containerd bug bounty programs

containerd programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
CO containerd Sorona · Bug bounty	–	–	–	$100	$1,500	Partial	–	24 hours promised	Open

• CO

  containerd

  Sorona · Bug bounty

  Open

  Top reward

  $1,500

  Critical

  –

  High

  –

  Medium

  –

  Low

  $100

  Safe harbor

  Partial

  First response

  24 hours promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://containerd.io

  Web

• ctr and the other command line tools the project ships

  Products and areas

• Every snapshotter the project ships, including overlayfs, native, btrfs, devmapper and zfs, along with the mount setup each performs

  Products and areas

• Exec, attach and the streaming endpoints that carry a process's input and output

  Products and areas

• Image unpacking and the archive handling behind it, covering tar entries, symlinks, hard links, device nodes and whiteout files

  Products and areas

• The content store, the lease and garbage collection machinery, and the metadata database behind them

  Products and areas

• The CRI plugin, the interface Kubernetes drives containerd through, including sandbox and container lifecycle operations

  Products and areas

• The events subsystem, the NRI plugin interface and the plugin loading path

  Products and areas

• The gRPC API and the socket it listens on, including the permissions on that socket and what a local caller can do through it

  Products and areas

• The image pull path in full: manifest and index handling, layer download, digest verification and OCI media type dispatch

  Products and areas

• The isolation primitives containerd configures on a workload's behalf: namespaces, cgroups, capabilities, seccomp profiles, AppArmor and SELinux labels, and user namespace ID mapping

  Products and areas

• The published policy asks for a private GitHub Security Advisory on containerd/containerd and declares no boundary narrower than the containerd tree. Everything below sits inside that

  Products and areas

• The registry client and its authentication: credential handling, token exchange, registry mirrors and redirect following

  Products and areas

• The runtime shim and the v2 shim API, plus the OCI runtime specification containerd generates and hands to runc

  Products and areas

• The Windows path through hcsshim where containerd drives it

  Products and areas

No target matches. Try part of a host name, such as the company name.