Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation

影響: go:github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8, go:go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3

Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the c…

在 GitHub Advisory Database 阅读

2026/10/16 05:22，GitHub Advisory Database 发布了“Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation”（类型：漏洞公告）。严重程度为“严重”（critical）。相关技术：Go、GitHub。CVE：CVE-2026-94603。