Concourse upgraded to v8.0.1

We have upgraded Concourse to v8.0.1, which includes all changes from the v8.0.0 major release. This is a significant upgrade that brings new features, improved defaults, and a few breaking changes that pipeline authors should be aware of.

The full upstream changelog is available here: v8 - New Year, New Concourse Release

What Changed

Container Runtime Default Changed to containerd

The default container runtime is now containerd instead of Guardian. This improves compatibility with newer kernel versions, especially systems using cgroups v2. Guardian is still supported but is no longer the default.

Instance Pipelines and across Step Now Stable

These features are no longer experimental. Their feature flags have been removed and both are now always enabled. No action is required if you were already using them.

Secret Redaction Always Enabled

Secret redaction is now permanently enabled and the corresponding feature flag has no effect. This was previously opt-in but has been considered stable for production use for a long time.

New Broadcast Message System

Operators can now broadcast messages to their Concourse cluster via fly set-wall, fly get-wall, and fly clear-wall. Messages appear as banners in the Concourse web UI.

Tasks Can Use ENTRYPOINT/CMD

If no run.path is defined in a Task config, Concourse will now fall back to the container image’s ENTRYPOINT/CMD. This aligns behavior with standard docker run / podman run.

Other Enhancements

• Two new env vars available in get and put steps: BUILD_URL and BUILD_URL_SHORT.
• Team name is now displayed in set_pipeline steps when setting pipelines for other teams.
• Group tabs are now highlighted red/orange when they contain failed builds.
• Resource version storage now uses SHA256 instead of MD5 for digests.

⚠️ Breaking Change: put.inputs Default Changed from all to detect

This is the most impactful change and may require action on your part.

Previously, put steps would stream all available volumes as inputs by default. This was often wasteful and caused long initialization times. Starting with v8, the default is detect, which means Concourse will inspect put.params and only mount volumes whose names match.

This will break your pipeline if you have a custom resource type that expects volumes by hard-coded names that don’t appear in put.params.

What You Need to Do

Review your pipelines for any put steps that rely on inputs not explicitly referenced in params. If you find any, you have two options:

Option 1: Explicitly list the required inputs:

# Before (v7 — worked because all inputs were mounted by default)
- put: deploy
  params:
    manifest: repo/manifest.yml

# After (v8 — 'config-repo' is not referenced in params, so it won't be mounted)
# Fix: explicitly declare the inputs you need
- put: deploy
  inputs:
    - repo
    - config-repo
  params:
    manifest: repo/manifest.yml

Option 2: Restore the old behavior by setting inputs: all:

- put: deploy
  inputs: all
  params:
    manifest: repo/manifest.yml

We recommend Option 1 as it makes your pipeline more explicit and improves put step initialization times.

Why This Matters

This major upgrade brings better performance defaults, improved stability, and modernizes Concourse’s internals (containerd, SHA256). The put.inputs change in particular can significantly speed up your pipelines by avoiding unnecessary volume mounts.

If you have any questions or need help updating your pipelines, don’t hesitate to reach out to us.