Bump github.com/docker/docker

Bumps [github.com/docker/docker](https://github.com/docker/docker) from 24.0.7+incompatible to 25.0.6+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v24.0.7...v25.0.6) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2025-06-18 12:06:36 +00:00 · 2024-08-01 17:17:23 +00:00
173 changed files with 2747 additions and 2722 deletions
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@ -16,7 +16,7 @@ jobs:
        with:
          fetch-depth: 1
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v5.0.0
        with:
          go-version: 1.22.x

--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@ -13,7 +13,7 @@ jobs:
        with:
          fetch-depth: 1
      - name: Install Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v5.0.0
        with:
          go-version: 1.22.x
      - name: Make publish
--- a/.github/workflows/verify-images.yaml
+++ b/.github/workflows/verify-images.yaml
@ -15,4 +15,4 @@ jobs:
      - name: Verify chart images
        id: verify_images
        run: |
-          VERBOSE=true make verify-compose
+          VERBOSE=true make verify-compose
--- a/EULA.md
+++ b/EULA.md
@ -1,63 +0,0 @@
-## OpenFaaS Community Edition (CE) EULA Addendum
-
-faasd is part of OpenFaaS Community Edition (CE) and is subject to the [OpenFaaS CE EULA](https://github.com/openfaas/faas/blob/master/EULA.md). Additional clauses apply to faasd only, to enable certain commercial usage for Individuals and within Small Business Environments.
-
-End User License Agreement (EULA) Addendum for faasd Licensed Software.
-
-This addendum to the OpenFaaS Community Edition EULA applies specifically to the use of faasd. It governs the conditions under which faasd may be used within Small Business Environments and for Personal Use.
-
-1. Definitions
-
-1.1 Small Business Environment:
-
-A "Small Business Environment" is defined as any commercial entity with fewer than 50 employees and less than US $5,000,000 (or equivalent local currency) in annual revenue. Internal usage refers to faasd being used solely within the business for developing, testing, or deploying solutions for internal purposes or hosted services offered by the business, without distributing faasd itself to end clients or customers.
-
-1.2 Personal Use:
-
-"Personal Use" refers to the use of faasd by individuals for personal or commercial purposes, including hosting or running applications. This includes using faasd as part of a hosted solution (e.g., hosting functions or running a commercial application) but does not permit distributing faasd itself to clients or customers.
-
-2. License Grant for faasd
-
-2.1 Small Business Environment Use:
-
-faasd may be used for limited commercial purposes within a Small Business Environment. This includes deploying faasd as part of a hosted solution or for internal usage (e.g., running functions or commercial applications for internal or customer-facing services), provided that faasd itself is not distributed, resold, or sublicensed to end clients or customers. The license covers internal use or as part of a hosted solution but restricts distributing faasd binaries or code to any third parties.
-
-2.2 Personal Use:
-
-faasd may be used by individuals for personal projects or commercial purposes, including hosting solutions for their own commercial applications or functions. This includes using faasd as part of a hosted solution (e.g., running functions or a commercial application within faasd), provided that faasd itself is not distributed to end clients or customers as part of the solution.
-
-3. Restrictions on faasd Use
-
-3.1 No Resale or Redistribution:
-
-faasd may not be resold, distributed, or provided as part of a product or service directly to end clients or customers, regardless of whether those entities meet the Small Business Environment criteria outlined above. This includes embedding faasd into a software or service that is distributed to other businesses or individuals.
-
-3.2 Non-transferability:
-
-The rights to use faasd under this addendum are non-transferable. If the user or business does not meet the definition of a Small Business Environment or if Personal Use criteria do not apply, a separate commercial license must be obtained from OpenFaaS Ltd. If the entity meets the Small Business Environment or Personal Use criteria, no additional license is required.
-
-4. Compliance
-
-4.1 License Enforcement:
-
-OpenFaaS Ltd reserves the right to implement reasonable measures to verify compliance with this faasd EULA addendum. The Customer agrees to cooperate with any compliance verification efforts conducted by OpenFaaS Ltd.
-
-5. Termination of faasd License
-
-This addendum and the license granted hereunder are effective upon installation and use of faasd. OpenFaaS Ltd reserves the right to terminate this license if any of the terms outlined in this addendum are violated. Upon termination, all copies of faasd must be deleted.
-
-6. Limitation of Liability
-
-6.1 Warranty Disclaimer:
-
-faasd is provided "as is" without warranty of any kind. The user assumes all risks associated with using faasd.
-
-6.2 Liability Limitations:
-
-OpenFaaS Ltd shall not be liable for any indirect, special, incidental, or consequential damages arising out of the use or inability to use faasd.
-
-7. Contact Information
-
-For questions regarding this faasd EULA Addendum or to inquire about commercial licenses, please contact OpenFaaS Ltd at:
-
-Email: contact@openfaas.com
--- a/6
+++ b/6
@ -1,10 +1,8 @@
-License for faasd contributions from OpenFaaS Ltd - 2017, 2029-2024, see: EULA.md
-
-Only third-party contributions to source code are licensed MIT:
-
 MIT License

+Copyright (c) 2020 Alex Ellis
 Copyright (c) 2020 OpenFaaS Ltd
+Copyright (c) 2020 OpenFaas Author(s)

 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
--- a/4
+++ b/4
@ -1,7 +1,7 @@
 Version := $(shell git describe --tags --dirty)
 GitCommit := $(shell git rev-parse HEAD)
-LDFLAGS := "-s -w -X github.com/openfaas/faasd/pkg.Version=$(Version) -X github.com/openfaas/faasd/pkg.GitCommit=$(GitCommit)"
-CONTAINERD_VER := 1.7.22
+LDFLAGS := "-s -w -X main.Version=$(Version) -X main.GitCommit=$(GitCommit)"
+CONTAINERD_VER := 1.7.18
 CNI_VERSION := v0.9.1
 ARCH := amd64

--- a/README.md
+++ b/README.md
@ -2,6 +2,7 @@

 [![Sponsor faasd](https://img.shields.io/static/v1?label=Sponsor&message=%E2%9D%A4&logo=GitHub&link=https://github.com/sponsors/openfaas)](https://github.com/sponsors/openfaas)
 [![Build Status](https://github.com/openfaas/faasd/workflows/build/badge.svg?branch=master)](https://github.com/openfaas/faasd/actions)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 ![Downloads](https://img.shields.io/github/downloads/openfaas/faasd/total)

 faasd is [OpenFaaS](https://github.com/openfaas/) reimagined, but without the cost and complexity of Kubernetes. It runs on a single host with very modest requirements, making it fast and easy to manage. Under the hood it uses [containerd](https://containerd.io/) and [Container Networking Interface (CNI)](https://github.com/containernetworking/cni) along with the same core OpenFaaS components from the main project.
@ -57,13 +58,7 @@ Watch the video: [faasd walk-through with cloud-init and Multipass](https://www.
 * [OpenFaaS CE queue-worker for NATS Streaming](https://github.com/openfaas/nats-queue-worker) - run your invocations in the background without adding any code. See also: [asynchronous invocations](https://docs.openfaas.com/reference/triggers/#async-nats-streaming)
 * [NATS](https://nats.io) for asynchronous processing and queues

-## Licensing & EULA for OpenFaaS (faasd)
-
-faasd (which is a distribution of OpenFaaS) is licensed under the [OpenFaaS Community Edition (CE) EULA](https://github.com/openfaas/faas/blob/master/EULA.md), [additional clauses apply](EULA.md) to enable faasd to be used for Personal Use and within Small Business Environments.
-
-A separate OpenFaaS Standard license is available for commercial use-cases, which is required for certain commercial use.
-
-### When should you use faasd over OpenFaaS on Kubernetes?
+> By default faasd comes with the Community Edition (CE) components, but if you like, you can purchase a license to upgrade to OpenFaaS Standard with scale to zero and rich support for async use-cases through the JetStream queue worker.

 faasd relies on industry-standard tools for running containers:

@ -73,6 +68,8 @@ faasd relies on industry-standard tools for running containers:

 You can use the standard [faas-cli](https://github.com/openfaas/faas-cli) along with pre-packaged functions from *the Function Store*, or build your own using any OpenFaaS template.

+### When should you use faasd over OpenFaaS on Kubernetes?
+
 * To deploy microservices and functions that you can update and monitor remotely
 * When you don't have the bandwidth to learn or manage Kubernetes
 * To deploy embedded apps in IoT and edge use-cases
@ -86,7 +83,7 @@ You can learn more about supported OpenFaaS features in the [ROADMAP.md](/docs/R

 ## Learning faasd

-You can find various resources to learn about faasd for free, however the official handbook is the most comprehensive guide to getting started with faasd and OpenFaaS.
+The faasd project is MIT licensed and open source, and you will find some documentation, blog posts and videos for free.

 ["Serverless For Everyone Else"](https://openfaas.gumroad.com/l/serverless-for-everyone-else) is the official handbook and was written to contribute funds towards the upkeep and maintenance of the project.

@ -121,42 +118,7 @@ View sample pages, reviews and testimonials on Gumroad:

 ["Serverless For Everyone Else"](https://openfaas.gumroad.com/l/serverless-for-everyone-else)

-### Deploy OpenFaaS Edge (commercial distribution of faasd)
-
-OpenFaaS Edge is a commercial distribution of faasd, with enhancements and additional features from OpenFaaS Pro. The [OpenFaaS Pro EULA applies](https://github.com/openfaas/faas/blob/master/pro/EULA.md).
-
-* Upgraded Pro components from OpenFaaS Standard: Gateway, Cron Connector, JetStream Queue Worker and Classic Scale to Zero
-* Deploy up to 250 functions per installation
-* Configure private DNS servers
-* Airgap-friendly with installation bundled in an OCI image
-* Detailed RAM/CPU metrics for stateful containers, and functions, including Out Of Memory (OOM) events
-* Multiple namespace support
-
-This version is intended for resale as part of a wider solution, and to be deployed both into industrial and on-premises environments.
-
-Individual [GitHub Sponsors of OpenFaaS](https://github.com/sponsors/openfaas) (25 USD / mo and higher) can use OpenFaaS Edge for personal use.
-
-You can install OpenFaaS Edge with the following script:
-
-```bash
-curl -sLSf \
-    https://raw.githubusercontent.com/openfaas/faasd/refs/heads/master/hack/install-edge.sh \
-    -o install-edge.sh && \
-chmod +x install-edge.sh
-sudo -E ./install-edge.sh
-```
-
-*For an offline installation*
-
-Copy the OCI bundle and the install-edge.sh script to the remote server.
-
-Then mirror the various images from docker-compose.yaml into your private registry, and update the references from i.e. `image: ghcr.io/openfaasltd/gateway` to the equivalents in your registry.
-
-If your system is unable to install apt, yum, or pacman packages, due to limited network access, then set the `SKIP_OS` environment to 1. The list of packages is available in the `install_required_packages` section of the script.
-
-### Deploy faasd CE
-
-faasd-ce supports 15 functions and needs a computer with a stable Internet connection to run. There are some restrictions on commercial use, but [individuals and certain small businesses can use it for free](EULA.md).
+### Deploy faasd

 The easiest way to deploy faasd is with cloud-init, we give several examples below, and post IaaS platforms will accept "user-data" pasted into their UI, or via their API.

--- a/cmd/install.go
+++ b/cmd/install.go
@ -50,37 +50,46 @@ func runInstall(_ *cobra.Command, _ []string) error {
 		return err
 	}

-	if err := binExists("/usr/local/bin/", "faasd"); err != nil {
+	err := binExists("/usr/local/bin/", "faasd")
+	if err != nil {
 		return err
 	}

-	if err := systemd.InstallUnit("faasd-provider", map[string]string{
+	err = systemd.InstallUnit("faasd-provider", map[string]string{
 		"Cwd":             faasdProviderWd,
-		"SecretMountPath": path.Join(faasdwd, "secrets")}); err != nil {
+		"SecretMountPath": path.Join(faasdwd, "secrets")})
+
+	if err != nil {
 		return err
 	}

-	if err := systemd.InstallUnit("faasd", map[string]string{"Cwd": faasdwd}); err != nil {
+	err = systemd.InstallUnit("faasd", map[string]string{"Cwd": faasdwd})
+	if err != nil {
 		return err
 	}

-	if err := systemd.DaemonReload(); err != nil {
+	err = systemd.DaemonReload()
+	if err != nil {
 		return err
 	}

-	if err := systemd.Enable("faasd-provider"); err != nil {
+	err = systemd.Enable("faasd-provider")
+	if err != nil {
 		return err
 	}

-	if err := systemd.Enable("faasd"); err != nil {
+	err = systemd.Enable("faasd")
+	if err != nil {
 		return err
 	}

-	if err := systemd.Start("faasd-provider"); err != nil {
+	err = systemd.Start("faasd-provider")
+	if err != nil {
 		return err
 	}

-	if err := systemd.Start("faasd"); err != nil {
+	err = systemd.Start("faasd")
+	if err != nil {
 		return err
 	}

--- a/cmd/provider.go
+++ b/cmd/provider.go
@ -3,6 +3,7 @@ package cmd
 import (
 	"fmt"
 	"io"
+	"io/ioutil"
 	"log"
 	"net/http"
 	"os"
@ -29,14 +30,25 @@ func makeProviderCmd() *cobra.Command {
 		Short: "Run the faasd-provider",
 	}

+	command.Flags().String("pull-policy", "Always", `Set to "Always" to force a pull of images upon deployment, or "IfNotPresent" to try to use a cached image.`)
+
 	command.RunE = runProviderE
-	command.PreRunE = preRunE

 	return command
 }

 func runProviderE(cmd *cobra.Command, _ []string) error {

+	pullPolicy, flagErr := cmd.Flags().GetString("pull-policy")
+	if flagErr != nil {
+		return flagErr
+	}
+
+	alwaysPull := false
+	if pullPolicy == "Always" {
+		alwaysPull = true
+	}
+
 	config, providerConfig, err := config.ReadFromEnv(types.OsEnv{})
 	if err != nil {
 		return err
@ -50,15 +62,18 @@ func runProviderE(cmd *cobra.Command, _ []string) error {
 		return err
 	}

-	if err := os.WriteFile(path.Join(wd, "hosts"),
-		[]byte(`127.0.0.1	localhost`), workingDirectoryPermission); err != nil {
-		return fmt.Errorf("cannot write hosts file: %s", err)
+	writeHostsErr := ioutil.WriteFile(path.Join(wd, "hosts"),
+		[]byte(`127.0.0.1	localhost`), workingDirectoryPermission)
+
+	if writeHostsErr != nil {
+		return fmt.Errorf("cannot write hosts file: %s", writeHostsErr)
 	}

-	if err := os.WriteFile(path.Join(wd, "resolv.conf"),
-		[]byte(`nameserver 8.8.8.8
-nameserver 8.8.4.4`), workingDirectoryPermission); err != nil {
-		return fmt.Errorf("cannot write resolv.conf file: %s", err)
+	writeResolvErr := ioutil.WriteFile(path.Join(wd, "resolv.conf"),
+		[]byte(`nameserver 8.8.8.8`), workingDirectoryPermission)
+
+	if writeResolvErr != nil {
+		return fmt.Errorf("cannot write resolv.conf file: %s", writeResolvErr)
 	}

 	cni, err := cninetwork.InitNetwork()
@ -82,26 +97,26 @@ nameserver 8.8.4.4`), workingDirectoryPermission); err != nil {
 		return err
 	}

-	alwaysPull := true
 	bootstrapHandlers := types.FaaSHandlers{
-		FunctionProxy:   httpHeaderMiddleware(proxy.NewHandlerFunc(*config, invokeResolver, false)),
-		DeleteFunction:  httpHeaderMiddleware(handlers.MakeDeleteHandler(client, cni)),
-		DeployFunction:  httpHeaderMiddleware(handlers.MakeDeployHandler(client, cni, baseUserSecretsPath, alwaysPull)),
-		FunctionLister:  httpHeaderMiddleware(handlers.MakeReadHandler(client)),
-		FunctionStatus:  httpHeaderMiddleware(handlers.MakeReplicaReaderHandler(client)),
-		ScaleFunction:   httpHeaderMiddleware(handlers.MakeReplicaUpdateHandler(client, cni)),
-		UpdateFunction:  httpHeaderMiddleware(handlers.MakeUpdateHandler(client, cni, baseUserSecretsPath, alwaysPull)),
-		Health:          httpHeaderMiddleware(func(w http.ResponseWriter, r *http.Request) {}),
-		Info:            httpHeaderMiddleware(handlers.MakeInfoHandler(faasd.Version, faasd.GitCommit)),
-		ListNamespaces:  httpHeaderMiddleware(handlers.MakeNamespacesLister(client)),
-		Secrets:         httpHeaderMiddleware(handlers.MakeSecretHandler(client.NamespaceService(), baseUserSecretsPath)),
-		Logs:            httpHeaderMiddleware(logs.NewLogHandlerFunc(faasdlogs.New(), config.ReadTimeout)),
-		MutateNamespace: httpHeaderMiddleware(handlers.MakeMutateNamespace(client)),
+		FunctionProxy:   proxy.NewHandlerFunc(*config, invokeResolver, false),
+		DeleteFunction:  handlers.MakeDeleteHandler(client, cni),
+		DeployFunction:  handlers.MakeDeployHandler(client, cni, baseUserSecretsPath, alwaysPull),
+		FunctionLister:  handlers.MakeReadHandler(client),
+		FunctionStatus:  handlers.MakeReplicaReaderHandler(client),
+		ScaleFunction:   handlers.MakeReplicaUpdateHandler(client, cni),
+		UpdateFunction:  handlers.MakeUpdateHandler(client, cni, baseUserSecretsPath, alwaysPull),
+		Health:          func(w http.ResponseWriter, r *http.Request) {},
+		Info:            handlers.MakeInfoHandler(Version, GitCommit),
+		ListNamespaces:  handlers.MakeNamespacesLister(client),
+		Secrets:         handlers.MakeSecretHandler(client.NamespaceService(), baseUserSecretsPath),
+		Logs:            logs.NewLogHandlerFunc(faasdlogs.New(), config.ReadTimeout),
+		MutateNamespace: handlers.MakeMutateNamespace(client),
 	}

-	log.Printf("Listening on: 0.0.0.0:%d", *config.TCPPort)
+	log.Printf("Listening on: 0.0.0.0:%d\n", *config.TCPPort)
 	bootstrap.Serve(cmd.Context(), &bootstrapHandlers, config)
 	return nil
+
 }

