Repository: moby/moby (language: go)

Issue:
Dockerfile with VOLUME statement appears to break named pipes (and the whole directory) in linux.
**Description**

Dockerfile with VOLUME statement appears to break named pipes (and the whole directory) in linux.

**Steps to reproduce the issue:**
Using this dockerfile:
```dockerfile
FROM debian:stable-slim@sha256:bd53ab674a48598863d4902d867fab6fa8f1da4f67a2d14b32785398e40c5f18
RUN mkdir /jail
RUN touch /jail/a
RUN mknod /jail/b p
RUN touch /jail/c
RUN ls -l /jail
VOLUME ["/jail"]
```
Building it: 
```sh
$ docker build -t tmp . && docker run tmp ls /jail
Sending build context to Docker daemon   16.9kB
Step 1/7 : FROM debian:stable-slim@sha256:bd53ab674a48598863d4902d867fab6fa8f1da4f67a2d14b32785398e40c5f18
 ---> e324495662f3
Step 2/7 : RUN mkdir /jail
 ---> Using cache
 ---> f8f1470e4e13
Step 3/7 : RUN touch /jail/a
 ---> Using cache
 ---> 8949073c9107
Step 4/7 : RUN mknod /jail/b p
 ---> Using cache
 ---> 5123c6d91bd6
Step 5/7 : RUN touch /jail/c
 ---> Using cache
 ---> 62e536c46985
Step 6/7 : RUN ls -l /jail
 ---> Running in a002458ba45e
total 0
-rw-r--r-- 1 root root 0 May 12 01:01 a
prw-r--r-- 1 root root 0 May 12 01:01 b
-rw-r--r-- 1 root root 0 May 12 01:01 c
Removing intermediate container a002458ba45e
 ---> 9d93321b4a57
Step 7/7 : VOLUME ["/jail"]
 ---> Running in af62bfd7c81a
Removing intermediate container af62bfd7c81a
 ---> 3c6fa588fe4f
Successfully built 3c6fa588fe4f
Successfully tagged tmp:latest
a

```

**Describe the results you received:**
only the file `a` is listed from the `docker run`, whereas all three files are listed during `docker build`

**Describe the results you expected:**
i expected three files:
- `a` (a normal file)
- `b` (a named pipe)
- `c` (a normal file)


**Additional information you deem important (e.g. issue happens only occasionally):**
This is cut down from a larger case involving a chroot tarball. Our observation is that it seems like the files in the directory are listed asciibetically, and any file that appears later in the list in that directory disappears after we build it.

If I comment out the `VOLUME` statement, I see what I expected (all three files).

**Output of `docker version`:**

```Client:
 Version:           20.10.12
 API version:       1.41
 Go version:        go1.16.2
 Git commit:        20.10.12-0ubuntu2~20.04.1
 Built:             Wed Apr  6 02:14:38 2022
 OS/Arch:           linux/amd64
 Context:           default
 Experimental:      true

Server:
 Engine:
  Version:          20.10.12
  API version:      1.41 (minimum version 1.12)
  Go version:       go1.16.2
  Git commit:       20.10.12-0ubuntu2~20.04.1
  Built:            Thu Feb 10 15:03:35 2022
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.5.9-0ubuntu1~20.04.1
  GitCommit:        
 runc:
  Version:          1.1.0-0ubuntu1~20.04.1
  GitCommit:        
 docker-init:
  Version:          0.19.0
  GitCommit:        
```

**Output of `docker info`:**

```Client:
 Context:    default
 Debug Mode: false

Server:
 Containers: 133
  Running: 0
  Paused: 0
  Stopped: 133
 Images: 626
 Server Version: 20.10.12
 Storage Driver: overlay2
  Backing Filesystem: extfs
  Supports d_type: true
  Native Overlay Diff: true
  userxattr: false
 Logging Driver: json-file
 Cgroup Driver: cgroupfs
 Cgroup Version: 1
 Plugins:
  Volume: local
  Network: bridge host ipvlan macvlan null overlay
  Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
 Swarm: inactive
 Runtimes: io.containerd.runc.v2 io.containerd.runtime.v1.linux runc
 Default Runtime: runc
 Init Binary: docker-init
 containerd version: 
 runc version: 
 init version: 
 Security Options:
  apparmor
  seccomp
   Profile: default
 Kernel Version: 5.14.0-1032-oem
 Operating System: Ubuntu 20.04.4 LTS
 OSType: linux
 Architecture: x86_64
 CPUs: 16
 Total Memory: 62.45GiB
 Name: r91395ed
 ID: RCZK:TITQ:KOA5:IHFG:SJXN:4P5Z:YLRS:MYL3:MFMI:WR6S:5TS6:JHI5
 Docker Root Dir: /var/lib/docker
 Debug Mode: false
 Username: novas0x2a
 Registry: https://index.docker.io/v1/
 Labels:
 Experimental: false
 Insecure Registries:
  127.0.0.0/8
 Live Restore Enabled: false
```

**Additional environment details (AWS, VirtualBox, physical, etc.):**
Physical (my laptop).


Discussion / hints:
This works in Docker 17.06.2:
```
[oldsystem ~]# cat >Dockerfile <<EOF
> FROM debian:10
> RUN mkdir /jail
> RUN touch /jail/a
> RUN mknod /jail/b p
> RUN touch /jail/c
> RUN ls -l /jail
> VOLUME ["/jail"]
> EOF
[oldsystem ~]# docker build -t tmp - < Dockerfile
Sending build context to Docker daemon  2.048kB
Step 1/7 : FROM debian:10
 ---> 4906f6b1e440
Step 2/7 : RUN mkdir /jail
 ---> Running in 71ee97aab3b3
 ---> a600f8e3875d
Removing intermediate container 71ee97aab3b3
Step 3/7 : RUN touch /jail/a
 ---> Running in f35d627e8e67
 ---> 81e547dd87a4
Removing intermediate container f35d627e8e67
Step 4/7 : RUN mknod /jail/b p
 ---> Running in dd4c6fb41667
 ---> 8f27741a1ddf
Removing intermediate container dd4c6fb41667
Step 5/7 : RUN touch /jail/c
 ---> Running in 0ea364ec7f45
 ---> eaf188929bfe
Removing intermediate container 0ea364ec7f45
Step 6/7 : RUN ls -l /jail
 ---> Running in 5e1dd6e54021
total 0
-rw-r--r-- 1 root root 0 May 12 23:25 a
prw-r--r-- 1 root root 0 May 12 23:25 b
-rw-r--r-- 1 root root 0 May 12 23:25 c
 ---> f51653c87a9e
Removing intermediate container 5e1dd6e54021
Step 7/7 : VOLUME /jail
 ---> Running in 0322d66940da
 ---> f6074bf939a2
Removing intermediate container 0322d66940da
Successfully built f6074bf939a2
Successfully tagged tmp:latest
[oldsystem ~]# docker run --rm tmp ls -l /jail
total 0
-rw-r--r-- 1 root root 0 May 12 23:25 a
prw-r--r-- 1 root root 0 May 12 23:25 b
-rw-r--r-- 1 root root 0 May 12 23:25 c
```
but not in Docker Engine 19.03.18:
```
<skipping redundant lines>
newsystem:~$ docker run --rm tmp ls -l /jail
total 0
-rw-r--r-- 1 root root 0 May 12 23:21 a
```
I think the problem is in assembling the container from the image, not building the image from the Dockerfile. If I copy the image from one system to the other, what matters is where I run `docker run`, not where I run `docker build`.
This has been fixed in https://github.com/containerd/continuity/pull/197
and taken into moby:
https://github.com/moby/moby/blob/2a35b01336289b6210e2acbcab5d6d98d24f7594/vendor/github.com/containerd/continuity/fs/copy.go#L157-L165 
https://github.com/moby/moby/pull/43547



