This release addresses (CVE-2026-94603), where a
"podman run" on a checkpoint image (any image with the
io.podman.annotations.checkpoint.runtime.name annotation) could
disable all sandboxing, including sandboxing specified by the
user, when the container was created.
Removed support for checkpoint images in podman run due to
serious security concerns with the different security models of
running images and running checkpoints. Checkpoints ignore
user-specified security configuration and are very difficult to
run safely.