 /*
@ -116,7 +131,7 @@ func moveSecretsToDefaultNamespaceSecrets(baseSecretPath string, defaultNamespac
 		return err
 	}

-	files, err := os.ReadDir(baseSecretPath)
+	files, err := ioutil.ReadDir(baseSecretPath)
 	if err != nil {
 		return err
 	}
@ -163,10 +178,3 @@ func copyFile(src, dst string) error {

 	return nil
 }
-
-func httpHeaderMiddleware(next http.HandlerFunc) http.HandlerFunc {
-	return func(w http.ResponseWriter, r *http.Request) {
-		w.Header().Set("X-OpenFaaS-EULA", "openfaas-ce")
-		next.ServeHTTP(w, r)
-	}
-}
--- a/cmd/root.go
+++ b/cmd/root.go
@ -4,7 +4,6 @@ import (
 	"fmt"

 	"github.com/morikuni/aec"
-	"github.com/openfaas/faasd/pkg"
 	"github.com/spf13/cobra"
 )

@ -23,8 +22,19 @@ func RootCommand() *cobra.Command {
 	return rootCommand
 }

+var (
+	// GitCommit Git Commit SHA
+	GitCommit string
+	// Version version of the CLI
+	Version string
+)
+
 // Execute faasd
-func Execute() error {
+func Execute(version, gitCommit string) error {
+
+	// Get Version and GitCommit values from main.go.
+	Version = version
+	GitCommit = gitCommit

 	if err := rootCommand.Execute(); err != nil {
 		return err
@ -36,16 +46,12 @@ var rootCommand = &cobra.Command{
 	Use:   "faasd",
 	Short: "Start faasd",
 	Long: `
-faasd Community Edition (CE):
+faasd - Serverless For Everyone Else

 Learn how to build, secure, and monitor functions with faasd with 
 the eBook:

 https://openfaas.gumroad.com/l/serverless-for-everyone-else
-
-License: OpenFaaS CE EULA with faasd addendum:
-
-https://github.com/openfaas/faasd/blob/master/EULA.md
 `,
 	RunE:         runRootCommand,
 	SilenceUsage: true,
@ -72,7 +78,7 @@ func parseBaseCommand(_ *cobra.Command, _ []string) {
 }

 func printVersion() {
-	fmt.Printf("faasd Community Edition (CE) version: %s\tcommit: %s\n", pkg.GetVersion(), pkg.GitCommit)
+	fmt.Printf("faasd version: %s\tcommit: %s\n", GetVersion(), GitCommit)
 }

 func printLogo() {
@ -80,6 +86,14 @@ func printLogo() {
 	fmt.Println(logoText)
 }

+// GetVersion get latest version
+func GetVersion() string {
+	if len(Version) == 0 {
+		return "dev"
+	}
+	return Version
+}
+
 // Logo for version and root command
 const Logo = `  __                     _ 
 / _| __ _  __ _ ___  __| |
--- a/cmd/up.go
+++ b/cmd/up.go
@ -2,6 +2,7 @@ package cmd

 import (
 	"fmt"
+	"io/ioutil"
 	"log"
 	"os"
 	"os/signal"
@ -38,10 +39,9 @@ func init() {
 }

 var upCmd = &cobra.Command{
-	Use:     "up",
-	Short:   "Start faasd",
-	RunE:    runUp,
-	PreRunE: preRunE,
+	Use:   "up",
+	Short: "Start faasd",
+	RunE:  runUp,
 }

 func runUp(cmd *cobra.Command, _ []string) error {
@ -166,7 +166,7 @@ func makeFile(filePath, fileContents string) error {
 		return nil
 	} else if os.IsNotExist(err) {
 		log.Printf("Writing to: %q\n", filePath)
-		return os.WriteFile(filePath, []byte(fileContents), workingDirectoryPermission)
+		return ioutil.WriteFile(filePath, []byte(fileContents), workingDirectoryPermission)
 	} else {
 		return err
 	}
@ -204,11 +204,3 @@ func parseUpFlags(cmd *cobra.Command) (upConfig, error) {
 	parsed.workingDir = faasdwd
 	return parsed, err
 }
-
-func preRunE(cmd *cobra.Command, _ []string) error {
-	if err := pkg.ConnectivityCheck(); err != nil {
-		return fmt.Errorf("the OpenFaaS CE EULA requires Internet access, upgrade to faasd Pro to continue")
-	}
-
-	return nil
-}
--- a/docker-compose.yaml
+++ b/docker-compose.yaml
@ -21,7 +21,7 @@ services:
    #    - "127.0.0.1:8222:8222"

  prometheus:
-    image: docker.io/prom/prometheus:v3.1.0
+    image: docker.io/prom/prometheus:v2.49.1
 # nobody
    user: "65534"
    volumes:
@ -39,7 +39,7 @@ services:
       - "127.0.0.1:9090:9090"

  gateway:
-    image: ghcr.io/openfaas/gateway:0.27.12
+    image: ghcr.io/openfaas/gateway:0.27.5
    environment:
      - basic_auth=true
      - functions_provider_url=http://faasd-provider:8081/
@ -69,7 +69,7 @@ services:
       - "8080:8080"

  queue-worker:
-    image: ghcr.io/openfaas/queue-worker:0.14.2
+    image: ghcr.io/openfaas/queue-worker:0.14.1
    environment:
      - faas_nats_address=nats
      - faas_nats_port=4222
--- a/docs/DEV.md
+++ b/docs/DEV.md
@ -86,7 +86,7 @@ EOF'
 * Install containerd `x86_64` only

 ```bash
-export VER=1.7.22
+export VER=1.7.18
 curl -sSL https://github.com/containerd/containerd/releases/download/v$VER/containerd-$VER-linux-amd64.tar.gz -o /tmp/containerd.tar.gz \
  && sudo tar -xvf /tmp/containerd.tar.gz -C /usr/local/bin/ --strip-components=1

@ -102,7 +102,7 @@ containerd -version
    git clone https://github.com/containerd/containerd
    cd containerd
    git fetch origin --tags
-    git checkout v1.7.22
+    git checkout v1.7.18

    make
    sudo make install
@ -113,7 +113,7 @@ containerd -version
 #### Ensure containerd is running

 ```bash
-curl -sLS https://raw.githubusercontent.com/containerd/containerd/v1.7.22/containerd.service > /tmp/containerd.service
+curl -sLS https://raw.githubusercontent.com/containerd/containerd/v1.7.18/containerd.service > /tmp/containerd.service

 # Extend the timeouts for low-performance VMs
 echo "[Manager]" | tee -a /tmp/containerd.service
--- a/go.mod
+++ b/go.mod
@ -1,16 +1,16 @@
 module github.com/openfaas/faasd

-go 1.22
+go 1.21

 require (
 	github.com/alexellis/arkade v0.0.0-20240320084407-6cf4a641c415
 	github.com/compose-spec/compose-go v0.0.0-20200528042322-36d8ce368e05
-	github.com/containerd/containerd v1.7.22
+	github.com/containerd/containerd v1.7.18
 	github.com/containerd/go-cni v1.1.9
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/docker/cli v24.0.7+incompatible
 	github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker v24.0.7+incompatible // indirect
+	github.com/docker/docker v25.0.6+incompatible // indirect
 	github.com/docker/go-units v0.5.0
 	github.com/gorilla/mux v1.8.1
 	github.com/morikuni/aec v1.0.0
@ -22,32 +22,28 @@ require (
 	github.com/spf13/pflag v1.0.5
 	github.com/vishvananda/netlink v1.2.1-beta.2
 	github.com/vishvananda/netns v0.0.4
-	golang.org/x/sys v0.19.0
+	golang.org/x/sys v0.18.0
 	k8s.io/apimachinery v0.29.3
 )

-require (
-	github.com/alexellis/go-execute/v2 v2.2.1
-	github.com/distribution/reference v0.6.0
-)
+require github.com/alexellis/go-execute/v2 v2.2.1

 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
 	github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/Microsoft/hcsshim v0.11.7 // indirect
+	github.com/Microsoft/hcsshim v0.11.5 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/cespare/xxhash/v2 v2.2.0 // indirect
 	github.com/containerd/cgroups v1.1.0 // indirect
-	github.com/containerd/containerd/api v1.7.19 // indirect
 	github.com/containerd/continuity v0.4.2 // indirect
 	github.com/containerd/errdefs v0.1.0 // indirect
 	github.com/containerd/fifo v1.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
-	github.com/containerd/ttrpc v1.2.5 // indirect
+	github.com/containerd/ttrpc v1.2.4 // indirect
 	github.com/containerd/typeurl/v2 v2.1.1 // indirect
 	github.com/containernetworking/cni v1.1.2 // indirect
+	github.com/distribution/reference v0.5.0 // indirect
 	github.com/docker/docker-credential-helpers v0.8.0 // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
@ -58,7 +54,7 @@ require (
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
-	github.com/google/uuid v1.4.0 // indirect
+	github.com/google/uuid v1.3.1 // indirect
 	github.com/imdario/mergo v0.3.14 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/klauspost/compress v1.17.4 // indirect
@ -69,8 +65,7 @@ require (
 	github.com/moby/sys/mountinfo v0.6.2 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
 	github.com/moby/sys/signal v0.7.0 // indirect
-	github.com/moby/sys/user v0.3.0 // indirect
-	github.com/moby/sys/userns v0.1.0 // indirect
+	github.com/moby/sys/user v0.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
@ -84,15 +79,15 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	go.opencensus.io v0.24.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 // indirect
-	go.opentelemetry.io/otel v1.21.0 // indirect
-	go.opentelemetry.io/otel/metric v1.21.0 // indirect
-	go.opentelemetry.io/otel/trace v1.21.0 // indirect
-	golang.org/x/net v0.24.0 // indirect
+	go.opentelemetry.io/otel v1.19.0 // indirect
+	go.opentelemetry.io/otel/metric v1.19.0 // indirect
+	go.opentelemetry.io/otel/trace v1.19.0 // indirect
+	golang.org/x/net v0.23.0 // indirect
 	golang.org/x/sync v0.6.0 // indirect
 	golang.org/x/text v0.14.0 // indirect
 	golang.org/x/tools v0.19.0 // indirect
-	google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20231212172506-995d672761c0 // indirect
+	google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97 // indirect
 	google.golang.org/grpc v1.59.0 // indirect
 	google.golang.org/protobuf v1.33.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
--- a/go.sum
+++ b/go.sum
@ -8,8 +8,6 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/Microsoft/hcsshim v0.11.5 h1:haEcLNpj9Ka1gd3B3tAEs9CpE0c+1IhoL59w/exYU38=
 github.com/Microsoft/hcsshim v0.11.5/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
-github.com/Microsoft/hcsshim v0.11.7 h1:vl/nj3Bar/CvJSYo7gIQPyRWc9f3c6IeSNavBTSZNZQ=
-github.com/Microsoft/hcsshim v0.11.7/go.mod h1:MV8xMfmECjl5HdO7U/3/hFVnkmSBjAjmA09d4bExKcU=
 github.com/alexellis/arkade v0.0.0-20240320084407-6cf4a641c415 h1:mLD1eSfXbmXcwKMP1AsFl01G2U16aC9E22Tcjehyyrw=
 github.com/alexellis/arkade v0.0.0-20240320084407-6cf4a641c415/go.mod h1:3sT9Gq9WUFG9Wwz9dFbRRc/2L3yepsA4p272aG2DR6w=
 github.com/alexellis/go-execute/v2 v2.2.1 h1:4Ye3jiCKQarstODOEmqDSRCqxMHLkC92Bhse743RdOI=
@ -30,10 +28,6 @@ github.com/containerd/cgroups v1.1.0 h1:v8rEWFl6EoqHB+swVNjVoCJE8o3jX7e8nqBGPLaD
 github.com/containerd/cgroups v1.1.0/go.mod h1:6ppBcbh/NOOUU+dMKrykgaBnK9lCIBxHqJDGwsa1mIw=
 github.com/containerd/containerd v1.7.18 h1:jqjZTQNfXGoEaZdW1WwPU0RqSn1Bm2Ay/KJPUuO8nao=
 github.com/containerd/containerd v1.7.18/go.mod h1:IYEk9/IO6wAPUz2bCMVUbsfXjzw5UNP5fLz4PsUygQ4=
-github.com/containerd/containerd v1.7.22 h1:nZuNnNRA6T6jB975rx2RRNqqH2k6ELYKDZfqTHqwyy0=
-github.com/containerd/containerd v1.7.22/go.mod h1:e3Jz1rYRUZ2Lt51YrH9Rz0zPyJBOlSvB3ghr2jbVD8g=
-github.com/containerd/containerd/api v1.7.19 h1:VWbJL+8Ap4Ju2mx9c9qS1uFSB1OVYr5JJrW2yT5vFoA=
-github.com/containerd/containerd/api v1.7.19/go.mod h1:fwGavl3LNwAV5ilJ0sbrABL44AQxmNjDRcwheXDb6Ig=
 github.com/containerd/continuity v0.4.2 h1:v3y/4Yz5jwnvqPKJJ+7Wf93fyWoCB3F5EclWG023MDM=
 github.com/containerd/continuity v0.4.2/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
 github.com/containerd/errdefs v0.1.0 h1:m0wCRBiu1WJT/Fr+iOoQHMQS/eP5myQ8lCv4Dz5ZURM=
@ -44,12 +38,8 @@ github.com/containerd/go-cni v1.1.9 h1:ORi7P1dYzCwVM6XPN4n3CbkuOx/NZ2DOqy+SHRdo9
 github.com/containerd/go-cni v1.1.9/go.mod h1:XYrZJ1d5W6E2VOvjffL3IZq0Dz6bsVlERHbekNK90PM=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
-github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
 github.com/containerd/ttrpc v1.2.4 h1:eQCQK4h9dxDmpOb9QOOMh2NHTfzroH1IkmHiKZi05Oo=
 github.com/containerd/ttrpc v1.2.4/go.mod h1:ojvb8SJBSch0XkqNO0L0YX/5NxR3UnVk2LzFKBK0upc=
-github.com/containerd/ttrpc v1.2.5 h1:IFckT1EFQoFBMG4c3sMdT8EP3/aKfumK1msY+Ze4oLU=
-github.com/containerd/ttrpc v1.2.5/go.mod h1:YCXHsb32f+Sq5/72xHubdiJRQY9inL4a4ZQrAbN1q9o=
 github.com/containerd/typeurl/v2 v2.1.1 h1:3Q4Pt7i8nYwy2KmQWIw2+1hTvwTE/6w9FqcttATPO/4=
 github.com/containerd/typeurl/v2 v2.1.1/go.mod h1:IDp2JFvbwZ31H8dQbEIY7sDl2L3o3HZj1hsSQlywkQ0=
 github.com/containernetworking/cni v1.1.2 h1:wtRGZVv7olUHMOqouPpn3cXJWpJgM6+EUl31EQbXALQ=
@ -63,14 +53,12 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
 github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
-github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
 github.com/docker/cli v24.0.7+incompatible h1:wa/nIwYFW7BVTGa7SWPVyyXU9lgORqUb1xfI36MSkFg=
 github.com/docker/cli v24.0.7+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
 github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
 github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
-github.com/docker/docker v24.0.7+incompatible h1:Wo6l37AuwP3JaMnZa226lzVXGA3F9Ig1seQen0cKYlM=
-github.com/docker/docker v24.0.7+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v25.0.6+incompatible h1:5cPwbwriIcsua2REJe8HqQV+6WlWc1byg2QSXzBxBGg=
+github.com/docker/docker v25.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
 github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
 github.com/docker/go-connections v0.4.0 h1:El9xVISelRB7BuFusrZozjnkIM5YnzCViNKohAFqRJQ=
@ -135,8 +123,6 @@ github.com/google/pprof v0.0.0-20210720184732-4bb14d4b1be1/go.mod h1:kpwsk12EmLe
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.3.1 h1:KjJaJ9iWZ3jOFZIf1Lqf4laDRCasjl0BCmnEGxkdLb4=
 github.com/google/uuid v1.3.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/google/uuid v1.4.0 h1:MtMxsa51/r9yyhkyLsVeVt0B+BGQZzpQiTQ4eHZ8bc4=
-github.com/google/uuid v1.4.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
@ -171,10 +157,6 @@ github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI
 github.com/moby/sys/signal v0.7.0/go.mod h1:GQ6ObYZfqacOwTtlXvcmh9A26dVRul/hbOZn88Kg8Tg=
 github.com/moby/sys/user v0.1.0 h1:WmZ93f5Ux6het5iituh9x2zAG7NFY9Aqi49jjE1PaQg=
 github.com/moby/sys/user v0.1.0/go.mod h1:fKJhFOnsCN6xZ5gSfbM6zaHGgDJMrqt9/reuj4T7MmU=
-github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
-github.com/moby/sys/user v0.3.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
-github.com/moby/sys/userns v0.1.0 h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
-github.com/moby/sys/userns v0.1.0/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
 github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A=
 github.com/morikuni/aec v1.0.0/go.mod h1:BbKIizmSmc5MMPqRYbxO4ZU0S0+P200+tUnFx7PXmsc=
 github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
@ -261,16 +243,10 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0 h1:x8Z78aZ
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.45.0/go.mod h1:62CPTSry9QZtOaSsE3tOzhx6LzDhHnXJ6xHeMNNiM6Q=
 go.opentelemetry.io/otel v1.19.0 h1:MuS/TNf4/j4IXsZuJegVzI1cwut7Qc00344rgH7p8bs=
 go.opentelemetry.io/otel v1.19.0/go.mod h1:i0QyjOq3UPoTzff0PJB2N66fb4S0+rSbSB15/oyH9fY=
-go.opentelemetry.io/otel v1.21.0 h1:hzLeKBZEL7Okw2mGzZ0cc4k/A7Fta0uoPgaJCr8fsFc=
-go.opentelemetry.io/otel v1.21.0/go.mod h1:QZzNPQPm1zLX4gZK4cMi+71eaorMSGT3A4znnUvNNEo=
 go.opentelemetry.io/otel/metric v1.19.0 h1:aTzpGtV0ar9wlV4Sna9sdJyII5jTVJEvKETPiOKwvpE=
 go.opentelemetry.io/otel/metric v1.19.0/go.mod h1:L5rUsV9kM1IxCj1MmSdS+JQAcVm319EUrDVLrt7jqt8=
-go.opentelemetry.io/otel/metric v1.21.0 h1:tlYWfeo+Bocx5kLEloTjbcDwBuELRrIFxwdQ36PlJu4=
-go.opentelemetry.io/otel/metric v1.21.0/go.mod h1:o1p3CA8nNHW8j5yuQLdc1eeqEaPfzug24uvsyIEJRWM=
 go.opentelemetry.io/otel/trace v1.19.0 h1:DFVQmlVbfVeOuBRrwdtaehRrWiL1JoVs9CPIQ1Dzxpg=
 go.opentelemetry.io/otel/trace v1.19.0/go.mod h1:mfaSyvGyEJEI0nyV2I4qhNQnbBOUUmYZpYojqMnX2vo=
-go.opentelemetry.io/otel/trace v1.21.0 h1:WD9i5gzvoUPuXIXH24ZNBudiarZDKuekPqi/E8fpfLc=
-go.opentelemetry.io/otel/trace v1.21.0/go.mod h1:LGbsEB0f9LGjN+OZaQQ26sohbOmiMR+BaslueVtS/qQ=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 go.uber.org/goleak v1.2.1/go.mod h1:qlT2yGI9QafXHhZZLxlSuNsMw3FFLxBr+tBRlmO1xH4=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
@ -294,8 +270,8 @@ golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
 golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
-golang.org/x/net v0.24.0 h1:1PcaxkF854Fu3+lvBIx5SYn9wRlBzzcnHZSiaFFAb0w=
-golang.org/x/net v0.24.0/go.mod h1:2Q7sJY5mzlzWjKtYUEXSlBWCdyaioyXzRB2RtU8KVE8=
+golang.org/x/net v0.23.0 h1:7EYJ93RZ9vYSZAIb2x3lnuvqO5zneoD6IvWjuhfxjTs=
+golang.org/x/net v0.23.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@ -323,8 +299,8 @@ golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.19.0 h1:q5f1RH2jigJ1MoAWp2KTp3gm5zAGFUTarQZ5U386+4o=
-golang.org/x/sys v0.19.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@ -354,12 +330,8 @@ google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98
 google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
 google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13 h1:vlzZttNJGVqTsRFU9AmdnrcO1Znh8Ew9kCD//yjigk0=
 google.golang.org/genproto v0.0.0-20230920204549-e6e6cdab5c13/go.mod h1:CCviP9RmpZ1mxVr8MUjCnSiY09IbAXZxhLE6EhHIdPU=
-google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3 h1:1hfbdAfFbkmpg41000wDVqr7jUpK/Yo+LPnIxxGzmkg=
-google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3/go.mod h1:5RBcpGRxr25RbDzY5w+dmaqpSEvl8Gwl1x2CICf60ic=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97 h1:6GQBEOdGkX6MMTLT9V+TjtIRZCw9VPD5Z+yHY9wMgS0=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231002182017-d307bd883b97/go.mod h1:v7nGkzlmW8P3n/bKmWBn2WpBjpOEx8Q6gMueudAmKfY=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231212172506-995d672761c0 h1:/jFB8jK5R3Sq3i/lmeZO0cATSzFfZaJq1J2Euan3XKU=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20231212172506-995d672761c0/go.mod h1:FUoWkonphQm3RhTS+kOEhF8h0iDpm4tdXolVCeZ9KKA=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
--- a/hack/build-containerd-arm64.sh
+++ b/hack/build-containerd-arm64.sh
@ -25,7 +25,7 @@ git clone https://github.com/containerd/containerd

