@@ -707,8 +707,8 @@ func verifyPlatformContainerSettings(daemon *Daemon, hostConfig *containertypes.

 		hostConfig.Runtime = daemon.configStore.GetDefaultRuntimeName()

 	}

-	if rt := daemon.configStore.GetRuntime(hostConfig.Runtime); rt == nil {

-		return warnings, fmt.Errorf("Unknown runtime specified %s", hostConfig.Runtime)

+	if _, err := daemon.getRuntime(hostConfig.Runtime); err != nil {

+		return warnings, err

 	}

 	parser := volumemounts.NewParser()

@@ -11,6 +11,7 @@ import (

 	"strings"

 	v2runcoptions "github.com/containerd/containerd/runtime/v2/runc/options"

+	"github.com/containerd/containerd/runtime/v2/shim"

 	"github.com/docker/docker/api/types"

 	"github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/errdefs"

@@ -116,7 +117,10 @@ func (daemon *Daemon) rewriteRuntimePath(name, p string, args []string) (string,

 func (daemon *Daemon) getRuntime(name string) (*types.Runtime, error) {

 	rt := daemon.configStore.GetRuntime(name)

 	if rt == nil {

-		return nil, errdefs.InvalidParameter(errors.Errorf("runtime not found in config: %s", name))

+		if !isPermissibleC8dRuntimeName(name) {

+			return nil, errdefs.InvalidParameter(errors.Errorf("unknown or invalid runtime name: %s", name))

+		}

+		return &types.Runtime{Shim: &types.ShimConfig{Binary: name}}, nil

 	}

 	if len(rt.Args) > 0 {

@@ -134,3 +138,37 @@ func (daemon *Daemon) getRuntime(name string) (*types.Runtime, error) {

 	return rt, nil

 }

+

+// isPermissibleC8dRuntimeName tests whether name is safe to pass into

+// containerd as a runtime name, and whether the name is well-formed.

+// It does not check if the runtime is installed.

+//

+// A runtime name containing slash characters is interpreted by containerd as

+// the path to a runtime binary. If we allowed this, anyone with Engine API

+// access could get containerd to execute an arbitrary binary as root. Although

+// Engine API access is already equivalent to root on the host, the runtime name

+// has not historically been a vector to run arbitrary code as root so users are

+// not expecting it to become one.

+//

+// This restriction is not configurable. There are viable workarounds for

+// legitimate use cases: administrators and runtime developers can make runtimes

+// available for use with Docker by installing them onto PATH following the

+// [binary naming convention] for containerd Runtime v2.

+//

+// [binary naming convention]: https://github.com/containerd/containerd/blob/main/runtime/v2/README.md#binary-naming

+func isPermissibleC8dRuntimeName(name string) bool {

+	// containerd uses a rather permissive test to validate runtime names:

+	//

+	//   - Any name for which filepath.IsAbs(name) is interpreted as the absolute

+	//     path to a shim binary. We want to block this behaviour.

+	//   - Any name which contains at least one '.' character and no '/' characters

+	//     and does not begin with a '.' character is a valid runtime name. The shim

+	//     binary name is derived from the final two components of the name and

+	//     searched for on the PATH. The name "a.." is technically valid per

+	//     containerd's implementation: it would resolve to a binary named

+	//     "containerd-shim---".

+	//

+	// https://github.com/containerd/containerd/blob/11ded166c15f92450958078cd13c6d87131ec563/runtime/v2/manager.go#L297-L317

+	// https://github.com/containerd/containerd/blob/11ded166c15f92450958078cd13c6d87131ec563/runtime/v2/shim/util.go#L83-L93

+	return !filepath.IsAbs(name) && !strings.ContainsRune(name, '/') && shim.BinaryName(name) != ""

+}

new file mode 100644

@@ -0,0 +1,107 @@

+//go:build !windows

+// +build !windows

+

+package daemon

+

+import (

+	"os"

+	"path/filepath"

+	"testing"

+

+	v2runcoptions "github.com/containerd/containerd/runtime/v2/runc/options"

+	"gotest.tools/v3/assert"

+	is "gotest.tools/v3/assert/cmp"

+

+	"github.com/docker/docker/api/types"

+	"github.com/docker/docker/daemon/config"

+	"github.com/docker/docker/errdefs"

+)

+

+func TestGetRuntime(t *testing.T) {

+	// Configured runtimes can have any arbitrary name, including names

+	// which would not be allowed as implicit runtime names. Explicit takes

+	// precedence over implicit.