Fix patch:
diff --git a/vendor.conf b/vendor.conf
index 54e97e4562d89..f59ec3c2c9199 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -134,7 +134,7 @@ google.golang.org/genproto                          3f1135a288c9a07e340ae8ba4cc6
 # containerd
 github.com/containerd/containerd                    7cfa023d95d37076d5ab035003d4839f4b6ba791 https://github.com/moby/containerd.git # master (v1.5.0-dev) + patch for CVE-2021-41190 and CVE-2022-24769
 github.com/containerd/fifo                          0724c46b320cf96bb172a0550c19a4b1fca4dacb
-github.com/containerd/continuity                    efbc4488d8fe1bdc16bde3b2d2990d9b3a899165
+github.com/containerd/continuity                    5ad51c7aca47b8e742f5e6e7dc841d50f5f6affd # v0.3.0
 github.com/containerd/cgroups                       b9de8a2212026c07cec67baf3323f1fc0121e048 # v1.0.1 
 github.com/containerd/console                       5d7e1412f07b502a01029ea20e20e0d2be31fa7c # v1.0.1
 github.com/containerd/go-runc                       16b287bc67d069a60fa48db15f330b790b74365b
diff --git a/vendor/github.com/containerd/continuity/README.md b/vendor/github.com/containerd/continuity/README.md
index f9f9ef0f96375..10996df163880 100644
--- a/vendor/github.com/containerd/continuity/README.md
+++ b/vendor/github.com/containerd/continuity/README.md
@@ -1,19 +1,20 @@
 # continuity
 
-[![GoDoc](https://godoc.org/github.com/containerd/continuity?status.svg)](https://godoc.org/github.com/containerd/continuity)
-[![Build Status](https://travis-ci.org/containerd/continuity.svg?branch=master)](https://travis-ci.org/containerd/continuity)
+[![Go Reference](https://pkg.go.dev/badge/github.com/containerd/continuity.svg)](https://pkg.go.dev/github.com/containerd/continuity)
+[![Build Status](https://github.com/containerd/continuity/workflows/Continuity/badge.svg)](https://github.com/containerd/continuity/actions?query=workflow%3AContinuity+branch%3Amain)
 
 A transport-agnostic, filesystem metadata manifest system
 
 This project is a staging area for experiments in providing transport agnostic
 metadata storage.
 
-Please see https://github.com/opencontainers/specs/issues/11 for more details.
+See [opencontainers/runtime-spec#11](https://github.com/opencontainers/runtime-spec/issues/11)
+for more details.
 
 ## Manifest Format
 
 A continuity manifest encodes filesystem metadata in Protocol Buffers.
-Please refer to [proto/manifest.proto](proto/manifest.proto).
+Refer to [proto/manifest.proto](proto/manifest.proto) for more details.
 