 cd containerd
 git fetch origin --tags
-git checkout v1.7.22
+git checkout v1.7.18

 make
 sudo make install
--- a/hack/build-containerd.sh
+++ b/hack/build-containerd.sh
@ -26,7 +26,7 @@ git clone https://github.com/containerd/containerd

 cd containerd
 git fetch origin --tags
-git checkout v1.7.22
+git checkout v1.7.18

 make
 sudo make install
--- a/hack/faasd-provider.service
+++ b/hack/faasd-provider.service
@ -2,7 +2,7 @@
 Description=faasd-provider

 [Service]
-MemoryMax=500M
+MemoryLimit=500M
 Environment="secret_mount_path={{.SecretMountPath}}"
 Environment="basic_auth=true"
 Environment="hosts_dir=/var/lib/faasd"
--- a/hack/faasd.service
+++ b/hack/faasd.service
@ -3,7 +3,7 @@ Description=faasd
 After=faasd-provider.service

 [Service]
-MemoryMax=500M
+MemoryLimit=500M
 ExecStart=/usr/local/bin/faasd up
 Restart=on-failure
 RestartSec=10s
--- a/hack/install-edge.sh
+++ b/hack/install-edge.sh
@ -1,99 +0,0 @@
-#!/bin/bash
-
-set -e # stop on error
-set -o pipefail
-
-if [ "$EUID" -ne 0 ]; then
-    echo "Please run as root or with sudo"
-    exit
-fi
-
-has_yum() {
-  [ -n "$(command -v yum)" ]
-}
-
-has_apt_get() {
-  [ -n "$(command -v apt-get)" ]
-}
-
-has_pacman() {
-  [ -n "$(command -v pacman)" ]
-}
-
-install_required_packages() {
-  if $(has_apt_get); then
-    # Debian bullseye is missing iptables. Added to required packages
-    # to get it working in raspberry pi. No such known issues in
-    # other distros. Hence, adding only to this block.
-    # reference: https://github.com/openfaas/faasd/pull/237
-    apt-get update -y
-    apt-get install -y curl runc bridge-utils iptables
-  elif $(has_yum); then
-    yum check-update -y
-    yum install -y curl runc iptables-services which
-  elif $(has_pacman); then
-    pacman -Syy
-    pacman -Sy curl runc bridge-utils
-  else
-    fatal "Could not find apt-get, yum, or pacman. Cannot install dependencies on this OS."
-    exit 1
-  fi
-}
-
-echo "OpenFaaS Edge (based upon faasd and OpenFaaS Standard)"
-echo ""
-echo ""
-
-echo "1. Installing required OS packages, set SKIP_OS=1 to skip this step"
-echo ""
-
-if [ -z "$SKIP_OS" ]; then
-    install_required_packages
-fi
-
-echo "2. Downloading OCI image, and installing pre-requisites"
-echo ""
-if [ ! -x "$(command -v arkade)" ]; then
-    # For Centos, RHEL, Fedora, Amazon Linux, and Oracle Linux, use BINLOCATION=/usr/bin/
-
-    if $(has_yum); then
-      BINLOCATION=/usr/bin/
-    fi
-
-    curl -sLS https://get.arkade.dev | BINLOCATION=${BINLOCATION} sh
-fi
-
-PATH=$PATH:$HOME/.arkade/bin
-
-tmpdir=$(mktemp -d)
-
-# Ensure all existing services are stopped when installing over an 
-# existing faasd installation
-systemctl stop faasd || :
-systemctl stop faasd-provider || :
-systemctl stop containerd || :
-killall -9 containerd-shim-runc-v2 || :
-killall -9 faasd || :
-
-# crane, or docker can also be used to download the OCI image and to extract it
-
-# Rather than the :latest tag, a specific tag can be given
-# Use "crane ls ghcr.io/openfaasltd/faasd-pro" to see available tags
-
-${BINLOCATION}arkade oci install --path ${tmpdir} \
-  ghcr.io/openfaasltd/faasd-pro:latest
-
-cd ${tmpdir}
-./install.sh ./
-
-echo ""
-echo "3. You now need to activate your license via GitHub"
-echo ""
-echo "sudo -E faasd github login"
-echo "sudo -E faasd activate"
-echo ""
-echo ""
-echo "4. Then perform the final installation steps"
-echo ""
-echo "sudo -E sh -c \"cd ${tmpdir}/var/lib/faasd && faasd install\""
-echo ""
--- a/hack/install.sh
+++ b/hack/install.sh
@ -90,7 +90,7 @@ install_cni_plugins() {
 }

 install_containerd() {
-  CONTAINERD_VER=1.7.22
+  CONTAINERD_VER=1.7.18
  $SUDO systemctl unmask containerd || :

  arch=$(uname -m)
--- a/main.go
+++ b/main.go
@ -7,6 +7,14 @@ import (
 	"github.com/openfaas/faasd/cmd"
 )

+// These values will be injected into these variables at the build time.
+var (
+	// GitCommit Git Commit SHA
+	GitCommit string
+	// Version version of the CLI
+	Version string
+)
+
 func main() {

 	if _, ok := os.LookupEnv("CONTAINER_ID"); ok {
@ -23,7 +31,7 @@ func main() {
 		os.Exit(0)
 	}

-	if err := cmd.Execute(); err != nil {
+	if err := cmd.Execute(Version, GitCommit); err != nil {
 		os.Exit(1)
 	}
 	return
--- a/pkg/cninetwork/cni_network.go
+++ b/pkg/cninetwork/cni_network.go
@ -5,6 +5,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"io/ioutil"
 	"log"
 	"net"
 	"os"
@ -85,7 +86,7 @@ func InitNetwork() (gocni.CNI, error) {
 	}

 	netConfig := path.Join(CNIConfDir, defaultCNIConfFilename)
-	if err := os.WriteFile(netConfig, []byte(defaultCNIConf), 644); err != nil {
+	if err := ioutil.WriteFile(netConfig, []byte(defaultCNIConf), 644); err != nil {
 		return nil, fmt.Errorf("cannot write network config: %s", defaultCNIConfFilename)
 	}

@ -150,7 +151,7 @@ func DeleteCNINetwork(ctx context.Context, cni gocni.CNI, client *containerd.Cli
 func GetIPAddress(container string, PID uint32) (string, error) {
 	CNIDir := path.Join(CNIDataDir, defaultNetworkName)

-	files, err := os.ReadDir(CNIDir)
+	files, err := ioutil.ReadDir(CNIDir)
 	if err != nil {
 		return "", fmt.Errorf("failed to read CNI dir for container %s: %v", container, err)
 	}
--- a/pkg/cninetwork/cni_network_test.go
+++ b/pkg/cninetwork/cni_network_test.go
@ -1,6 +1,7 @@
 package cninetwork

 import (
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@ -14,7 +15,7 @@ eth1`
 	PID := uint32(621)
 	fullPath := filepath.Join(os.TempDir(), fileName)

-	err := os.WriteFile(fullPath, []byte(body), 0700)
+	err := ioutil.WriteFile(fullPath, []byte(body), 0700)
 	if err != nil {
 		t.Fatalf(err.Error())
 	}
@ -23,6 +24,7 @@ eth1`
 	}()

 	got, err := isCNIResultForPID(fullPath, container, PID)
+
 	if err != nil {
 		t.Fatalf(err.Error())
 	}
@ -41,7 +43,7 @@ eth1`
 	PID := uint32(621)
 	fullPath := filepath.Join(os.TempDir(), fileName)

-	err := os.WriteFile(fullPath, []byte(body), 0700)
+	err := ioutil.WriteFile(fullPath, []byte(body), 0700)
 	if err != nil {
 		t.Fatalf(err.Error())
 	}
@ -50,10 +52,10 @@ eth1`
 	}()

 	got, err := isCNIResultForPID(fullPath, container, PID)
+
 	if err != nil {
 		t.Fatalf(err.Error())
 	}
-
 	want := false
 	if got != want {
 		t.Fatalf("want %v, but got %v", want, got)
--- a/pkg/connectivity.go
+++ b/pkg/connectivity.go
@ -1,39 +0,0 @@
-package pkg
-
-import (
-	"fmt"
-	"io"
-	"net/http"
-	"strings"
-)
-
-// ConnectivityCheck checks if the controller can reach the
-// public Internet via HTTPS.
-// A license is required to use OpenFaaS CE for Commercial Use.
-func ConnectivityCheck() error {
-	req, err := http.NewRequest(http.MethodGet, "https://checkip.amazonaws.com", nil)
-	if err != nil {
-		return err
-	}
-
-	req.Header.Set("User-Agent", fmt.Sprintf("openfaas-ce/%s faas-netes", Version))
-
-	res, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return err
-	}
-	if req.Body != nil {
-		defer req.Body.Close()
-	}
-
-	if res.StatusCode != http.StatusOK {
-		var body []byte
-		if res.Body != nil {
-			body, _ = io.ReadAll(res.Body)
-		}
-
-		return fmt.Errorf("unexpected status code checking connectivity: %d, body: %s", res.StatusCode, strings.TrimSpace(string(body)))
-	}
-
-	return nil
-}
--- a/pkg/local_resolver.go
+++ b/pkg/local_resolver.go
@ -1,6 +1,7 @@
 package pkg

 import (
+	"io/ioutil"
 	"log"
 	"os"
 	"strings"
@ -53,7 +54,7 @@ func (l *LocalResolver) rebuild() {
 	l.Mutex.Lock()
 	defer l.Mutex.Unlock()

-	fileData, fileErr := os.ReadFile(l.Path)
+	fileData, fileErr := ioutil.ReadFile(l.Path)
 	if fileErr != nil {
 		log.Printf("resolver rebuild error: %s", fileErr.Error())
 		return
--- a/pkg/logs/requestor.go
+++ b/pkg/logs/requestor.go
@ -58,10 +58,10 @@ func (r *requester) Query(ctx context.Context, req logs.Request) (<-chan logs.Me

 // buildCmd reeturns the equivalent of
 //
-//	journalctl -t <namespace>:<name>  \
-//		--output=json \
-//		--since=<timestamp> \
-//		<--follow> \
+// 	journalctl -t <namespace>:<name>  \
+// 		--output=json \
+// 		--since=<timestamp> \
+// 		<--follow> \
 func buildCmd(ctx context.Context, req logs.Request) *exec.Cmd {
 	// // set the cursor position based on req, default to 5m
 	since := time.Now().Add(-5 * time.Minute)
@ -105,12 +105,12 @@ func streamLogs(ctx context.Context, cmd *exec.Cmd, out io.ReadCloser, msgs chan

 	// will ensure `out` is closed and all related resources cleaned up
 	go func() {
-		if err := cmd.Wait(); err != nil {
-			log.Printf("journalctl exited with error: %s", err)
-		}
+		err := cmd.Wait()
+		log.Println("wait result", err)
 	}()

 	defer func() {
+		log.Println("closing journal stream")
 		close(msgs)
 	}()

@ -176,6 +176,7 @@ func parseEntry(entry map[string]string) (logs.Message, error) {
 }

 func logErrOut(out io.ReadCloser) {
+	defer log.Println("stderr closed")
 	defer out.Close()

 	io.Copy(log.Writer(), out)
--- a/pkg/provider/handlers/delete.go
+++ b/pkg/provider/handlers/delete.go
@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"log"
 	"net/http"

@ -29,11 +29,13 @@ func MakeDeleteHandler(client *containerd.Client, cni gocni.CNI) func(w http.Res

 		defer r.Body.Close()

-		body, _ := io.ReadAll(r.Body)
+		body, _ := ioutil.ReadAll(r.Body)
+		log.Printf("[Delete] request: %s\n", string(body))

 		req := types.DeleteFunctionRequest{}
-		if err := json.Unmarshal(body, &req); err != nil {
-			log.Printf("[Delete] error parsing input: %s", err)
+		err := json.Unmarshal(body, &req)
+		if err != nil {
+			log.Printf("[Delete] error parsing input: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)

 			return
@ -61,7 +63,7 @@ func MakeDeleteHandler(client *containerd.Client, cni gocni.CNI) func(w http.Res

 		function, err := GetFunction(client, name, namespace)
 		if err != nil {
-			msg := fmt.Sprintf("function %s.%s not found", name, namespace)
+			msg := fmt.Sprintf("service %s not found", name)
 			log.Printf("[Delete] %s\n", msg)
 			http.Error(w, msg, http.StatusNotFound)
 			return
@ -83,6 +85,6 @@ func MakeDeleteHandler(client *containerd.Client, cni gocni.CNI) func(w http.Res
 			return
 		}

-		log.Printf("[Delete] Removed: %s.%s\n", name, namespace)
+		log.Printf("[Delete] deleted %s\n", name)
 	}
 }
--- a/pkg/provider/handlers/deploy.go
+++ b/pkg/provider/handlers/deploy.go
@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"log"
 	"net/http"
 	"os"
@ -17,7 +17,7 @@ import (
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/oci"
 	gocni "github.com/containerd/go-cni"
-	"github.com/distribution/reference"
+	"github.com/docker/distribution/reference"
 	"github.com/opencontainers/runtime-spec/specs-go"
 	"github.com/openfaas/faas-provider/types"
 	cninetwork "github.com/openfaas/faasd/pkg/cninetwork"
@ -39,12 +39,13 @@ func MakeDeployHandler(client *containerd.Client, cni gocni.CNI, secretMountPath

 		defer r.Body.Close()

-		body, _ := io.ReadAll(r.Body)
+		body, _ := ioutil.ReadAll(r.Body)
+		log.Printf("[Deploy] request: %s\n", string(body))

 		req := types.FunctionDeployment{}
 		err := json.Unmarshal(body, &req)
 		if err != nil {
-			log.Printf("[Deploy] - error parsing input: %s", err)
+			log.Printf("[Deploy] - error parsing input: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)

 			return
@ -75,15 +76,10 @@ func MakeDeployHandler(client *containerd.Client, cni gocni.CNI, secretMountPath
 		name := req.Service
 		ctx := namespaces.WithNamespace(context.Background(), namespace)

-		if err := preDeploy(client, 1); err != nil {
-			http.Error(w, err.Error(), http.StatusBadRequest)
-			log.Printf("[Deploy] error deploying %s, error: %s\n", name, err)
-			return
-		}
-
-		if err := deploy(ctx, req, client, cni, namespaceSecretMountPath, alwaysPull); err != nil {
-			log.Printf("[Deploy] error deploying %s, error: %s\n", name, err)
-			http.Error(w, err.Error(), http.StatusBadRequest)
+		deployErr := deploy(ctx, req, client, cni, namespaceSecretMountPath, alwaysPull)
+		if deployErr != nil {
+			log.Printf("[Deploy] error deploying %s, error: %s\n", name, deployErr)
+			http.Error(w, deployErr.Error(), http.StatusBadRequest)
 			return
 		}
 	}
@ -183,27 +179,8 @@ func deploy(ctx context.Context, req types.FunctionDeployment, client *container

