3.7.6. This resolves CVE-2021-4209.

Fixed CVE-2021-3669 in the Linux kernel.

cos-93-16623-227-22

Date Kernel Docker Containerd GPU Drivers
Aug 29, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03

Fixed issues in cos-gpu-installer where nvidia-peermem.ko was not installed and where driver signatures were included in the cached build tools.

Fixed CVE-2022-1158 in Linux Kernel.

cos-93-16623-227-19

Date Kernel Docker Containerd GPU Drivers
Aug 22, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03

Updated net-misc/rsync to v3.2.5 and fixed CVE-2022-29154.

Updated dev-db/sqlite to v3.39.2 to fix CVE-2022-35737.

cos-93-16623-227-16

Date Kernel Docker Containerd GPU Drivers
Aug 12, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03

Updated gvnic drivers to match M97.

Enable IOMMU_SUPPORT and IRQ_REMAP kernel configurations.

Runtime sysctl changes:

  • Changed: fs.file-max: 814064 -> 814062

cos-93-16623-227-13

Date Kernel Docker Containerd GPU Drivers
Aug 08, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.203.03(default),v470.141.03

Updated default Nvidia driver to v450.203.03 and latest Nvidia driver to v470.141.03.

Fixed CVE-2022-21505 in the Linux kernel.

cos-93-16623-227-10

Date Kernel Docker Containerd GPU Drivers
Aug 01, 2022 COS-5.10.133 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Updated toolbox to v20220722.

Updated the Linux kernel to v5.10.133. This includes mitigations for the Retbleed speculative execution vulnerability. This may have non-trivial performance impact on your workloads.

Runtime sysctl changes:

  • Changed: fs.file-max: 814065 -> 814063

cos-93-16623-227-7

Date Kernel Docker Containerd GPU Drivers
Jul 25, 2022 COS-5.10.127 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Upgraded openssl to v1.1.1q to resolve CVE-2022-2097.

cos-93-16623-227-6

Date Kernel Docker Containerd GPU Drivers
Jul 18, 2022 COS-5.10.127 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Moved the toolchain source from gs://chromiumos-sdk to gs://cos-sdk.

Updated net-misc/curl to v7.84.0. This resolves CVE-2022-32205, CVE-2022-32206, CVE-2022-32207, and CVE-2022-32208.

Fixed CVE-2022-33743 in the Linux kernel.

cos-93-16623-227-1

Date Kernel Docker Containerd GPU Drivers
Jul 11, 2022 COS-5.10.127 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Updated the built-in kubectl/kubelet to 1.21.14.

Updated cos-gpu-installer to fetch the COS toolchain from gs://cos-tools instead of gs://chromiumos-sdk.

Update runc to v1.1.2.

Added pci=clearmsi option for kdump stackdriver.

Updated the Linux kernel to v5.10.127.

Updated toolbox to v20220630.

Updated net-dns/c-ares to 1.17.2.

Upgraded contanerd to 1.5.11 and fixed CVE-2022-24769.

Updated app-editors/vim and app-editors/vim-core to v8.2.5066. This resolves CVE-2022-2126,CVE-2022-2125,CVE-2022-2124,CVE-2022-2129,CVE-2022-1720, CVE-2022-1942,CVE-2022-1886,CVE-2022-1851,CVE-2022-1160,CVE-2022-1154, CVE-2022-1381,CVE-2022-1420,CVE-2022-1733,CVE-2022-1796,CVE-2022-1769, CVE-2022-1735,CVE-2022-1674,CVE-2022-1771,CVE-2022-1620,CVE-2022-1785, CVE-2022-1629,CVE-2022-1616,CVE-2022-1621,CVE-2022-1619,CVE-2022-1927, CVE-2022-1898, CVE-2022-0696,CVE-2022-0729,CVE-2022-0572,CVE-2022-0685, CVE-2022-0714,CVE-2022-0629 and CVE-2022-0943.

Updated net-misc/curl to 7.83.1. This resolves CVE-2022-22576, CVE-2022-27774, CVE-2022-27775, CVE-2022-27776, CVE-2022-27778, CVE-2022-27779, CVE-2022-27780, CVE-2022-27781, CVE-2022-27782, CVE-2022-30115.

Upgraded dev-libs/libxml2 to 2.9.13-r1. This resolves CVE-2022-23308.

Fixed CVE-2022-28893, CVE-2022-0494 in the Linux kernel.

