Nonceworks
MenuClose

GitHub's ubuntu-latest moves to Ubuntu 26.04 between 2026-10-19 and 2026-11-19

Written 11 October 2026

Written 2026-10-11 for teams whose GitHub Actions jobs run on ubuntu-latest. GitHub announced on 2026-09-17 that the x64 ubuntu-latest label moves to Ubuntu 26.04 "over a period of several weeks beginning October 19, 2026", and that it plans to "complete the migration by November 19, 2026" (actions/runner-images#14748). During those weeks the same workflow can get either image from one run to the next.

What moves, and what already moved

  • Moves: jobs with runs-on: ubuntu-latest on GitHub's x64 hosted runners. The announcement lists Azure DevOps as affected too.
  • Does not move: jobs pinned to ubuntu-24.04 or ubuntu-26.04, Arm runners (the announcement is for the x64 label), and self-hosted runners.
  • Already moved, in May: the Docker tag ubuntu:latest. It has pointed at Ubuntu 26.04 since 2026-05-05 (docker-library/official-images#21359), and on 2026-10-11 ubuntu:latest and ubuntu:26.04 had the same digest (f144425ff09b). An image built FROM ubuntu:latest is on 26.04 already, whichever runner builds it. What changes on 2026-10-19 is the machine your workflow steps run on.

What changes on the runner

From the image READMEs GitHub publishes for the two labels (24.04 image 20261004.327.1, 26.04 image 20260927.149.1, both read 2026-10-11); the glibc row is the libc6 package in the ubuntu:24.04 and ubuntu:26.04 images, which are the same Ubuntu releases the runners run:

ubuntu-24.04 ubuntu-26.04
glibc 2.39 2.43
OpenSSL 3.0.13 3.5.5
gcc 13.3 15.2
Clang, newest installed 18.1.3 22.1.2
CMake 3.31.6 4.4.3
Python, system 3.12.3 3.14.4
Node.js, system 22.23.3 24.21.0
PHP 8.3.6 8.5.4
Docker 28.0.4 29.4.2
Docker Compose 2.38.2 5.1.3
Helm 3.22.0 4.3.0
PostgreSQL 16.15 18.6
MySQL 8.0.46 8.4.11

Not on the 26.04 image: Miniconda (CONDA is empty), Julia, Swift, Mercurial, Pulumi, Fastlane, Lerna, Parcel, Newman, MediaInfo and Java 8.

Java is unclear. The announcement says the default "remains Java 17"; the 26.04 README lists 25.0.4 as the default. If a step relies on the default java, run java -version on ubuntu-26.04 or set the version with actions/setup-java.

What breaks, and how to tell

  • Large writes to /tmp. On Ubuntu 26.04, /tmp is a RAM-backed tmpfs. The runner maintainers reproduced it on ubuntu-26.04: 50% of RAM, about 7.8G, with a per-user quota that regular users hit at about 6.3G, while the same 9G write passes on ubuntu-24.04 (runner-images#14777). The report there is a large go build failing with compile: writing output: write $WORK/b4822/_pkg_.a: disk quota exceeded. On 2026-09-24 the maintainers wrote that they were "discussing a fix in the image itself"; on 2026-10-11 the issue was still open, and the pull request that keeps /tmp on the root disk (#14814, approved 2026-09-29) was not merged. We checked it on 2026-10-11 on a runner where /tmp was 3.9G (the size follows the runner's memory): a 4.2G write failed, and after the workaround below the same write passed.
  • Tools that are gone. A step that calls one of the tools listed above fails with "command not found".
  • Versions that moved. Steps that use the runner's own compilers, Python, Node.js, CMake or Docker get the 26.04 versions. CMake 4, Docker Compose 5 and Helm 4 are new major versions.
  • Binaries built on the runner. A binary compiled on the runner and copied into an image is now built against glibc 2.43 instead of 2.39. The upgrade canary's library check fails any executable whose libraries or glibc symbol versions the image does not have.

To see which image a job got, open its "Set up job" step: the "Runner Image" group names it (our run on 2026-10-11 printed Image: ubuntu-24.04 and Version: 20261004.327.1). Runs on ubuntu-latest also carry a notice annotation: "The ubuntu-latest label will migrate to Ubuntu 26 beginning October 19, 2026", with a link to the announcement.

The fix

  • To keep Ubuntu 24.04 while you fix things, pin runs-on: ubuntu-24.04. That is GitHub's own mitigation in the announcement.
  • To test the new image now, use runs-on: ubuntu-26.04, generally available since 2026-09-17 (runner-images#14747).
  • Install the tools that left the image in the job itself, and set language versions with the actions/setup-* actions instead of relying on the runner's defaults.

For /tmp, the maintainers' workaround goes in as the first step of the job, because files already in /tmp are not visible after the unmount. Setting TMPDIR to ${{ runner.temp }} is the other option they give.

- name: Put /tmp back on the root disk
  run: |
    sudo systemctl mask tmp.mount
    sudo umount -l /tmp

Check before the date

Run the jobs that matter on both labels now. For jobs that build an image, the upgrade canary does a clean build on a builder created for the run, checks that every executable in the image can load its libraries, starts the image and diffs its packages against the last green run, once per runner:

jobs:
  canary:
    strategy:
      fail-fast: false
      matrix:
        runner: [ubuntu-24.04, ubuntu-26.04]
    runs-on: ${{ matrix.runner }}
    steps:
      - uses: actions/checkout@v7
      - uses: zachsplat/upgrade-canary@3df0c83a8ee4b32feb5c9e115228e2eb866043dd
        with:
          name: app-${{ matrix.runner }}
          dockerfile: Dockerfile
          ready-url: http://localhost:8080/health
          flip-preview: "true"

A job that passes on ubuntu-24.04 and fails on ubuntu-26.04 has found a runner difference before the label moves. flip-preview also rebuilds the image on the next value of its floating base tags, which covers the node:lts move on 2026-10-28.

A green build alone would not have caught the break the canary was written for. On 2026-10-10 the OpenZeppelin Relayer's main branch built without an error after Wolfi's openssl-dev moved to OpenSSL 4, and its binary then exited 127 with libssl.so.4: cannot open shared object file. The library and start checks failed it; a branch that pins OpenSSL 3.6 passed them.

If you also want to move images pinned to ubuntu:24.04, the canary previews that build: ./canary.sh --flip ubuntu:24.04=ubuntu:26.04 . On our Ubuntu fixture, which installs ca-certificates and curl, both builds passed, with 124 packages changed, 30 added and 4 removed, among them glibc 2.39 to 2.43, curl 8.5.0 to 8.18.0 and OpenSSL 3.0.13 to 3.5.5.

Limits

  • We ran the Action snippet above on ubuntu-24.04 and ubuntu-26.04, and the /tmp workaround on ubuntu-26.04, on 2026-10-11. The other runner facts come from GitHub's announcement, the two image READMEs and the maintainers' reply on #14777.
  • The READMEs change with each image release; the versions above are from the image versions named.
  • The canary checks images and the steps that build them. It does not run the rest of a workflow.

Sources