Summary

I read the release notes for Podman v6.1.3, and they're short but important: this is a security release that patches CVE-2026-94603 related to checkpoint images. What caught my attention is how the fix doesn't just patch the bug, but directly drops all checkpoint image support in podman run because its security model was considered impossible to fix safely.

The problem being fixed

Essentially, a checkpoint image is any container image that has the io.podman.annotations.checkpoint.runtime.name annotation. When an image like this is run via podman run, it turns out Podman could disable all sandboxing when the container is created — including security configuration that the user had explicitly set. This makes sense when you think about it from the checkpoint/restore mechanism's side: the restore process basically "revives" container state from a snapshot, and that process has its own security model that's different from a normally run container. The problem is, that restore process ignores the security configuration requested by the user, so according to the Podman team itself, checkpoints are very difficult to run safely through the regular podman run path.

Key feature and code example

Since this is a feature removal (not a new feature), what's relevant to me is its effect on the workflow. Previously, people could run a checkpoint image directly via podman run just like a regular image:

# Sebelum v6.1.3 — ini yang sekarang DIBLOKIR
podman run --annotation io.podman.annotations.checkpoint.runtime.name=runc checkpoint-image:latest

Starting with v6.1.3, this path is closed off. If you do need to restore a container from a checkpoint, the available path is still through Podman's dedicated checkpoint/restore commands, not podman run:

# Ilustrasi arah command yang tetap didukung (bukan dikutip dari release notes)
podman container checkpoint my-container --export=/tmp/checkpoint.tar
podman container restore --import=/tmp/checkpoint.tar

The release notes themselves don't explicitly detail a replacement command, so the two lines above are just my illustration of a path that still makes sense to use.

Impact and upgrade notes

This is a breaking change: if there's any automation or script that has relied on podman run to run a checkpoint image directly, it will fail after upgrading to v6.1.3. But since the root cause is a CVE that could disable all container sandboxing — including what the user had set — I see this as an upgrade that shouldn't be delayed, especially for environments that use Podman's checkpoint/restore feature at all.

---

First announced on Podman releases. Read the original source for full details.

Read also