 }

-// countFunctions returns the number of functions deployed along with a map with a count
-// in each namespace
-func countFunctions(client *containerd.Client) (int64, int64, error) {
-	count := int64(0)
-	namespaceCount := int64(0)
-
-	namespaces := ListNamespaces(client)
-
-	for _, namespace := range namespaces {
-		fns, err := ListFunctions(client, namespace)
-		if err != nil {
-			return 0, 0, err
-		}
-		namespaceCount++
-		count += int64(len(fns))
-	}
-
-	return count, namespaceCount, nil
-}
-
 func buildLabels(request *types.FunctionDeployment) (map[string]string, error) {
+	// Adapted from faas-swarm/handlers/deploy.go:buildLabels
 	labels := map[string]string{}

 	if request.Labels != nil {
@ -252,8 +229,9 @@ func createTask(ctx context.Context, container containerd.Container, cni gocni.C

 	log.Printf("%s has IP: %s.\n", name, ip)

-	if _, err := task.Wait(ctx); err != nil {
-		return errors.Wrapf(err, "Unable to wait for task to start: %s", name)
+	_, waitErr := task.Wait(ctx)
+	if waitErr != nil {
+		return errors.Wrapf(waitErr, "Unable to wait for task to start: %s", name)
 	}

 	if startErr := task.Start(ctx); startErr != nil {
@ -337,17 +315,3 @@ func withMemory(mem *specs.LinuxMemory) oci.SpecOpts {
 		return nil
 	}
 }
-
-func preDeploy(client *containerd.Client, additional int64) error {
-	count, countNs, err := countFunctions(client)
-	log.Printf("Function count: %d, Namespace count: %d\n", count, countNs)
-
-	if err != nil {
-		return err
-	} else if count+additional > faasdMaxFunctions {
-		return fmt.Errorf("the OpenFaaS CE EULA allows %d/%d function(s), upgrade to faasd Pro to continue", faasdMaxFunctions, count+additional)
-	} else if countNs > faasdMaxNs {
-		return fmt.Errorf("the OpenFaaS CE EULA allows %d/%d namespace(s), upgrade to faasd Pro to continue", faasdMaxNs, countNs)
-	}
-	return nil
-}
--- a/pkg/provider/handlers/function_list.go
+++ b/pkg/provider/handlers/function_list.go
@ -1,65 +0,0 @@
-package handlers
-
-import (
-	"context"
-	"errors"
-	"log"
-	"strings"
-	"time"
-
-	"github.com/containerd/containerd"
-	"github.com/containerd/containerd/namespaces"
-)
-
-type Function struct {
-	name        string
-	namespace   string
-	image       string
-	pid         uint32
-	replicas    int
-	IP          string
-	labels      map[string]string
-	annotations map[string]string
-	secrets     []string
-	envVars     map[string]string
-	envProcess  string
-	memoryLimit int64
-	createdAt   time.Time
-}
-
-// ListFunctions returns a map of all functions with running tasks on namespace
-func ListFunctions(client *containerd.Client, namespace string) (map[string]*Function, error) {
-
-	// Check if namespace exists, and it has the openfaas label
-	valid, err := validNamespace(client.NamespaceService(), namespace)
-	if err != nil {
-		return nil, err
-	}
-
-	if !valid {
-		return nil, errors.New("namespace not valid")
-	}
-
-	ctx := namespaces.WithNamespace(context.Background(), namespace)
-	functions := make(map[string]*Function)
-
-	containers, err := client.Containers(ctx)
-	if err != nil {
-		return functions, err
-	}
-
-	for _, c := range containers {
-		name := c.ID()
-		f, err := GetFunction(client, name, namespace)
-		if err != nil {
-			if !strings.Contains(err.Error(), "unable to get IP address for container") {
-				log.Printf("List functions, skipping: %s, error: %s", name, err)
-			}
-
-		} else {
-			functions[name] = &f
-		}
-	}
-
-	return functions, nil
-}
--- a/pkg/provider/handlers/function_get.go
+++ b/pkg/provider/handlers/function_get.go
@ -2,17 +2,71 @@ package handlers

 import (
 	"context"
+	"errors"
 	"fmt"
 	"log"
 	"strings"
+	"time"

 	"github.com/opencontainers/runtime-spec/specs-go"

 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/namespaces"
+	"github.com/openfaas/faasd/pkg"
+	faasd "github.com/openfaas/faasd/pkg"
 	"github.com/openfaas/faasd/pkg/cninetwork"
 )

+type Function struct {
+	name        string
+	namespace   string
+	image       string
+	pid         uint32
+	replicas    int
+	IP          string
+	labels      map[string]string
+	annotations map[string]string
+	secrets     []string
+	envVars     map[string]string
+	envProcess  string
+	memoryLimit int64
+	createdAt   time.Time
+}
+
+// ListFunctions returns a map of all functions with running tasks on namespace
+func ListFunctions(client *containerd.Client, namespace string) (map[string]*Function, error) {
+
+	// Check if namespace exists, and it has the openfaas label
+	valid, err := validNamespace(client.NamespaceService(), namespace)
+	if err != nil {
+		return nil, err
+	}
+
+	if !valid {
+		return nil, errors.New("namespace not valid")
+	}
+
+	ctx := namespaces.WithNamespace(context.Background(), namespace)
+	functions := make(map[string]*Function)
+
+	containers, err := client.Containers(ctx)
+	if err != nil {
+		return functions, err
+	}
+
+	for _, c := range containers {
+		name := c.ID()
+		f, err := GetFunction(client, name, namespace)
+		if err != nil {
+			log.Printf("skipping %s, error: %s", name, err)
+		} else {
+			functions[name] = &f
+		}
+	}
+
+	return functions, nil
+}
+
 // GetFunction returns a function that matches name
 func GetFunction(client *containerd.Client, name string, namespace string) (Function, error) {
 	ctx := namespaces.WithNamespace(context.Background(), namespace)
@ -142,6 +196,44 @@ func buildLabelsAndAnnotations(ctrLabels map[string]string) (map[string]string,
 	return labels, annotations
 }

+func ListNamespaces(client *containerd.Client) []string {
+	set := []string{}
+	store := client.NamespaceService()
+	namespaces, err := store.List(context.Background())
+	if err != nil {
+		log.Printf("Error listing namespaces: %s", err.Error())
+		set = append(set, faasd.DefaultFunctionNamespace)
+		return set
+	}
+
+	for _, namespace := range namespaces {
+		labels, err := store.Labels(context.Background(), namespace)
+		if err != nil {
+			log.Printf("Error listing label for namespace %s: %s", namespace, err.Error())
+			continue
+		}
+
+		if _, found := labels[pkg.NamespaceLabel]; found {
+			set = append(set, namespace)
+		}
+
+		if !findNamespace(faasd.DefaultFunctionNamespace, set) {
+			set = append(set, faasd.DefaultFunctionNamespace)
+		}
+	}
+
+	return set
+}
+
+func findNamespace(target string, items []string) bool {
+	for _, n := range items {
+		if n == target {
+			return true
+		}
+	}
+	return false
+}
+
 func readMemoryLimitFromSpec(spec *specs.Spec) int64 {
 	if spec.Linux == nil || spec.Linux.Resources == nil || spec.Linux.Resources.Memory == nil || spec.Linux.Resources.Memory.Limit == nil {
 		return 0
--- a/pkg/provider/handlers/functions_test.go
+++ b/pkg/provider/handlers/functions_test.go
--- a/pkg/provider/handlers/info.go
+++ b/pkg/provider/handlers/info.go
@ -12,10 +12,10 @@ const (
 	OrchestrationIdentifier = "containerd"

 	// ProviderName name of the provider
-	ProviderName = "faasd-ce"
+	ProviderName = "faasd"
 )

-// MakeInfoHandler creates handler for /system/info endpoint
+//MakeInfoHandler creates handler for /system/info endpoint
 func MakeInfoHandler(version, sha string) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		if r.Body != nil {
@ -31,8 +31,8 @@ func MakeInfoHandler(version, sha string) http.HandlerFunc {
 			},
 		}

-		jsonOut, err := json.Marshal(infoResponse)
-		if err != nil {
+		jsonOut, marshalErr := json.Marshal(infoResponse)
+		if marshalErr != nil {
 			w.WriteHeader(http.StatusInternalServerError)
 			return
 		}
@ -42,6 +42,3 @@ func MakeInfoHandler(version, sha string) http.HandlerFunc {
 		w.Write(jsonOut)
 	}
 }
-
-const faasdMaxFunctions = 15
-const faasdMaxNs = 1
--- a/pkg/provider/handlers/namespaces.go
+++ b/pkg/provider/handlers/namespaces.go
@ -1,14 +1,10 @@
 package handlers

 import (
-	"context"
 	"encoding/json"
-	"log"
 	"net/http"

 	"github.com/containerd/containerd"
-	"github.com/openfaas/faasd/pkg"
-	faasd "github.com/openfaas/faasd/pkg"
 )

 func MakeNamespacesLister(client *containerd.Client) func(w http.ResponseWriter, r *http.Request) {
@ -20,43 +16,3 @@ func MakeNamespacesLister(client *containerd.Client) func(w http.ResponseWriter,
 		w.Write(body)
 	}
 }
-
-func ListNamespaces(client *containerd.Client) []string {
-	set := []string{faasd.DefaultFunctionNamespace}
-
-	store := client.NamespaceService()
-
-	namespaces, err := store.List(context.Background())
-	if err != nil {
-		log.Printf("Error listing namespaces: %s", err.Error())
-		return set
-	}
-
-	for _, namespace := range namespaces {
-		labels, err := store.Labels(context.Background(), namespace)
-		if err != nil {
-			log.Printf("Error listing label for namespace %s: %s", namespace, err.Error())
-			continue
-		}
-
-		if _, found := labels[pkg.NamespaceLabel]; found {
-			set = append(set, namespace)
-		}
-
-	}
-
-	if len(set) == 0 {
-		set = append(set, faasd.DefaultFunctionNamespace)
-	}
-
-	return set
-}
-
-func findNamespace(target string, items []string) bool {
-	for _, n := range items {
-		if n == target {
-			return true
-		}
-	}
-	return false
-}
--- a/pkg/provider/handlers/read.go
+++ b/pkg/provider/handlers/read.go
@ -31,7 +31,7 @@ func MakeReadHandler(client *containerd.Client) func(w http.ResponseWriter, r *h
 		res := []types.FunctionStatus{}
 		fns, err := ListFunctions(client, lookupNamespace)
 		if err != nil {
-			log.Printf("[Read] error listing functions. Error: %s", err)
+			log.Printf("[Read] error listing functions. Error: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)
 			return
 		}
--- a/pkg/provider/handlers/scale.go
+++ b/pkg/provider/handlers/scale.go
@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"log"
 	"net/http"

@ -27,11 +27,12 @@ func MakeReplicaUpdateHandler(client *containerd.Client, cni gocni.CNI) func(w h

 		defer r.Body.Close()

-		body, _ := io.ReadAll(r.Body)
+		body, _ := ioutil.ReadAll(r.Body)
+		log.Printf("[Scale] request: %s\n", string(body))

 		req := types.ScaleServiceRequest{}
 		if err := json.Unmarshal(body, &req); err != nil {
-			log.Printf("[Scale] error parsing input: %s", err)
+			log.Printf("[Scale] error parsing input: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)

 			return
@ -57,7 +58,7 @@ func MakeReplicaUpdateHandler(client *containerd.Client, cni gocni.CNI) func(w h
 		name := req.ServiceName

 		if _, err := GetFunction(client, name, namespace); err != nil {
-			msg := fmt.Sprintf("function: %s.%s not found", name, namespace)
+			msg := fmt.Sprintf("service %s not found", name)
 			log.Printf("[Scale] %s\n", msg)
 			http.Error(w, msg, http.StatusNotFound)
 			return
@ -96,24 +97,32 @@ func MakeReplicaUpdateHandler(client *containerd.Client, cni gocni.CNI) func(w h

 		createNewTask := false

+		// Scale to zero
 		if req.Replicas == 0 {
-			http.Error(w, "replicas must > 0 for faasd CE", http.StatusBadRequest)
-			return
+			// If a task is running, pause it
+			if taskExists && taskStatus.Status == containerd.Running {
+				if pauseErr := task.Pause(ctx); pauseErr != nil {
+					wrappedPauseErr := fmt.Errorf("error pausing task %s, error: %s", name, pauseErr)
+					log.Printf("[Scale] %s\n", wrappedPauseErr.Error())
+					http.Error(w, wrappedPauseErr.Error(), http.StatusNotFound)
+					return
+				}
+			}
 		}

 		if taskExists {
 			if taskStatus != nil {
 				if taskStatus.Status == containerd.Paused {
-					if _, err := task.Delete(ctx); err != nil {
-						log.Printf("[Scale] error deleting paused task %s, error: %s\n", name, err)
-						http.Error(w, err.Error(), http.StatusBadRequest)
+					if resumeErr := task.Resume(ctx); resumeErr != nil {
+						log.Printf("[Scale] error resuming task %s, error: %s\n", name, resumeErr)
+						http.Error(w, resumeErr.Error(), http.StatusBadRequest)
 						return
 					}
 				} else if taskStatus.Status == containerd.Stopped {
 					// Stopped tasks cannot be restarted, must be removed, and created again
-					if _, err := task.Delete(ctx); err != nil {
-						log.Printf("[Scale] error deleting stopped task %s, error: %s\n", name, err)
-						http.Error(w, err.Error(), http.StatusBadRequest)
+					if _, delErr := task.Delete(ctx); delErr != nil {
+						log.Printf("[Scale] error deleting stopped task %s, error: %s\n", name, delErr)
+						http.Error(w, delErr.Error(), http.StatusBadRequest)
 						return
 					}
 					createNewTask = true
--- a/pkg/provider/handlers/secret.go
+++ b/pkg/provider/handlers/secret.go
@ -3,7 +3,7 @@ package handlers
 import (
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"log"
 	"net/http"
 	"os"
@ -71,7 +71,7 @@ func listSecrets(store provider.Labeller, w http.ResponseWriter, r *http.Request
 	}

 	if err != nil {
-		log.Printf("[Secret] Error listing secrets: %s ", err)
+		fmt.Printf("Error Occured: %s \n", err)
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
@ -116,7 +116,7 @@ func createSecret(w http.ResponseWriter, r *http.Request, mountPath string) {
 		data = []byte(secret.Value)
 	}

-	err = os.WriteFile(path.Join(mountPath, secret.Name), data, secretFilePermission)
+	err = ioutil.WriteFile(path.Join(mountPath, secret.Name), data, secretFilePermission)

 	if err != nil {
 		log.Printf("[secret] error %s", err.Error())
@ -147,7 +147,7 @@ func deleteSecret(w http.ResponseWriter, r *http.Request, mountPath string) {

 func parseSecret(r *http.Request) (types.Secret, error) {
 	secret := types.Secret{}
-	bytesOut, err := io.ReadAll(r.Body)
+	bytesOut, err := ioutil.ReadAll(r.Body)
 	if err != nil {
 		return secret, err
 	}
--- a/pkg/provider/handlers/secret_test.go
+++ b/pkg/provider/handlers/secret_test.go
@ -3,7 +3,7 @@ package handlers
 import (
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"os"
@ -232,7 +232,7 @@ func TestListSecrets(t *testing.T) {
 				t.Fatalf("want error message: %q, but got %q", tc.err, w.Body.String())
 			}

-			body, err := io.ReadAll(resp.Body)
+			body, err := ioutil.ReadAll(resp.Body)
 			if err != nil {
 				t.Fatalf("can't read response of list %v", err)
 			}
--- a/pkg/provider/handlers/update.go
+++ b/pkg/provider/handlers/update.go
@ -4,7 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io"
+	"io/ioutil"
 	"log"
 	"net/http"

@ -28,17 +28,17 @@ func MakeUpdateHandler(client *containerd.Client, cni gocni.CNI, secretMountPath

 		defer r.Body.Close()

-		body, _ := io.ReadAll(r.Body)
+		body, _ := ioutil.ReadAll(r.Body)
+		log.Printf("[Update] request: %s\n", string(body))

 		req := types.FunctionDeployment{}
 		err := json.Unmarshal(body, &req)
 		if err != nil {
-			log.Printf("[Update] error parsing input: %s", err)
+			log.Printf("[Update] error parsing input: %s\n", err)
 			http.Error(w, err.Error(), http.StatusBadRequest)

 			return
 		}
-
 		name := req.Service
 		namespace := getRequestNamespace(req.Namespace)

@ -54,17 +54,11 @@ func MakeUpdateHandler(client *containerd.Client, cni gocni.CNI, secretMountPath
 			return
 		}

-		if err := preDeploy(client, int64(0)); err != nil {
-			http.Error(w, err.Error(), http.StatusBadRequest)
-			log.Printf("[Deploy] error deploying %s, error: %s\n", name, err)
-			return
-		}
-
 		namespaceSecretMountPath := getNamespaceSecretMountPath(secretMountPath, namespace)

 		function, err := GetFunction(client, name, namespace)
 		if err != nil {
-			msg := fmt.Sprintf("function: %s.%s not found", name, namespace)
+			msg := fmt.Sprintf("service %s not found", name)
 			log.Printf("[Update] %s\n", msg)
 			http.Error(w, msg, http.StatusNotFound)
 			return
--- a/pkg/proxy.go
+++ b/pkg/proxy.go
@ -86,7 +86,7 @@ func (p *Proxy) Start() error {
 			conn.Close()

 			log.Printf("Unable to dial: %s, error: %s", upstreamAddr, err.Error())
-			continue
+			return err
 		}

 		go pipe(conn, upstream)
--- a/pkg/proxy_test.go
+++ b/pkg/proxy_test.go
@ -2,7 +2,7 @@ package pkg

 import (
 	"fmt"
-	"io"
+	"io/ioutil"
 	"log"
 	"net/http"
 	"net/http/httptest"
@ -61,7 +61,7 @@ func Test_Proxy_ToPrivateServer(t *testing.T) {
 			time.Sleep(time.Millisecond * 100)
 		} else {

-			resBody, _ := io.ReadAll(res.Body)
+			resBody, _ := ioutil.ReadAll(res.Body)
 			if string(resBody) != string(wantBody) {
 				t.Errorf("want %s, but got %s in body", string(wantBody), string(resBody))
 			}
--- a/pkg/service/service.go
+++ b/pkg/service/service.go
@ -6,7 +6,6 @@ import (
 	"log"
 	"os"
 	"path/filepath"
-	"strings"
 	"sync"
 	"time"

@ -46,24 +45,10 @@ func Remove(ctx context.Context, client *containerd.Client, name string) error {
 				log.Printf("Status of %s is: %s\n", name, status.Status)
 			}