 ## Usage
 
@@ -63,6 +64,10 @@ $ stat -c %a Makefile
 $ ./bin/continuity verify . /tmp/a.pb
 ```
 
+## Platforms
+
+continuity primarily targets Linux. Continuity may compile for and work on
+other operating systems, but those platforms are not tested.
 
 ## Contribution Guide
 ### Building Proto Package
@@ -77,8 +82,8 @@ $ go generate ./proto
 
 continuity is a containerd sub-project, licensed under the [Apache 2.0 license](./LICENSE).
 As a containerd sub-project, you will find the:
- * [Project governance](https://github.com/containerd/project/blob/master/GOVERNANCE.md),
- * [Maintainers](https://github.com/containerd/project/blob/master/MAINTAINERS),
- * and [Contributing guidelines](https://github.com/containerd/project/blob/master/CONTRIBUTING.md)
+ * [Project governance](https://github.com/containerd/project/blob/main/GOVERNANCE.md),
+ * [Maintainers](https://github.com/containerd/project/blob/main/MAINTAINERS),
+ * and [Contributing guidelines](https://github.com/containerd/project/blob/main/CONTRIBUTING.md)
 
 information in our [`containerd/project`](https://github.com/containerd/project) repository.
diff --git a/vendor/github.com/containerd/continuity/devices/devices_unix.go b/vendor/github.com/containerd/continuity/devices/devices_unix.go
index 950ebf1cd0d99..3dd3bb42e8315 100644
--- a/vendor/github.com/containerd/continuity/devices/devices_unix.go
+++ b/vendor/github.com/containerd/continuity/devices/devices_unix.go
@@ -1,4 +1,5 @@
-// +build linux darwin freebsd solaris
+//go:build !windows
+// +build !windows
 
 /*
    Copyright The containerd Authors.
@@ -56,7 +57,7 @@ func Mknod(p string, mode os.FileMode, maj, min int) error {
 		m |= unix.S_IFIFO
 	}
 
-	return unix.Mknod(p, m, int(dev))
+	return mknod(p, m, dev)
 }
 
 // syscallMode returns the syscall-specific mode bits from Go's portable mode bits.
diff --git a/vendor/github.com/containerd/continuity/devices/devices_windows.go b/vendor/github.com/containerd/continuity/devices/devices_windows.go
index 04627c80582d7..cd551f53e5f8b 100644
--- a/vendor/github.com/containerd/continuity/devices/devices_windows.go
+++ b/vendor/github.com/containerd/continuity/devices/devices_windows.go
@@ -17,11 +17,10 @@
 package devices
 
 import (
+	"fmt"
 	"os"
-
-	"github.com/pkg/errors"
 )
 
 func DeviceInfo(fi os.FileInfo) (uint64, uint64, error) {
-	return 0, 0, errors.Wrap(ErrNotSupported, "cannot get device info on windows")
+	return 0, 0, fmt.Errorf("cannot get device info on windows: %w", ErrNotSupported)
 }
diff --git a/vendor/github.com/containerd/continuity/devices/mknod_freebsd.go b/vendor/github.com/containerd/continuity/devices/mknod_freebsd.go
new file mode 100644
index 0000000000000..067ff7de16cd6
--- /dev/null
+++ b/vendor/github.com/containerd/continuity/devices/mknod_freebsd.go
@@ -0,0 +1,26 @@
+//go:build freebsd
+// +build freebsd
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package devices
+
+import "golang.org/x/sys/unix"
+
+func mknod(path string, mode uint32, dev uint64) (err error) {
+	return unix.Mknod(path, mode, dev)
+}
diff --git a/vendor/github.com/containerd/continuity/devices/mknod_unix.go b/vendor/github.com/containerd/continuity/devices/mknod_unix.go
new file mode 100644
index 0000000000000..5c7f5525b69e4
--- /dev/null
+++ b/vendor/github.com/containerd/continuity/devices/mknod_unix.go
@@ -0,0 +1,26 @@
+//go:build !(freebsd || windows)
+// +build !freebsd,!windows
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package devices
+
+import "golang.org/x/sys/unix"
+
+func mknod(path string, mode uint32, dev uint64) (err error) {
+	return unix.Mknod(path, mode, int(dev))
+}
diff --git a/vendor/github.com/containerd/continuity/driver/driver_unix.go b/vendor/github.com/containerd/continuity/driver/driver_unix.go
index 3e58d10af27f9..6089c51dba820 100644
--- a/vendor/github.com/containerd/continuity/driver/driver_unix.go
+++ b/vendor/github.com/containerd/continuity/driver/driver_unix.go
@@ -1,4 +1,5 @@
-// +build linux darwin freebsd solaris
+//go:build !windows
+// +build !windows
 
 /*
    Copyright The containerd Authors.
@@ -53,7 +54,7 @@ func (d *driver) Mkfifo(path string, mode os.FileMode) error {
 func (d *driver) Getxattr(p string) (map[string][]byte, error) {
 	xattrs, err := sysx.Listxattr(p)
 	if err != nil {
-		return nil, fmt.Errorf("listing %s xattrs: %v", p, err)
+		return nil, fmt.Errorf("listing %s xattrs: %w", p, err)
 	}
 
 	sort.Strings(xattrs)
@@ -62,7 +63,7 @@ func (d *driver) Getxattr(p string) (map[string][]byte, error) {
 	for _, attr := range xattrs {
 		value, err := sysx.Getxattr(p, attr)
 		if err != nil {
-			return nil, fmt.Errorf("getting %q xattr on %s: %v", attr, p, err)
+			return nil, fmt.Errorf("getting %q xattr on %s: %w", attr, p, err)
 		}
 
 		// NOTE(stevvooe): This append/copy tricky relies on unique
@@ -81,7 +82,7 @@ func (d *driver) Getxattr(p string) (map[string][]byte, error) {
 func (d *driver) Setxattr(path string, attrMap map[string][]byte) error {
 	for attr, value := range attrMap {
 		if err := sysx.Setxattr(path, attr, value, 0); err != nil {
-			return fmt.Errorf("error setting xattr %q on %s: %v", attr, path, err)
+			return fmt.Errorf("error setting xattr %q on %s: %w", attr, path, err)
 		}
 	}
 
@@ -93,7 +94,7 @@ func (d *driver) Setxattr(path string, attrMap map[string][]byte) error {
 func (d *driver) LGetxattr(p string) (map[string][]byte, error) {
 	xattrs, err := sysx.LListxattr(p)
 	if err != nil {
-		return nil, fmt.Errorf("listing %s xattrs: %v", p, err)
+		return nil, fmt.Errorf("listing %s xattrs: %w", p, err)
 	}
 
 	sort.Strings(xattrs)
@@ -102,7 +103,7 @@ func (d *driver) LGetxattr(p string) (map[string][]byte, error) {
 	for _, attr := range xattrs {
 		value, err := sysx.LGetxattr(p, attr)
 		if err != nil {
-			return nil, fmt.Errorf("getting %q xattr on %s: %v", attr, p, err)
+			return nil, fmt.Errorf("getting %q xattr on %s: %w", attr, p, err)
 		}
 
 		// NOTE(stevvooe): This append/copy tricky relies on unique
@@ -121,7 +122,7 @@ func (d *driver) LGetxattr(p string) (map[string][]byte, error) {
 func (d *driver) LSetxattr(path string, attrMap map[string][]byte) error {
 	for attr, value := range attrMap {
 		if err := sysx.LSetxattr(path, attr, value, 0); err != nil {
-			return fmt.Errorf("error setting xattr %q on %s: %v", attr, path, err)
+			return fmt.Errorf("error setting xattr %q on %s: %w", attr, path, err)
