@@ -14,7 +14,7 @@ github.com/sirupsen/logrus v1.0.6

 github.com/tchap/go-patricia v2.2.6

 github.com/vdemeester/shakers 24d7f1d6a71aa5d9cbe7390e4afb66b7eef9e1b3

 golang.org/x/net a680a1efc54dd51c040b3b5ce4939ea3cf2ea0d1

-golang.org/x/sys 41f3e6584952bb034a481797859f6ab34b6803bd

+golang.org/x/sys d455e41777fca6e8a5a79e34a14b8368bc11d9ba

 github.com/docker/go-units 47565b4f722fb6ceae66b95f853feed578a4a51c # v0.3.3

 github.com/docker/go-connections 7395e3f8aa162843a74ed6d48e79627d9792ac55 # v0.4.0

 golang.org/x/text f21a4dfb5e38f5895301dc265a8def02365cc3d0 # v0.3.0

@@ -119,14 +119,14 @@ github.com/googleapis/gax-go v2.0.0

 google.golang.org/genproto 694d95ba50e67b2e363f3483057db5d4910c18f9

 # containerd

-github.com/containerd/containerd bb71b10fd8f58240ca47fbb579b9d1028eea7c84 # v1.2.5

+github.com/containerd/containerd a15b6e2097c48b632dbdc63254bad4c62b69e709

 github.com/containerd/fifo 3d5202aec260678c48179c56f40e6f38a095738c

 github.com/containerd/continuity 004b46473808b3e7a4a3049c20e4376c91eb966d

 github.com/containerd/cgroups dbea6f2bd41658b84b00417ceefa416b979cbf10

 github.com/containerd/console c12b1e7919c14469339a5d38f2f8ed9b64a9de23

 github.com/containerd/go-runc 5a6d9f37cfa36b15efba46dc7ea349fa9b7143c3

 github.com/containerd/typeurl a93fcdb778cd272c6e9b3028b2f42d813e785d40

-github.com/containerd/ttrpc 2a805f71863501300ae1976d29f0454ae003e85a

+github.com/containerd/ttrpc f02858b1457c5ca3aaec3a0803eb0d59f96e41d6

 github.com/gogo/googleapis 08a7655d27152912db7aaf4f983275eaf8d128ef

 # cluster

@@ -172,11 +172,9 @@ checkpoint, err := task.Checkpoint(context)

 err := client.Push(context, "myregistry/checkpoints/redis:master", checkpoint)

 // on a new machine pull the checkpoint and restore the redis container

-image, err := client.Pull(context, "myregistry/checkpoints/redis:master")

+checkpoint, err := client.Pull(context, "myregistry/checkpoints/redis:master")

-checkpoint := image.Target()

-

-redis, err = client.NewContainer(context, "redis-master", containerd.WithCheckpoint(checkpoint, "redis-rootfs"))

+redis, err = client.NewContainer(context, "redis-master", containerd.WithNewSnapshot("redis-rootfs", checkpoint))

 defer container.Delete(context)

 task, err = redis.NewTask(context, cio.Stdio, containerd.WithTaskCheckpoint(checkpoint))

@@ -212,11 +210,6 @@ See [PLUGINS.md](PLUGINS.md) for how to create plugins

 Please see [RELEASES.md](RELEASES.md) for details on versioning and stability

 of containerd components.

-### Development reports.

-

-Weekly summary on the progress and what is being worked on.

-https://github.com/containerd/containerd/tree/master/reports

-

 ### Communication

 For async communication and long running discussions please use issues and pull requests on the github repo.

@@ -224,7 +217,12 @@ This will be the best place to discuss design and implementation.

 For sync communication we have a community slack with a #containerd channel that everyone is welcome to join and chat about development.

-**Slack:** https://join.slack.com/t/dockercommunity/shared_invite/enQtNDM4NjAwNDMyOTUwLWZlMDZmYWRjZjk4Zjc5ZGQ5NWZkOWI1Yjk2NGE3ZWVlYjYxM2VhYjczOWIyZDFhZTE3NTUwZWQzMjhmNGYyZTg

+**Slack:** Catch us in the #containerd and #containerd-dev channels on dockercommunity.slack.com.

+[Click here for an invite to docker community slack.](https://join.slack.com/t/dockercommunity/shared_invite/enQtNDY4MDc1Mzc0MzIwLTgxZDBlMmM4ZGEyNDc1N2FkMzlhODJkYmE1YTVkYjM1MDE3ZjAwZjBkOGFlOTJkZjRmZGYzNjYyY2M3ZTUxYzQ)

+

+### Security audit

+

+A third party security audit was performed by Cure53 in 4Q2018; the [full report](docs/SECURITY_AUDIT.pdf) is available in our docs/ directory.

 ### Reporting security issues

@@ -249,3 +247,8 @@ Please find all these core project documents, including the:

  * and [Contributing guidelines](https://github.com/containerd/project/blob/master/CONTRIBUTING.md)

 information in our [`containerd/project`](https://github.com/containerd/project) repository.

+

+## Adoption

+

+Interested to see who is using containerd? Are you using containerd in a project?

+Please add yourself via pull request to our [ADOPTERS.md](./ADOPTERS.md) file.

@@ -55,6 +55,9 @@ type TaskDelete struct {

 	Pid         uint32    `protobuf:"varint,2,opt,name=pid,proto3" json:"pid,omitempty"`

 	ExitStatus  uint32    `protobuf:"varint,3,opt,name=exit_status,json=exitStatus,proto3" json:"exit_status,omitempty"`

 	ExitedAt    time.Time `protobuf:"bytes,4,opt,name=exited_at,json=exitedAt,stdtime" json:"exited_at"`

+	// id is the specific exec. By default if omitted will be `""` thus matches

+	// the init exec of the task matching `container_id`.