-			var gracePeriod = time.Second * 30
-			spec, err := t.Spec(ctx)
-			if err == nil {
-				for _, p := range spec.Process.Env {
-					k, v, ok := strings.Cut(p, "=")
-					if ok && k == "grace_period" {
-						periodVal, err := time.ParseDuration(v)
-						if err == nil {
-							gracePeriod = periodVal
-						}
-					}
-				}
-			}
-
-			if err = killTask(ctx, t, gracePeriod); err != nil {
+			log.Printf("Need to kill task: %s\n", name)
+			if err = killTask(ctx, t); err != nil {
 				return fmt.Errorf("error killing task %s, %s, %w", container.ID(), name, err)
 			}
-
 		}

 		if err := container.Delete(ctx, containerd.WithSnapshotCleanup); err != nil {
@ -81,13 +66,14 @@ func Remove(ctx context.Context, client *containerd.Client, name string) error {
 }

 // Adapted from Stellar - https://github.com/stellar
-func killTask(ctx context.Context, task containerd.Task, gracePeriod time.Duration) error {
+func killTask(ctx context.Context, task containerd.Task) error {
+
+	killTimeout := 30 * time.Second

 	wg := &sync.WaitGroup{}
 	wg.Add(1)
 	var err error

-	waited := false
 	go func() {
 		defer wg.Done()
 		if task != nil {
@ -103,39 +89,22 @@ func killTask(ctx context.Context, task containerd.Task, gracePeriod time.Durati

 			select {
 			case <-wait:
-				waited = true
+				task.Delete(ctx)
 				return
-			case <-time.After(gracePeriod):
-				log.Printf("Sending SIGKILL to: %s after: %s", task.ID(), gracePeriod.Round(time.Second).String())
+			case <-time.After(killTimeout):
 				if err := task.Kill(ctx, unix.SIGKILL, containerd.WithKillAll); err != nil {
-					log.Printf("error sending SIGKILL to task: %s", err)
+					log.Printf("error force killing container task: %s", err)
 				}
-
 				return
 			}
 		}
 	}()
 	wg.Wait()

-	if task != nil {
-		if !waited {
-			wait, err := task.Wait(ctx)
-			if err != nil {
-				log.Printf("error waiting on task after kill: %s", err)
-			}
-
-			<-wait
-		}
-
-		if _, err := task.Delete(ctx); err != nil {
-			return err
-		}
-	}
-
 	return err
 }

-func getResolver(configFile *configfile.ConfigFile) (remotes.Resolver, error) {
+func getResolver(ctx context.Context, configFile *configfile.ConfigFile) (remotes.Resolver, error) {
 	// credsFunc is based on https://github.com/moby/buildkit/blob/0b130cca040246d2ddf55117eeff34f546417e40/session/auth/authprovider/authprovider.go#L35
 	credFunc := func(host string) (string, string, error) {
 		if host == "registry-1.docker.io" {
@ -170,7 +139,7 @@ func PrepareImage(ctx context.Context, client *containerd.Client, imageName, sna
 		if err != nil {
 			return nil, err
 		}
-		resolver, err = getResolver(configFile)
+		resolver, err = getResolver(ctx, configFile)
 		if err != nil {
 			return empty, err
 		}
--- a/pkg/supervisor.go
+++ b/pkg/supervisor.go
@ -3,6 +3,7 @@ package pkg
 import (
 	"context"
 	"fmt"
+	"io/ioutil"
 	"log"
 	"os"
 	"path"
@ -18,7 +19,7 @@ import (
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/oci"
 	gocni "github.com/containerd/go-cni"
-	"github.com/distribution/reference"
+	"github.com/docker/distribution/reference"
 	"github.com/openfaas/faasd/pkg/cninetwork"
 	"github.com/openfaas/faasd/pkg/service"
 	"github.com/pkg/errors"
@ -101,7 +102,7 @@ func (s *Supervisor) Start(svcs []Service) error {
 127.0.0.1	localhost
 %s	faasd-provider`, gw)

-	writeHostsErr := os.WriteFile(path.Join(wd, "hosts"),
+	writeHostsErr := ioutil.WriteFile(path.Join(wd, "hosts"),
 		[]byte(hosts), workingDirectoryPermission)

 	if writeHostsErr != nil {
@ -227,7 +228,7 @@ func (s *Supervisor) Start(svcs []Service) error {
 		)

 		if err != nil {
-			log.Printf("Error creating container: %s", err)
+			log.Printf("Error creating container: %s\n", err)
 			return err
 		}

@ -235,7 +236,7 @@ func (s *Supervisor) Start(svcs []Service) error {

 		task, err := newContainer.NewTask(ctx, cio.BinaryIO("/usr/local/bin/faasd", nil))
 		if err != nil {
-			log.Printf("Error creating task: %s", err)
+			log.Printf("Error creating task: %s\n", err)
 			return err
 		}

@ -254,7 +255,7 @@ func (s *Supervisor) Start(svcs []Service) error {

 		log.Printf("%s has IP: %s\n", newContainer.ID(), ip)

-		hosts, err := os.ReadFile("hosts")
+		hosts, err := ioutil.ReadFile("hosts")
 		if err != nil {
 			log.Printf("Unable to read hosts file: %s\n", err.Error())
 		}
@ -263,12 +264,12 @@ func (s *Supervisor) Start(svcs []Service) error {
 %s	%s
 `, ip, svc.Name))

-		if err := os.WriteFile("hosts", hosts, workingDirectoryPermission); err != nil {
+		if err := ioutil.WriteFile("hosts", hosts, workingDirectoryPermission); err != nil {
 			log.Printf("Error writing file: %s %s\n", "hosts", err)
 		}

 		if _, err := task.Wait(ctx); err != nil {
-			log.Printf("Task wait error: %s", err)
+			log.Printf("Task wait error: %s\n", err)
 			return err
 		}

@ -276,7 +277,7 @@ func (s *Supervisor) Start(svcs []Service) error {
 		// log.Println("Exited: ", exitStatusC)

 		if err = task.Start(ctx); err != nil {
-			log.Printf("Task start error: %s", err)
+			log.Printf("Task start error: %s\n", err)
 			return err
 		}
 	}
@ -399,7 +400,7 @@ func LoadComposeFile(wd string, file string) (*compose.Config, error) {
 func LoadComposeFileWithArch(wd string, file string, archGetter ArchGetter) (*compose.Config, error) {

 	file = path.Join(wd, file)
-	b, err := os.ReadFile(file)
+	b, err := ioutil.ReadFile(file)
 	if err != nil {
 		return nil, err
 	}
--- a/pkg/version.go
+++ b/pkg/version.go
@ -1,17 +1 @@
 package pkg
-
-// These values will be injected into these variables at the build time.
-var (
-	// GitCommit Git Commit SHA
-	GitCommit string
-	// Version version of the CLI
-	Version string
-)
-
-// GetVersion get latest version
-func GetVersion() string {
-	if len(Version) == 0 {
-		return "dev"
-	}
-	return Version
-}
--- a/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go
@ -10,28 +10,6 @@ import (
 	"github.com/sirupsen/logrus"
 )

-// EndpointState represents the states of an HNS Endpoint lifecycle.
-type EndpointState uint16
-
-// EndpointState const
-// The lifecycle of an Endpoint goes through created, attached, AttachedSharing - endpoint is being shared with other containers,
-// detached, after being attached, degraded and finally destroyed.
-// Note: This attribute is used by calico to define stale containers and is dependent on HNS v1 api, if we move to HNS v2 api we will need
-// to update the current calico code and cordinate the change with calico. Reach out to Microsoft to facilate the change via HNS.
-const (
-	Uninitialized   EndpointState = iota
-	Created         EndpointState = 1
-	Attached        EndpointState = 2
-	AttachedSharing EndpointState = 3
-	Detached        EndpointState = 4
-	Degraded        EndpointState = 5
-	Destroyed       EndpointState = 6
-)
-
-func (es EndpointState) String() string {
-	return [...]string{"Uninitialized", "Attached", "AttachedSharing", "Detached", "Degraded", "Destroyed"}[es]
-}
-
 // HNSEndpoint represents a network endpoint in HNS
 type HNSEndpoint struct {
 	Id                 string            `json:"ID,omitempty"`
@ -56,7 +34,6 @@ type HNSEndpoint struct {
 	Namespace          *Namespace        `json:",omitempty"`
 	EncapOverhead      uint16            `json:",omitempty"`
 	SharedContainers   []string          `json:",omitempty"`
-	State              EndpointState     `json:",omitempty"`
 }

 // SystemType represents the type of the system on which actions are done
--- a/vendor/github.com/Microsoft/hcsshim/internal/hns/hnspolicy.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hns/hnspolicy.go
@ -57,10 +57,9 @@ type PaPolicy struct {

 type OutboundNatPolicy struct {
 	Policy
-	VIP              string   `json:"VIP,omitempty"`
-	Exceptions       []string `json:"ExceptionList,omitempty"`
-	Destinations     []string `json:",omitempty"`
-	MaxPortPoolUsage uint16   `json:",omitempty"`
+	VIP          string   `json:"VIP,omitempty"`
+	Exceptions   []string `json:"ExceptionList,omitempty"`
+	Destinations []string `json:",omitempty"`
 }

 type ProxyPolicy struct {
--- a/vendor/github.com/containerd/containerd/.cirrus.yml
+++ b/vendor/github.com/containerd/containerd/.cirrus.yml
@ -0,0 +1,82 @@
+# Cirrus CI gives open-source projects free 16.0 CPUs,
+# we use 4 CPUs x 3 tasks = 12 CPUs.
+# https://cirrus-ci.org/faq/#are-there-any-limits
+#
+# Undocumented constraints;
+# - The maximum memory limit is 4G times the number of CPUs.
+# - The number of CPUs should be multiple of 2.
+
+task:
+  name: Vagrant
+
+  compute_engine_instance:
+    image_project: cirrus-images
+    image: family/docker-kvm
+    platform: linux
+    nested_virtualization: true
+    cpu: 4
+    memory: 16G
+
+  env:
+    GOTEST: gotestsum --
+    # By default, Cirrus CI doesn't have HOME defined
+    HOME: /root
+    matrix:
+      BOX: fedora/37-cloud-base
+      # v7.0.0 does not boot. v6.0.0 was not released.
+      BOX: rockylinux/8@5.0.0
+  install_libvirt_vagrant_script: |
+    # if another process is keeping a lock, wait for 60 seconds for it to release the lock.
+    apt-get -o DPkg::Lock::Timeout=60 update
+    apt-get -o DPkg::Lock::Timeout=60 install -y libvirt-daemon libvirt-daemon-system vagrant vagrant-libvirt
+    systemctl enable --now libvirtd
+
+  vagrant_cache:
+    folder: /root/.vagrant.d
+    fingerprint_script: uname --kernel-release --kernel-version && cat Vagrantfile
+
+  vagrant_up_script: |
+    vagrant up --no-tty
+
+  integration_script: |
+    vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-integration
+
+  cri_integration_script: |
+    vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-cri-integration
+
+  cri_test_script: |
+    vagrant up --provision-with=selinux,install-runc,install-gotestsum,test-cri
+
+task:
+  name: CGroupsV2 - rootless CRI test
+
+  env:
+    HOME: /root
+
+  compute_engine_instance:
+    image_project: cirrus-images
+    image: family/docker-kvm
+    platform: linux
+    nested_virtualization: true
+    cpu: 4
+    memory: 16G
+
+  install_libvirt_vagrant_script: |
+    # if another process is keeping a lock, wait for 60 seconds for it to release the lock.
+    apt-get -o DPkg::Lock::Timeout=60 update
+    apt-get -o DPkg::Lock::Timeout=60 install -y libvirt-daemon libvirt-daemon-system vagrant vagrant-libvirt
+    systemctl enable --now libvirtd
+
+  vagrant_cache:
+    folder: /root/.vagrant.d
+    fingerprint_script: uname -a; cat Vagrantfile
+
+  vagrant_up_script: |
+    vagrant up --provision-with=install-rootless-podman --no-tty
+
+  podman_build_script: |
+    # Execute rootless podman to create the UserNS env
+    vagrant ssh -- podman build --target cri-in-userns -t cri-in-userns -f /vagrant/contrib/Dockerfile.test /vagrant
+
+  test_script: |
+    vagrant ssh -- podman run --rm --privileged cri-in-userns
--- a/vendor/github.com/containerd/containerd/.golangci.yml
+++ b/vendor/github.com/containerd/containerd/.golangci.yml
@ -1,6 +1,5 @@
 linters:
  enable:
-    - depguard      # Checks for imports that shouldn't be used.
    - exportloopref # Checks for pointers to enclosing loop variables
    - gofmt
    - goimports
@ -62,16 +61,6 @@ issues:


 linters-settings:
-  depguard:
-    rules:
-      main:
-        deny:
-          - pkg: "github.com/containerd/containerd/errdefs"
-            desc: The containerd errdefs package was migrated to a separate module. Use github.com/containerd/errdefs instead.
-          - pkg: "github.com/containerd/containerd/log"
-            desc: The containerd log package was migrated to a separate module. Use github.com/containerd/log instead.
-          - pkg: "github.com/containerd/containerd/platforms"
-            desc: The containerd platforms package was migrated to a separate module. Use github.com/containerd/platforms instead.
  gosec:
    # The following issues surfaced when `gosec` linter
    # was enabled. They are temporarily excluded to unblock
--- a/vendor/github.com/containerd/containerd/BUILDING.md
+++ b/vendor/github.com/containerd/containerd/BUILDING.md
@ -15,7 +15,7 @@ This doc includes:
 To build the `containerd` daemon, and the `ctr` simple test client, the following build system dependencies are required:


-* Go 1.22.x or above
+* Go 1.21.x or above
 * Protoc 3.x compiler and headers (download at the [Google protobuf releases page](https://github.com/protocolbuffers/protobuf/releases))
 * Btrfs headers and libraries for your distribution. Note that building the btrfs driver can be disabled via the build tag `no_btrfs`, removing this dependency.

--- a/vendor/github.com/containerd/containerd/Makefile
+++ b/vendor/github.com/containerd/containerd/Makefile
@ -149,7 +149,7 @@ GOTEST ?= $(GO) test
 OUTPUTDIR = $(join $(ROOTDIR), _output)
 CRIDIR=$(OUTPUTDIR)/cri

-.PHONY: clean all AUTHORS build binaries test integration generate protos check-protos coverage ci check help install uninstall vendor release static-release mandir install-man genman install-cri-deps cri-release cri-cni-release cri-integration install-deps bin/cri-integration.test remove-replace clean-vendor
+.PHONY: clean all AUTHORS build binaries test integration generate protos check-protos coverage ci check help install uninstall vendor release static-release mandir install-man genman install-cri-deps cri-release cri-cni-release cri-integration install-deps bin/cri-integration.test
 .DEFAULT: default

 # Forcibly set the default goal to all, in case an include above brought in a rule definition.
@ -180,8 +180,6 @@ protos: bin/protoc-gen-go-fieldpath
 	@mv ${TMPDIR}/vendor ${ROOTDIR}
 	@rm -rf ${TMPDIR}
 	go-fix-acronym -w -a '(Id|Io|Uuid|Os)$$' $(shell find api/ runtime/ -name '*.pb.go')
-	@test -z "$$(git status --short | grep "api/next.pb.txt" | tee /dev/stderr)" || \
-		$(GO) mod edit -replace=github.com/containerd/containerd/api=./api

 check-protos: protos ## check if protobufs needs to be generated again
 	@echo "$(WHALE) $@"
@ -472,31 +470,23 @@ root-coverage: ## generate coverage profiles for unit tests that require root
 		fi; \
 	done )

-remove-replace:
-	@echo "$(WHALE) $@"
-	@$(GO) mod edit -dropreplace=github.com/containerd/containerd/api
-
 vendor: ## ensure all the go.mod/go.sum files are up-to-date including vendor/ directory
 	@echo "$(WHALE) $@"
 	@$(GO) mod tidy
 	@$(GO) mod vendor
 	@$(GO) mod verify
 	@(cd ${ROOTDIR}/integration/client && ${GO} mod tidy)
-	@(cd ${ROOTDIR}/api && ${GO} mod tidy)

 verify-vendor: ## verify if all the go.mod/go.sum files are up-to-date
 	@echo "$(WHALE) $@"
 	$(eval TMPDIR := $(shell mktemp -d))
 	@cp -R ${ROOTDIR} ${TMPDIR}
 	@(cd ${TMPDIR}/containerd && ${GO} mod tidy)
-	@(cd ${TMPDIR}/containerd/api && ${GO} mod tidy)
 	@(cd ${TMPDIR}/containerd/integration/client && ${GO} mod tidy)
 	@diff -r -u -q ${ROOTDIR} ${TMPDIR}/containerd
 	@rm -rf ${TMPDIR}
 	@${ROOTDIR}/script/verify-go-modules.sh integration/client

-clean-vendor: remove-replace vendor
-

 help: ## this help
 	@awk 'BEGIN {FS = ":.*?## "} /^[a-zA-Z_-]+:.*?## / {printf "\033[36m%-30s\033[0m %s\n", $$1, $$2}' $(MAKEFILE_LIST) | sort
--- a/vendor/github.com/containerd/containerd/Vagrantfile
+++ b/vendor/github.com/containerd/containerd/Vagrantfile
@ -17,7 +17,7 @@

 # Vagrantfile for Fedora and EL
 Vagrant.configure("2") do |config|
-  config.vm.box = ENV["BOX"] ? ENV["BOX"].split("@")[0] : "fedora/39-cloud-base"
+  config.vm.box = ENV["BOX"] ? ENV["BOX"].split("@")[0] : "fedora/37-cloud-base"
  # BOX_VERSION is deprecated. Use "BOX=<BOX>@<BOX_VERSION>".
  config.vm.box_version = ENV["BOX_VERSION"] || (ENV["BOX"].split("@")[1] if ENV["BOX"])

@ -29,13 +29,11 @@ Vagrant.configure("2") do |config|
    v.cpus = cpus
    # Needs env var VAGRANT_EXPERIMENTAL="disks"
    o.vm.disk :disk, size: "#{disk_size}GB", primary: true
-    v.customize ["modifyvm", :id, "--firmware", "efi"]
  end
  config.vm.provider :libvirt do |v|
    v.memory = memory
    v.cpus = cpus
    v.machine_virtual_size = disk_size
-    v.loader = "/usr/share/OVMF/OVMF_CODE.fd"
  end

  config.vm.synced_folder ".", "/vagrant", type: "rsync"
@ -104,7 +102,7 @@ EOF
  config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
    sh.upload_path = "/tmp/vagrant-install-golang"
    sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.22.7",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.21.11",
    }
    sh.inline = <<~SHELL
        #!/usr/bin/env bash
@ -328,4 +326,29 @@ EOF
    SHELL
  end