 		}
 	}
 
diff --git a/vendor/github.com/containerd/continuity/driver/driver_windows.go b/vendor/github.com/containerd/continuity/driver/driver_windows.go
index 9baea3ba642d5..f539feecf5974 100644
--- a/vendor/github.com/containerd/continuity/driver/driver_windows.go
+++ b/vendor/github.com/containerd/continuity/driver/driver_windows.go
@@ -1,3 +1,4 @@
+//go:build go1.13
 // +build go1.13
 
 /*
diff --git a/vendor/github.com/containerd/continuity/driver/lchmod_unix.go b/vendor/github.com/containerd/continuity/driver/lchmod_unix.go
index b8877a8ae5103..161c79fa57420 100644
--- a/vendor/github.com/containerd/continuity/driver/lchmod_unix.go
+++ b/vendor/github.com/containerd/continuity/driver/lchmod_unix.go
@@ -1,4 +1,5 @@
-// +build darwin freebsd solaris
+//go:build darwin || freebsd || netbsd || openbsd || solaris
+// +build darwin freebsd netbsd openbsd solaris
 
 /*
    Copyright The containerd Authors.
diff --git a/vendor/github.com/containerd/continuity/driver/utils.go b/vendor/github.com/containerd/continuity/driver/utils.go
index 0c688d158f197..d122a3f732b20 100644
--- a/vendor/github.com/containerd/continuity/driver/utils.go
+++ b/vendor/github.com/containerd/continuity/driver/utils.go
@@ -18,12 +18,11 @@ package driver
 
 import (
 	"io"
-	"io/ioutil"
 	"os"
 	"sort"
 )
 
-// ReadFile works the same as ioutil.ReadFile with the Driver abstraction
+// ReadFile works the same as os.ReadFile with the Driver abstraction
 func ReadFile(r Driver, filename string) ([]byte, error) {
 	f, err := r.Open(filename)
 	if err != nil {
@@ -31,7 +30,7 @@ func ReadFile(r Driver, filename string) ([]byte, error) {
 	}
 	defer f.Close()
 
-	data, err := ioutil.ReadAll(f)
+	data, err := io.ReadAll(f)
 	if err != nil {
 		return nil, err
 	}
@@ -39,7 +38,7 @@ func ReadFile(r Driver, filename string) ([]byte, error) {
 	return data, nil
 }
 
-// WriteFile works the same as ioutil.WriteFile with the Driver abstraction
+// WriteFile works the same as os.WriteFile with the Driver abstraction
 func WriteFile(r Driver, filename string, data []byte, perm os.FileMode) error {
 	f, err := r.OpenFile(filename, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, perm)
 	if err != nil {
diff --git a/vendor/github.com/containerd/continuity/fs/copy.go b/vendor/github.com/containerd/continuity/fs/copy.go
index 818bba2cda201..6982a761ba9e0 100644
--- a/vendor/github.com/containerd/continuity/fs/copy.go
+++ b/vendor/github.com/containerd/continuity/fs/copy.go
@@ -17,12 +17,13 @@
 package fs
 
 import (
+	"fmt"
 	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
 
-	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
 )
 
 var bufferPool = &sync.Pool{
@@ -32,13 +33,15 @@ var bufferPool = &sync.Pool{
 	},
 }
 
-// XAttrErrorHandlers transform a non-nil xattr error.
+// XAttrErrorHandler transform a non-nil xattr error.
 // Return nil to ignore an error.
 // xattrKey can be empty for listxattr operation.
 type XAttrErrorHandler func(dst, src, xattrKey string, err error) error
 
 type copyDirOpts struct {
 	xeh XAttrErrorHandler
+	// xex contains a set of xattrs to exclude when copying
+	xex map[string]struct{}
 }
 
 type CopyDirOpt func(*copyDirOpts) error
@@ -61,6 +64,19 @@ func WithAllowXAttrErrors() CopyDirOpt {
 	return WithXAttrErrorHandler(xeh)
 }
 
+// WithXAttrExclude allows for exclusion of specified xattr during CopyDir operation.
+func WithXAttrExclude(keys ...string) CopyDirOpt {
+	return func(o *copyDirOpts) error {
+		if o.xex == nil {
+			o.xex = make(map[string]struct{}, len(keys))
+		}
+		for _, key := range keys {
+			o.xex[key] = struct{}{}
+		}
+		return nil
+	}
+}
+
 // CopyDir copies the directory from src to dst.
 // Most efficient copy of files is attempted.
 func CopyDir(dst, src string, opts ...CopyDirOpt) error {
@@ -77,35 +93,35 @@ func CopyDir(dst, src string, opts ...CopyDirOpt) error {
 func copyDirectory(dst, src string, inodes map[uint64]string, o *copyDirOpts) error {
 	stat, err := os.Stat(src)
 	if err != nil {
-		return errors.Wrapf(err, "failed to stat %s", src)
+		return fmt.Errorf("failed to stat %s: %w", src, err)
 	}
 	if !stat.IsDir() {
-		return errors.Errorf("source %s is not directory", src)
+		return fmt.Errorf("source %s is not directory", src)
 	}
 
 	if st, err := os.Stat(dst); err != nil {
 		if err := os.Mkdir(dst, stat.Mode()); err != nil {
-			return errors.Wrapf(err, "failed to mkdir %s", dst)
+			return fmt.Errorf("failed to mkdir %s: %w", dst, err)
 		}
 	} else if !st.IsDir() {
-		return errors.Errorf("cannot copy to non-directory: %s", dst)
+		return fmt.Errorf("cannot copy to non-directory: %s", dst)
 	} else {
 		if err := os.Chmod(dst, stat.Mode()); err != nil {
-			return errors.Wrapf(err, "failed to chmod on %s", dst)
+			return fmt.Errorf("failed to chmod on %s: %w", dst, err)
 		}
 	}
 
 	fis, err := ioutil.ReadDir(src)
 	if err != nil {
-		return errors.Wrapf(err, "failed to read %s", src)
+		return fmt.Errorf("failed to read %s: %w", src, err)
 	}
 
-	if err := copyFileInfo(stat, dst); err != nil {
-		return errors.Wrapf(err, "failed to copy file info for %s", dst)
+	if err := copyFileInfo(stat, src, dst); err != nil {
+		return fmt.Errorf("failed to copy file info for %s: %w", dst, err)
 	}
 
-	if err := copyXAttrs(dst, src, o.xeh); err != nil {
-		return errors.Wrap(err, "failed to copy xattrs")
+	if err := copyXAttrs(dst, src, o.xex, o.xeh); err != nil {
+		return fmt.Errorf("failed to copy xattrs: %w", err)
 	}
 
 	for _, fi := range fis {
@@ -121,37 +137,40 @@ func copyDirectory(dst, src string, inodes map[uint64]string, o *copyDirOpts) er
 		case (fi.Mode() & os.ModeType) == 0:
 			link, err := getLinkSource(target, fi, inodes)
 			if err != nil {
-				return errors.Wrap(err, "failed to get hardlink")
+				return fmt.Errorf("failed to get hardlink: %w", err)
 			}
 			if link != "" {
 				if err := os.Link(link, target); err != nil {
-					return errors.Wrap(err, "failed to create hard link")
+					return fmt.Errorf("failed to create hard link: %w", err)
 				}
 			} else if err := CopyFile(target, source); err != nil {
-				return errors.Wrap(err, "failed to copy files")
+				return fmt.Errorf("failed to copy files: %w", err)
 			}
 		case (fi.Mode() & os.ModeSymlink) == os.ModeSymlink:
 			link, err := os.Readlink(source)
 			if err != nil {
-				return errors.Wrapf(err, "failed to read link: %s", source)