+	ID string `protobuf:"bytes,5,opt,name=id,proto3" json:"id,omitempty"`

 }

 func (m *TaskDelete) Reset()                    { *m = TaskDelete{} }

@@ -210,6 +213,8 @@ func (m *TaskDelete) Field(fieldpath []string) (string, bool) {

 	// unhandled: exited_at

 	case "container_id":

 		return string(m.ContainerID), len(m.ContainerID) > 0

+	case "id":

+		return string(m.ID), len(m.ID) > 0

 	}

 	return "", false

 }

@@ -474,6 +479,12 @@ func (m *TaskDelete) MarshalTo(dAtA []byte) (int, error) {

 		return 0, err

 	}

 	i += n2

+	if len(m.ID) > 0 {

+		dAtA[i] = 0x2a

+		i++

+		i = encodeVarintTask(dAtA, i, uint64(len(m.ID)))

+		i += copy(dAtA[i:], m.ID)

+	}

 	return i, nil

 }

@@ -806,6 +817,10 @@ func (m *TaskDelete) Size() (n int) {

 	}

 	l = types.SizeOfStdTime(m.ExitedAt)

 	n += 1 + l + sovTask(uint64(l))

+	l = len(m.ID)

+	if l > 0 {

+		n += 1 + l + sovTask(uint64(l))

+	}

 	return n

 }

@@ -975,6 +990,7 @@ func (this *TaskDelete) String() string {

 		`Pid:` + fmt.Sprintf("%v", this.Pid) + `,`,

 		`ExitStatus:` + fmt.Sprintf("%v", this.ExitStatus) + `,`,

 		`ExitedAt:` + strings.Replace(strings.Replace(this.ExitedAt.String(), "Timestamp", "google_protobuf2.Timestamp", 1), `&`, ``, 1) + `,`,

+		`ID:` + fmt.Sprintf("%v", this.ID) + `,`,

 		`}`,

 	}, "")

 	return s

@@ -1522,6 +1538,35 @@ func (m *TaskDelete) Unmarshal(dAtA []byte) error {

 				return err

 			}

 			iNdEx = postIndex

+		case 5:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)

+			}

+			var stringLen uint64

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowTask

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}

+				b := dAtA[iNdEx]

+				iNdEx++

+				stringLen |= (uint64(b) & 0x7F) << shift

+				if b < 0x80 {

+					break

+				}

+			}

+			intStringLen := int(stringLen)

+			if intStringLen < 0 {

+				return ErrInvalidLengthTask

+			}

+			postIndex := iNdEx + intStringLen

+			if postIndex > l {

+				return io.ErrUnexpectedEOF

+			}

+			m.ID = string(dAtA[iNdEx:postIndex])

+			iNdEx = postIndex

 		default:

 			iNdEx = preIndex

 			skippy, err := skipTask(dAtA[iNdEx:])

@@ -2566,45 +2611,46 @@ func init() {

 }

 var fileDescriptorTask = []byte{

-	// 637 bytes of a gzipped FileDescriptorProto

+	// 644 bytes of a gzipped FileDescriptorProto

 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x95, 0xcd, 0x6e, 0xd3, 0x40,

-	0x10, 0xc7, 0x63, 0xa7, 0x75, 0x93, 0x09, 0x55, 0x8b, 0x55, 0x41, 0xc8, 0xc1, 0x8e, 0xcc, 0x25,

-	0x27, 0x5b, 0x04, 0x89, 0x0b, 0x42, 0x6a, 0xd2, 0x70, 0xc8, 0xa1, 0x4a, 0x71, 0x7b, 0xa8, 0xb8,

-	0x44, 0x4e, 0x76, 0x93, 0x2c, 0x8d, 0xbd, 0x96, 0x3d, 0x46, 0x45, 0xe2, 0xc0, 0x23, 0xf0, 0x08,

-	0x3c, 0x05, 0xcf, 0xd0, 0x03, 0x07, 0x8e, 0x9c, 0x02, 0xf5, 0x03, 0x70, 0xe2, 0x01, 0xd0, 0x7a,

-	0x1d, 0xb7, 0x50, 0xf1, 0x65, 0x89, 0x53, 0x76, 0x66, 0x67, 0xff, 0x33, 0xf3, 0xdb, 0xc9, 0x1a,

-	0x1e, 0xcd, 0x19, 0x2e, 0x92, 0x89, 0x3d, 0xe5, 0xbe, 0x33, 0xe5, 0x01, 0x7a, 0x2c, 0xa0, 0x11,

-	0xb9, 0xbe, 0xf4, 0x42, 0xe6, 0xd0, 0x97, 0x34, 0xc0, 0xd8, 0x41, 0x2f, 0x3e, 0xb3, 0xc3, 0x88,

-	0x23, 0xd7, 0x6f, 0x5f, 0x45, 0xd8, 0x72, 0xb7, 0xb5, 0x37, 0xe7, 0x73, 0x9e, 0xed, 0x3a, 0x62,

-	0x25, 0x03, 0x5b, 0xe6, 0x9c, 0xf3, 0xf9, 0x92, 0x3a, 0x99, 0x35, 0x49, 0x66, 0x0e, 0x32, 0x9f,

-	0xc6, 0xe8, 0xf9, 0x61, 0x1e, 0xf0, 0x77, 0x15, 0xe0, 0xab, 0x90, 0xc6, 0x8e, 0xcf, 0x93, 0x00,

-	0xf3, 0x73, 0xfb, 0x7f, 0x3c, 0x57, 0xa4, 0x0c, 0x97, 0xc9, 0x9c, 0x05, 0xce, 0x8c, 0xd1, 0x25,

-	0x09, 0x3d, 0x5c, 0x48, 0x05, 0xeb, 0xab, 0x02, 0x70, 0xe2, 0xc5, 0x67, 0x07, 0x11, 0xf5, 0x90,

-	0xea, 0x5d, 0xb8, 0x55, 0x1c, 0x1e, 0x33, 0xd2, 0x54, 0xda, 0x4a, 0xa7, 0xde, 0xdf, 0x49, 0x57,

-	0x66, 0xe3, 0x60, 0xed, 0x1f, 0x0e, 0xdc, 0x46, 0x11, 0x34, 0x24, 0xfa, 0x1d, 0xd0, 0x26, 0x49,