Runtime sysctl changes:

  • Changed: fs.file-max: 814062 -> 814063
  • Changed: kernel.random.poolsize: 4096 -> 256
  • Changed: kernel.random.write_wakeup_threshold: 896 -> 256

cos-93-16623-171-33

Date Kernel Docker Containerd GPU Drivers
Jul 06, 2022 COS-5.10.109 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Fixed CVE-2022-29217 in dev-python/pyjwt.

Upgraded openssl to v1.1.1p to resolve CVE-2022-2068.

cos-93-16623-171-31

Date Kernel Docker Containerd GPU Drivers
Jun 21, 2022 COS-5.10.109 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Fixed CVE-2022-29162 in runc.

cos-93-16623-171-26

Date Kernel Docker Containerd GPU Drivers
Jun 13, 2022 COS-5.10.109 v20.10.6 v1.5.13 v450.172.01(default),v470.82.01

Fixed a Linux kernel write IOPS regression with nfsd.

Updated containerd to v1.5.13. This resolves CVE-2022-31030.

cos-93-16623-171-24

Date Kernel Docker Containerd GPU Drivers
Jun 03, 2022 COS-5.10.109 v20.10.6 v1.5.11 v450.172.01(default),v470.82.01

Fixed the toolbox creation issue when service account is not available.

Fixed CVE-2022-30594 and CVE-2022-1516 in the Linux Kernel.

Fixed a bug in KTD LSM xattr handling.

cos-93-16623-171-20

Date Kernel Docker Containerd GPU Drivers
May 25, 2022 COS-5.10.109 v20.10.6 v1.5.11 v450.172.01(default),v470.82.01

Fixed CVE-2022-1729 in the Linux Kernel.

cos-93-16623-171-19

Date Kernel Docker Containerd GPU Drivers
May 23, 2022 COS-5.10.109 v20.10.6 v1.5.11 v450.172.01(default),v470.82.01

Fixed an issue that prevented large cloud-configs (~256KB) from working properly.

Upgraded openssl to v1.1.1o. This resolves CVE-2022-1292.

Upgraded dev-libs/libxml2 to v2.9.14. This resolves CVE-2022-29824.

Upgraded dev-libs/libxslt to v1.1.35. This resolves CVE-2022-29824.

Updated sys-libs/ncurses to v6.3_p20220423. This resolves CVE-2022-29458.

Fixed CVE-2022-1786, CVE-2022-28893 and CVE-2022-0494 in the Linux kernel.

cos-93-16623-171-10

Date Kernel Docker Containerd GPU Drivers
Apr 25, 2022 COS-5.10.109 v20.10.6 v1.5.11 v450.172.01(default),v470.82.01

Made /var/lib/chrony owned by chrony user.

Fixed CVE-2022-29581 and CVE-2022-29582 in the Linux kernel.

cos-93-16623-171-6

Date Kernel Docker Containerd GPU Drivers
Apr 18, 2022 COS-5.10.109 v20.10.6 v1.5.11 v450.172.01(default),v470.82.01

Upgraded containerd to 1.5.11. This fixes CVE-2022-24769.

Upgraded dev-libs/libxml2 to 2.9.13-r1. This fixes CVE-2022-23308.

Updated app-editors/vim and app-editors/vim-core to v8.2.4586. This fixes CVE-2022-0696,CVE-2022-0729,CVE-2022-0572,CVE-2022-0685, CVE-2022-0714,CVE-2022-0629 and CVE-2022-0943.

cos-93-16623-171-1

Date Kernel Docker Containerd GPU Drivers
Apr 07, 2022 COS-5.10.109 v20.10.6 v1.5.10 v450.172.01(default),v470.82.01

Updated default GPU driver version to v450.172.01.

Upgraded app-admin/google-guest-agent to v20220104.00.

Updated oslogin to v20220113.00.

Updated containerd to v1.5.10.

Updated the built-in kubectl/kubelet to v1.21.9.

Updated the Linux kernel to v5.10.109.

Added option to GPU driver installation script for populating and resetting toolchain cache.

Added command "cos-extensions list -- --gpu-installer" to show the default cos-gpu-installer.

Added support for NFSv4 Kerberos authentication.

Fixed the issue where IPv4 times out by waiting for IPv4 address indefinitely.

Increased the number of vCPUs supported from 256 to 512.

Updated CIS compliance scripts to fix the "ambiguous redirect" error in the 5440-configure-default-user-umask.sh script.

Enabled IBLOCK and FILEIO iSCSI backing stores kernel configuration.