+				return fmt.Errorf("failed to read link: %s: %w", source, err)
 			}
 			if err := os.Symlink(link, target); err != nil {
-				return errors.Wrapf(err, "failed to create symlink: %s", target)
+				return fmt.Errorf("failed to create symlink: %s: %w", target, err)
 			}
-		case (fi.Mode() & os.ModeDevice) == os.ModeDevice:
-			if err := copyDevice(target, fi); err != nil {
-				return errors.Wrapf(err, "failed to create device")
+		case (fi.Mode() & os.ModeDevice) == os.ModeDevice,
+			(fi.Mode() & os.ModeNamedPipe) == os.ModeNamedPipe,
+			(fi.Mode() & os.ModeSocket) == os.ModeSocket:
+			if err := copyIrregular(target, fi); err != nil {
+				return fmt.Errorf("failed to create irregular file: %w", err)
 			}
 		default:
-			// TODO: Support pipes and sockets
-			return errors.Wrapf(err, "unsupported mode %s", fi.Mode())
+			logrus.Warnf("unsupported mode: %s: %s", source, fi.Mode())
+			continue
 		}
-		if err := copyFileInfo(fi, target); err != nil {
-			return errors.Wrap(err, "failed to copy file info")
+
+		if err := copyFileInfo(fi, source, target); err != nil {
+			return fmt.Errorf("failed to copy file info: %w", err)
 		}
 
-		if err := copyXAttrs(target, source, o.xeh); err != nil {
-			return errors.Wrap(err, "failed to copy xattrs")
+		if err := copyXAttrs(target, source, o.xex, o.xeh); err != nil {
+			return fmt.Errorf("failed to copy xattrs: %w", err)
 		}
 	}
 
@@ -163,12 +182,12 @@ func copyDirectory(dst, src string, inodes map[uint64]string, o *copyDirOpts) er
 func CopyFile(target, source string) error {
 	src, err := os.Open(source)
 	if err != nil {
-		return errors.Wrapf(err, "failed to open source %s", source)
+		return fmt.Errorf("failed to open source %s: %w", source, err)
 	}
 	defer src.Close()
 	tgt, err := os.Create(target)
 	if err != nil {
-		return errors.Wrapf(err, "failed to open target %s", target)
+		return fmt.Errorf("failed to open target %s: %w", target, err)
 	}
 	defer tgt.Close()
 
diff --git a/vendor/github.com/containerd/continuity/fs/copy_irregular_freebsd.go b/vendor/github.com/containerd/continuity/fs/copy_irregular_freebsd.go
new file mode 100644
index 0000000000000..cfe9d8020476e
--- /dev/null
+++ b/vendor/github.com/containerd/continuity/fs/copy_irregular_freebsd.go
@@ -0,0 +1,36 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package fs
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// copyIrregular covers devices, pipes, and sockets
+func copyIrregular(dst string, fi os.FileInfo) error {
+	st, ok := fi.Sys().(*syscall.Stat_t) // not *unix.Stat_t
+	if !ok {
+		return fmt.Errorf("unsupported stat type: %s: %v", dst, fi.Mode())
+	}
+	var rDev uint64 // uint64 on FreeBSD, int on other unixen
+	if fi.Mode()&os.ModeDevice == os.ModeDevice {
+		rDev = st.Rdev
+	}
+	return syscall.Mknod(dst, uint32(st.Mode), rDev)
+}
diff --git a/vendor/github.com/containerd/continuity/fs/copy_irregular_unix.go b/vendor/github.com/containerd/continuity/fs/copy_irregular_unix.go
new file mode 100644
index 0000000000000..99fc8a9651216
--- /dev/null
+++ b/vendor/github.com/containerd/continuity/fs/copy_irregular_unix.go
@@ -0,0 +1,40 @@
+//go:build !windows && !freebsd
+// +build !windows,!freebsd
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package fs
+
+import (
+	"fmt"
+	"os"
+	"syscall"
+)
+
+// copyIrregular covers devices, pipes, and sockets
+func copyIrregular(dst string, fi os.FileInfo) error {
+	st, ok := fi.Sys().(*syscall.Stat_t) // not *unix.Stat_t
+	if !ok {
+		return fmt.Errorf("unsupported stat type: %s: %v", dst, fi.Mode())
+	}
+	var rDev int
+	if fi.Mode()&os.ModeDevice == os.ModeDevice {
+		rDev = int(st.Rdev)
+	}
+	//nolint:unconvert
+	return syscall.Mknod(dst, uint32(st.Mode), rDev)
+}
diff --git a/vendor/github.com/containerd/continuity/fs/copy_linux.go b/vendor/github.com/containerd/continuity/fs/copy_linux.go
index 72bae7d4e499e..1906e5e011d87 100644
--- a/vendor/github.com/containerd/continuity/fs/copy_linux.go
+++ b/vendor/github.com/containerd/continuity/fs/copy_linux.go
@@ -17,16 +17,16 @@
 package fs
 
 import (
+	"fmt"
 	"io"
 	"os"
 	"syscall"
 
 	"github.com/containerd/continuity/sysx"
-	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
 )
 
-func copyFileInfo(fi os.FileInfo, name string) error {
+func copyFileInfo(fi os.FileInfo, src, name string) error {
 	st := fi.Sys().(*syscall.Stat_t)
 	if err := os.Lchown(name, int(st.Uid), int(st.Gid)); err != nil {
 		if os.IsPermission(err) {
@@ -41,13 +41,13 @@ func copyFileInfo(fi os.FileInfo, name string) error {
 			}
 		}
 		if err != nil {
-			return errors.Wrapf(err, "failed to chown %s", name)
+			return fmt.Errorf("failed to chown %s: %w", name, err)
 		}
 	}
 
 	if (fi.Mode() & os.ModeSymlink) != os.ModeSymlink {
 		if err := os.Chmod(name, fi.Mode()); err != nil {
-			return errors.Wrapf(err, "failed to chmod %s", name)
+			return fmt.Errorf("failed to chmod %s: %w", name, err)
 		}
 	}
 
@@ -56,7 +56,7 @@ func copyFileInfo(fi os.FileInfo, name string) error {
 		unix.NsecToTimespec(syscall.TimespecToNsec(StatMtime(st))),
 	}
 	if err := unix.UtimesNanoAt(unix.AT_FDCWD, name, timespec, unix.AT_SYMLINK_NOFOLLOW); err != nil {
-		return errors.Wrapf(err, "failed to utime %s", name)
+		return fmt.Errorf("failed to utime %s: %w", name, err)
 	}
 
 	return nil
@@ -67,7 +67,7 @@ const maxSSizeT = int64(^uint(0) >> 1)
 func copyFileContent(dst, src *os.File) error {
 	st, err := src.Stat()
 	if err != nil {
-		return errors.Wrap(err, "unable to stat source")
+		return fmt.Errorf("unable to stat source: %w", err)
 	}
 
 	size := st.Size()
@@ -88,13 +88,16 @@ func copyFileContent(dst, src *os.File) error {
 		n, err := unix.CopyFileRange(srcFd, nil, dstFd, nil, copySize, 0)
 		if err != nil {
 			if (err != unix.ENOSYS && err != unix.EXDEV) || !first {
-				return errors.Wrap(err, "copy file range failed")
+				return fmt.Errorf("copy file range failed: %w", err)
 			}
 
 			buf := bufferPool.Get().(*[]byte)
 			_, err = io.CopyBuffer(dst, src, *buf)
 			bufferPool.Put(buf)
-			return errors.Wrap(err, "userspace copy failed")
+			if err != nil {
+				return fmt.Errorf("userspace copy failed: %w", err)
+			}
+			return nil
 		}
 
 		first = false
@@ -104,30 +107,33 @@ func copyFileContent(dst, src *os.File) error {
 	return nil
 }
 
-func copyXAttrs(dst, src string, xeh XAttrErrorHandler) error {
+func copyXAttrs(dst, src string, excludes map[string]struct{}, errorHandler XAttrErrorHandler) error {