-	0x40, 0x96, 0xb4, 0xa9, 0x8a, 0x68, 0x37, 0xb7, 0x74, 0x07, 0xb4, 0x88, 0x73, 0x9c, 0xc5, 0xcd,

-	0x6a, 0xbb, 0xda, 0x69, 0x74, 0xef, 0xda, 0xd7, 0x78, 0x65, 0xbd, 0xd8, 0x87, 0xa2, 0x17, 0x37,

-	0x0f, 0xd3, 0x1f, 0x80, 0xca, 0x78, 0x73, 0xa3, 0xad, 0x74, 0x1a, 0xdd, 0x7b, 0xf6, 0x0d, 0xb8,

-	0xb6, 0xa8, 0x73, 0x38, 0xea, 0x6b, 0xe9, 0xca, 0x54, 0x87, 0x23, 0x57, 0x65, 0x5c, 0x37, 0x00,

-	0xa6, 0x0b, 0x3a, 0x3d, 0x0b, 0x39, 0x0b, 0xb0, 0xb9, 0x99, 0xe5, 0xbf, 0xe6, 0xd1, 0x77, 0xa1,

-	0x1a, 0x32, 0xd2, 0xd4, 0xda, 0x4a, 0x67, 0xdb, 0x15, 0x4b, 0xeb, 0x19, 0xd4, 0x85, 0xce, 0x31,

-	0x7a, 0x11, 0x96, 0x6a, 0x37, 0x97, 0x54, 0xaf, 0x24, 0xdf, 0xe7, 0x0c, 0x07, 0x74, 0x49, 0x4b,

-	0x32, 0xbc, 0x21, 0xaa, 0x9b, 0xd0, 0xa0, 0xe7, 0x0c, 0xc7, 0x31, 0x7a, 0x98, 0x08, 0x84, 0x62,

-	0x07, 0x84, 0xeb, 0x38, 0xf3, 0xe8, 0x3d, 0xa8, 0x0b, 0x8b, 0x92, 0xb1, 0x87, 0x39, 0xb4, 0x96,

-	0x2d, 0x07, 0xcd, 0x5e, 0xdf, 0xba, 0x7d, 0xb2, 0x1e, 0xb4, 0x7e, 0xed, 0x62, 0x65, 0x56, 0xde,

-	0x7e, 0x36, 0x15, 0xb7, 0x26, 0x8f, 0xf5, 0xd0, 0x7a, 0x01, 0x9a, 0x64, 0xaa, 0xef, 0xc1, 0x66,

-	0x8c, 0x84, 0x05, 0xb2, 0x58, 0x57, 0x1a, 0xe2, 0x66, 0x63, 0x24, 0x3c, 0xc1, 0xf5, 0xcd, 0x4a,

-	0x2b, 0xf7, 0xd3, 0x28, 0xca, 0xca, 0x92, 0x7e, 0x1a, 0x45, 0x7a, 0x0b, 0x6a, 0x48, 0x23, 0x9f,

-	0x05, 0xde, 0x32, 0xab, 0xa8, 0xe6, 0x16, 0xb6, 0xf5, 0x41, 0x81, 0x9a, 0x48, 0xf6, 0xf4, 0x9c,

-	0x61, 0xc9, 0x31, 0x53, 0x73, 0x42, 0xf5, 0x7c, 0x04, 0x06, 0xae, 0xca, 0x0a, 0x74, 0xd5, 0x5f,

-	0xa2, 0xdb, 0xf8, 0x3d, 0xba, 0xcd, 0x52, 0xe8, 0x9e, 0xc0, 0x96, 0xe8, 0x66, 0x34, 0x3a, 0x2c,

-	0xd3, 0x8c, 0xb5, 0x80, 0x6d, 0x09, 0x83, 0x4e, 0x7b, 0x84, 0x50, 0x52, 0x8a, 0xc8, 0x7d, 0xd8,

-	0xa2, 0xe7, 0x74, 0x3a, 0x2e, 0xb0, 0x40, 0xba, 0x32, 0x35, 0xa1, 0x39, 0x1c, 0xb8, 0x9a, 0xd8,

-	0x1a, 0x12, 0xeb, 0x35, 0xec, 0xac, 0x33, 0x65, 0x33, 0xff, 0x1f, 0x73, 0xdd, 0xbc, 0x0a, 0x6b,

-	0x5f, 0xfe, 0x33, 0x8e, 0xbc, 0x24, 0x2e, 0x97, 0xd8, 0xea, 0x41, 0x43, 0x28, 0xb8, 0x34, 0x4e,

-	0xfc, 0x92, 0x12, 0x33, 0xd8, 0xcd, 0x9e, 0xb8, 0xe2, 0x59, 0x28, 0xc9, 0xe0, 0xc7, 0xc7, 0x46,

-	0xfd, 0xf9, 0xb1, 0xe9, 0x1f, 0x5d, 0x5c, 0x1a, 0x95, 0x4f, 0x97, 0x46, 0xe5, 0x4d, 0x6a, 0x28,

-	0x17, 0xa9, 0xa1, 0x7c, 0x4c, 0x0d, 0xe5, 0x4b, 0x6a, 0x28, 0xef, 0xbe, 0x19, 0xca, 0xf3, 0xee,

-	0x3f, 0x7c, 0x65, 0x1e, 0xcb, 0x9f, 0xd3, 0xca, 0x69, 0x75, 0xa2, 0x65, 0x13, 0xf9, 0xf0, 0x7b,

-	0x00, 0x00, 0x00, 0xff, 0xff, 0x07, 0x69, 0x62, 0x9d, 0xa6, 0x06, 0x00, 0x00,

+	0x10, 0xc7, 0x63, 0xa7, 0x75, 0xd3, 0x09, 0x55, 0x8b, 0x55, 0x95, 0x90, 0x83, 0x1d, 0x99, 0x4b,