+	const configuredRtName = "my/custom.shim.v1"

+	configuredRuntime := types.Runtime{Path: "/bin/true"}

+

+	d := &Daemon{configStore: config.New()}

+	d.configStore.Root = t.TempDir()

+	assert.Assert(t, os.Mkdir(filepath.Join(d.configStore.Root, "runtimes"), 0700))

+	d.configStore.Runtimes = map[string]types.Runtime{

+		configuredRtName: configuredRuntime,

+	}

+	configureRuntimes(d.configStore)

+	assert.Assert(t, d.loadRuntimes())

+

+	stockRuntime, ok := d.configStore.Runtimes[config.StockRuntimeName]

+	assert.Assert(t, ok, "stock runtime could not be found (test needs to be updated)")

+

+	configdOpts := *stockRuntime.Shim.Opts.(*v2runcoptions.Options)

+	configdOpts.BinaryName = configuredRuntime.Path

+	wantConfigdRuntime := configuredRuntime

+	wantConfigdRuntime.Shim = &types.ShimConfig{

+		Binary: stockRuntime.Shim.Binary,

+		Opts:   &configdOpts,

+	}

+

+	for _, tt := range []struct {

+		name, runtime string

+		want          *types.Runtime

+	}{

+		{

+			name:    "StockRuntime",

+			runtime: config.StockRuntimeName,

+			want:    &stockRuntime,

+		},

+		{

+			name:    "ShimName",

+			runtime: "io.containerd.my-shim.v42",

+			want:    &types.Runtime{Shim: &types.ShimConfig{Binary: "io.containerd.my-shim.v42"}},

+		},

+		{

+			// containerd is pretty loose about the format of runtime names. Perhaps too

+			// loose. The only requirements are that the name contain a dot and (depending

+			// on the containerd version) not start with a dot. It does not enforce any

+			// particular format of the dot-delimited components of the name.

+			name:    "VersionlessShimName",

+			runtime: "io.containerd.my-shim",

+			want:    &types.Runtime{Shim: &types.ShimConfig{Binary: "io.containerd.my-shim"}},

+		},

+		{

+			name:    "IllformedShimName",

+			runtime: "myshim",

+		},

+		{

+			name:    "EmptyString",

+			runtime: "",

+		},

+		{

+			name:    "PathToShim",

+			runtime: "/path/to/runc",

+		},

+		{

+			name:    "PathToShimName",

+			runtime: "/path/to/io.containerd.runc.v2",

+		},

+		{

+			name:    "RelPathToShim",

+			runtime: "my/io.containerd.runc.v2",

+		},

+		{

+			name:    "ConfiguredRuntime",

+			runtime: configuredRtName,

+			want:    &wantConfigdRuntime,

+		},

+	} {

+		tt := tt

+		t.Run(tt.name, func(t *testing.T) {

+			got, err := d.getRuntime(tt.runtime)

+			assert.Check(t, is.DeepEqual(got, tt.want))

+			if tt.want != nil {

+				assert.Check(t, err)

+			} else {

+				assert.Check(t, errdefs.IsInvalidParameter(err))

+			}

+		})

+	}

+}

@@ -39,6 +39,7 @@ import (

 	"github.com/moby/sys/mount"

 	"golang.org/x/sys/unix"

 	"gotest.tools/v3/assert"

+	is "gotest.tools/v3/assert/cmp"

 	"gotest.tools/v3/icmd"

 	"gotest.tools/v3/poll"

 )

@@ -2384,7 +2385,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {

 	// Run with "vm"

 	out, err = s.d.Cmd("run", "--rm", "--runtime=vm", "busybox", "ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

+	assert.Assert(c, is.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

 	// Reset config to only have the default

 	config = `

 {

@@ -2404,11 +2405,11 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {

 	// Run with "oci"

 	out, err = s.d.Cmd("run", "--rm", "--runtime=oci", "busybox", "ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "Unknown runtime specified oci"))

+	assert.Assert(c, is.Contains(out, "unknown or invalid runtime name: oci"))

 	// Start previously created container with oci

 	out, err = s.d.Cmd("start", "oci-runtime-ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "Unknown runtime specified oci"))

+	assert.Assert(c, is.Contains(out, "unknown or invalid runtime name: oci"))

 	// Check that we can't override the default runtime

 	config = `

 {

@@ -2426,7 +2427,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {

 	content, err := s.d.ReadLogFile()

 	assert.NilError(c, err)

-	assert.Assert(c, strings.Contains(string(content), `file configuration validation failed: runtime name 'runc' is reserved`))

+	assert.Assert(c, is.Contains(string(content), `file configuration validation failed: runtime name 'runc' is reserved`))

 	// Check that we can select a default runtime

 	config = `

 {

@@ -2451,7 +2452,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromConfigFile(c *testing.T) {

 	out, err = s.d.Cmd("run", "--rm", "busybox", "ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

+	assert.Assert(c, is.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

 	// Run with default runtime explicitly

 	out, err = s.d.Cmd("run", "--rm", "--runtime=runc", "busybox", "ls")

 	assert.NilError(c, err, out)

@@ -2475,7 +2476,7 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromCommandLine(c *testing.T) {

 	// Run with "vm"

 	out, err = s.d.Cmd("run", "--rm", "--runtime=vm", "busybox", "ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