Fixed the bug that created excessive warning logs on missing attrs.tag from container logs.

Upgraded cos-gpu-installer-v2 to v2.0.17 in cos-extensions. Refined error message for installing latest driver. Preinstalled dependencies are now detected separately.

Upgraded net-misc/dhcp to v4.4.2. This fixes CVE-2021-25217.

Runtime sysctl changes:

  • Added: dev.cdrom.autoclose: 1
  • Added: dev.cdrom.autoeject: 0
  • Added: dev.cdrom.check_media: 0
  • Added: dev.cdrom.debug: 0
  • Added: dev.cdrom.info:
  • Added: dev.cdrom.lock: 1

cos-93-16623-102-34

Date Kernel Docker Containerd GPU Drivers
Mar 25, 2022 COS-5.10.90 v20.10.6 v1.5.4 v450.119.04(default),v470.82.01

Fixed CVE-2022-27666, CVE-2022-1055 and CVE-2020-36516 in the Linux Kernel.

Upgraded openssl package to v1.1.1n to fix CVE-2022-0778.

cos-93-16623-102-28

Date Kernel Docker Containerd GPU Drivers
Mar 21, 2022 COS-5.10.90 v20.10.6 v1.5.4 v450.119.04(default),v470.82.01

Fixed CVE-2021-22570 in libprotobuf.

cos-93-16623-102-27

Date Kernel Docker Containerd Default GPU Driver
Mar 15, 2022 COS-5.10.90 v20.10.6 v1.5.4 v450.119.04

Fixed an issue in systemd to consider primary network interface configured only after non-link-local IPv4 address is available.

cos-93-16623-102-23

Date Kernel Docker Containerd Default GPU Driver
Mar 07, 2022 COS-5.10.90 v20.10.6 v1.5.4 v450.119.04

Enabled disk_setup module in cloud-init.

Fixed CVE-2022-0847 in the Linux kernel.

Fixed CVE-2022-23648 in containerd.

cos-93-16623-102-19

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Feb 28, 2022 COS-5.10.90 v1.21.8 v20.10.6 v1.5.4 v450.119.04

Fixed CVE-2021-45346 in dev-db/sqlite.

Fixed segmentation fault in ebtables.

Fixed get_status API in device policy manager.

Renamed cos-alphabet-compliance package to cis-compliance.

cos-93-16623-102-12

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Feb 14, 2022 COS-5.10.90 v1.21.8 v20.10.6 v1.5.4 v450.119.04

Fixed issue related to shim exiting during system shutdown.

Fixed an issue in containerd where pods returned "failed to reserve container name".

Updated app-editors/vim and app-editors/vim-core to v8.2.4328. This resolves CVE-2021-4187, CVE-2022-0128, CVE-2022-0156, CVE-2022-0158, CVE-2022-0261, CVE-2022-0318, CVE-2022-0319, CVE-2022-0392, CVE-2022-0368, CVE-2022-0393, CVE-2022-0361, CVE-2022-0359, CVE-2022-0413, CVE-2022-0408, CVE-2022-0407, and CVE-2022-0443.

Fixed CVE-2022-0492 in the Linux kernel.

cos-93-16623-102-8

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Feb 07, 2022 COS-5.10.90 v1.21.8 v20.10.6 v1.5.4 v450.119.04

Upgraded latest GPU driver version to v470.82.01.

Fixed an issue in containerd where layer hashes were sometimes computed incorrectly for large self-hosted containers.

Runtime sysctl changes:

  • Changed: net.ipv4.tcp_mem: 94245 125663 188490 -> 94248 125664 188496
  • Changed: net.ipv4.udp_mem: 188493 251327 376986 -> 188496 251328 376992

cos-93-16623-102-5

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Jan 31, 2022 COS-5.10.90 v1.21.8 v20.10.6 v1.5.4 v450.119.04

Backported fixes for CVE-2021-43816 in containerd.

cos-93-16623-102-4

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Jan 20, 2022 COS-5.10.90 v1.21.8 v20.10.6 v1.5.4 v450.119.04

Fixed an issue where IPv6 address allocation sometimes fails in systemd.

Fixed a privilege escalation vulnerability in fs_context in the Linux kernel. This resolves CVE-2022-0185.