+	0x4e, 0xb6, 0x08, 0x12, 0x17, 0x84, 0xd4, 0xa4, 0xe1, 0x90, 0x43, 0x95, 0xe2, 0xf6, 0x50, 0x71,

+	0x89, 0x36, 0xd9, 0x4d, 0xb2, 0x34, 0xf1, 0x5a, 0xf6, 0x18, 0x15, 0x89, 0x03, 0x8f, 0xc0, 0x23,

+	0xf0, 0x38, 0x3d, 0x20, 0xc4, 0x91, 0x53, 0xa0, 0x7e, 0x00, 0x4e, 0x3c, 0x00, 0x5a, 0xaf, 0x93,

+	0xb6, 0x54, 0x7c, 0x59, 0xe2, 0x94, 0x9d, 0xd9, 0xd9, 0xff, 0xec, 0xfc, 0x76, 0x3c, 0x81, 0xc7,

+	0x13, 0x8e, 0xd3, 0x64, 0xe8, 0x8e, 0xc4, 0xdc, 0x1b, 0x89, 0x00, 0x09, 0x0f, 0x58, 0x44, 0xaf,

+	0x2f, 0x49, 0xc8, 0x3d, 0xf6, 0x8a, 0x05, 0x18, 0x7b, 0x48, 0xe2, 0x33, 0x37, 0x8c, 0x04, 0x0a,

+	0xf3, 0xee, 0x55, 0x84, 0xab, 0x76, 0xeb, 0xbb, 0x13, 0x31, 0x11, 0xd9, 0xae, 0x27, 0x57, 0x2a,

+	0xb0, 0x6e, 0x4f, 0x84, 0x98, 0xcc, 0x98, 0x97, 0x59, 0xc3, 0x64, 0xec, 0x21, 0x9f, 0xb3, 0x18,

+	0xc9, 0x3c, 0xcc, 0x03, 0xfe, 0xee, 0x06, 0xf8, 0x3a, 0x64, 0xb1, 0x37, 0x17, 0x49, 0x80, 0xf9,

+	0xb9, 0xfd, 0x3f, 0x9e, 0x5b, 0xa5, 0x0c, 0x67, 0xc9, 0x84, 0x07, 0xde, 0x98, 0xb3, 0x19, 0x0d,

+	0x09, 0x4e, 0x95, 0x82, 0xf3, 0x4d, 0x03, 0x38, 0x21, 0xf1, 0xd9, 0x41, 0xc4, 0x08, 0x32, 0xb3,

+	0x05, 0x77, 0x56, 0x87, 0x07, 0x9c, 0xd6, 0xb4, 0x86, 0xd6, 0xdc, 0xec, 0x6c, 0xa7, 0x0b, 0xbb,

+	0x7a, 0xb0, 0xf4, 0xf7, 0xba, 0x7e, 0x75, 0x15, 0xd4, 0xa3, 0xe6, 0x1e, 0x18, 0xc3, 0x24, 0xa0,

+	0x33, 0x56, 0xd3, 0x65, 0xb4, 0x9f, 0x5b, 0xa6, 0x07, 0x46, 0x24, 0x04, 0x8e, 0xe3, 0x5a, 0xb9,

+	0x51, 0x6e, 0x56, 0x5b, 0xf7, 0xdc, 0x6b, 0xbc, 0xb2, 0x5a, 0xdc, 0x43, 0x59, 0x8b, 0x9f, 0x87,

+	0x99, 0x0f, 0x41, 0xe7, 0xa2, 0xb6, 0xd6, 0xd0, 0x9a, 0xd5, 0xd6, 0x7d, 0xf7, 0x16, 0x5c, 0x57,

+	0xde, 0xb3, 0xd7, 0xef, 0x18, 0xe9, 0xc2, 0xd6, 0x7b, 0x7d, 0x5f, 0xe7, 0xc2, 0xb4, 0x00, 0x46,

+	0x53, 0x36, 0x3a, 0x0b, 0x05, 0x0f, 0xb0, 0xb6, 0x9e, 0xe5, 0xbf, 0xe6, 0x31, 0x77, 0xa0, 0x1c,

+	0x72, 0x5a, 0x33, 0x1a, 0x5a, 0x73, 0xcb, 0x97, 0x4b, 0xe7, 0x39, 0x6c, 0x4a, 0x9d, 0x63, 0x24,

+	0x11, 0x16, 0x2a, 0x37, 0x97, 0xd4, 0xaf, 0x24, 0x3f, 0xe6, 0x0c, 0xbb, 0x6c, 0xc6, 0x0a, 0x32,

+	0xbc, 0x25, 0x6a, 0xda, 0x50, 0x65, 0xe7, 0x1c, 0x07, 0x31, 0x12, 0x4c, 0x24, 0x42, 0xb9, 0x03,

+	0xd2, 0x75, 0x9c, 0x79, 0xcc, 0x36, 0x6c, 0x4a, 0x8b, 0xd1, 0x01, 0xc1, 0x1c, 0x5a, 0xdd, 0x55,

+	0x8d, 0xe6, 0x2e, 0x5f, 0xdd, 0x3d, 0x59, 0x36, 0x5a, 0xa7, 0x72, 0xb1, 0xb0, 0x4b, 0xef, 0xbe,

+	0xd8, 0x9a, 0x5f, 0x51, 0xc7, 0xda, 0x68, 0xee, 0x81, 0xce, 0xa9, 0xa2, 0x96, 0x53, 0xed, 0xfa,

+	0x3a, 0xa7, 0xce, 0x4b, 0x30, 0x14, 0x6b, 0x73, 0x17, 0xd6, 0x63, 0xa4, 0x3c, 0x50, 0x45, 0xf8,

+	0xca, 0x90, 0x2f, 0x1e, 0x23, 0x15, 0x09, 0x2e, 0x5f, 0x5c, 0x59, 0xb9, 0x9f, 0x45, 0x51, 0x76,

+	0x5d, 0xe5, 0x67, 0x51, 0x64, 0xd6, 0xa1, 0x82, 0x2c, 0x9a, 0xf3, 0x80, 0xcc, 0xb2, 0x9b, 0x56,

