…el unpack

Carry containerd/containerd#13125 (cherry-pick of #13115 to release/2.2).
Fixes whiteouts being ignored when parallel unpack is used with overlayfs
by converting bind mounts to overlay mounts before applying diffs.

Signed-off-by: Yutong Sun <[email protected]>

containerd 2.2.3

Welcome to the v2.2.3 release of containerd!

The third patch release for containerd 2.2 contains various fixes
and updates including a security patch.

* **spdystream**
  * [**CVE-2026-35469**](GHSA-pc3f-x583-g7j2)

* Preserve cgroup mount options for privileged containers ([containerd#13120](containerd#13120))
* Ensure UpdatePodSandbox returns Unimplemented instead of a generic error ([containerd#13023](containerd#13023))

* Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 ([containerd#13015](containerd#13015))

* Enable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) ([containerd#13198](containerd#13198))
* Apply hardening to prevent TOCTOU race during tar extraction ([containerd#12971](containerd#12971))

* Restore support for client-mounted roots in Windows containers using process isolation ([containerd#13195](containerd#13195))
* Update runc to v1.3.5 ([containerd#13061](containerd#13061))
* Apply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems ([containerd#13019](containerd#13019))
* Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 ([containerd#13015](containerd#13015))

* Fix bug that caused whiteouts to be ignored when parallel unpack was used ([containerd#13125](containerd#13125))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Samuel Karp
* Sebastiaan van Stijn
* Maksym Pavlenko
* Chris Henzie
* Derek McGowan
* Paulo Oliveira
* Henry Wang
* Phil Estes
* Wei Fu
* Akihiro Suda
* Gao Xiang
* Ricardo Branco
* Shachar Tal

<details><summary>40 commits</summary>
<p>

* Prepare release notes for v2.2.3 ([containerd#13224](containerd#13224))
  * [`8a0f4ed5d`](containerd@8a0f4ed) Prepare release notes for v2.2.3
* update github.com/moby/spdystream v0.5.1 ([containerd#13217](containerd#13217))
  * [`31bd34a06`](containerd@31bd34a) update github.com/moby/spdystream v0.5.1
* vendor: github.com/klauspost/compress v1.18.5 ([containerd#13197](containerd#13197))
  * [`1336f6c45`](containerd@1336f6c) vendor: github.com/klauspost/compress v1.18.5
* diff/walking: enable mount manager ([containerd#13198](containerd#13198))
  * [`409f75be8`](containerd@409f75b) diff/walking: enable mount manager
* update runhcs to v0.14.1 ([containerd#13195](containerd#13195))
  * [`3f33146c1`](containerd@3f33146) update runhcs to v0.14.1
* vendor: github.com/Microsoft/hcsshim v0.14.1 ([containerd#13196](containerd#13196))
  * [`8bd1b74e5`](containerd@8bd1b74) vendor: github.com/Microsoft/hcsshim v0.14.1
  * [`c6b0be8e1`](containerd@c6b0be8) vendor: github.com/Microsoft/hcsshim v0.14.0
* update to Go 1.25.9, 1.26.2 ([containerd#13190](containerd#13190))
  * [`2ecde8cfe`](containerd@2ecde8c) update to Go 1.25.9, 1.26.2
* Skip TestExportAndImportMultiLayer on s390x ([containerd#13154](containerd#13154))
  * [`be554f478`](containerd@be554f4) Skip TestExportAndImportMultiLayer on s390x
* Tweak mount info for overlayfs in case of parallel unpack ([containerd#13125](containerd#13125))
  * [`660de195b`](containerd@660de19) Tweak mount info for overlayfs in case of parallel unpack
  * [`bc9274a4b`](containerd@bc9274a) Add integration test for issue 13030
* Preserve cgroup mount options for privileged containers ([containerd#13120](containerd#13120))
  * [`c387890b5`](containerd@c387890) Add integration test for privileged container cgroup mounts
  * [`047a335a6`](containerd@047a335) Forward RUNC_FLAVOR env var down to integration tests
  * [`9b2d72ee0`](containerd@9b2d72e) Preserve host cgroup mount options for privileged containers
  * [`5b66cd6a0`](containerd@5b66cd6) Move cgroup namespace placement higher in spec builder
* update runc binary to v1.3.5 ([containerd#13061](containerd#13061))
  * [`584205c2f`](containerd@584205c) [release/2.2] update runc binary to v1.3.5
* Fix vagrant on CI ([containerd#13066](containerd#13066))
  * [`77c6886df`](containerd@77c6886) Ignore NOCHANGE error
* Fix TOCTOU race bug in tar extraction ([containerd#12971](containerd#12971))
  * [`fbed68b8f`](containerd@fbed68b) Fix TOCTOU race bug in tar extraction
* cri: UpdatePodSandbox should return Unimplemented ([containerd#13023](containerd#13023))
  * [`a83510103`](containerd@a835101) cri: UpdatePodSandbox should return Unimplemented
* fix(oci): apply absolute symlink resolution to /etc/group ([containerd#13019](containerd#13019))
  * [`ee4179e52`](containerd@ee4179e) fix(oci): apply absolute symlink resolution to /etc/group
* fix(oci): handle absolute symlinks in rootfs user lookup ([containerd#13015](containerd#13015))
  * [`fd061b848`](containerd@fd061b8) test(oci): use fstest and mock fs for better symlink coverage
  * [`5d44d2c22`](containerd@5d44d2c) fix(oci): handle absolute symlinks in rootfs user lookup
* update to go1.25.8, test go1.26.1 ([containerd#13011](containerd#13011))
  * [`00c776f07`](containerd@00c776f) update to go1.25.8, test go1.26.1
</p>
</details>

* **github.com/Microsoft/hcsshim**   v0.14.0-rc.1 -> v0.14.1
* **github.com/klauspost/compress**  v1.18.1 -> v1.18.5
* **github.com/moby/spdystream**     v0.5.0 -> v0.5.1

Previous release can be found at [v2.2.2](https://github.com/containerd/containerd/releases/tag/v2.2.2)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.