+	assert.Assert(c, is.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

 	// Start a daemon without any extra runtimes

 	s.d.Stop(c)

 	s.d.StartWithBusybox(c)

@@ -2487,25 +2488,25 @@ func (s *DockerDaemonSuite) TestRunWithRuntimeFromCommandLine(c *testing.T) {

 	// Run with "oci"

 	out, err = s.d.Cmd("run", "--rm", "--runtime=oci", "busybox", "ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "Unknown runtime specified oci"))

+	assert.Assert(c, is.Contains(out, "unknown or invalid runtime name: oci"))

 	// Start previously created container with oci

 	out, err = s.d.Cmd("start", "oci-runtime-ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "Unknown runtime specified oci"))

+	assert.Assert(c, is.Contains(out, "unknown or invalid runtime name: oci"))

 	// Check that we can't override the default runtime

 	s.d.Stop(c)

 	assert.Assert(c, s.d.StartWithError("--add-runtime", "runc=my-runc") != nil)

 	content, err := s.d.ReadLogFile()

 	assert.NilError(c, err)

-	assert.Assert(c, strings.Contains(string(content), `runtime name 'runc' is reserved`))

+	assert.Assert(c, is.Contains(string(content), `runtime name 'runc' is reserved`))

 	// Check that we can select a default runtime

 	s.d.Stop(c)

 	s.d.StartWithBusybox(c, "--default-runtime=vm", "--add-runtime", "oci=runc", "--add-runtime", "vm=/usr/local/bin/vm-manager")

 	out, err = s.d.Cmd("run", "--rm", "busybox", "ls")

 	assert.ErrorContains(c, err, "", out)

-	assert.Assert(c, strings.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

+	assert.Assert(c, is.Contains(out, "/usr/local/bin/vm-manager: no such file or directory"))

 	// Run with default runtime explicitly

 	out, err = s.d.Cmd("run", "--rm", "--runtime=runc", "busybox", "ls")

 	assert.NilError(c, err, out)

@@ -5,6 +5,7 @@ import (

 	"context"

 	"io"

 	"os"

+	"os/exec"

 	"path/filepath"

 	"strings"

 	"testing"

@@ -15,7 +16,9 @@ import (

 	"github.com/docker/docker/api/types/versions"

 	"github.com/docker/docker/integration/internal/container"

 	net "github.com/docker/docker/integration/internal/network"

+	"github.com/docker/docker/pkg/stdcopy"

 	"github.com/docker/docker/pkg/system"

+	"github.com/docker/docker/testutil/daemon"

 	"golang.org/x/sys/unix"

 	"gotest.tools/v3/assert"

 	is "gotest.tools/v3/assert/cmp"

@@ -214,3 +217,57 @@ func TestRunConsoleSize(t *testing.T) {

 	assert.Equal(t, strings.TrimSpace(b.String()), "123 57")

 }

+

+func TestRunWithAlternativeContainerdShim(t *testing.T) {

+	skip.If(t, testEnv.IsRemoteDaemon)

+	skip.If(t, testEnv.DaemonInfo.OSType != "linux")

+

+	realShimPath, err := exec.LookPath("containerd-shim-runc-v2")

+	assert.Assert(t, err)

+	realShimPath, err = filepath.Abs(realShimPath)

+	assert.Assert(t, err)

+

+	// t.TempDir() can't be used here as the temporary directory returned by

+	// that function cannot be accessed by the fake-root user for rootless

+	// Docker. It creates a nested hierarchy of directories where the

+	// outermost has permission 0700.

+	shimDir, err := os.MkdirTemp("", t.Name())

+	assert.Assert(t, err)

+	t.Cleanup(func() {

+		if err := os.RemoveAll(shimDir); err != nil {

+			t.Errorf("shimDir RemoveAll cleanup: %v", err)

+		}

+	})

+	assert.Assert(t, os.Chmod(shimDir, 0777))

+	shimDir, err = filepath.Abs(shimDir)

+	assert.Assert(t, err)

+	assert.Assert(t, os.Symlink(realShimPath, filepath.Join(shimDir, "containerd-shim-realfake-v42")))

+

+	d := daemon.New(t,

+		daemon.WithEnvVars("PATH="+shimDir+":"+os.Getenv("PATH")),

+		daemon.WithContainerdSocket(""), // A new containerd instance needs to be started which inherits the PATH env var defined above.

+	)

+	d.StartWithBusybox(t)

+	defer d.Stop(t)

+

+	client := d.NewClientT(t)

+	ctx := context.Background()

+

+	cID := container.Run(ctx, t, client,

+		container.WithImage("busybox"),

+		container.WithCmd("sh", "-c", `echo 'Hello, world!'`),

+		container.WithRuntime("io.containerd.realfake.v42"),

+	)

+

+	poll.WaitOn(t, container.IsStopped(ctx, client, cID), poll.WithDelay(100*time.Millisecond))

+

+	out, err := client.ContainerLogs(ctx, cID, types.ContainerLogsOptions{ShowStdout: true})

+	assert.NilError(t, err)

+	defer out.Close()

+

+	var b bytes.Buffer

+	_, err = stdcopy.StdCopy(&b, io.Discard, out)

+	assert.NilError(t, err)

+

+	assert.Equal(t, strings.TrimSpace(b.String()), "Hello, world!")