+	0xfc, 0x95, 0xed, 0x7c, 0xd0, 0xa0, 0x22, 0x93, 0x3d, 0x3b, 0xe7, 0x58, 0xb0, 0xfd, 0xf4, 0x9c,

+	0xdc, 0x8d, 0x22, 0x96, 0x48, 0xcb, 0xbf, 0x44, 0xba, 0xf6, 0x7b, 0xa4, 0xeb, 0x45, 0x90, 0x3a,

+	0x4f, 0x61, 0x43, 0x56, 0xd3, 0xef, 0x1f, 0x16, 0x29, 0xc6, 0x99, 0xc2, 0x96, 0x82, 0xc1, 0x46,

+	0x6d, 0x4a, 0x19, 0x2d, 0x44, 0xe4, 0x01, 0x6c, 0xb0, 0x73, 0x36, 0x1a, 0xac, 0xb0, 0x40, 0xba,

+	0xb0, 0x0d, 0xa9, 0xd9, 0xeb, 0xfa, 0x86, 0xdc, 0xea, 0x51, 0xe7, 0x0d, 0x6c, 0x2f, 0x33, 0x65,

+	0xdf, 0xc2, 0x7f, 0xcc, 0x75, 0xfb, 0x29, 0x9c, 0x7d, 0xf5, 0xc5, 0x1c, 0x91, 0x24, 0x2e, 0x96,

+	0xd8, 0x69, 0x43, 0x55, 0x2a, 0xf8, 0x2c, 0x4e, 0xe6, 0x05, 0x25, 0xc6, 0xb0, 0x93, 0x8d, 0xbe,

+	0xd5, 0xb8, 0x28, 0xc8, 0xe0, 0xe6, 0x10, 0xd2, 0x7f, 0x1e, 0x42, 0x9d, 0xa3, 0x8b, 0x4b, 0xab,

+	0xf4, 0xf9, 0xd2, 0x2a, 0xbd, 0x4d, 0x2d, 0xed, 0x22, 0xb5, 0xb4, 0x4f, 0xa9, 0xa5, 0x7d, 0x4d,

+	0x2d, 0xed, 0xfd, 0x77, 0x4b, 0x7b, 0xd1, 0xfa, 0x87, 0x7f, 0x9f, 0x27, 0xea, 0xe7, 0xb4, 0x74,

+	0x5a, 0x1e, 0x1a, 0x59, 0x47, 0x3e, 0xfa, 0x11, 0x00, 0x00, 0xff, 0xff, 0xc5, 0x58, 0x0f, 0xec,

+	0xbe, 0x06, 0x00, 0x00,

 }

@@ -29,6 +29,9 @@ message TaskDelete {

 	uint32 pid = 2;

 	uint32 exit_status = 3;

 	google.protobuf.Timestamp exited_at = 4 [(gogoproto.stdtime) = true, (gogoproto.nullable) = false];

+	// id is the specific exec. By default if omitted will be `""` thus matches

+	// the init exec of the task matching `container_id`.

+	string id = 5;

 }

 message TaskIO {

deleted file mode 100644

@@ -1,30 +0,0 @@

-/*

-   Copyright The containerd Authors.

-

-   Licensed under the Apache License, Version 2.0 (the "License");

-   you may not use this file except in compliance with the License.

-   You may obtain a copy of the License at

-

-       http://www.apache.org/licenses/LICENSE-2.0

-

-   Unless required by applicable law or agreed to in writing, software

-   distributed under the License is distributed on an "AS IS" BASIS,

-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

-   See the License for the specific language governing permissions and

-   limitations under the License.

-*/

-

-package archive

-

-import (

-	"time"

-

-	"github.com/pkg/errors"

-)

-

-// as at MacOS 10.12 there is apparently no way to set timestamps

-// with nanosecond precision. We could fall back to utimes/lutimes

-// and lose the precision as a temporary workaround.

-func chtimes(path string, atime, mtime time.Time) error {

-	return errors.New("OSX missing UtimesNanoAt")

-}

@@ -1,4 +1,4 @@

-// +build freebsd linux openbsd solaris

+// +build !windows

 /*

    Copyright The containerd Authors.

@@ -31,11 +31,15 @@ const pipeRoot = `\\.\pipe`

 // NewFIFOSetInDir returns a new set of fifos for the task

 func NewFIFOSetInDir(_, id string, terminal bool) (*FIFOSet, error) {

+	stderrPipe := ""

+	if !terminal {

+		stderrPipe = fmt.Sprintf(`%s\ctr-%s-stderr`, pipeRoot, id)

+	}

 	return NewFIFOSet(Config{

 		Terminal: terminal,

 		Stdin:    fmt.Sprintf(`%s\ctr-%s-stdin`, pipeRoot, id),

 		Stdout:   fmt.Sprintf(`%s\ctr-%s-stdout`, pipeRoot, id),

-		Stderr:   fmt.Sprintf(`%s\ctr-%s-stderr`, pipeRoot, id),

+		Stderr:   stderrPipe,

 	}, nil), nil

 }

@@ -17,11 +17,14 @@

 package containerd

 import (

+	"bytes"

 	"context"

+	"encoding/json"

 	"fmt"

 	"net/http"

 	"runtime"

 	"strconv"

+	"strings"

 	"sync"

 	"time"

@@ -40,7 +43,6 @@ import (

 	"github.com/containerd/containerd/content"

 	contentproxy "github.com/containerd/containerd/content/proxy"

 	"github.com/containerd/containerd/defaults"

-	"github.com/containerd/containerd/errdefs"

 	"github.com/containerd/containerd/events"

 	"github.com/containerd/containerd/images"

 	"github.com/containerd/containerd/leases"

@@ -51,7 +53,6 @@ import (

 	"github.com/containerd/containerd/plugin"

 	"github.com/containerd/containerd/remotes"

 	"github.com/containerd/containerd/remotes/docker"

-	"github.com/containerd/containerd/remotes/docker/schema1"

 	"github.com/containerd/containerd/snapshots"

 	snproxy "github.com/containerd/containerd/snapshots/proxy"

 	"github.com/containerd/typeurl"

@@ -280,6 +281,12 @@ type RemoteContext struct {

 	// handlers.