+  # Rootless Podman is used for testing CRI-in-UserNS
+  # (We could use rootless nerdctl, but we are using Podman here because it is available in dnf)
+  config.vm.provision "install-rootless-podman", type: "shell", run: "never" do |sh|
+    sh.upload_path = "/tmp/vagrant-install-rootless-podman"
+    sh.inline = <<~SHELL
+        #!/usr/bin/env bash
+        set -eux -o pipefail
+        # Delegate cgroup v2 controllers to rootless
+        mkdir -p /etc/systemd/system/user@.service.d
+        cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF
+[Service]
+Delegate=yes
+EOF
+        systemctl daemon-reload
+        # Install Podman
+        dnf install -y podman
+        # Configure Podman to resolve `golang` to `docker.io/library/golang`
+        mkdir -p /etc/containers
+        cat > /etc/containers/registries.conf <<EOF
+[registries.search]
+registries = ['docker.io']
+EOF
+    SHELL
+  end
+
 end
--- a/vendor/github.com/containerd/containerd/api/LICENSE
+++ b/vendor/github.com/containerd/containerd/api/LICENSE
@ -1,191 +0,0 @@
-
-                                 Apache License
-                           Version 2.0, January 2004
-                        https://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   Copyright The containerd Authors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       https://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--- a/vendor/github.com/containerd/containerd/api/runtime/sandbox/v1/doc.go
+++ b/vendor/github.com/containerd/containerd/api/runtime/sandbox/v1/doc.go
@ -15,9 +15,3 @@
 */

 package sandbox
-
-// Not implemented types introduced in later versions and included for API compatibility
-// Use of these types should only use not implemented errors
-
-type SandboxMetricsRequest struct{}
-type SandboxMetricsResponse struct{}
--- a/vendor/github.com/containerd/containerd/api/services/events/v1/events.pb.go
+++ b/vendor/github.com/containerd/containerd/api/services/events/v1/events.pb.go
@ -22,7 +22,7 @@
 package events

 import (
-	_ "github.com/containerd/containerd/api/types"
+	_ "github.com/containerd/containerd/protobuf/plugin"
 	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
 	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
 	anypb "google.golang.org/protobuf/types/known/anypb"
@ -268,63 +268,63 @@ var file_github_com_containerd_containerd_api_services_events_v1_events_proto_ra
 	0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x76, 0x31, 0x2f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
 	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x1d, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
 	0x72, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e,
-	0x74, 0x73, 0x2e, 0x76, 0x31, 0x1a, 0x3a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x74, 0x73, 0x2e, 0x76, 0x31, 0x1a, 0x40, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
 	0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e,
-	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65,
-	0x73, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f,
-	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d,
-	0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x52, 0x0a, 0x0e, 0x50, 0x75,
-	0x62, 0x6c, 0x69, 0x73, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x14, 0x0a, 0x05,
-	0x74, 0x6f, 0x70, 0x69, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x70,
-	0x69, 0x63, 0x12, 0x2a, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x22, 0x55,
-	0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x12, 0x43, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x27, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
-	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e,
-	0x76, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x52, 0x08, 0x65, 0x6e, 0x76,
-	0x65, 0x6c, 0x6f, 0x70, 0x65, 0x22, 0x2c, 0x0a, 0x10, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69,
-	0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x66, 0x69, 0x6c,
-	0x74, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x66, 0x69, 0x6c, 0x74,
-	0x65, 0x72, 0x73, 0x22, 0xaa, 0x01, 0x0a, 0x08, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65,
-	0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
-	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61,
-	0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6e,
-	0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x70, 0x69,
-	0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x12, 0x2a,
-	0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x41, 0x6e, 0x79, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x3a, 0x04, 0x80, 0xb9, 0x1f, 0x01,
-	0x32, 0x95, 0x02, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x50, 0x0a, 0x07, 0x50,
-	0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
-	0x65, 0x72, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65,
-	0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x50, 0x0a,
-	0x07, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69, 0x6e, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74,
+	0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70, 0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a,
+	0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x22, 0x52, 0x0a, 0x0e, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x05, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x12, 0x2a, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e,
+	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x65,
+	0x76, 0x65, 0x6e, 0x74, 0x22, 0x55, 0x0a, 0x0e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x43, 0x0a, 0x08, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f,
+	0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61,
 	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x65,
-	0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12,
-	0x67, 0x0a, 0x09, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x12, 0x2f, 0x2e, 0x63,
+	0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70,
+	0x65, 0x52, 0x08, 0x65, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x22, 0x2c, 0x0a, 0x10, 0x53,
+	0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x18, 0x0a, 0x07, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x09,
+	0x52, 0x07, 0x66, 0x69, 0x6c, 0x74, 0x65, 0x72, 0x73, 0x22, 0xaa, 0x01, 0x0a, 0x08, 0x45, 0x6e,
+	0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x12, 0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x14,
+	0x0a, 0x05, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74,
+	0x6f, 0x70, 0x69, 0x63, 0x12, 0x2a, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74,
+	0x3a, 0x04, 0x80, 0xb9, 0x1f, 0x01, 0x32, 0x95, 0x02, 0x0a, 0x06, 0x45, 0x76, 0x65, 0x6e, 0x74,
+	0x73, 0x12, 0x50, 0x0a, 0x07, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x73, 0x68, 0x12, 0x2d, 0x2e, 0x63,
 	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63,
-	0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x53, 0x75, 0x62,
-	0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e,
-	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76, 0x69,
-	0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e,
-	0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x30, 0x01, 0x42, 0x40, 0x5a, 0x3e, 0x67, 0x69, 0x74, 0x68,
-	0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
-	0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69,
-	0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
-	0x2f, 0x76, 0x31, 0x3b, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x75, 0x62,
+	0x6c, 0x69, 0x73, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x12, 0x50, 0x0a, 0x07, 0x46, 0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x12, 0x2d,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x73, 0x65, 0x72, 0x76,
+	0x69, 0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x46,
+	0x6f, 0x72, 0x77, 0x61, 0x72, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x67, 0x0a, 0x09, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69,
+	0x62, 0x65, 0x12, 0x2f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x62, 0x65, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x27, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2e, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2e, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x45, 0x6e, 0x76, 0x65, 0x6c, 0x6f, 0x70, 0x65, 0x30, 0x01, 0x42, 0x40,
+	0x5a, 0x3e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x73, 0x2f,
+	0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x2f, 0x76, 0x31, 0x3b, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }

 var (
--- a/vendor/github.com/containerd/containerd/api/services/events/v1/events.proto
+++ b/vendor/github.com/containerd/containerd/api/services/events/v1/events.proto
@ -18,7 +18,7 @@ syntax = "proto3";

 package containerd.services.events.v1;

-import "github.com/containerd/containerd/api/types/fieldpath.proto";
+import "github.com/containerd/containerd/protobuf/plugin/fieldpath.proto";
 import "google/protobuf/any.proto";
 import "google/protobuf/empty.proto";
 import "google/protobuf/timestamp.proto";
@ -63,7 +63,7 @@ message SubscribeRequest {
 }

 message Envelope {
-	option (containerd.types.fieldpath) = true;
+	option (containerd.plugin.fieldpath) = true;
 	google.protobuf.Timestamp timestamp = 1;
 	string namespace = 2;
 	string topic = 3;
--- a/vendor/github.com/containerd/containerd/api/services/introspection/v1/doc.go
+++ b/vendor/github.com/containerd/containerd/api/services/introspection/v1/doc.go
@ -15,9 +15,3 @@
 */

 package introspection
-
-// Not implemented types introduced in later versions and included for API compatibility
-// Use of these types should only use not implemented errors
-
-type PluginInfoRequest struct{}
-type PluginInfoResponse struct{}
--- a/vendor/github.com/containerd/containerd/api/types/fieldpath.pb.go
+++ b/vendor/github.com/containerd/containerd/api/types/fieldpath.pb.go
@ -1,144 +0,0 @@
-// Protocol Buffers for Go with Gadgets
-//
-// Copyright (c) 2013, The GoGo Authors. All rights reserved.
-// http://github.com/gogo/protobuf
-//
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following disclaimer
-// in the documentation and/or other materials provided with the
-// distribution.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Code generated by protoc-gen-go. DO NOT EDIT.
-// versions:
-// 	protoc-gen-go v1.28.1
-// 	protoc        v3.20.1
-// source: github.com/containerd/containerd/api/types/fieldpath.proto
-
-package types
-
-import (
-	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
-	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
-	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
-	reflect "reflect"
-)
-
-const (
-	// Verify that this generated code is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
-	// Verify that runtime/protoimpl is sufficiently up-to-date.
-	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
-)
-
-var file_github_com_containerd_containerd_api_types_fieldpath_proto_extTypes = []protoimpl.ExtensionInfo{
-	{
-		ExtendedType:  (*descriptorpb.FileOptions)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         63300,
-		Name:          "containerd.types.fieldpath_all",
-		Tag:           "varint,63300,opt,name=fieldpath_all",
-		Filename:      "github.com/containerd/containerd/api/types/fieldpath.proto",
-	},
-	{
-		ExtendedType:  (*descriptorpb.MessageOptions)(nil),
-		ExtensionType: (*bool)(nil),
-		Field:         64400,
-		Name:          "containerd.types.fieldpath",
-		Tag:           "varint,64400,opt,name=fieldpath",
-		Filename:      "github.com/containerd/containerd/api/types/fieldpath.proto",
-	},
-}
-
-// Extension fields to descriptorpb.FileOptions.
-var (
-	// optional bool fieldpath_all = 63300;
-	E_FieldpathAll = &file_github_com_containerd_containerd_api_types_fieldpath_proto_extTypes[0]
-)
-
-// Extension fields to descriptorpb.MessageOptions.
-var (
-	// optional bool fieldpath = 64400;
-	E_Fieldpath = &file_github_com_containerd_containerd_api_types_fieldpath_proto_extTypes[1]
-)
-
-var File_github_com_containerd_containerd_api_types_fieldpath_proto protoreflect.FileDescriptor
-
-var file_github_com_containerd_containerd_api_types_fieldpath_proto_rawDesc = []byte{
-	0x0a, 0x3a, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
-	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
-	0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x66, 0x69, 0x65,
-	0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f,
-	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x20,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
-	0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x3a, 0x46, 0x0a, 0x0d, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x61, 0x6c,
-	0x6c, 0x12, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18,
-	0xc4, 0xee, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61,
-	0x74, 0x68, 0x41, 0x6c, 0x6c, 0x88, 0x01, 0x01, 0x3a, 0x42, 0x0a, 0x09, 0x66, 0x69, 0x65, 0x6c,
-	0x64, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x90, 0xf7, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
-	0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x88, 0x01, 0x01, 0x42, 0x32, 0x5a, 0x30,
-	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61,
-	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
-	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x3b, 0x74, 0x79, 0x70, 0x65, 0x73,
-	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
-}
-
-var file_github_com_containerd_containerd_api_types_fieldpath_proto_goTypes = []interface{}{
-	(*descriptorpb.FileOptions)(nil),    // 0: google.protobuf.FileOptions
-	(*descriptorpb.MessageOptions)(nil), // 1: google.protobuf.MessageOptions
-}
-var file_github_com_containerd_containerd_api_types_fieldpath_proto_depIdxs = []int32{
-	0, // 0: containerd.types.fieldpath_all:extendee -> google.protobuf.FileOptions
-	1, // 1: containerd.types.fieldpath:extendee -> google.protobuf.MessageOptions
-	2, // [2:2] is the sub-list for method output_type
-	2, // [2:2] is the sub-list for method input_type
-	2, // [2:2] is the sub-list for extension type_name
-	0, // [0:2] is the sub-list for extension extendee
-	0, // [0:0] is the sub-list for field type_name
-}
-
-func init() { file_github_com_containerd_containerd_api_types_fieldpath_proto_init() }
-func file_github_com_containerd_containerd_api_types_fieldpath_proto_init() {
-	if File_github_com_containerd_containerd_api_types_fieldpath_proto != nil {
-		return
-	}
-	type x struct{}
-	out := protoimpl.TypeBuilder{
-		File: protoimpl.DescBuilder{
-			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_github_com_containerd_containerd_api_types_fieldpath_proto_rawDesc,
-			NumEnums:      0,
-			NumMessages:   0,
-			NumExtensions: 2,
-			NumServices:   0,
-		},
-		GoTypes:           file_github_com_containerd_containerd_api_types_fieldpath_proto_goTypes,
-		DependencyIndexes: file_github_com_containerd_containerd_api_types_fieldpath_proto_depIdxs,
-		ExtensionInfos:    file_github_com_containerd_containerd_api_types_fieldpath_proto_extTypes,
-	}.Build()
-	File_github_com_containerd_containerd_api_types_fieldpath_proto = out.File
-	file_github_com_containerd_containerd_api_types_fieldpath_proto_rawDesc = nil
-	file_github_com_containerd_containerd_api_types_fieldpath_proto_goTypes = nil
-	file_github_com_containerd_containerd_api_types_fieldpath_proto_depIdxs = nil
-}
--- a/vendor/github.com/containerd/containerd/archive/tar.go
+++ b/vendor/github.com/containerd/containerd/archive/tar.go
@ -29,10 +29,9 @@ import (
 	"syscall"
 	"time"

-	"github.com/moby/sys/userns"
-
 	"github.com/containerd/containerd/archive/tarheader"
 	"github.com/containerd/containerd/pkg/epoch"
+	"github.com/containerd/containerd/pkg/userns"
 	"github.com/containerd/continuity/fs"
 	"github.com/containerd/log"
 )
--- a/vendor/github.com/containerd/containerd/archive/tar_unix.go
+++ b/vendor/github.com/containerd/containerd/archive/tar_unix.go
@ -27,11 +27,10 @@ import (
 	"strings"
 	"syscall"

-	"github.com/moby/sys/userns"
-	"golang.org/x/sys/unix"
-
+	"github.com/containerd/containerd/pkg/userns"
 	"github.com/containerd/continuity/fs"
 	"github.com/containerd/continuity/sysx"
+	"golang.org/x/sys/unix"
 )

 func chmodTarEntry(perm os.FileMode) os.FileMode {
--- a/vendor/github.com/containerd/containerd/cio/io.go
+++ b/vendor/github.com/containerd/containerd/cio/io.go
@ -268,6 +268,26 @@ func BinaryIO(binary string, args map[string]string) Creator {
 	}
 }

+// TerminalBinaryIO forwards container STDOUT|STDERR directly to a logging binary
+// It also sets the terminal option to true
+func TerminalBinaryIO(binary string, args map[string]string) Creator {
+	return func(_ string) (IO, error) {
+		uri, err := LogURIGenerator("binary", binary, args)
+		if err != nil {
+			return nil, err
+		}
+
+		res := uri.String()
+		return &logURI{
+			config: Config{
+				Stdout:   res,
+				Stderr:   res,
+				Terminal: true,
+			},
+		}, nil
+	}
+}
+
 // LogFile creates a file on disk that logs the task's STDOUT,STDERR.
 // If the log file already exists, the logs will be appended to the file.
 func LogFile(path string) Creator {
--- a/vendor/github.com/containerd/containerd/cio/io_unix.go
+++ b/vendor/github.com/containerd/containerd/cio/io_unix.go
@ -22,7 +22,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"net/url"
 	"os"
 	"path/filepath"
 	"sync"
@ -159,37 +158,3 @@ func NewDirectIO(ctx context.Context, fifos *FIFOSet) (*DirectIO, error) {
 		},
 	}, err
 }
-
-// TerminalLogURI provides the raw logging URI
-// as well as sets the terminal option to true.
-func TerminalLogURI(uri *url.URL) Creator {
-	return func(_ string) (IO, error) {
-		return &logURI{
-			config: Config{
-				Stdout:   uri.String(),
-				Stderr:   uri.String(),
-				Terminal: true,
-			},
-		}, nil
-	}
-}
-
-// TerminalBinaryIO forwards container STDOUT|STDERR directly to a logging binary
-// It also sets the terminal option to true
-func TerminalBinaryIO(binary string, args map[string]string) Creator {
-	return func(_ string) (IO, error) {
-		uri, err := LogURIGenerator("binary", binary, args)
-		if err != nil {
-			return nil, err
-		}
-
-		res := uri.String()
-		return &logURI{
-			config: Config{
-				Stdout:   res,
-				Stderr:   res,
-				Terminal: true,
-			},
-		}, nil
-	}
-}
--- a/vendor/github.com/containerd/containerd/cio/io_windows.go
+++ b/vendor/github.com/containerd/containerd/cio/io_windows.go
@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"net/url"

 	winio "github.com/Microsoft/go-winio"
 	"github.com/containerd/log"
@ -156,42 +155,3 @@ func NewDirectIOFromFIFOSet(ctx context.Context, stdin io.WriteCloser, stdout, s
 		},
 	}
 }
-
-// TerminalLogURI provides the raw logging URI
-// as well as sets the terminal option to true.
-func TerminalLogURI(uri *url.URL) Creator {
-	return func(_ string) (IO, error) {
-		return &logURI{
-			config: Config{
-				Terminal: true,
-				Stdout:   uri.String(),
-
-				// Windows HCSShim requires that stderr is an empty string when using terminal.
-				// https://github.com/microsoft/hcsshim/blob/200feabd854da69f615a598ed6a1263ce9531676/cmd/containerd-shim-runhcs-v1/service_internal.go#L127
-				Stderr: "",
-			},
-		}, nil
-	}
-}
-
-// TerminalBinaryIO forwards container STDOUT|STDERR directly to a logging binary
-// It also sets the terminal option to true
-func TerminalBinaryIO(binary string, args map[string]string) Creator {
-	return func(_ string) (IO, error) {
-		uri, err := LogURIGenerator("binary", binary, args)
-		if err != nil {
-			return nil, err
-		}
-
-		return &logURI{
-			config: Config{
-				Terminal: true,
-				Stdout:   uri.String(),
-
-				// Windows HCSShim requires that stderr is an empty string when using terminal.
-				// https://github.com/microsoft/hcsshim/blob/200feabd854da69f615a598ed6a1263ce9531676/cmd/containerd-shim-runhcs-v1/service_internal.go#L127
-				Stderr: "",
-			},
-		}, nil
-	}
-}
--- a/vendor/github.com/containerd/containerd/client.go
+++ b/vendor/github.com/containerd/containerd/client.go
@ -50,6 +50,7 @@ import (
 	leasesproxy "github.com/containerd/containerd/leases/proxy"
 	"github.com/containerd/containerd/namespaces"
 	"github.com/containerd/containerd/pkg/dialer"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/containerd/plugin"
 	ptypes "github.com/containerd/containerd/protobuf/types"
 	"github.com/containerd/containerd/remotes"
@ -60,7 +61,6 @@ import (
 	"github.com/containerd/containerd/snapshots"
 	snproxy "github.com/containerd/containerd/snapshots/proxy"
 	"github.com/containerd/errdefs"
-	"github.com/containerd/platforms"
 	"github.com/containerd/typeurl/v2"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/runtime-spec/specs-go"
--- a/vendor/github.com/containerd/containerd/client_opts.go
+++ b/vendor/github.com/containerd/containerd/client_opts.go
@ -20,9 +20,9 @@ import (
 	"time"