+}

@@ -234,3 +234,10 @@ func WithConsoleSize(width, height uint) func(*TestContainerConfig) {

 		c.HostConfig.ConsoleSize = [2]uint{height, width}

 	}

 }

+

+// WithRuntime sets the runtime to use to start the container

+func WithRuntime(name string) func(*TestContainerConfig) {

+	return func(c *TestContainerConfig) {

+		c.HostConfig.Runtime = name

+	}

+}

@@ -76,6 +76,7 @@ type Daemon struct {

 	log                        LogT

 	pidFile                    string

 	args                       []string

+	extraEnv                   []string

 	containerdSocket           string

 	rootlessUser               *user.User

 	rootlessXDGRuntimeDir      string

@@ -334,9 +335,10 @@ func (d *Daemon) StartWithLogFile(out *os.File, providedArgs ...string) error {

 		dockerdBinary = "sudo"

 		d.args = append(d.args,

 			"-u", d.rootlessUser.Username,

-			"-E", "XDG_RUNTIME_DIR="+d.rootlessXDGRuntimeDir,

-			"-E", "HOME="+d.rootlessUser.HomeDir,

-			"-E", "PATH="+os.Getenv("PATH"),

+			"--preserve-env",

+			"--preserve-env=PATH", // Pass through PATH, overriding secure_path.

+			"XDG_RUNTIME_DIR="+d.rootlessXDGRuntimeDir,

+			"HOME="+d.rootlessUser.HomeDir,

 			"--",

 			defaultDockerdRootlessBinary,

 		)

@@ -392,6 +394,7 @@ func (d *Daemon) StartWithLogFile(out *os.File, providedArgs ...string) error {

 	d.args = append(d.args, providedArgs...)

 	d.cmd = exec.Command(dockerdBinary, d.args...)

 	d.cmd.Env = append(os.Environ(), "DOCKER_SERVICE_PREFER_OFFLINE_IMAGE=1")

+	d.cmd.Env = append(d.cmd.Env, d.extraEnv...)

 	d.cmd.Stdout = out

 	d.cmd.Stderr = out

 	d.logFile = out

@@ -122,3 +122,10 @@ func WithOOMScoreAdjust(score int) Option {

 		d.OOMScoreAdjust = score

 	}

 }

+

+// WithEnvVars sets additional environment variables for the daemon

+func WithEnvVars(vars ...string) Option {

+	return func(d *Daemon) {

+		d.extraEnv = append(d.extraEnv, vars...)

+	}

+}

new file mode 100644

@@ -0,0 +1,18 @@

+/*

+   Copyright The containerd Authors.

+

+   Licensed under the Apache License, Version 2.0 (the "License");

+   you may not use this file except in compliance with the License.

+   You may obtain a copy of the License at

+

+       http://www.apache.org/licenses/LICENSE-2.0

+

+   Unless required by applicable law or agreed to in writing, software

+   distributed under the License is distributed on an "AS IS" BASIS,

+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

+   See the License for the specific language governing permissions and

+   limitations under the License.

+*/

+

+// Package events defines the ttrpc event service.

+package events

new file mode 100644

@@ -0,0 +1,760 @@

+// Code generated by protoc-gen-gogo. DO NOT EDIT.

+// source: github.com/containerd/containerd/api/services/ttrpc/events/v1/events.proto

+

+package events

+

+import (

+	context "context"

+	fmt "fmt"

+	github_com_containerd_ttrpc "github.com/containerd/ttrpc"

+	github_com_containerd_typeurl "github.com/containerd/typeurl"

+	proto "github.com/gogo/protobuf/proto"

+	github_com_gogo_protobuf_types "github.com/gogo/protobuf/types"

+	types "github.com/gogo/protobuf/types"

+	io "io"

+	math "math"

+	math_bits "math/bits"

+	reflect "reflect"

+	strings "strings"

+	time "time"

+)

+

+// Reference imports to suppress errors if they are not otherwise used.

+var _ = proto.Marshal

+var _ = fmt.Errorf

+var _ = math.Inf

+var _ = time.Kitchen

+

+// This is a compile-time assertion to ensure that this generated file

+// is compatible with the proto package it is being compiled against.

+// A compilation error at this line likely means your copy of the

+// proto package needs to be updated.

