containers
Podman v6.1.3 removed a feature that let a container image override your sandbox settings
CVE-2026-94603 (CVSS 10.0) let any image bearing a checkpoint annotation instruct `podman run` to disable almost all sandboxing, including the flags you explicitly set. The fix in v6.1.3 is a breaking change, not a quiet patch.