 	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/containerd/remotes"
 	"github.com/containerd/containerd/snapshots"
-	"github.com/containerd/platforms"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"google.golang.org/grpc"
@ -110,7 +110,7 @@ type RemoteOpt func(*Client, *RemoteContext) error
 // content for
 func WithPlatform(platform string) RemoteOpt {
 	if platform == "" {
-		platform = platforms.Format(platforms.DefaultSpec()) // For 1.7 continue using the old format without os-version included.
+		platform = platforms.DefaultString()
 	}
 	return func(_ *Client, c *RemoteContext) error {
 		for _, p := range c.Platforms {
--- a/vendor/github.com/containerd/containerd/container_checkpoint_opts.go
+++ b/vendor/github.com/containerd/containerd/container_checkpoint_opts.go
@ -27,11 +27,11 @@ import (
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/diff"
 	"github.com/containerd/containerd/images"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/containerd/protobuf"
 	"github.com/containerd/containerd/protobuf/proto"
 	"github.com/containerd/containerd/rootfs"
 	"github.com/containerd/containerd/runtime/v2/runc/options"
-	"github.com/containerd/platforms"
 	"github.com/opencontainers/go-digest"
 	imagespec "github.com/opencontainers/image-spec/specs-go/v1"
 )
--- a/vendor/github.com/containerd/containerd/errdefs/errdefs_deprecated.go
+++ b/vendor/github.com/containerd/containerd/errdefs/errdefs_deprecated.go
@ -24,8 +24,6 @@
 //
 // The functions ToGRPC and FromGRPC can be used to map server-side and
 // client-side errors to the correct types.
-//
-// Deprecated: use [github.com/containerd/errdefs].
 package errdefs

 import (
--- a/vendor/github.com/containerd/containerd/events.go
+++ b/vendor/github.com/containerd/containerd/events.go
@ -19,12 +19,11 @@ package containerd
 import (
 	"context"

-	"github.com/containerd/errdefs"
-	"github.com/containerd/typeurl/v2"
-
 	eventsapi "github.com/containerd/containerd/api/services/events/v1"
 	"github.com/containerd/containerd/events"
 	"github.com/containerd/containerd/protobuf"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/typeurl/v2"
 )

 // EventService handles the publish, forward and subscribe of events.
--- a/vendor/github.com/containerd/containerd/image.go
+++ b/vendor/github.com/containerd/containerd/image.go
@ -29,10 +29,10 @@ import (
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/labels"
 	"github.com/containerd/containerd/pkg/kmutex"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/containerd/rootfs"
 	"github.com/containerd/containerd/snapshots"
 	"github.com/containerd/errdefs"
-	"github.com/containerd/platforms"
 	"github.com/opencontainers/go-digest"
 	"github.com/opencontainers/image-spec/identity"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
--- a/vendor/github.com/containerd/containerd/images/archive/exporter.go
+++ b/vendor/github.com/containerd/containerd/images/archive/exporter.go
@ -29,9 +29,9 @@ import (
 	"github.com/containerd/containerd/content"
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/labels"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
-	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"
 	ocispecs "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
--- a/vendor/github.com/containerd/containerd/images/archive/importer.go
+++ b/vendor/github.com/containerd/containerd/images/archive/importer.go
@ -31,9 +31,9 @@ import (
 	"github.com/containerd/containerd/content"
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/labels"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
-	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"
 	specs "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
--- a/vendor/github.com/containerd/containerd/images/archive/reference.go
+++ b/vendor/github.com/containerd/containerd/images/archive/reference.go
@ -21,7 +21,7 @@ import (
 	"strings"

 	"github.com/containerd/containerd/reference"
-	distref "github.com/distribution/reference"
+	distref "github.com/containerd/containerd/reference/docker"
 	"github.com/opencontainers/go-digest"
 )

--- a/vendor/github.com/containerd/containerd/images/handlers.go
+++ b/vendor/github.com/containerd/containerd/images/handlers.go
@ -23,8 +23,8 @@ import (
 	"sort"

 	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/errdefs"
-	"github.com/containerd/platforms"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/sync/semaphore"
--- a/vendor/github.com/containerd/containerd/images/image.go
+++ b/vendor/github.com/containerd/containerd/images/image.go
@ -24,9 +24,9 @@ import (
 	"time"

 	"github.com/containerd/containerd/content"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
-	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
--- a/vendor/github.com/containerd/containerd/import.go
+++ b/vendor/github.com/containerd/containerd/import.go
@ -24,8 +24,8 @@ import (
 	"github.com/containerd/containerd/content"
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/images/archive"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/errdefs"
-	"github.com/containerd/platforms"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
--- a/vendor/github.com/containerd/containerd/mount/mount_linux.go
+++ b/vendor/github.com/containerd/containerd/mount/mount_linux.go
@ -26,7 +26,7 @@ import (
 	"strings"
 	"time"

-	"github.com/moby/sys/userns"
+	"github.com/containerd/containerd/pkg/userns"
 	"golang.org/x/sys/unix"
 )

--- a/vendor/github.com/containerd/containerd/mount/temp.go
+++ b/vendor/github.com/containerd/containerd/mount/temp.go
@ -29,10 +29,6 @@ var tempMountLocation = getTempDir()
 // WithTempMount mounts the provided mounts to a temp dir, and pass the temp dir to f.
 // The mounts are valid during the call to the f.
 // Finally we will unmount and remove the temp dir regardless of the result of f.
-//
-// NOTE: The volatile option of overlayfs doesn't allow to mount again using the
-// same upper / work dirs. Since it's a temp mount, avoid using that option here
-// if found.
 func WithTempMount(ctx context.Context, mounts []Mount, f func(root string) error) (err error) {
 	root, uerr := os.MkdirTemp(tempMountLocation, "containerd-mount")
 	if uerr != nil {
@ -62,8 +58,7 @@ func WithTempMount(ctx context.Context, mounts []Mount, f func(root string) erro
 			}
 		}
 	}()
-
-	if uerr = All(RemoveVolatileOption(mounts), root); uerr != nil {
+	if uerr = All(mounts, root); uerr != nil {
 		return fmt.Errorf("failed to mount %s: %w", root, uerr)
 	}
 	if err := f(root); err != nil {
@ -72,45 +67,6 @@ func WithTempMount(ctx context.Context, mounts []Mount, f func(root string) erro
 	return nil
 }

-// RemoveVolatileOption copies and remove the volatile option for overlay
-// type, since overlayfs doesn't allow to mount again using the same upper/work
-// dirs.
-//
-// REF: https://docs.kernel.org/filesystems/overlayfs.html#volatile-mount
-//
-// TODO: Make this logic conditional once the kernel supports reusing
-// overlayfs volatile mounts.
-func RemoveVolatileOption(mounts []Mount) []Mount {
-	var out []Mount
-	for i, m := range mounts {
-		if m.Type != "overlay" {
-			continue
-		}
-		for j, opt := range m.Options {
-			if opt == "volatile" {
-				if out == nil {
-					out = copyMounts(mounts)
-				}
-				out[i].Options = append(out[i].Options[:j], out[i].Options[j+1:]...)
-				break
-			}
-		}
-	}
-
-	if out != nil {
-		return out
-	}
-
-	return mounts
-}
-
-// copyMounts creates a copy of the original slice to allow for modification and not altering the original
-func copyMounts(in []Mount) []Mount {
-	out := make([]Mount, len(in))
-	copy(out, in)
-	return out
-}
-
 // WithReadonlyTempMount mounts the provided mounts to a temp dir as readonly,
 // and pass the temp dir to f. The mounts are valid during the call to the f.
 // Finally we will unmount and remove the temp dir regardless of the result of f.
--- a/vendor/github.com/containerd/containerd/oci/spec.go
+++ b/vendor/github.com/containerd/containerd/oci/spec.go
@ -27,7 +27,7 @@ import (

 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/namespaces"
-	"github.com/containerd/platforms"
+	"github.com/containerd/containerd/platforms"
 )

 const (
@ -64,7 +64,7 @@ func ReadSpec(path string) (*Spec, error) {
 // GenerateSpec will generate a default spec from the provided image
 // for use as a containerd container
 func GenerateSpec(ctx context.Context, client Client, c *containers.Container, opts ...SpecOpts) (*Spec, error) {
-	return GenerateSpecWithPlatform(ctx, client, platforms.Format(platforms.DefaultSpec()), c, opts...) // For 1.7 continue using the old format without os-version included.
+	return GenerateSpecWithPlatform(ctx, client, platforms.DefaultString(), c, opts...)
 }

 // GenerateSpecWithPlatform will generate a default spec from the provided image
--- a/vendor/github.com/containerd/containerd/oci/spec_opts.go
+++ b/vendor/github.com/containerd/containerd/oci/spec_opts.go
@ -33,8 +33,8 @@ import (
 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/namespaces"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/continuity/fs"
-	"github.com/containerd/platforms"
 	"github.com/moby/sys/user"
 	v1 "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/runtime-spec/specs-go"
@ -138,7 +138,7 @@ func ensureAdditionalGids(s *Spec) {
 // Use as the first option to clear the spec, then apply options afterwards.
 func WithDefaultSpec() SpecOpts {
 	return func(ctx context.Context, _ Client, c *containers.Container, s *Spec) error {
-		return generateDefaultSpecWithPlatform(ctx, platforms.Format(platforms.DefaultSpec()), c.ID, s) // For 1.7 continue using the old format without os-version included.
+		return generateDefaultSpecWithPlatform(ctx, platforms.DefaultString(), c.ID, s)
 	}
 }

@ -955,11 +955,6 @@ func WithCapabilities(caps []string) SpecOpts {
 		s.Process.Capabilities.Bounding = caps
 		s.Process.Capabilities.Effective = caps
 		s.Process.Capabilities.Permitted = caps
-		if len(caps) == 0 {
-			s.Process.Capabilities.Inheritable = nil
-		} else if len(s.Process.Capabilities.Inheritable) > 0 {
-			filterCaps(&s.Process.Capabilities.Inheritable, caps)
-		}

 		return nil
 	}
@ -985,16 +980,6 @@ func removeCap(caps *[]string, s string) {
 	*caps = newcaps
 }

-func filterCaps(caps *[]string, filters []string) {
-	var newcaps []string
-	for _, c := range *caps {
-		if capsContain(filters, c) {
-			newcaps = append(newcaps, c)
-		}
-	}
-	*caps = newcaps
-}
-
 // WithAddedCapabilities adds the provided capabilities
 func WithAddedCapabilities(caps []string) SpecOpts {
 	return func(_ context.Context, _ Client, _ *containers.Container, s *Spec) error {
@ -1023,7 +1008,6 @@ func WithDroppedCapabilities(caps []string) SpecOpts {
 				&s.Process.Capabilities.Bounding,
 				&s.Process.Capabilities.Effective,
 				&s.Process.Capabilities.Permitted,
-				&s.Process.Capabilities.Inheritable,
 			} {
 				removeCap(cl, c)
 			}
--- a/vendor/github.com/containerd/containerd/oci/utils_unix.go
+++ b/vendor/github.com/containerd/containerd/oci/utils_unix.go
@ -24,7 +24,7 @@ import (
 	"os"
 	"path/filepath"

-	"github.com/moby/sys/userns"
+	"github.com/containerd/containerd/pkg/userns"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/sys/unix"
 )
--- a/vendor/github.com/containerd/containerd/pkg/deprecation/deprecation.go
+++ b/vendor/github.com/containerd/containerd/pkg/deprecation/deprecation.go
@ -73,11 +73,11 @@ var messages = map[Warning]string{
 		"Use a v2 runtime and `options` instead.",
 	CRIRuntimeRoot: "The `runtime_root` property of [plugins.\"io.containerd.grpc.v1.cri\".containerd.runtimes.*] is deprecated since containerd v1.3 and will be removed in containerd v2.0. " +
 		"Use a v2 runtime and `options.Root` instead.",
-	CRIRegistryMirrors: "The `mirrors` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.1. " +
+	CRIRegistryMirrors: "The `mirrors` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.0. " +
 		"Use `config_path` instead.",
-	CRIRegistryAuths: "The `auths` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.3 and will be removed in containerd v2.1. " +
+	CRIRegistryAuths: "The `auths` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.3 and will be removed in containerd v2.0. " +
 		"Use `ImagePullSecrets` instead.",
-	CRIRegistryConfigs: "The `configs` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.1. " +
+	CRIRegistryConfigs: "The `configs` property of `[plugins.\"io.containerd.grpc.v1.cri\".registry]` is deprecated since containerd v1.5 and will be removed in containerd v2.0. " +
 		"Use `config_path` instead.",
 	CRIAPIV1Alpha2:  "CRI API v1alpha2 is deprecated since containerd v1.7 and removed in containerd v2.0. Use CRI API v1 instead.",
 	AUFSSnapshotter: "The aufs snapshotter is deprecated since containerd v1.5 and removed in containerd v2.0. Use the overlay snapshotter instead.",
--- a/vendor/github.com/containerd/containerd/pkg/unpack/unpacker.go
+++ b/vendor/github.com/containerd/containerd/pkg/unpack/unpacker.go
@ -35,11 +35,11 @@ import (
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/pkg/cleanup"
 	"github.com/containerd/containerd/pkg/kmutex"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/containerd/snapshots"
 	"github.com/containerd/containerd/tracing"
 	"github.com/containerd/errdefs"
 	"github.com/containerd/log"
-	"github.com/containerd/platforms"
 	"github.com/opencontainers/go-digest"
 	"github.com/opencontainers/image-spec/identity"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
--- a/vendor/github.com/containerd/containerd/pkg/userns/userns_linux.go
+++ b/vendor/github.com/containerd/containerd/pkg/userns/userns_linux.go
@ -0,0 +1,62 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package userns
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"sync"
+)
+
+var (
+	inUserNS bool
+	nsOnce   sync.Once
+)
+
+// RunningInUserNS detects whether we are currently running in a user namespace.
+// Originally copied from github.com/lxc/lxd/shared/util.go
+func RunningInUserNS() bool {
+	nsOnce.Do(func() {
+		file, err := os.Open("/proc/self/uid_map")
+		if err != nil {
+			// This kernel-provided file only exists if user namespaces are supported
+			return
+		}
+		defer file.Close()
+
+		buf := bufio.NewReader(file)
+		l, _, err := buf.ReadLine()
+		if err != nil {
+			return
+		}
+
+		line := string(l)
+		var a, b, c int64
+		fmt.Sscanf(line, "%d %d %d", &a, &b, &c)
+
+		/*
+		 * We assume we are in the initial user namespace if we have a full
+		 * range - 4294967295 uids starting at uid 0.
+		 */
+		if a == 0 && b == 0 && c == 4294967295 {
+			return
+		}
+		inUserNS = true
+	})
+	return inUserNS
+}
--- a/vendor/github.com/containerd/containerd/pkg/userns/userns_unsupported.go
+++ b/vendor/github.com/containerd/containerd/pkg/userns/userns_unsupported.go
@ -1,3 +1,5 @@
+//go:build !linux
+
 /*
   Copyright The containerd Authors.