+const _ = proto.GoGoProtoPackageIsVersion3 // please upgrade the proto package

+

+type ForwardRequest struct {

+	Envelope             *Envelope `protobuf:"bytes,1,opt,name=envelope,proto3" json:"envelope,omitempty"`

+	XXX_NoUnkeyedLiteral struct{}  `json:"-"`

+	XXX_unrecognized     []byte    `json:"-"`

+	XXX_sizecache        int32     `json:"-"`

+}

+

+func (m *ForwardRequest) Reset()      { *m = ForwardRequest{} }

+func (*ForwardRequest) ProtoMessage() {}

+func (*ForwardRequest) Descriptor() ([]byte, []int) {

+	return fileDescriptor_19f98672016720b5, []int{0}

+}

+func (m *ForwardRequest) XXX_Unmarshal(b []byte) error {

+	return m.Unmarshal(b)

+}

+func (m *ForwardRequest) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

+	if deterministic {

+		return xxx_messageInfo_ForwardRequest.Marshal(b, m, deterministic)

+	} else {

+		b = b[:cap(b)]

+		n, err := m.MarshalToSizedBuffer(b)

+		if err != nil {

+			return nil, err

+		}

+		return b[:n], nil

+	}

+}

+func (m *ForwardRequest) XXX_Merge(src proto.Message) {

+	xxx_messageInfo_ForwardRequest.Merge(m, src)

+}

+func (m *ForwardRequest) XXX_Size() int {

+	return m.Size()

+}

+func (m *ForwardRequest) XXX_DiscardUnknown() {

+	xxx_messageInfo_ForwardRequest.DiscardUnknown(m)

+}

+

+var xxx_messageInfo_ForwardRequest proto.InternalMessageInfo

+

+type Envelope struct {

+	Timestamp            time.Time  `protobuf:"bytes,1,opt,name=timestamp,proto3,stdtime" json:"timestamp"`

+	Namespace            string     `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`

+	Topic                string     `protobuf:"bytes,3,opt,name=topic,proto3" json:"topic,omitempty"`

+	Event                *types.Any `protobuf:"bytes,4,opt,name=event,proto3" json:"event,omitempty"`

+	XXX_NoUnkeyedLiteral struct{}   `json:"-"`

+	XXX_unrecognized     []byte     `json:"-"`

+	XXX_sizecache        int32      `json:"-"`

+}

+

+func (m *Envelope) Reset()      { *m = Envelope{} }

+func (*Envelope) ProtoMessage() {}

+func (*Envelope) Descriptor() ([]byte, []int) {

+	return fileDescriptor_19f98672016720b5, []int{1}

+}

+func (m *Envelope) XXX_Unmarshal(b []byte) error {

+	return m.Unmarshal(b)

+}

+func (m *Envelope) XXX_Marshal(b []byte, deterministic bool) ([]byte, error) {

+	if deterministic {

+		return xxx_messageInfo_Envelope.Marshal(b, m, deterministic)

+	} else {

+		b = b[:cap(b)]

+		n, err := m.MarshalToSizedBuffer(b)

+		if err != nil {

+			return nil, err

+		}

+		return b[:n], nil

+	}

+}

+func (m *Envelope) XXX_Merge(src proto.Message) {

+	xxx_messageInfo_Envelope.Merge(m, src)

+}

+func (m *Envelope) XXX_Size() int {

+	return m.Size()

+}

+func (m *Envelope) XXX_DiscardUnknown() {

+	xxx_messageInfo_Envelope.DiscardUnknown(m)

+}

+

+var xxx_messageInfo_Envelope proto.InternalMessageInfo

+

+func init() {

+	proto.RegisterType((*ForwardRequest)(nil), "containerd.services.events.ttrpc.v1.ForwardRequest")

+	proto.RegisterType((*Envelope)(nil), "containerd.services.events.ttrpc.v1.Envelope")

+}

+

+func init() {

+	proto.RegisterFile("github.com/containerd/containerd/api/services/ttrpc/events/v1/events.proto", fileDescriptor_19f98672016720b5)

+}

+

+var fileDescriptor_19f98672016720b5 = []byte{

+	// 396 bytes of a gzipped FileDescriptorProto

+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xa4, 0x52, 0xc1, 0x8e, 0xd3, 0x30,

+	0x10, 0x8d, 0x61, 0x77, 0x69, 0x8d, 0xc4, 0xc1, 0xaa, 0x50, 0x08, 0x28, 0x59, 0x2d, 0x97, 0x15,

+	0x12, 0xb6, 0x76, 0xf7, 0x06, 0x17, 0xa8, 0x28, 0x12, 0x1c, 0x23, 0x84, 0x2a, 0x90, 0x10, 0x6e,

+	0x3a, 0x4d, 0x2d, 0x25, 0xb6, 0x49, 0x9c, 0xa0, 0xde, 0xfa, 0x09, 0x7c, 0x0c, 0x17, 0xfe, 0xa0,

+	0x47, 0x8e, 0x9c, 0x80, 0xe6, 0x4b, 0x50, 0x9d, 0xa4, 0x81, 0xf6, 0x40, 0xa5, 0xbd, 0xbd, 0xcc,