Runtime sysctl changes:

  • Changed: net.ipv6.conf.all.forwarding: 1 -> 0
  • Changed: net.ipv6.conf.default.forwarding: 1 -> 0
  • Changed: net.ipv6.conf.docker0.forwarding: 1 -> 0
  • Changed: net.ipv6.conf.eth0.forwarding: 1 -> 0
  • Changed: net.ipv6.conf.lo.forwarding: 1 -> 0

cos-93-16623-102-1

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Jan 18, 2022 COS-5.10.90 v1.21.8 v20.10.6 v1.5.4 v450.119.04

Updated the built-in kubernetes version to v1.21.8.

Updated the Linux kernel to v5.10.90.

Enabled cos-extensions to fetch artifacts with geo-redundancy when installing GPU driver.

Added crictl commands to sosreport.

Created kernel config file under /boot directory.

Added support for consistent device naming for NVMe disks.

Fixed kernel crash dump collection.

Fixed resolv.conf in toolbox.

Update vim and vim-core to v8.2.3950. This resolves the following CVEs: CVE-2021-4193, CVE-2021-4192, CVE-2021-4173, CVE-2021-4166, CVE-2021-4136.

Upgraded dev-libs/libgcrypt to v1.9.4. This resolves CVE-2021-40528.

Runtime sysctl changes:

  • Changed: fs.epoll.max_user_watches: 1667911 -> 1667850
  • Changed: fs.file-max: 814099 -> 814074
  • Changed: kernel.threads-max: 63625 -> 63623
  • Changed: net.ipv4.tcp_mem: 94251 125668 188502 -> 94245 125663 188490
  • Changed: net.ipv4.udp_mem: 188502 251336 377004 -> 188493 251327 376986
  • Changed: user.max_cgroup_namespaces: 31812 -> 31811
  • Changed: user.max_ipc_namespaces: 31812 -> 31811
  • Changed: user.max_mnt_namespaces: 31812 -> 31811
  • Changed: user.max_net_namespaces: 31812 -> 31811
  • Changed: user.max_pid_namespaces: 31812 -> 31811
  • Changed: user.max_time_namespaces: 31812 -> 31811
  • Changed: user.max_user_namespaces: 31812 -> 31811
  • Changed: user.max_uts_namespaces: 31812 -> 31811

cos-93-16623-39-40

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Jan 11, 2022 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Upgraded dev-libs/nspr to v3.42. This resolves CVE-2021-43527.

Upgraded dev-libs/nss to v3.73. This resolves CVE-2021-43527.

Upgraded app-crypt/nss to v3.73. This resolves CVE-2021-43527.

Upgraded app-emulation/runc to v1.0.3. This resolves CVE-2021-43784.

Updated vim and vim-core to v8.2.3741. This resolves CVE-2021-3973, CVE-2021-3968, CVE-2021-4069, CVE-2021-4019, CVE-2021-3984 and CVE-2021-3974.

Fixed a double-free issue in packet_set_ring in the Linux kernel.

Fixed CVE-2021-4155 in the Linux kernel.

Fixed access to private toolbox images hosted on GCR.

cos-93-16623-39-30

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Dec 07, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Fixed the bug that resolv.conf can be broken by toolbox.

Fixed CVE-2021-4002 in the Linux Kernel.

cos-93-16623-39-28

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Dec 01, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Fixed CVE-2021-41190 in app-emulation/docker.

Fixed CVE-2021-41190 in app-emulation/containerd.

Fixed CVE-2021-41617 in openssh.

Fixed CVE-2021-43618 in gmp.

Fixed CVE-2020-14387 in rsync.

cos-93-16623-39-21

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Nov 15, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Fixed UUID parsing in kernel crash dump collection.

Updated vim and vim-core to v8.2.3582. This fixes CVE-2021-3872, CVE-2021-3875, CVE-2021-3903, CVE-2021-3927 and CVE-2021-3928.

Updated dev-libs/nettle to v3.7.3. This fixes CVE-2021-3580.

cos-93-16623-39-16

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Nov 08, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Upgraded app-arch/libarchive to v3.5.2. This fixes CVE-2021-36976.

cos-93-16623-39-13

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Nov 03, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Fixed plugin timeout for checking boot disk size inconsistencies.

Backported fixes for CVE-2021-41103 in containerd.

Upgraded openssl to 1.1.1l. This fixes CVE-2021-3711.

Fixed CVE-2021-22945 in net-misc/curl.

Fixed CVE-2021-39537 in ncurses package.

Updated vim to v8.2.3428. This resolves CVE-2021-3796, CVE-2021-3778, and CVE-2021-3770.

