live wire
▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat▸PLATFORM · Clang 23 bytecode interpreter cuts allocations and expands constant-expression supportRed Hat Developer▸PLATFORM · RHEL becomes first-party on OCI; OpenShift subscriptions reach Oracle MarketplaceRed Hat▸AI · vLLM-Omni merges native MOSS-Image serving with parallelism and offloadvLLM▸AI · vLLM adds System One endpoint for Decision 3.0 multimodal routing models (Oct. 15)vLLM▸SECURITY · Red Hat rates OpenShift AI 3.4.5 update Critical; advisory lists hundreds of CVEsRed Hat Product Security▸SECURITY · Red Hat’s first Security Signals report shifts focus from CVE counts to risk paths (Oct. 15)Red Hat▸PLATFORM · IBM adds non-destructive FlexVolume-to-CSI migration tool for OpenShift object storageIBM Cloud▸vLLM tests agent-built Kimi K3 decode path at up to 1.9× speedup; PR remains openvLLM▸AI · LeaderWorkerSet 1.0 changes rollout defaults for disaggregated AI workloadsKubernetes SIGs▸SECURITY · Red Hat flags active exploitation of kernel flaw affecting OpenShift CoreOS; no fix listedRed Hat Product Security▸AI · Red Hat sets Dec. 9 showcase for AI 3.6 agent governance and model servicesRed Hat▸vLLM 0.32.0 drops Python 3.10, restricts CORS defaults and adds security fixesvLLM▸SECURITY · Red Hat tracks Moderate Hono auth bypass across OpenShift AI, Dev Spaces and AnsibleRed Hat Product Security▸SECURITY · Red Hat Hardened Images fixes Moderate libpng denial-of-service flawRed Hat
upstreambeat.ai
releaseSECURITY

Podman 6.1.3 closes a sandbox bypass by removing checkpoint images from podman run

The security fix is deliberately breaking: checkpoint images can no longer override user-requested container isolation through the normal run path.

Podman 6.1.3 blocks checkpoint images from overriding sandbox settings.
Side by side: what changed
By The Release Desk· Sep 29, 2026the quick take — two AI hosts go live when you do

Podman 6.1.3 removes support for running container checkpoint images through podman run, closing CVE-2026-94603. The project describes the change as both a security fix and a breaking change because the affected checkpoint path could silently replace sandbox settings supplied by the user.

What changed

Podman added OCI distribution of container checkpoints in version 4.4.0, allowing a checkpoint to be pulled from a registry and launched with podman run. Podman identifies those artifacts through the io.podman.annotations.checkpoint.runtime.name image annotation.

The project's security advisory says that once this annotation was present, checkpoint configuration controlled how the container was created. User-provided restrictions could be ignored: the advisory gives podman run --cap-drop=ALL as an example where the checkpoint could instead restore a different capability set. The maintainers concluded that treating checkpoints like ordinary runnable images was inherently unsafe and reverted the feature.

Who it affects

Teams that pull images from registries and depend on command-line sandbox controls should treat the update as security-relevant. The risk is concentrated in images carrying the checkpoint-runtime annotation, but the normal podman run interface did not distinguish that security model clearly enough for callers to rely on their requested restrictions.

The release also affects legitimate workflows that distributed checkpoints as OCI images and launched them with podman run. Podman 6.1.3 intentionally removes that behavior rather than trying to preserve compatibility.

What to do

Users on the 6.1 line should update to 6.1.3 and test any checkpoint-transfer workflow against the removal. Where an immediate update is not possible, the advisory's workaround is to scan pulled images for io.podman.annotations.checkpoint.runtime.name and reject images carrying it. The advisory also warns that Podman cannot currently perform that scan and rejection automatically, so the check must sit elsewhere in the image-admission or pull process.

sources

Filed by The Release Desk. Corrections: desk@upstreambeat.ai · Our standards →

comments · 0

    Comments are moderated before they appear. Your email is used once to confirm it is you — never shown, never sold. Corrections and questions get an answer from the desk when we have one.

    more from the desk