+	0x7b, 0x6f, 0xde, 0xcc, 0xc4, 0xf8, 0x75, 0x2c, 0xcc, 0xbc, 0x98, 0xd0, 0x48, 0xa5, 0x2c, 0x52,

+	0xd2, 0x70, 0x21, 0x21, 0x9b, 0xfe, 0x0d, 0xb9, 0x16, 0x2c, 0x87, 0xac, 0x14, 0x11, 0xe4, 0xcc,

+	0x98, 0x4c, 0x47, 0x0c, 0x4a, 0x90, 0x26, 0x67, 0xe5, 0x45, 0x83, 0xa8, 0xce, 0x94, 0x51, 0xe4,

+	0x61, 0xe7, 0xa2, 0xad, 0x83, 0x36, 0x0a, 0x6b, 0xa4, 0xe5, 0x85, 0xf7, 0xec, 0xbf, 0x81, 0xb6,

+	0xd9, 0xa4, 0x98, 0x31, 0x9d, 0x14, 0xb1, 0x90, 0x6c, 0x26, 0x20, 0x99, 0x6a, 0x6e, 0xe6, 0x75,

+	0x8c, 0x37, 0x88, 0x55, 0xac, 0x2c, 0x64, 0x1b, 0xd4, 0x54, 0xef, 0xc5, 0x4a, 0xc5, 0x09, 0x74,

+	0x6e, 0x2e, 0x17, 0x0d, 0x75, 0x7f, 0x97, 0x82, 0x54, 0x9b, 0x96, 0x0c, 0x76, 0x49, 0x23, 0x52,

+	0xc8, 0x0d, 0x4f, 0x75, 0x2d, 0x38, 0x7b, 0x8f, 0xef, 0xbc, 0x54, 0xd9, 0x67, 0x9e, 0x4d, 0x43,

+	0xf8, 0x54, 0x40, 0x6e, 0xc8, 0x2b, 0xdc, 0x03, 0x59, 0x42, 0xa2, 0x34, 0xb8, 0xe8, 0x14, 0x9d,

+	0xdf, 0xbe, 0x7c, 0x4c, 0x0f, 0x58, 0x9d, 0x8e, 0x1a, 0x53, 0xb8, 0xb5, 0x9f, 0x7d, 0x45, 0xb8,

+	0xd7, 0x96, 0xc9, 0x10, 0xf7, 0xb7, 0xe1, 0x4d, 0x63, 0x8f, 0xd6, 0xe3, 0xd1, 0x76, 0x3c, 0xfa,

+	0xa6, 0x55, 0x0c, 0x7b, 0xab, 0x9f, 0x81, 0xf3, 0xe5, 0x57, 0x80, 0xc2, 0xce, 0x46, 0x1e, 0xe0,

+	0xbe, 0xe4, 0x29, 0xe4, 0x9a, 0x47, 0xe0, 0xde, 0x38, 0x45, 0xe7, 0xfd, 0xb0, 0x2b, 0x90, 0x01,

+	0x3e, 0x36, 0x4a, 0x8b, 0xc8, 0xbd, 0x69, 0x99, 0xfa, 0x83, 0x3c, 0xc2, 0xc7, 0x76, 0x54, 0xf7,

+	0xc8, 0x66, 0x0e, 0xf6, 0x32, 0x9f, 0xcb, 0x45, 0x58, 0x4b, 0x9e, 0x1c, 0x2d, 0xbf, 0x05, 0xe8,

+	0xf2, 0x23, 0x3e, 0x19, 0xd9, 0xe5, 0xc8, 0x5b, 0x7c, 0xab, 0xb9, 0x0e, 0xb9, 0x3a, 0xe8, 0x08,

+	0xff, 0xde, 0xd2, 0xbb, 0xbb, 0x17, 0x36, 0xda, 0xfc, 0x9c, 0xe1, 0x87, 0xd5, 0xda, 0x77, 0x7e,

+	0xac, 0x7d, 0x67, 0x59, 0xf9, 0x68, 0x55, 0xf9, 0xe8, 0x7b, 0xe5, 0xa3, 0xdf, 0x95, 0x8f, 0xde,

+	0xbd, 0xb8, 0xd6, 0x8b, 0x7d, 0x5a, 0xa3, 0xb1, 0x33, 0x46, 0x93, 0x13, 0x9b, 0x79, 0xf5, 0x27,

+	0x00, 0x00, 0xff, 0xff, 0xd4, 0x90, 0xbd, 0x09, 0x04, 0x03, 0x00, 0x00,

+}

+

+// Field returns the value for the given fieldpath as a string, if defined.

+// If the value is not defined, the second value will be false.