 	xattrKeys, err := sysx.LListxattr(src)
 	if err != nil {
-		e := errors.Wrapf(err, "failed to list xattrs on %s", src)
-		if xeh != nil {
-			e = xeh(dst, src, "", e)
+		e := fmt.Errorf("failed to list xattrs on %s: %w", src, err)
+		if errorHandler != nil {
+			e = errorHandler(dst, src, "", e)
 		}
 		return e
 	}
 	for _, xattr := range xattrKeys {
+		if _, exclude := excludes[xattr]; exclude {
+			continue
+		}
 		data, err := sysx.LGetxattr(src, xattr)
 		if err != nil {
-			e := errors.Wrapf(err, "failed to get xattr %q on %s", xattr, src)
-			if xeh != nil {
-				if e = xeh(dst, src, xattr, e); e == nil {
+			e := fmt.Errorf("failed to get xattr %q on %s: %w", xattr, src, err)
+			if errorHandler != nil {
+				if e = errorHandler(dst, src, xattr, e); e == nil {
 					continue
 				}
 			}
 			return e
 		}
 		if err := sysx.LSetxattr(dst, xattr, data, 0); err != nil {
-			e := errors.Wrapf(err, "failed to set xattr %q on %s", xattr, dst)
-			if xeh != nil {
-				if e = xeh(dst, src, xattr, e); e == nil {
+			e := fmt.Errorf("failed to set xattr %q on %s: %w", xattr, dst, err)
+			if errorHandler != nil {
+				if e = errorHandler(dst, src, xattr, e); e == nil {
 					continue
 				}
 			}
@@ -137,11 +143,3 @@ func copyXAttrs(dst, src string, xeh XAttrErrorHandler) error {
 
 	return nil
 }
-
-func copyDevice(dst string, fi os.FileInfo) error {
-	st, ok := fi.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.New("unsupported stat type")
-	}
-	return unix.Mknod(dst, uint32(fi.Mode()), int(st.Rdev))
-}
diff --git a/vendor/github.com/containerd/continuity/fs/copy_unix.go b/vendor/github.com/containerd/continuity/fs/copy_unix.go
index a5de89261f624..0e68ba9ec2b9b 100644
--- a/vendor/github.com/containerd/continuity/fs/copy_unix.go
+++ b/vendor/github.com/containerd/continuity/fs/copy_unix.go
@@ -1,4 +1,5 @@
-// +build darwin freebsd openbsd solaris
+//go:build darwin || freebsd || openbsd || netbsd || solaris
+// +build darwin freebsd openbsd netbsd solaris
 
 /*
    Copyright The containerd Authors.
@@ -19,16 +20,15 @@
 package fs
 
 import (
+	"fmt"
 	"io"
 	"os"
 	"syscall"
 
 	"github.com/containerd/continuity/sysx"
-	"github.com/pkg/errors"
-	"golang.org/x/sys/unix"
 )
 
-func copyFileInfo(fi os.FileInfo, name string) error {
+func copyFileInfo(fi os.FileInfo, src, name string) error {
 	st := fi.Sys().(*syscall.Stat_t)
 	if err := os.Lchown(name, int(st.Uid), int(st.Gid)); err != nil {
 		if os.IsPermission(err) {
@@ -43,19 +43,18 @@ func copyFileInfo(fi os.FileInfo, name string) error {
 			}
 		}
 		if err != nil {
-			return errors.Wrapf(err, "failed to chown %s", name)
+			return fmt.Errorf("failed to chown %s: %w", name, err)
 		}
 	}
 
 	if (fi.Mode() & os.ModeSymlink) != os.ModeSymlink {
 		if err := os.Chmod(name, fi.Mode()); err != nil {
-			return errors.Wrapf(err, "failed to chmod %s", name)
+			return fmt.Errorf("failed to chmod %s: %w", name, err)
 		}
 	}
 
-	timespec := []syscall.Timespec{StatAtime(st), StatMtime(st)}
-	if err := syscall.UtimesNano(name, timespec); err != nil {
-		return errors.Wrapf(err, "failed to utime %s", name)
+	if err := utimesNano(name, StatAtime(st), StatMtime(st)); err != nil {
+		return fmt.Errorf("failed to utime %s: %w", name, err)
 	}
 
 	return nil
@@ -69,30 +68,33 @@ func copyFileContent(dst, src *os.File) error {
 	return err
 }
 
-func copyXAttrs(dst, src string, xeh XAttrErrorHandler) error {
+func copyXAttrs(dst, src string, excludes map[string]struct{}, errorHandler XAttrErrorHandler) error {
 	xattrKeys, err := sysx.LListxattr(src)
 	if err != nil {
-		e := errors.Wrapf(err, "failed to list xattrs on %s", src)
-		if xeh != nil {
-			e = xeh(dst, src, "", e)
+		e := fmt.Errorf("failed to list xattrs on %s: %w", src, err)
+		if errorHandler != nil {
+			e = errorHandler(dst, src, "", e)
 		}
 		return e
 	}
 	for _, xattr := range xattrKeys {
+		if _, exclude := excludes[xattr]; exclude {
+			continue
+		}
 		data, err := sysx.LGetxattr(src, xattr)
 		if err != nil {
-			e := errors.Wrapf(err, "failed to get xattr %q on %s", xattr, src)
-			if xeh != nil {
-				if e = xeh(dst, src, xattr, e); e == nil {
+			e := fmt.Errorf("failed to get xattr %q on %s: %w", xattr, src, err)
+			if errorHandler != nil {
+				if e = errorHandler(dst, src, xattr, e); e == nil {
 					continue
 				}
 			}
 			return e
 		}
 		if err := sysx.LSetxattr(dst, xattr, data, 0); err != nil {
-			e := errors.Wrapf(err, "failed to set xattr %q on %s", xattr, dst)
-			if xeh != nil {
-				if e = xeh(dst, src, xattr, e); e == nil {
+			e := fmt.Errorf("failed to set xattr %q on %s: %w", xattr, dst, err)
+			if errorHandler != nil {
+				if e = errorHandler(dst, src, xattr, e); e == nil {
 					continue
 				}
 			}
@@ -102,11 +104,3 @@ func copyXAttrs(dst, src string, xeh XAttrErrorHandler) error {
 
 	return nil
 }
-
-func copyDevice(dst string, fi os.FileInfo) error {
-	st, ok := fi.Sys().(*syscall.Stat_t)
-	if !ok {
-		return errors.New("unsupported stat type")
-	}
-	return unix.Mknod(dst, uint32(fi.Mode()), int(st.Rdev))
-}
diff --git a/vendor/github.com/containerd/continuity/fs/copy_windows.go b/vendor/github.com/containerd/continuity/fs/copy_windows.go
index 27c7d7dbb9f36..4dad9441de8d8 100644
--- a/vendor/github.com/containerd/continuity/fs/copy_windows.go
+++ b/vendor/github.com/containerd/continuity/fs/copy_windows.go
@@ -17,19 +17,60 @@
 package fs
 
 import (
+	"errors"
+	"fmt"
 	"io"
 	"os"
 
-	"github.com/pkg/errors"
+	winio "github.com/Microsoft/go-winio"
+	"golang.org/x/sys/windows"
 )
 
-func copyFileInfo(fi os.FileInfo, name string) error {
+const (
+	seTakeOwnershipPrivilege = "SeTakeOwnershipPrivilege"
+)
+
+func copyFileInfo(fi os.FileInfo, src, name string) error {
 	if err := os.Chmod(name, fi.Mode()); err != nil {
-		return errors.Wrapf(err, "failed to chmod %s", name)
+		return fmt.Errorf("failed to chmod %s: %w", name, err)
+	}
+
+	// Copy file ownership and ACL
+	// We need SeRestorePrivilege and SeTakeOwnershipPrivilege in order
+	// to restore security info on a file, especially if we're trying to
+	// apply security info which includes SIDs not necessarily present on
+	// the host.
+	privileges := []string{winio.SeRestorePrivilege, seTakeOwnershipPrivilege}
+	if err := winio.EnableProcessPrivileges(privileges); err != nil {
+		return err
+	}
+	defer winio.DisableProcessPrivileges(privileges)