 	BaseHandlers []images.Handler

+	// HandlerWrapper wraps the handler which gets sent to dispatch.

+	// Unlike BaseHandlers, this can run before and after the built

+	// in handlers, allowing operations to run on the descriptor

+	// after it has completed transferring.

+	HandlerWrapper func(images.Handler) images.Handler

+

 	// ConvertSchema1 is whether to convert Docker registry schema 1

 	// manifests. If this option is false then any image which resolves

 	// to schema 1 will return an error since schema 1 is not supported.

@@ -290,6 +297,9 @@ type RemoteContext struct {

 	// platforms will be used to create a PlatformMatcher with no ordering

 	// preference.

 	Platforms []string

+

+	// MaxConcurrentDownloads is the max concurrent content downloads for each pull.

+	MaxConcurrentDownloads int

 }

 func defaultRemoteContext() *RemoteContext {

@@ -341,157 +351,6 @@ func (c *Client) Fetch(ctx context.Context, ref string, opts ...RemoteOpt) (imag

 	return c.fetch(ctx, fetchCtx, ref, 0)

 }

-// Pull downloads the provided content into containerd's content store

-// and returns a platform specific image object

-func (c *Client) Pull(ctx context.Context, ref string, opts ...RemoteOpt) (Image, error) {

-	pullCtx := defaultRemoteContext()

-	for _, o := range opts {

-		if err := o(c, pullCtx); err != nil {

-			return nil, err

-		}

-	}

-

-	if pullCtx.PlatformMatcher == nil {

-		if len(pullCtx.Platforms) > 1 {

-			return nil, errors.New("cannot pull multiplatform image locally, try Fetch")

-		} else if len(pullCtx.Platforms) == 0 {

-			pullCtx.PlatformMatcher = platforms.Default()

-		} else {

-			p, err := platforms.Parse(pullCtx.Platforms[0])

-			if err != nil {

-				return nil, errors.Wrapf(err, "invalid platform %s", pullCtx.Platforms[0])

-			}

-

-			pullCtx.PlatformMatcher = platforms.Only(p)

-		}

-	}

-

-	ctx, done, err := c.WithLease(ctx)

-	if err != nil {

-		return nil, err

-	}

-	defer done(ctx)

-

-	img, err := c.fetch(ctx, pullCtx, ref, 1)

-	if err != nil {

-		return nil, err

-	}

-

-	i := NewImageWithPlatform(c, img, pullCtx.PlatformMatcher)

-

-	if pullCtx.Unpack {

-		if err := i.Unpack(ctx, pullCtx.Snapshotter); err != nil {

-			return nil, errors.Wrapf(err, "failed to unpack image on snapshotter %s", pullCtx.Snapshotter)

-		}

-	}

-

-	return i, nil

-}

-

-func (c *Client) fetch(ctx context.Context, rCtx *RemoteContext, ref string, limit int) (images.Image, error) {

-	store := c.ContentStore()

-	name, desc, err := rCtx.Resolver.Resolve(ctx, ref)

-	if err != nil {

-		return images.Image{}, errors.Wrapf(err, "failed to resolve reference %q", ref)

-	}

-

-	fetcher, err := rCtx.Resolver.Fetcher(ctx, name)

-	if err != nil {

-		return images.Image{}, errors.Wrapf(err, "failed to get fetcher for %q", name)

-	}

-

-	var (

-		handler images.Handler

-

-		isConvertible bool

-		converterFunc func(context.Context, ocispec.Descriptor) (ocispec.Descriptor, error)

-	)

-

-	if desc.MediaType == images.MediaTypeDockerSchema1Manifest && rCtx.ConvertSchema1 {

-		schema1Converter := schema1.NewConverter(store, fetcher)

-

-		handler = images.Handlers(append(rCtx.BaseHandlers, schema1Converter)...)

-

-		isConvertible = true

-

-		converterFunc = func(ctx context.Context, _ ocispec.Descriptor) (ocispec.Descriptor, error) {

-			return schema1Converter.Convert(ctx)

-		}

-	} else {

-		// Get all the children for a descriptor

-		childrenHandler := images.ChildrenHandler(store)

-		// Set any children labels for that content

-		childrenHandler = images.SetChildrenLabels(store, childrenHandler)

-		// Filter children by platforms

-		childrenHandler = images.FilterPlatforms(childrenHandler, rCtx.PlatformMatcher)

-		// Sort and limit manifests if a finite number is needed

-		if limit > 0 {

-			childrenHandler = images.LimitManifests(childrenHandler, rCtx.PlatformMatcher, limit)

-		}

-

-		// set isConvertible to true if there is application/octet-stream media type

-		convertibleHandler := images.HandlerFunc(

-			func(_ context.Context, desc ocispec.Descriptor) ([]ocispec.Descriptor, error) {

-				if desc.MediaType == docker.LegacyConfigMediaType {

-					isConvertible = true

-				}

-

-				return []ocispec.Descriptor{}, nil

-			},

-		)

-

-		handler = images.Handlers(append(rCtx.BaseHandlers,

-			remotes.FetchHandler(store, fetcher),

-			convertibleHandler,

-			childrenHandler,

-		)...)

