• CRI-O v1.33.13
  • Downloads
  • Changelog since v1.33.12
    • Changes by Kind
      • Bug or Regression
      • Uncategorized
  • Dependencies
    • Added
    • Changed
    • Removed

CRI-O v1.33.13

The release notes have been generated for the commit range v1.33.12…d6a41c4 on Mon, 14 Sep 2026 12:25:50 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

• cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz
  • cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.sha256sum
  • cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.bundle
  • cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx
  • cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx.bundle
• cri-o.arm64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz
  • cri-o.arm64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.sha256sum
  • cri-o.arm64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.bundle
  • cri-o.arm64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx
  • cri-o.arm64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx.bundle
• cri-o.ppc64le.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz
  • cri-o.ppc64le.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.sha256sum
  • cri-o.ppc64le.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.bundle
  • cri-o.ppc64le.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx
  • cri-o.ppc64le.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx.bundle
• cri-o.s390x.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz
  • cri-o.s390x.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.sha256sum
  • cri-o.s390x.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.bundle
  • cri-o.s390x.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx
  • cri-o.s390x.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx.bundle

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz \
    --certificate-identity https://github.com/cri-o/packaging/.github/workflows/obs.yml@refs/heads/main \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/packaging \
    --certificate-github-workflow-ref refs/heads/main \
    --bundle cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.bundle

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz
> bom validate -e cri-o.amd64.d6a41c4e4b1f50d670c83c3f1d813bbcc0134121.tar.gz.spdx -d cri-o

Changelog since v1.33.12

Changes by Kind

Bug or Regression

• Fix a panic caused by concurrent StopContainer calls racing to send on an already-closed channel. (#9926, @sabujmaity)
• User namespace UID/GID mappings are now correctly restored after CRI-O restart, fixing “permission denied” errors for containers using user namespaces with ID-mapped mounts. (#10232, @Chandan9112)

Uncategorized

• Fixed a bug where ImageRef in container status changed from a repo@digest to a raw image ID hash after CRI-O restart. (#9987, @saschagrunert)
• Fixed the race condition where cri-o reports exitCode 255 when the container exits fast. (#9932, @openshift-cherrypick-robot)
• Update gomaxprocs hook to ignore workload partitioning when considering whether to inject, as well as update the calculation to ensure containers get at least double the requested number of CPUs, to reduce potential go scheduler throttling. (#10065, @openshift-cherrypick-robot)

Dependencies

Added

Nothing has changed.

Changed

• github.com/go-jose/go-jose/v4: v4.0.5 → v4.1.4

Removed

Nothing has changed.