Fixes CVE-2021-41864 in the Linux kernel.

cos-93-16623-39-6

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Oct 18, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

This is a Stable release.

cos-beta-93-16623-39-6

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Oct 07, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Installed the kernel configuration in the /boot directory.

Fixed an issue where GPU drivers wouldn't load due to being incorrectly linked.

Fixed an issue where docker stats returned zeroes for some containers.

cos-beta-93-16623-39-1

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Sep 29, 2021 COS-5.10.68 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Updated the Linux kernel to v5.10.68.

Fixed CVE-2020-12403 in dev-libs/nss.

Fixed CVE-2019-17594 and CVE-2019-17595 in sys-libs/ncurses.

cos-beta-93-16623-0-23

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Sep 27, 2021 COS-5.10.57 v1.21.3 v20.10.6 v1.5.4 v450.119.04

Updated app-emulation/containerd to v1.5.4. This resolves CVE-2021-32760.

Updated glib, glib-utils and gdbus-codegen to v2.68.3. This resolves CVE-2021-28153.

cos-beta-93-16623-0-15

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Sep 07, 2021 COS-5.10.57 v1.21.3 v20.10.6 v1.5.3 v450.119.04

Upgraded net-misc/curl to v7.78.0. This resolves CVE-2021-22924 and CVE-2021-22926.

cos-beta-93-16623-0-13

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Sep 02, 2021 COS-5.10.57 v1.21.3 v20.10.6 v1.5.3 v450.119.04

Fixed an issue where some NFS clients ran out of memory and crashed.

Runtime sysctl changes:

  • Changed: fs.file-max: 9223372036854775807 -> 814100
  • Changed: fs.nr_open: 1073741816 -> 1048576
  • Changed: net.ipv4.tcp_fastopen_key: 763328f0-eed1e25b-33ba5cd4-36e8e00d -> 11665687-fa208935-2719c70f-e7f2feb2

cos-beta-93-16623-0-5 (vs Milestone 89)

Date Kernel Kubernetes Docker Containerd Default GPU Driver
Aug 23, 2021 COS-5.10.57 v1.21.3 v20.10.6 v1.5.3 v450.119.04

Upgraded systemd to v248.6.

Upgraded sys-apps/cloud-disk-resize to commit edbe236.

Updated oslogin to v20210707.00.

Updated google-guest-agent to v20210707.00.

Upgraded the Linux kernel to v5.10.57.

Updated the built-in kubectl/kubelet to v1.21.3.

Upgraded containerd to v1.5.3.

Updated sosreport to v4.1.

Updated chronyd to v4.1.

Updated docker-credential-gcr to v2.0.5.

Updated docker-cli to v20.10.6.

Updated ChromeOS base to ChromeOS version v14056.0.0.

Upgraded Linux Audit (sys-process/audit) to v3.0.2.

Upgraded xfsprogs to version v5.10.

Upgraded dev-util/gdbus-codegen to version v2.66.7 on x86.

Updated the stackdriver logging agent to v1.8.9.

Updated app-emulation/docker-proxy to v0.8.0_p20210525.

Updated app-emulation/docker-credential-helpers to v0.6.4.

Upgraded cloud-init to v21.2.

Updated docker to v20.10.6.

Updated makedumpfile package to v1.6.9.

Upgraded sys-auth/pambase to version v20201103.

Upgraded sys-libs/pam to version v1.5.1.

Upgraded sys-auth/passwdqc to version v1.4.0.

Updated chronyd to run as the chrony user instead of the root user.

Runtime sysctl changes:

  • Added: kernel.hung_task_all_cpu_backtrace: 0
  • Added: kernel.oops_all_cpu_backtrace: 0
  • Added: kernel.sched_deadline_period_max_us: 4194304
  • Added: kernel.sched_deadline_period_min_us: 100
  • Added: net.ipv4.ip_autobind_reuse: 0
  • Added: net.ipv4.nexthop_compat_mode: 1
  • Added: net.ipv4.tcp_comp_sack_slack_ns: 100000
  • Added: net.ipv4.tcp_no_ssthresh_metrics_save: 1
  • Added: net.ipv4.tcp_reflect_tos: 0
  • Added: net.ipv6.conf.all.rpl_seg_enabled: 0
  • Added: net.ipv6.conf.default.rpl_seg_enabled: 0
  • Added: net.ipv6.conf.docker0.rpl_seg_enabled: 0
  • Added: net.ipv6.conf.eth0.rpl_seg_enabled: 0
  • Added: net.ipv6.conf.lo.rpl_seg_enabled: 0
  • Added: user.max_time_namespaces: 31820
  • Added: vm.compaction_proactiveness: 20
  • Added: vm.page_lock_unfairness: 5
  • Changed: fs.epoll.max_user_watches: 1668751 -> 1668321
  • Changed: fs.file-max: 814576 -> 9223372036854775807
  • Changed: fs.nr_open: 1048576 -> 1073741816
  • Changed: fs.epoll.max_user_watches: 1668321 -> 1667911
  • Changed: kernel.printk_devkmsg: ratelimit -> on
  • Changed: kernel.threads-max: 63658 -> 63625
  • Changed: kernel.cap_last_cap: 37 -> 40
  • Changed: kernel.usermodehelper.bset: 4294967295 63 -> 4294967295 511
  • Changed: kernel.usermodehelper.inheritable: 4294967295 63 -> 4294967295 511
  • Changed: net.ipv4.tcp_fastopen_blackhole_timeout_sec: 3600 -> 0
  • Changed: net.ipv4.tcp_fastopen_key: 00000000-00000000-00000000-00000000 -> 763328f0-eed1e25b-33ba5cd4-36e8e00d
  • Changed: net.ipv4.tcp_mem: 94299 125733 188598 -> 94251 125668 188502
  • Changed: net.ipv4.udp_mem: 188598 251466 377196 -> 188502 251336 377004
  • Changed: net.ipv6.conf.all.forwarding: 0 -> 1
  • Changed: net.ipv6.conf.default.forwarding: 0 -> 1
  • Changed: net.ipv6.conf.docker0.forwarding: 0 -> 1
  • Changed: net.ipv6.conf.eth0.forwarding: 0 -> 1
  • Changed: net.ipv6.conf.lo.forwarding: 0 -> 1
  • Changed: net.core.bpf_jit_kallsyms: 0 -> 1
  • Changed: user.max_cgroup_namespaces: 31829 -> 31812
  • Changed: user.max_ipc_namespaces: 31829 -> 31812
  • Changed: user.max_mnt_namespaces: 31829 -> 31812
  • Changed: user.max_net_namespaces: 31829 -> 31812
  • Changed: user.max_pid_namespaces: 31829 -> 31812
  • Changed: user.max_time_namespaces: 31820 -> 31812
  • Changed: user.max_user_namespaces: 31829 -> 31812
  • Changed: user.max_uts_namespaces: 31829 -> 31812
  • Deleted: kernel.random.read_wakeup_threshold: 64

Removed toolbox's dependency on docker command.

Added sys-block/open-iscsi package.

Renamed 99-virtio.network to 99-default.network to include gve driver support.

Enabled IPV6 configuration by default. This does not disable IPV4 configuration. In addition, fixed an issue where enabling both IPv6 and IPv4 configuration on IPv4-exclusive networks resulted in slow boot times.

Upgraded cos-gpu-installer-v2 to v2.0.9 in cos-extensions. Users can now specify --version=latest when installing GPU drivers.

Added support for ext4 journal checkpointing in the Linux kernel.

Enabled ip6table_nat as module.

Enabled CONFIG_TLS and CONFIG_TLS_DEVICE in the kernel to support kTLS.

Enabled CONFIG_MEMORY_FAILURE and CONFIG_X86_MCE in the Linux kernel.

Enabled CONFIG_IP6_NF_MANGLE to allow ip6table_mangle kernel module.

Enabled CONFIG_TLS in the kernel to support OpenSSL3.0.

Added support for multiple architectures in toolbox.

Fixed 32 x truesize under-estimation for tiny skbs in the Linux kernel.

Fixed an issue in google-guest-agent where the GID of a user's home directory referred to a different user after a reboot.

Fixed a kernel crash due to fast commit changes.

Configured google-guest-agent to use usermod instead of gpasswd to add users to groups. This fixes an issue where users created through cloud-init sometimes were not added to the appropriate groups.

Upgraded openssl package to v1.1.1k to resolve CVEs CVE-2021-3449 and CVE-2021-3450.

Upgraded net-misc/wget to v1.21.1. This also resolves CVE-2021-31879.

Upgraded libgcrypt to v1.9.3. This fixes CVE-2021-33560.

Upgraded OpenSSH to v8.5_p1. This resolved CVE-2021-28041.

Upgraded libgcrypt to v1.9.1. This addresses CVE-2021-3345.

Upgraded dev-python/jinja to v2.11.3. This addresses CVE-2020-28493.