-

-		converterFunc = func(ctx context.Context, desc ocispec.Descriptor) (ocispec.Descriptor, error) {

-			return docker.ConvertManifest(ctx, store, desc)

-		}

-	}

-

-	if err := images.Dispatch(ctx, handler, desc); err != nil {

-		return images.Image{}, err

-	}

-

-	if isConvertible {

-		if desc, err = converterFunc(ctx, desc); err != nil {

-			return images.Image{}, err

-		}

-	}

-

-	img := images.Image{

-		Name:   name,

-		Target: desc,

-		Labels: rCtx.Labels,

-	}

-

-	is := c.ImageService()

-	for {

-		if created, err := is.Create(ctx, img); err != nil {

-			if !errdefs.IsAlreadyExists(err) {

-				return images.Image{}, err

-			}

-

-			updated, err := is.Update(ctx, img)

-			if err != nil {

-				// if image was removed, try create again

-				if errdefs.IsNotFound(err) {

-					continue

-				}

-				return images.Image{}, err

-			}

-

-			img = updated

-		} else {

-			img = created

-		}

-

-		return img, nil

-	}

-}

-

 // Push uploads the provided content to a remote resource

 func (c *Client) Push(ctx context.Context, ref string, desc ocispec.Descriptor, opts ...RemoteOpt) error {

 	pushCtx := defaultRemoteContext()

@@ -521,7 +380,21 @@ func (c *Client) Push(ctx context.Context, ref string, desc ocispec.Descriptor,

 		return err

 	}

-	return remotes.PushContent(ctx, pusher, desc, c.ContentStore(), pushCtx.PlatformMatcher, pushCtx.BaseHandlers...)

+	var wrapper func(images.Handler) images.Handler

+

+	if len(pushCtx.BaseHandlers) > 0 {

+		wrapper = func(h images.Handler) images.Handler {

+			h = images.Handlers(append(pushCtx.BaseHandlers, h)...)

+			if pushCtx.HandlerWrapper != nil {

+				h = pushCtx.HandlerWrapper(h)

+			}

+			return h

+		}

+	} else if pushCtx.HandlerWrapper != nil {

+		wrapper = pushCtx.HandlerWrapper

+	}

+

+	return remotes.PushContent(ctx, pusher, desc, c.ContentStore(), pushCtx.PlatformMatcher, wrapper)

 }

 // GetImage returns an existing image

@@ -546,6 +419,45 @@ func (c *Client) ListImages(ctx context.Context, filters ...string) ([]Image, er

 	return images, nil

 }

+// Restore restores a container from a checkpoint

+func (c *Client) Restore(ctx context.Context, id string, checkpoint Image, opts ...RestoreOpts) (Container, error) {

+	store := c.ContentStore()

+	index, err := decodeIndex(ctx, store, checkpoint.Target())

+	if err != nil {

+		return nil, err

+	}

+

+	ctx, done, err := c.WithLease(ctx)

+	if err != nil {

+		return nil, err

+	}

+	defer done(ctx)

+

+	copts := []NewContainerOpts{}

+	for _, o := range opts {

+		copts = append(copts, o(ctx, id, c, checkpoint, index))

+	}

+

+	ctr, err := c.NewContainer(ctx, id, copts...)

+	if err != nil {

+		return nil, err

+	}

+

+	return ctr, nil

+}

+

+func writeIndex(ctx context.Context, index *ocispec.Index, client *Client, ref string) (d ocispec.Descriptor, err error) {

+	labels := map[string]string{}

+	for i, m := range index.Manifests {

+		labels[fmt.Sprintf("containerd.io/gc.ref.content.%d", i)] = m.Digest.String()

+	}

+	data, err := json.Marshal(index)

+	if err != nil {

+		return ocispec.Descriptor{}, err

+	}

+	return writeContent(ctx, client.ContentStore(), ocispec.MediaTypeImageIndex, ref, bytes.NewReader(data), content.WithLabels(labels))

+}

+

 // Subscribe to events that match one or more of the provided filters.

 //

 // Callers should listen on both the envelope and errs channels. If the errs

@@ -703,3 +615,20 @@ func (c *Client) Version(ctx context.Context) (Version, error) {

 		Revision: response.Revision,

 	}, nil

 }

+

+// CheckRuntime returns true if the current runtime matches the expected

+// runtime. Providing various parts of the runtime schema will match those

+// parts of the expected runtime

+func CheckRuntime(current, expected string) bool {

+	cp := strings.Split(current, ".")

+	l := len(cp)

+	for i, p := range strings.Split(expected, ".") {

+		if i > l {

+			return false

+		}

+		if p != cp[i] {

+			return false

+		}

+	}

+	return true

+}

@@ -178,3 +178,19 @@ func WithImageHandler(h images.Handler) RemoteOpt {

 		return nil

 	}

 }

+

+// WithImageHandlerWrapper wraps the handlers to be called on dispatch.

+func WithImageHandlerWrapper(w func(images.Handler) images.Handler) RemoteOpt {

+	return func(client *Client, c *RemoteContext) error {

+		c.HandlerWrapper = w

+		return nil

+	}

+}

+

+// WithMaxConcurrentDownloads sets max concurrent download limit.

+func WithMaxConcurrentDownloads(max int) RemoteOpt {

+	return func(client *Client, c *RemoteContext) error {

+		c.MaxConcurrentDownloads = max

+		return nil

+	}

+}

@@ -28,12 +28,22 @@ import (

 	"github.com/containerd/containerd/cio"

 	"github.com/containerd/containerd/containers"

 	"github.com/containerd/containerd/errdefs"

+	"github.com/containerd/containerd/images"

 	"github.com/containerd/containerd/oci"

+	"github.com/containerd/containerd/runtime/v2/runc/options"

 	"github.com/containerd/typeurl"

 	prototypes "github.com/gogo/protobuf/types"

+	ver "github.com/opencontainers/image-spec/specs-go"

+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"

 	"github.com/pkg/errors"

 )

+const (

+	checkpointImageNameLabel       = "org.opencontainers.image.ref.name"

+	checkpointRuntimeNameLabel     = "io.containerd.checkpoint.runtime"

+	checkpointSnapshotterNameLabel = "io.containerd.checkpoint.snapshotter"

+)

+

 // Container is a metadata object for container resources and task creation

 type Container interface {

 	// ID identifies the container

@@ -64,6 +74,8 @@ type Container interface {

 	Extensions(context.Context) (map[string]prototypes.Any, error)

