Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

影響: go:github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8, go:go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3

Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the c…

Read on GitHub Advisory Database

On 10/16/2026, 05:22 AM, GitHub Advisory Database published "Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation" (type: Advisory). Severity is "Critical" (critical). Related technologies: Go, GitHub. CVE: CVE-2026-94603.