+func (m *Envelope) Field(fieldpath []string) (string, bool) {

+	if len(fieldpath) == 0 {

+		return "", false

+	}

+

+	switch fieldpath[0] {

+	// unhandled: timestamp

+	case "namespace":

+		return string(m.Namespace), len(m.Namespace) > 0

+	case "topic":

+		return string(m.Topic), len(m.Topic) > 0

+	case "event":

+		decoded, err := github_com_containerd_typeurl.UnmarshalAny(m.Event)

+		if err != nil {

+			return "", false

+		}

+

+		adaptor, ok := decoded.(interface{ Field([]string) (string, bool) })

+		if !ok {

+			return "", false

+		}

+		return adaptor.Field(fieldpath[1:])

+	}

+	return "", false

+}

+func (m *ForwardRequest) Marshal() (dAtA []byte, err error) {

+	size := m.Size()

+	dAtA = make([]byte, size)

+	n, err := m.MarshalToSizedBuffer(dAtA[:size])

+	if err != nil {

+		return nil, err

+	}

+	return dAtA[:n], nil

+}

+

+func (m *ForwardRequest) MarshalTo(dAtA []byte) (int, error) {

+	size := m.Size()

+	return m.MarshalToSizedBuffer(dAtA[:size])

+}

+

+func (m *ForwardRequest) MarshalToSizedBuffer(dAtA []byte) (int, error) {

+	i := len(dAtA)

+	_ = i

+	var l int

+	_ = l

+	if m.XXX_unrecognized != nil {

+		i -= len(m.XXX_unrecognized)

+		copy(dAtA[i:], m.XXX_unrecognized)

+	}

+	if m.Envelope != nil {

+		{

+			size, err := m.Envelope.MarshalToSizedBuffer(dAtA[:i])

+			if err != nil {

+				return 0, err

+			}

+			i -= size

+			i = encodeVarintEvents(dAtA, i, uint64(size))

+		}

+		i--

+		dAtA[i] = 0xa

+	}

+	return len(dAtA) - i, nil

+}

+

+func (m *Envelope) Marshal() (dAtA []byte, err error) {

+	size := m.Size()

+	dAtA = make([]byte, size)

+	n, err := m.MarshalToSizedBuffer(dAtA[:size])

+	if err != nil {

+		return nil, err

+	}

+	return dAtA[:n], nil

+}

+

+func (m *Envelope) MarshalTo(dAtA []byte) (int, error) {

+	size := m.Size()

+	return m.MarshalToSizedBuffer(dAtA[:size])

+}

+

+func (m *Envelope) MarshalToSizedBuffer(dAtA []byte) (int, error) {

+	i := len(dAtA)

+	_ = i

+	var l int

+	_ = l

+	if m.XXX_unrecognized != nil {

+		i -= len(m.XXX_unrecognized)

+		copy(dAtA[i:], m.XXX_unrecognized)

+	}

+	if m.Event != nil {

+		{

+			size, err := m.Event.MarshalToSizedBuffer(dAtA[:i])

+			if err != nil {

+				return 0, err

+			}

+			i -= size

+			i = encodeVarintEvents(dAtA, i, uint64(size))

+		}

+		i--

+		dAtA[i] = 0x22

+	}

+	if len(m.Topic) > 0 {

+		i -= len(m.Topic)

+		copy(dAtA[i:], m.Topic)

+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Topic)))

+		i--

+		dAtA[i] = 0x1a

+	}

+	if len(m.Namespace) > 0 {

+		i -= len(m.Namespace)

+		copy(dAtA[i:], m.Namespace)

+		i = encodeVarintEvents(dAtA, i, uint64(len(m.Namespace)))

+		i--

+		dAtA[i] = 0x12

+	}

+	n3, err3 := github_com_gogo_protobuf_types.StdTimeMarshalTo(m.Timestamp, dAtA[i-github_com_gogo_protobuf_types.SizeOfStdTime(m.Timestamp):])

+	if err3 != nil {

+		return 0, err3

+	}

+	i -= n3

+	i = encodeVarintEvents(dAtA, i, uint64(n3))

+	i--

+	dAtA[i] = 0xa

+	return len(dAtA) - i, nil

+}

+

+func encodeVarintEvents(dAtA []byte, offset int, v uint64) int {

+	offset -= sovEvents(v)

+	base := offset

+	for v >= 1<<7 {

+		dAtA[offset] = uint8(v&0x7f | 0x80)

+		v >>= 7

+		offset++

+	}

+	dAtA[offset] = uint8(v)

+	return base

+}

+func (m *ForwardRequest) Size() (n int) {

+	if m == nil {

+		return 0

+	}

+	var l int

+	_ = l

+	if m.Envelope != nil {

+		l = m.Envelope.Size()

+		n += 1 + l + sovEvents(uint64(l))

+	}

+	if m.XXX_unrecognized != nil {

+		n += len(m.XXX_unrecognized)

+	}

+	return n

+}

+

+func (m *Envelope) Size() (n int) {

+	if m == nil {

+		return 0

+	}

+	var l int

+	_ = l

+	l = github_com_gogo_protobuf_types.SizeOfStdTime(m.Timestamp)