 	// Update a container

 	Update(context.Context, ...UpdateContainerOpts) error

+	// Checkpoint creates a checkpoint image of the current container

+	Checkpoint(context.Context, string, ...CheckpointOpts) (Image, error)

 }

 func containerFromRecord(client *Client, c containers.Container) *container {

@@ -217,7 +229,9 @@ func (c *container) NewTask(ctx context.Context, ioCreate cio.Creator, opts ...N

 			})

 		}

 	}

-	var info TaskInfo

+	info := TaskInfo{

+		runtime: r.Runtime.Name,

+	}

 	for _, o := range opts {

 		if err := o(ctx, c.client, &info); err != nil {

 			return nil, err

@@ -272,6 +286,70 @@ func (c *container) Update(ctx context.Context, opts ...UpdateContainerOpts) err

 	return nil

 }

+func (c *container) Checkpoint(ctx context.Context, ref string, opts ...CheckpointOpts) (Image, error) {

+	index := &ocispec.Index{

+		Versioned: ver.Versioned{

+			SchemaVersion: 2,

+		},

+		Annotations: make(map[string]string),

+	}

+	copts := &options.CheckpointOptions{

+		Exit:                false,

+		OpenTcp:             false,

+		ExternalUnixSockets: false,

+		Terminal:            false,

+		FileLocks:           true,

+		EmptyNamespaces:     nil,

+	}

+	info, err := c.Info(ctx)

+	if err != nil {

+		return nil, err

+	}

+

+	img, err := c.Image(ctx)

+	if err != nil {

+		return nil, err

+	}

+

+	ctx, done, err := c.client.WithLease(ctx)

+	if err != nil {

+		return nil, err

+	}

+	defer done(ctx)

+

+	// add image name to manifest

+	index.Annotations[checkpointImageNameLabel] = img.Name()

+	// add runtime info to index

+	index.Annotations[checkpointRuntimeNameLabel] = info.Runtime.Name

+	// add snapshotter info to index

+	index.Annotations[checkpointSnapshotterNameLabel] = info.Snapshotter

+

+	// process remaining opts

+	for _, o := range opts {

+		if err := o(ctx, c.client, &info, index, copts); err != nil {

+			err = errdefs.FromGRPC(err)

+			if !errdefs.IsAlreadyExists(err) {

+				return nil, err

+			}

+		}

+	}

+

+	desc, err := writeIndex(ctx, index, c.client, c.ID()+"index")

+	if err != nil {

+		return nil, err

+	}

+	i := images.Image{

+		Name:   ref,

+		Target: desc,

+	}

+	checkpoint, err := c.client.ImageService().Create(ctx, i)

+	if err != nil {

+		return nil, err

+	}

+

+	return NewImage(c.client, checkpoint), nil

+}

+

 func (c *container) loadTask(ctx context.Context, ioAttach cio.Attach) (Task, error) {

 	response, err := c.client.TaskService().Get(ctx, &tasks.GetRequest{

 		ContainerID: c.id,

new file mode 100644

@@ -0,0 +1,155 @@

+/*

+   Copyright The containerd Authors.

+

+   Licensed under the Apache License, Version 2.0 (the "License");

+   you may not use this file except in compliance with the License.

+   You may obtain a copy of the License at

+

+       http://www.apache.org/licenses/LICENSE-2.0

+

+   Unless required by applicable law or agreed to in writing, software

+   distributed under the License is distributed on an "AS IS" BASIS,

+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+   See the License for the specific language governing permissions and

+   limitations under the License.

+*/

+

+package containerd

+

+import (

+	"bytes"

+	"context"

+	"fmt"

+	"runtime"

+

+	tasks "github.com/containerd/containerd/api/services/tasks/v1"

+	"github.com/containerd/containerd/containers"

+	"github.com/containerd/containerd/diff"

+	"github.com/containerd/containerd/images"

+	"github.com/containerd/containerd/platforms"

+	"github.com/containerd/containerd/rootfs"

+	"github.com/containerd/containerd/runtime/v2/runc/options"

+	"github.com/containerd/typeurl"

+	imagespec "github.com/opencontainers/image-spec/specs-go/v1"

+	"github.com/pkg/errors"

+)

+

+var (

+	// ErrCheckpointRWUnsupported is returned if the container runtime does not support checkpoint

+	ErrCheckpointRWUnsupported = errors.New("rw checkpoint is only supported on v2 runtimes")

+	// ErrMediaTypeNotFound returns an error when a media type in the manifest is unknown

+	ErrMediaTypeNotFound = errors.New("media type not found")

+)

+

+// CheckpointOpts are options to manage the checkpoint operation

+type CheckpointOpts func(context.Context, *Client, *containers.Container, *imagespec.Index, *options.CheckpointOptions) error

+

+// WithCheckpointImage includes the container image in the checkpoint

+func WithCheckpointImage(ctx context.Context, client *Client, c *containers.Container, index *imagespec.Index, copts *options.CheckpointOptions) error {

+	ir, err := client.ImageService().Get(ctx, c.Image)

+	if err != nil {

+		return err

+	}

+	index.Manifests = append(index.Manifests, ir.Target)

+	return nil

+}

+

+// WithCheckpointTask includes the running task

+func WithCheckpointTask(ctx context.Context, client *Client, c *containers.Container, index *imagespec.Index, copts *options.CheckpointOptions) error {

+	any, err := typeurl.MarshalAny(copts)

+	if err != nil {

+		return nil

+	}

+	task, err := client.TaskService().Checkpoint(ctx, &tasks.CheckpointTaskRequest{

+		ContainerID: c.ID,

+		Options:     any,

+	})

+	if err != nil {

+		return err

+	}

+	for _, d := range task.Descriptors {

+		platformSpec := platforms.DefaultSpec()

+		index.Manifests = append(index.Manifests, imagespec.Descriptor{

+			MediaType: d.MediaType,

+			Size:      d.Size_,

+			Digest:    d.Digest,

+			Platform:  &platformSpec,

+		})

+	}

+	// save copts

+	data, err := any.Marshal()

+	if err != nil {