@crosbymichael @dmcgowan Hmm, I see that files patched to fix the runc's CVE-2019-16884 (see opencontainers/runc#2129) are not in this commit (as they are not used by containerd and thus are discarded by vndr). It means this PR is shallow/useless by itself (aside from the fact that it brings some other updates to runc code, not related to the CVE). Or am I missing something? The only thing I can think of is someone copy-pasting the sha from vendor.conf to build runc binary...

The last sentence is the winner :) It's a packaging detail, so that when we package containerd we are using the properly fixed version of runc:
https://github.com/containerd/containerd/blob/master/script/setup/install-runc#L24