+	n += 1 + l + sovEvents(uint64(l))

+	l = len(m.Namespace)

+	if l > 0 {

+		n += 1 + l + sovEvents(uint64(l))

+	}

+	l = len(m.Topic)

+	if l > 0 {

+		n += 1 + l + sovEvents(uint64(l))

+	}

+	if m.Event != nil {

+		l = m.Event.Size()

+		n += 1 + l + sovEvents(uint64(l))

+	}

+	if m.XXX_unrecognized != nil {

+		n += len(m.XXX_unrecognized)

+	}

+	return n

+}

+

+func sovEvents(x uint64) (n int) {

+	return (math_bits.Len64(x|1) + 6) / 7

+}

+func sozEvents(x uint64) (n int) {

+	return sovEvents(uint64((x << 1) ^ uint64((int64(x) >> 63))))

+}

+func (this *ForwardRequest) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&ForwardRequest{`,

+		`Envelope:` + strings.Replace(this.Envelope.String(), "Envelope", "Envelope", 1) + `,`,

+		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,

+		`}`,

+	}, "")

+	return s

+}

+func (this *Envelope) String() string {

+	if this == nil {

+		return "nil"

+	}

+	s := strings.Join([]string{`&Envelope{`,

+		`Timestamp:` + strings.Replace(strings.Replace(fmt.Sprintf("%v", this.Timestamp), "Timestamp", "types.Timestamp", 1), `&`, ``, 1) + `,`,

+		`Namespace:` + fmt.Sprintf("%v", this.Namespace) + `,`,

+		`Topic:` + fmt.Sprintf("%v", this.Topic) + `,`,

+		`Event:` + strings.Replace(fmt.Sprintf("%v", this.Event), "Any", "types.Any", 1) + `,`,

+		`XXX_unrecognized:` + fmt.Sprintf("%v", this.XXX_unrecognized) + `,`,

+		`}`,

+	}, "")

+	return s

+}

+func valueToStringEvents(v interface{}) string {

+	rv := reflect.ValueOf(v)

+	if rv.IsNil() {

+		return "nil"

+	}

+	pv := reflect.Indirect(rv).Interface()

+	return fmt.Sprintf("*%v", pv)

+}

+

+type EventsService interface {

+	Forward(ctx context.Context, req *ForwardRequest) (*types.Empty, error)

+}

+

+func RegisterEventsService(srv *github_com_containerd_ttrpc.Server, svc EventsService) {

+	srv.Register("containerd.services.events.ttrpc.v1.Events", map[string]github_com_containerd_ttrpc.Method{

+		"Forward": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {

+			var req ForwardRequest

+			if err := unmarshal(&req); err != nil {

+				return nil, err

+			}

+			return svc.Forward(ctx, &req)

+		},

+	})

+}

+

+type eventsClient struct {

+	client *github_com_containerd_ttrpc.Client

+}

+

+func NewEventsClient(client *github_com_containerd_ttrpc.Client) EventsService {

+	return &eventsClient{

+		client: client,

+	}

+}

+

+func (c *eventsClient) Forward(ctx context.Context, req *ForwardRequest) (*types.Empty, error) {

+	var resp types.Empty

+	if err := c.client.Call(ctx, "containerd.services.events.ttrpc.v1.Events", "Forward", req, &resp); err != nil {

+		return nil, err

+	}

+	return &resp, nil

+}

+func (m *ForwardRequest) Unmarshal(dAtA []byte) error {

+	l := len(dAtA)

+	iNdEx := 0

+	for iNdEx < l {

+		preIndex := iNdEx

+		var wire uint64

+		for shift := uint(0); ; shift += 7 {

+			if shift >= 64 {

+				return ErrIntOverflowEvents

+			}

+			if iNdEx >= l {

+				return io.ErrUnexpectedEOF

+			}

+			b := dAtA[iNdEx]

+			iNdEx++

+			wire |= uint64(b&0x7F) << shift

+			if b < 0x80 {

+				break

+			}

+		}

+		fieldNum := int32(wire >> 3)

+		wireType := int(wire & 0x7)

+		if wireType == 4 {

+			return fmt.Errorf("proto: ForwardRequest: wiretype end group for non-group")

+		}

+		if fieldNum <= 0 {

+			return fmt.Errorf("proto: ForwardRequest: illegal tag %d (wire type %d)", fieldNum, wire)

+		}

+		switch fieldNum {

+		case 1:

+			if wireType != 2 {

+				return fmt.Errorf("proto: wrong wireType = %d for field Envelope", wireType)

+			}

+			var msglen int

+			for shift := uint(0); ; shift += 7 {

+				if shift >= 64 {

+					return ErrIntOverflowEvents

+				}

+				if iNdEx >= l {

+					return io.ErrUnexpectedEOF

+				}