@ -14,17 +16,10 @@
   limitations under the License.
 */

-package platforms
+package userns

-import "errors"
-
-// These errors mirror the errors defined in [github.com/containerd/containerd/errdefs],
-// however, they are not exported as they are not expected to be used as sentinel
-// errors by consumers of this package.
-//
-//nolint:unused // not all errors are used on all platforms.
-var (
-	errNotFound        = errors.New("not found")
-	errInvalidArgument = errors.New("invalid argument")
-	errNotImplemented  = errors.New("not implemented")
-)
+// RunningInUserNS is a stub for non-Linux systems
+// Always returns false
+func RunningInUserNS() bool {
+	return false
+}
--- a/vendor/github.com/containerd/containerd/platforms/compare.go
+++ b/vendor/github.com/containerd/containerd/platforms/compare.go
--- a/vendor/github.com/containerd/containerd/platforms/cpuinfo.go
+++ b/vendor/github.com/containerd/containerd/platforms/cpuinfo.go
--- a/vendor/github.com/containerd/containerd/platforms/cpuinfo_linux.go
+++ b/vendor/github.com/containerd/containerd/platforms/cpuinfo_linux.go
@ -19,12 +19,12 @@ package platforms
 import (
 	"bufio"
 	"bytes"
-	"errors"
 	"fmt"
 	"os"
 	"runtime"
 	"strings"

+	"github.com/containerd/errdefs"
 	"golang.org/x/sys/unix"
 )

@ -70,7 +70,7 @@ func getCPUInfo(pattern string) (info string, err error) {
 		return "", err
 	}

-	return "", fmt.Errorf("getCPUInfo for pattern %s: %w", pattern, errNotFound)
+	return "", fmt.Errorf("getCPUInfo for pattern %s: %w", pattern, errdefs.ErrNotFound)
 }

 // getCPUVariantFromArch get CPU variant from arch through a system call
@ -83,7 +83,7 @@ func getCPUVariantFromArch(arch string) (string, error) {
 	if arch == "aarch64" {
 		variant = "8"
 	} else if arch[0:4] == "armv" && len(arch) >= 5 {
-		// Valid arch format is in form of armvXx
+		//Valid arch format is in form of armvXx
 		switch arch[3:5] {
 		case "v8":
 			variant = "8"
@ -101,7 +101,7 @@ func getCPUVariantFromArch(arch string) (string, error) {
 			variant = "unknown"
 		}
 	} else {
-		return "", fmt.Errorf("getCPUVariantFromArch invalid arch: %s, %w", arch, errInvalidArgument)
+		return "", fmt.Errorf("getCPUVariantFromArch invalid arch: %s, %w", arch, errdefs.ErrInvalidArgument)
 	}
 	return variant, nil
 }
@ -112,10 +112,11 @@ func getCPUVariantFromArch(arch string) (string, error) {
 // This is to cover running ARM in emulated environment on x86 host as this field in /proc/cpuinfo
 // was not present.
 func getCPUVariant() (string, error) {
+
 	variant, err := getCPUInfo("Cpu architecture")
 	if err != nil {
-		if errors.Is(err, errNotFound) {
-			// Let's try getting CPU variant from machine architecture
+		if errdefs.IsNotFound(err) {
+			//Let's try getting CPU variant from machine architecture
 			arch, err := getMachineArch()
 			if err != nil {
 				return "", fmt.Errorf("failure getting machine architecture: %v", err)
--- a/vendor/github.com/containerd/containerd/platforms/cpuinfo_other.go
+++ b/vendor/github.com/containerd/containerd/platforms/cpuinfo_other.go
@ -21,6 +21,8 @@ package platforms
 import (
 	"fmt"
 	"runtime"
+
+	"github.com/containerd/errdefs"
 )

 func getCPUVariant() (string, error) {
@ -47,8 +49,10 @@ func getCPUVariant() (string, error) {
 		default:
 			variant = "unknown"
 		}
+
 	} else {
-		return "", fmt.Errorf("getCPUVariant for OS %s: %v", runtime.GOOS, errNotImplemented)
+		return "", fmt.Errorf("getCPUVariant for OS %s: %v", runtime.GOOS, errdefs.ErrNotImplemented)
+
 	}

 	return variant, nil
--- a/vendor/github.com/containerd/containerd/platforms/database.go
+++ b/vendor/github.com/containerd/containerd/platforms/database.go
--- a/vendor/github.com/containerd/containerd/platforms/defaults.go
+++ b/vendor/github.com/containerd/containerd/platforms/defaults.go
@ -16,11 +16,9 @@

 package platforms

-// DefaultString returns the default string specifier for the platform,
-// with [PR#6](https://github.com/containerd/platforms/pull/6) the result
-// may now also include the OSVersion from the provided platform specification.
+// DefaultString returns the default string specifier for the platform.
 func DefaultString() string {
-	return FormatAll(DefaultSpec())
+	return Format(DefaultSpec())
 }

 // DefaultStrict returns strict form of Default.
--- a/vendor/github.com/containerd/containerd/platforms/defaults_darwin.go
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_darwin.go
--- a/vendor/github.com/containerd/containerd/platforms/defaults_freebsd.go
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_freebsd.go
--- a/vendor/github.com/containerd/containerd/platforms/defaults_unix.go
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_unix.go
--- a/vendor/github.com/containerd/containerd/platforms/defaults_windows.go
+++ b/vendor/github.com/containerd/containerd/platforms/defaults_windows.go
@ -22,6 +22,7 @@ import (
 	"strconv"
 	"strings"

+	"github.com/Microsoft/hcsshim/osversion"
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
 	"golang.org/x/sys/windows"
 )
@ -51,29 +52,29 @@ func (m windowsmatcher) Match(p specs.Platform) bool {

 	if match && m.OS == "windows" {
 		// HPC containers do not have OS version filled
-		if m.OSVersion == "" || p.OSVersion == "" {
+		if p.OSVersion == "" {
 			return true
 		}

-		hostOsVersion := getOSVersion(m.osVersionPrefix)
-		ctrOsVersion := getOSVersion(p.OSVersion)
-		return checkHostAndContainerCompat(hostOsVersion, ctrOsVersion)
+		hostOsVersion := GetOsVersion(m.osVersionPrefix)
+		ctrOsVersion := GetOsVersion(p.OSVersion)
+		return osversion.CheckHostAndContainerCompat(hostOsVersion, ctrOsVersion)
 	}

 	return match
 }

-func getOSVersion(osVersionPrefix string) osVersion {
+func GetOsVersion(osVersionPrefix string) osversion.OSVersion {
 	parts := strings.Split(osVersionPrefix, ".")
 	if len(parts) < 3 {
-		return osVersion{}
+		return osversion.OSVersion{}
 	}

 	majorVersion, _ := strconv.Atoi(parts[0])
 	minorVersion, _ := strconv.Atoi(parts[1])
 	buildNumber, _ := strconv.Atoi(parts[2])

-	return osVersion{
+	return osversion.OSVersion{
 		MajorVersion: uint8(majorVersion),
 		MinorVersion: uint8(minorVersion),
 		Build:        uint16(buildNumber),
--- a/vendor/github.com/containerd/containerd/platforms/platforms.go
+++ b/vendor/github.com/containerd/containerd/platforms/platforms.go
@ -102,9 +102,6 @@
 // unless it is explicitly provided. This is treated as equivalent to armhf. A
 // previous architecture, armel, will be normalized to arm/v6.
 //
-// Similarly, the most common arm64 version v8, and most common amd64 version v1
-// are represented without the variant.
-//
 // While these normalizations are provided, their support on arm platforms has
 // not yet been fully implemented and tested.
 package platforms
@ -118,15 +115,14 @@ import (
 	"strings"

 	specs "github.com/opencontainers/image-spec/specs-go/v1"
+
+	"github.com/containerd/errdefs"
 )

 var (
-	specifierRe    = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
-	osAndVersionRe = regexp.MustCompile(`^([A-Za-z0-9_-]+)(?:\(([A-Za-z0-9_.-]*)\))?$`)
+	specifierRe = regexp.MustCompile(`^[A-Za-z0-9_-]+$`)
 )

-const osAndVersionFormat = "%s(%s)"
-
 // Platform is a type alias for convenience, so there is no need to import image-spec package everywhere.
 type Platform = specs.Platform

@ -159,68 +155,40 @@ func (m *matcher) Match(platform specs.Platform) bool {
 }

 func (m *matcher) String() string {
-	return FormatAll(m.Platform)
-}
-
-// ParseAll parses a list of platform specifiers into a list of platform.
-func ParseAll(specifiers []string) ([]specs.Platform, error) {
-	platforms := make([]specs.Platform, len(specifiers))
-	for i, s := range specifiers {
-		p, err := Parse(s)
-		if err != nil {
-			return nil, fmt.Errorf("invalid platform %s: %w", s, err)
-		}
-		platforms[i] = p
-	}
-	return platforms, nil
+	return Format(m.Platform)
 }

 // Parse parses the platform specifier syntax into a platform declaration.
 //
-// Platform specifiers are in the format `<os>[(<OSVersion>)]|<arch>|<os>[(<OSVersion>)]/<arch>[/<variant>]`.
+// Platform specifiers are in the format `<os>|<arch>|<os>/<arch>[/<variant>]`.
 // The minimum required information for a platform specifier is the operating
-// system or architecture. The OSVersion can be part of the OS like `windows(10.0.17763)`
-// When an OSVersion is specified, then specs.Platform.OSVersion is populated with that value,
-// and an empty string otherwise.
-// If there is only a single string (no slashes), the
+// system or architecture. If there is only a single string (no slashes), the
 // value will be matched against the known set of operating systems, then fall
 // back to the known set of architectures. The missing component will be
 // inferred based on the local environment.
 func Parse(specifier string) (specs.Platform, error) {
 	if strings.Contains(specifier, "*") {
 		// TODO(stevvooe): need to work out exact wildcard handling
-		return specs.Platform{}, fmt.Errorf("%q: wildcards not yet supported: %w", specifier, errInvalidArgument)
+		return specs.Platform{}, fmt.Errorf("%q: wildcards not yet supported: %w", specifier, errdefs.ErrInvalidArgument)
 	}

-	// Limit to 4 elements to prevent unbounded split
-	parts := strings.SplitN(specifier, "/", 4)
+	parts := strings.Split(specifier, "/")

-	var p specs.Platform
-	for i, part := range parts {
-		if i == 0 {
-			// First element is <os>[(<OSVersion>)]
-			osVer := osAndVersionRe.FindStringSubmatch(part)
-			if osVer == nil {
-				return specs.Platform{}, fmt.Errorf("%q is an invalid OS component of %q: OSAndVersion specifier component must match %q: %w", part, specifier, osAndVersionRe.String(), errInvalidArgument)
-			}
-
-			p.OS = normalizeOS(osVer[1])
-			p.OSVersion = osVer[2]
-		} else {
-			if !specifierRe.MatchString(part) {
-				return specs.Platform{}, fmt.Errorf("%q is an invalid component of %q: platform specifier component must match %q: %w", part, specifier, specifierRe.String(), errInvalidArgument)
-			}
+	for _, part := range parts {
+		if !specifierRe.MatchString(part) {
+			return specs.Platform{}, fmt.Errorf("%q is an invalid component of %q: platform specifier component must match %q: %w", part, specifier, specifierRe.String(), errdefs.ErrInvalidArgument)
 		}
 	}

+	var p specs.Platform
 	switch len(parts) {
 	case 1:
-		// in this case, we will test that the value might be an OS (with or
-		// without the optional OSVersion specified) and look it up.
-		// If it is not known, we'll treat it as an architecture. Since
+		// in this case, we will test that the value might be an OS, then look
+		// it up. If it is not known, we'll treat it as an architecture. Since
 		// we have very little information about the platform here, we are
 		// going to be a little more strict if we don't know about the argument
 		// value.
+		p.OS = normalizeOS(parts[0])
 		if isKnownOS(p.OS) {
 			// picks a default architecture
 			p.Architecture = runtime.GOARCH
@ -228,6 +196,10 @@ func Parse(specifier string) (specs.Platform, error) {
 				p.Variant = cpuVariant()
 			}

+			if p.OS == "windows" {
+				p.OSVersion = GetWindowsOsVersion()
+			}
+
 			return p, nil
 		}

@ -240,27 +212,37 @@ func Parse(specifier string) (specs.Platform, error) {
 			return p, nil
 		}

-		return specs.Platform{}, fmt.Errorf("%q: unknown operating system or architecture: %w", specifier, errInvalidArgument)
+		return specs.Platform{}, fmt.Errorf("%q: unknown operating system or architecture: %w", specifier, errdefs.ErrInvalidArgument)
 	case 2:
-		// In this case, we treat as a regular OS[(OSVersion)]/arch pair. We don't care
+		// In this case, we treat as a regular os/arch pair. We don't care
 		// about whether or not we know of the platform.
+		p.OS = normalizeOS(parts[0])
 		p.Architecture, p.Variant = normalizeArch(parts[1], "")
 		if p.Architecture == "arm" && p.Variant == "v7" {
 			p.Variant = ""
 		}

+		if p.OS == "windows" {
+			p.OSVersion = GetWindowsOsVersion()
+		}
+
 		return p, nil
 	case 3:
 		// we have a fully specified variant, this is rare
+		p.OS = normalizeOS(parts[0])
 		p.Architecture, p.Variant = normalizeArch(parts[1], parts[2])
 		if p.Architecture == "arm64" && p.Variant == "" {
 			p.Variant = "v8"
 		}

+		if p.OS == "windows" {
+			p.OSVersion = GetWindowsOsVersion()
+		}
+
 		return p, nil
 	}

-	return specs.Platform{}, fmt.Errorf("%q: cannot parse platform specifier: %w", specifier, errInvalidArgument)
+	return specs.Platform{}, fmt.Errorf("%q: cannot parse platform specifier: %w", specifier, errdefs.ErrInvalidArgument)
 }

 // MustParse is like Parses but panics if the specifier cannot be parsed.
@ -282,20 +264,6 @@ func Format(platform specs.Platform) string {
 	return path.Join(platform.OS, platform.Architecture, platform.Variant)
 }

-// FormatAll returns a string specifier that also includes the OSVersion from the
-// provided platform specification.
-func FormatAll(platform specs.Platform) string {
-	if platform.OS == "" {
-		return "unknown"
-	}
-
-	if platform.OSVersion != "" {
-		OSAndVersion := fmt.Sprintf(osAndVersionFormat, platform.OS, platform.OSVersion)
-		return path.Join(OSAndVersion, platform.Architecture, platform.Variant)
-	}
-	return path.Join(platform.OS, platform.Architecture, platform.Variant)
-}
-
 // Normalize validates and translate the platform to the canonical value.
 //
 // For example, if "Aarch64" is encountered, we change it to "arm64" or if
--- a/vendor/github.com/containerd/containerd/platforms/platforms_other.go
+++ b/vendor/github.com/containerd/containerd/platforms/platforms_other.go
@ -28,3 +28,7 @@ func newDefaultMatcher(platform specs.Platform) Matcher {
 		Platform: Normalize(platform),
 	}
 }
+
+func GetWindowsOsVersion() string {
+	return ""
+}
--- a/vendor/github.com/containerd/containerd/platforms/platforms_windows.go
+++ b/vendor/github.com/containerd/containerd/platforms/platforms_windows.go
@ -17,7 +17,10 @@
 package platforms

 import (
+	"fmt"
+
 	specs "github.com/opencontainers/image-spec/specs-go/v1"
+	"golang.org/x/sys/windows"
 )

 // NewMatcher returns a Windows matcher that will match on osVersionPrefix if
@ -32,3 +35,8 @@ func newDefaultMatcher(platform specs.Platform) Matcher {
 		},
 	}
 }
+
+func GetWindowsOsVersion() string {
+	major, minor, build := windows.RtlGetNtVersionNumbers()
+	return fmt.Sprintf("%d.%d.%d", major, minor, build)
+}
--- a/vendor/github.com/containerd/containerd/protobuf/plugin/doc.go
+++ b/vendor/github.com/containerd/containerd/protobuf/plugin/doc.go
@ -0,0 +1,17 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package plugin
--- a/vendor/github.com/containerd/containerd/protobuf/plugin/fieldpath.pb.go
+++ b/vendor/github.com/containerd/containerd/protobuf/plugin/fieldpath.pb.go
@ -0,0 +1,144 @@
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        v3.20.1
+// source: github.com/containerd/containerd/protobuf/plugin/fieldpath.proto
+
+package plugin
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
+	reflect "reflect"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+var file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*descriptorpb.FileOptions)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         63300,
+		Name:          "containerd.plugin.fieldpath_all",
+		Tag:           "varint,63300,opt,name=fieldpath_all",
+		Filename:      "github.com/containerd/containerd/protobuf/plugin/fieldpath.proto",
+	},
+	{
+		ExtendedType:  (*descriptorpb.MessageOptions)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         64400,
+		Name:          "containerd.plugin.fieldpath",
+		Tag:           "varint,64400,opt,name=fieldpath",
+		Filename:      "github.com/containerd/containerd/protobuf/plugin/fieldpath.proto",
+	},
+}
+
+// Extension fields to descriptorpb.FileOptions.
+var (
+	// optional bool fieldpath_all = 63300;
+	E_FieldpathAll = &file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_extTypes[0]
+)
+
+// Extension fields to descriptorpb.MessageOptions.
+var (
+	// optional bool fieldpath = 64400;
+	E_Fieldpath = &file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_extTypes[1]
+)
+
+var File_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto protoreflect.FileDescriptor
+
+var file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_rawDesc = []byte{
+	0x0a, 0x40, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x70, 0x6c, 0x75, 0x67,
+	0x69, 0x6e, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x12, 0x11, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x70,
+	0x6c, 0x75, 0x67, 0x69, 0x6e, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f,
+	0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x3a, 0x43, 0x0a, 0x0d, 0x66, 0x69, 0x65, 0x6c, 0x64,
+	0x70, 0x61, 0x74, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x12, 0x1c, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x6c, 0x65, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xc4, 0xee, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0c,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x41, 0x6c, 0x6c, 0x3a, 0x3f, 0x0a, 0x09,
+	0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73, 0x73,
+	0x61, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x90, 0xf7, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x42, 0x32, 0x5a,
+	0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x70, 0x6c, 0x75, 0x67, 0x69,
+	0x6e,
+}
+
+var file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_goTypes = []interface{}{
+	(*descriptorpb.FileOptions)(nil),    // 0: google.protobuf.FileOptions
+	(*descriptorpb.MessageOptions)(nil), // 1: google.protobuf.MessageOptions
+}
+var file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_depIdxs = []int32{
+	0, // 0: containerd.plugin.fieldpath_all:extendee -> google.protobuf.FileOptions
+	1, // 1: containerd.plugin.fieldpath:extendee -> google.protobuf.MessageOptions
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	0, // [0:2] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_init() }
+func file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_init() {
+	if File_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   0,
+			NumExtensions: 2,
+			NumServices:   0,
+		},
+		GoTypes:           file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_goTypes,
+		DependencyIndexes: file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_depIdxs,
+		ExtensionInfos:    file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_extTypes,
+	}.Build()
+	File_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto = out.File
+	file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_rawDesc = nil
+	file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_goTypes = nil
+	file_github_com_containerd_containerd_protobuf_plugin_fieldpath_proto_depIdxs = nil
+}
--- a/vendor/github.com/containerd/containerd/protobuf/plugin/fieldpath.proto
+++ b/vendor/github.com/containerd/containerd/protobuf/plugin/fieldpath.proto
@ -26,12 +26,12 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

-syntax = "proto3";
-package containerd.types;
+syntax = "proto2";
+package containerd.plugin;

 import "google/protobuf/descriptor.proto";

-option go_package = "github.com/containerd/containerd/api/types;types";
+option go_package = "github.com/containerd/containerd/protobuf/plugin";

 extend google.protobuf.FileOptions {
 	optional bool fieldpath_all = 63300;
--- a/vendor/github.com/containerd/containerd/pull.go
+++ b/vendor/github.com/containerd/containerd/pull.go
@ -26,12 +26,12 @@ import (

 	"github.com/containerd/containerd/images"
 	"github.com/containerd/containerd/pkg/unpack"
+	"github.com/containerd/containerd/platforms"
 	"github.com/containerd/containerd/remotes"
 	"github.com/containerd/containerd/remotes/docker"
 	"github.com/containerd/containerd/remotes/docker/schema1" //nolint:staticcheck // Ignore SA1019. Need to keep deprecated package for compatibility.
 	"github.com/containerd/containerd/tracing"
 	"github.com/containerd/errdefs"
-	"github.com/containerd/platforms"
 )

 const (
--- a/Show More
+++ b/Show More