+
+	secInfo, err := windows.GetNamedSecurityInfo(
+		src, windows.SE_FILE_OBJECT,
+		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION)
+
+	if err != nil {
+		return err
+	}
+
+	dacl, _, err := secInfo.DACL()
+	if err != nil {
+		return err
 	}
 
-	// TODO: copy windows specific metadata
+	sid, _, err := secInfo.Owner()
+	if err != nil {
+		return err
+	}
+
+	if err := windows.SetNamedSecurityInfo(
+		name, windows.SE_FILE_OBJECT,
+		windows.OWNER_SECURITY_INFORMATION|windows.DACL_SECURITY_INFORMATION,
+		sid, nil, dacl, nil); err != nil {
 
+		return err
+	}
 	return nil
 }
 
@@ -40,10 +81,10 @@ func copyFileContent(dst, src *os.File) error {
 	return err
 }
 
-func copyXAttrs(dst, src string, xeh XAttrErrorHandler) error {
+func copyXAttrs(dst, src string, excludes map[string]struct{}, errorHandler XAttrErrorHandler) error {
 	return nil
 }
 
-func copyDevice(dst string, fi os.FileInfo) error {
-	return errors.New("device copy not supported")
+func copyIrregular(dst string, fi os.FileInfo) error {
+	return errors.New("irregular copy not supported")
 }
diff --git a/vendor/github.com/containerd/continuity/fs/diff.go b/vendor/github.com/containerd/continuity/fs/diff.go
index e64f9e73d3046..3cd4eee6fbf30 100644
--- a/vendor/github.com/containerd/continuity/fs/diff.go
+++ b/vendor/github.com/containerd/continuity/fs/diff.go
@@ -22,9 +22,8 @@ import (
 	"path/filepath"
 	"strings"
 
-	"golang.org/x/sync/errgroup"
-
 	"github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
 )
 
 // ChangeKind is the type of modification that
diff --git a/vendor/github.com/containerd/continuity/fs/diff_unix.go b/vendor/github.com/containerd/continuity/fs/diff_unix.go
index 7913af27d903a..5de9b6b48f28e 100644
--- a/vendor/github.com/containerd/continuity/fs/diff_unix.go
+++ b/vendor/github.com/containerd/continuity/fs/diff_unix.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 /*
@@ -20,11 +21,11 @@ package fs
 
 import (
 	"bytes"
+	"fmt"
 	"os"
 	"syscall"
 
 	"github.com/containerd/continuity/sysx"
-	"github.com/pkg/errors"
 )
 
 // detectDirDiff returns diff dir options if a directory could
@@ -56,11 +57,11 @@ func compareSysStat(s1, s2 interface{}) (bool, error) {
 func compareCapabilities(p1, p2 string) (bool, error) {
 	c1, err := sysx.LGetxattr(p1, "security.capability")
 	if err != nil && err != sysx.ENODATA {
-		return false, errors.Wrapf(err, "failed to get xattr for %s", p1)
+		return false, fmt.Errorf("failed to get xattr for %s: %w", p1, err)
 	}
 	c2, err := sysx.LGetxattr(p2, "security.capability")
 	if err != nil && err != sysx.ENODATA {
-		return false, errors.Wrapf(err, "failed to get xattr for %s", p2)
+		return false, fmt.Errorf("failed to get xattr for %s: %w", p2, err)
 	}
 	return bytes.Equal(c1, c2), nil
 }
diff --git a/vendor/github.com/containerd/continuity/fs/dtype_linux.go b/vendor/github.com/containerd/continuity/fs/dtype_linux.go
index 10510d8decee9..a8eab1db8ac26 100644
--- a/vendor/github.com/containerd/continuity/fs/dtype_linux.go
+++ b/vendor/github.com/containerd/continuity/fs/dtype_linux.go
@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 /*
@@ -34,7 +35,7 @@ func locateDummyIfEmpty(path string) (string, error) {
 	if len(children) != 0 {
 		return "", nil
 	}
-	dummyFile, err := ioutil.TempFile(path, "fsutils-dummy")
+	dummyFile, err := os.CreateTemp(path, "fsutils-dummy")
 	if err != nil {
 		return "", err
 	}
diff --git a/vendor/github.com/containerd/continuity/fs/du_unix.go b/vendor/github.com/containerd/continuity/fs/du_unix.go
index e22ffbea378fc..bf33c42d72daf 100644
--- a/vendor/github.com/containerd/continuity/fs/du_unix.go
+++ b/vendor/github.com/containerd/continuity/fs/du_unix.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 /*
@@ -25,6 +26,14 @@ import (
 	"syscall"
 )
 
+// blocksUnitSize is the unit used by `st_blocks` in `stat` in bytes.
+// See https://man7.org/linux/man-pages/man2/stat.2.html
+//   st_blocks
+//     This field indicates the number of blocks allocated to the
+//     file, in 512-byte units.  (This may be smaller than
+//     st_size/512 when the file has holes.)
+const blocksUnitSize = 512
+
 type inode struct {
 	// TODO(stevvooe): Can probably reduce memory usage by not tracking
 	// device, but we can leave this right for now.
@@ -33,10 +42,8 @@ type inode struct {
 
 func newInode(stat *syscall.Stat_t) inode {
 	return inode{
-		// Dev is uint32 on darwin/bsd, uint64 on linux/solaris
-		dev: uint64(stat.Dev), // nolint: unconvert
-		// Ino is uint32 on bsd, uint64 on darwin/linux/solaris
-		ino: uint64(stat.Ino), // nolint: unconvert
+		dev: uint64(stat.Dev), //nolint: unconvert // dev is uint32 on darwin/bsd, uint64 on linux/solaris/freebsd
+		ino: uint64(stat.Ino), //nolint: unconvert // ino is uint32 on bsd, uint64 on darwin/linux/solaris/freebsd
 	}
 }
 
@@ -59,10 +66,11 @@ func diskUsage(ctx context.Context, roots ...string) (Usage, error) {
 			default:
 			}
 
-			inoKey := newInode(fi.Sys().(*syscall.Stat_t))
+			stat := fi.Sys().(*syscall.Stat_t)
+			inoKey := newInode(stat)
 			if _, ok := inodes[inoKey]; !ok {
 				inodes[inoKey] = struct{}{}
-				size += fi.Size()
+				size += stat.Blocks * blocksUnitSize
 			}
 
 			return nil
@@ -89,10 +97,11 @@ func diffUsage(ctx context.Context, a, b string) (Usage, error) {
 		}
 
 		if kind == ChangeKindAdd || kind == ChangeKindModify {
-			inoKey := newInode(fi.Sys().(*syscall.Stat_t))
+			stat := fi.Sys().(*syscall.Stat_t)
+			inoKey := newInode(stat)
 			if _, ok := inodes[inoKey]; !ok {
 				inodes[inoKey] = struct{}{}
-				size += fi.Size()
+				size += stat.Blocks * blocksUnitSize
 			}
 
 			return nil
diff --git a/vendor/github.com/containerd/continuity/fs/du_windows.go b/vendor/github.com/containerd/continuity/fs/du_windows.go
index 8f25ec59c5693..08fb283336aa6 100644
--- a/vendor/github.com/containerd/continuity/fs/du_windows.go
+++ b/vendor/github.com/containerd/continuity/fs/du_windows.go
@@ -1,3 +1,4 @@
+//go:build windows
 // +build windows
 
 /*
diff --git a/vendor/github.com/containerd/continuity/fs/hardlink_unix.go b/vendor/github.com/containerd/continuity/fs/hardlink_unix.go
index f95f0904c192c..cce8902f3b411 100644
--- a/vendor/github.com/containerd/continuity/fs/hardlink_unix.go
+++ b/vendor/github.com/containerd/continuity/fs/hardlink_unix.go
@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 /*
@@ -29,6 +30,5 @@ func getLinkInfo(fi os.FileInfo) (uint64, bool) {
 		return 0, false
 	}
 
-	// Ino is uint32 on bsd, uint64 on darwin/linux/solaris
-	return uint64(s.Ino), !fi.IsDir() && s.Nlink > 1 // nolint: unconvert
+	return uint64(s.Ino), !fi.IsDir() && s.Nlink > 1 //nolint: unconvert // ino is uint32 on bsd, uint64 on darwin/linux/solaris
 }
diff --git a/vendor/github.com/containerd/continuity/fs/path.go b/vendor/github.com/containerd/continuity/fs/path.go
index c26be79898e3d..97313e2b82e12 100644
--- a/vendor/github.com/containerd/continuity/fs/path.go
+++ b/vendor/github.com/containerd/continuity/fs/path.go
@@ -19,11 +19,10 @@ package fs
 import (
 	"bytes"
 	"context"
+	"errors"
 	"io"
 	"os"
 	"path/filepath"
-
-	"github.com/pkg/errors"
 )
 
 var (
diff --git a/vendor/github.com/containerd/continuity/fs/stat_linuxopenbsd.go b/vendor/github.com/containerd/continuity/fs/stat_atim.go
similarity index 85%
rename from vendor/github.com/containerd/continuity/fs/stat_linuxopenbsd.go
rename to vendor/github.com/containerd/continuity/fs/stat_atim.go
index c68df6e586cde..996b9c1ae7bc3 100644
--- a/vendor/github.com/containerd/continuity/fs/stat_linuxopenbsd.go
+++ b/vendor/github.com/containerd/continuity/fs/stat_atim.go
@@ -1,4 +1,5 @@
-// +build linux openbsd
+//go:build linux || openbsd || solaris
+// +build linux openbsd solaris
 
 /*
    Copyright The containerd Authors.
@@ -40,6 +41,5 @@ func StatMtime(st *syscall.Stat_t) syscall.Timespec {
 
 // StatATimeAsTime returns st.Atim as a time.Time
 func StatATimeAsTime(st *syscall.Stat_t) time.Time {
-	// The int64 conversions ensure the line compiles for 32-bit systems as well.
-	return time.Unix(int64(st.Atim.Sec), int64(st.Atim.Nsec)) // nolint: unconvert
+	return time.Unix(st.Atim.Unix())
 }
diff --git a/vendor/github.com/containerd/continuity/fs/stat_darwinfreebsd.go b/vendor/github.com/containerd/continuity/fs/stat_darwinbsd.go
similarity index 90%
rename from vendor/github.com/containerd/continuity/fs/stat_darwinfreebsd.go
rename to vendor/github.com/containerd/continuity/fs/stat_darwinbsd.go
index cb7400a33e13d..dbdb90ec83c30 100644
--- a/vendor/github.com/containerd/continuity/fs/stat_darwinfreebsd.go
+++ b/vendor/github.com/containerd/continuity/fs/stat_darwinbsd.go
@@ -1,4 +1,5 @@
-// +build darwin freebsd
+//go:build darwin || freebsd || netbsd
+// +build darwin freebsd netbsd
 
 /*
    Copyright The containerd Authors.
@@ -40,5 +41,5 @@ func StatMtime(st *syscall.Stat_t) syscall.Timespec {
 
 // StatATimeAsTime returns the access time as a time.Time
 func StatATimeAsTime(st *syscall.Stat_t) time.Time {
-	return time.Unix(int64(st.Atimespec.Sec), int64(st.Atimespec.Nsec)) // nolint: unconvert
+	return time.Unix(st.Atimespec.Unix())
 }
diff --git a/vendor/github.com/containerd/continuity/fs/utimesnanoat.go b/vendor/github.com/containerd/continuity/fs/utimesnanoat.go
new file mode 100644
index 0000000000000..5435398d48797
--- /dev/null
+++ b/vendor/github.com/containerd/continuity/fs/utimesnanoat.go
@@ -0,0 +1,33 @@
+//go:build !(windows || linux)
+// +build !windows,!linux
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package fs
+
+import (
+	"syscall"
+
+	"golang.org/x/sys/unix"
+)
+
+func utimesNano(name string, atime, mtime syscall.Timespec) error {
+	at := unix.NsecToTimespec(atime.Nano())
+	mt := unix.NsecToTimespec(mtime.Nano())
+	utimes := [2]unix.Timespec{at, mt}
+	return unix.UtimesNanoAt(unix.AT_FDCWD, name, utimes[0:], unix.AT_SYMLINK_NOFOLLOW)
+}
diff --git a/vendor/github.com/containerd/continuity/go.mod b/vendor/github.com/containerd/continuity/go.mod
index 75a061aaac0ac..b1a393cc96d42 100644
--- a/vendor/github.com/containerd/continuity/go.mod
+++ b/vendor/github.com/containerd/continuity/go.mod
@@ -1,23 +1,14 @@
 module github.com/containerd/continuity
 
-go 1.13
+go 1.17
 
 require (
-	bazil.org/fuse v0.0.0-20160811212531-371fbbdaa898
-	github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4
-	github.com/golang/protobuf v1.2.0
-	github.com/inconshreveable/mousetrap v1.0.0 // indirect
-	github.com/onsi/ginkgo v1.10.1 // indirect
-	github.com/onsi/gomega v1.7.0 // indirect
-	github.com/opencontainers/go-digest v1.0.0-rc1
-	github.com/pkg/errors v0.8.1-0.20171018195549-f15c970de5b7
-	github.com/sirupsen/logrus v1.0.4-0.20170822132746-89742aefa4b2
-	github.com/spf13/cobra v0.0.2-0.20171109065643-2da4a54c5cee
-	github.com/spf13/pflag v1.0.1-0.20171106142849-4c012f6dcd95 // indirect
-	github.com/stretchr/testify v1.4.0 // indirect
-	golang.org/x/crypto v0.0.0-20171113213409-9f005a07e0d3 // indirect
-	golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f
-	golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e
-	gopkg.in/airbrake/gobrake.v2 v2.0.9 // indirect
-	gopkg.in/gemnasium/logrus-airbrake-hook.v2 v2.1.2 // indirect
+	github.com/Microsoft/go-winio v0.5.2
+	github.com/opencontainers/go-digest v1.0.0
+	github.com/sirupsen/logrus v1.8.1
+	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
+	golang.org/x/sys v0.0.0-20220405210540-1e041c57c461
+	google.golang.org/protobuf v1.26.0
 )
+
+require github.com/stretchr/testify v1.3.0 // indirect
diff --git a/vendor/github.com/containerd/continuity/sysx/nodata_unix.go b/vendor/github.com/containerd/continuity/sysx/nodata_unix.go
index de4b3d50cedad..e78f77f6a1226 100644
--- a/vendor/github.com/containerd/continuity/sysx/nodata_unix.go
+++ b/vendor/github.com/containerd/continuity/sysx/nodata_unix.go
@@ -1,4 +1,5 @@
-// +build darwin freebsd openbsd
+//go:build !(linux || solaris || windows)
+// +build !linux,!solaris,!windows
 
 /*
    Copyright The containerd Authors.
diff --git a/vendor/github.com/containerd/continuity/sysx/xattr.go b/vendor/github.com/containerd/continuity/sysx/xattr.go
index db6fe70fe927c..1497398553509 100644
--- a/vendor/github.com/containerd/continuity/sysx/xattr.go
+++ b/vendor/github.com/containerd/continuity/sysx/xattr.go
@@ -1,3 +1,4 @@
+//go:build linux || darwin
 // +build linux darwin
 
 /*
diff --git a/vendor/github.com/containerd/continuity/sysx/xattr_unsupported.go b/vendor/github.com/containerd/continuity/sysx/xattr_unsupported.go
index f8fa8c63fbae5..da1e940d62bdf 100644
--- a/vendor/github.com/containerd/continuity/sysx/xattr_unsupported.go
+++ b/vendor/github.com/containerd/continuity/sysx/xattr_unsupported.go
@@ -1,3 +1,4 @@
+//go:build !linux && !darwin
 // +build !linux,!darwin
 
 /*


Test patch: