diff --git a/.gitmodules b/.gitmodules
index a17be6e3..b80218f0 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -26,3 +26,7 @@
 	path = src/garden-performance-acceptance-tests
 	url = https://github.com/cloudfoundry/garden-performance-acceptance-tests
 	branch = main
+[submodule "src/containerd"]
+	path = src/containerd
+	url = https://github.com/containerd/containerd.git
+	branch = release/2.0
diff --git a/jobs/garden/templates/bin/containerd_utils.erb b/jobs/garden/templates/bin/containerd_utils.erb
index 7a26d0ba..738eb722 100644
--- a/jobs/garden/templates/bin/containerd_utils.erb
+++ b/jobs/garden/templates/bin/containerd_utils.erb
@@ -52,7 +52,7 @@ start_containerd() {
 
   echo "$!" > "$CONTAINERD_PIDFILE"
 
-  address=$(grep containerd.sock $containerd_config_filepath | awk '{print $3}' | tr -d '"')
+  address=$(grep containerd.sock $containerd_config_filepath | awk '{print $3}' | tr -d \')
   while ! /var/vcap/packages/containerd/bin/ctr -a $address --connect-timeout 100ms c ls; do
     log "waiting for containerd to become available"
     sleep 0.1
diff --git a/jobs/garden/templates/config/containerd.toml.erb b/jobs/garden/templates/config/containerd.toml.erb
index cd714fdf..cc3cb86a 100644
--- a/jobs/garden/templates/config/containerd.toml.erb
+++ b/jobs/garden/templates/config/containerd.toml.erb
@@ -1,33 +1,207 @@
-root = "/var/vcap/data/containerd/root"
-state = "/var/vcap/sys/run/containerd/state"
-subreaper = true
+version = 3
+root = '/var/vcap/data/containerd/root'
+state = '/var/vcap/sys/run/containerd/state'
+temp = ''
+plugin_dir = ''
+disabled_plugins = ['io.containerd.snapshotter.v1.aufs',
+  'io.containerd.snapshotter.v1.devmapper',
+  'io.containerd.snapshotter.v1.overlayfs',
+  'io.containerd.snapshotter.v1.zfs',
+  'io.containerd.grpc.v1.walking',
+  'io.containerd.gc.v1.scheduler',
+  'io.containerd.service.v1.diff-service',
+  'io.containerd.service.v1.images-service',
+  'io.containerd.service.v1.namespaces-service',
+  'io.containerd.service.v1.snapshots-service',
+  'io.containerd.grpc.v1.diff',
+ 'io.containerd.grpc.v1.healthcheck',
+ 'io.containerd.grpc.v1.images',
+ 'io.containerd.grpc.v1.namespaces',
+ 'io.containerd.grpc.v1.snapshots',
+ 'io.containerd.grpc.v1.version',
+ 'io.containerd.grpc.v1.cri',
+ 'io.containerd.grpc.v1.leases',
+ 'io.containerd.service.v1.leases-service',
+ 'io.containerd.internal.v1.restart']
+
+required_plugins = []
 oom_score = -999
-disabled_plugins = [
-  "aufs",
-  "devmapper",
-  "overlayfs",
-  "zfs",
-  "walking",
-  "scheduler",
-  "diff-service",
-  "images-service",
-  "namespaces-service",
-  "snapshots-service",
-  "diff",
-  "healthcheck",
-  "images",
-  "namespaces",
-  "snapshots",
-  "version",
-  "cri",
-  "leases",
-  "leases-service",
-  "restart",
-]
+imports = []
 
 [grpc]
-address = "/var/vcap/sys/run/containerd/containerd.sock"
+  address = '/var/vcap/sys/run/containerd/containerd.sock'
+  tcp_address = ''
+  tcp_tls_ca = ''
+  tcp_tls_cert = ''
+  tcp_tls_key = ''
+  uid = 0
+  gid = 0
+  max_recv_message_size = 16777216
+  max_send_message_size = 16777216
+
+[ttrpc]
+  address = ''
+  uid = 0
+  gid = 0
 
 [debug]
-address = "/var/vcap/sys/run/containerd/debug.sock"
-level = "info"
+  address = '/var/vcap/sys/run/containerd/debug.sock'
+  uid = 0
+  gid = 0
+  level = 'info'
+  format = ''
+
+[metrics]
+  address = ''
+  grpc_histogram = false
+
+[plugins]
+  [plugins.'io.containerd.cri.v1.images']
+    snapshotter = 'overlayfs'
+    disable_snapshot_annotations = true
+    discard_unpacked_layers = false
+    max_concurrent_downloads = 3
+    image_pull_progress_timeout = '5m0s'
+    image_pull_with_sync_fs = false
+    stats_collect_period = 10
+
+    [plugins.'io.containerd.cri.v1.images'.pinned_images]
+      sandbox = 'registry.k8s.io/pause:3.10'
+
+    [plugins.'io.containerd.cri.v1.images'.registry]
+      config_path = ''
+
+    [plugins.'io.containerd.cri.v1.images'.image_decryption]
+      key_model = 'node'
+
+  [plugins.'io.containerd.cri.v1.runtime']
+    enable_selinux = false
+    selinux_category_range = 1024
+    max_container_log_line_size = 16384
+    disable_apparmor = false
+    restrict_oom_score_adj = false
+    disable_proc_mount = false
+    unset_seccomp_profile = ''
+    tolerate_missing_hugetlb_controller = true
+    disable_hugetlb_controller = true
+    device_ownership_from_security_context = false
+    ignore_image_defined_volumes = false
+    netns_mounts_under_state_dir = false
+    enable_unprivileged_ports = true
+    enable_unprivileged_icmp = true
+    enable_cdi = true
+    cdi_spec_dirs = ['/etc/cdi', '/var/run/cdi']
+    drain_exec_sync_io_timeout = '0s'
+    ignore_deprecation_warnings = []
+
+    [plugins.'io.containerd.cri.v1.runtime'.containerd]
+      default_runtime_name = 'runc'
+      ignore_blockio_not_enabled_errors = false
+      ignore_rdt_not_enabled_errors = false
+
+      [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes]
+        [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc]
+          runtime_type = 'io.containerd.runc.v2'
+          runtime_path = ''
+          pod_annotations = []
+          container_annotations = []
+          privileged_without_host_devices = false
+          privileged_without_host_devices_all_devices_allowed = false
+          base_runtime_spec = ''
+          cni_conf_dir = ''
+          cni_max_conf_num = 0
+          snapshotter = ''
+          sandboxer = 'podsandbox'
+          io_type = ''
+
+          [plugins.'io.containerd.cri.v1.runtime'.containerd.runtimes.runc.options]
+            BinaryName = ''
+            CriuImagePath = ''
+            CriuWorkPath = ''
+            IoGid = 0
+            IoUid = 0
+            NoNewKeyring = false
+            Root = ''
+            ShimCgroup = ''
+
+    [plugins.'io.containerd.cri.v1.runtime'.cni]
+      bin_dir = '/opt/cni/bin'
+      conf_dir = '/etc/cni/net.d'
+      max_conf_num = 1
+      setup_serially = false
+      conf_template = ''
+      ip_pref = ''
+      use_internal_loopback = false
+
+  [plugins.'io.containerd.image-verifier.v1.bindir']
+    bin_dir = '/opt/containerd/image-verifier/bin'
+    max_verifiers = 10
+    per_verifier_timeout = '10s'
+
+  [plugins.'io.containerd.internal.v1.opt']
+    path = '/opt/containerd'
+
+  [plugins.'io.containerd.internal.v1.tracing']
+
+  [plugins.'io.containerd.metadata.v1.bolt']
+    content_sharing_policy = 'shared'
+
+  [plugins.'io.containerd.monitor.container.v1.restart']
+    interval = '10s'
+
+  [plugins.'io.containerd.monitor.task.v1.cgroups']
+    no_prometheus = false
+
+  [plugins.'io.containerd.nri.v1.nri']
+    disable = false
+    socket_path = '/var/run/nri/nri.sock'
+    plugin_path = '/opt/nri/plugins'
+    plugin_config_path = '/etc/nri/conf.d'
+    plugin_registration_timeout = '5s'
+    plugin_request_timeout = '2s'
+    disable_connections = false
+
+  [plugins.'io.containerd.runtime.v2.task']
+    platforms = ['linux/amd64']
+
+  [plugins.'io.containerd.service.v1.tasks-service']
+    blockio_config_file = ''
+    rdt_config_file = ''
+
+  [plugins.'io.containerd.shim.v1.manager']
+    env = []
+
+  [plugins.'io.containerd.snapshotter.v1.blockfile']
+    root_path = ''
+    scratch_file = ''
+    fs_type = ''
+    mount_options = []
+    recreate_scratch = false
+
+  [plugins.'io.containerd.snapshotter.v1.native']
+    root_path = ''
+
+  [plugins.'io.containerd.tracing.processor.v1.otlp']
+
+  [plugins.'io.containerd.transfer.v1.local']
+    max_concurrent_downloads = 3
+    max_concurrent_uploaded_layers = 3
+    config_path = ''
+
+[cgroup]
+  path = ''
+
+[stream_processors]
+  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar']
+    accepts = ['application/vnd.oci.image.layer.v1.tar+encrypted']
+    returns = 'application/vnd.oci.image.layer.v1.tar'
+    path = 'ctd-decoder'
+    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
+    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']
+
+  [stream_processors.'io.containerd.ocicrypt.decoder.v1.tar.gzip']
+    accepts = ['application/vnd.oci.image.layer.v1.tar+gzip+encrypted']
+    returns = 'application/vnd.oci.image.layer.v1.tar+gzip'
+    path = 'ctd-decoder'
+    args = ['--decryption-keys-path', '/etc/containerd/ocicrypt/keys']
+    env = ['OCICRYPT_KEYPROVIDER_CONFIG=/etc/containerd/ocicrypt/ocicrypt_keyprovider.conf']
diff --git a/packages/containerd/packaging b/packages/containerd/packaging
index c9556371..fbfdad72 100644
--- a/packages/containerd/packaging
+++ b/packages/containerd/packaging
@@ -10,10 +10,8 @@ source /var/vcap/packages/golang-*-linux/bosh/compile.env
 mkdir -p "${BOSH_INSTALL_TARGET}/bin"
 export GOBIN="${BOSH_INSTALL_TARGET}/bin"
 
-pushd src/guardian/vendor/github.com/containerd/containerd
+pushd src/containerd
   BUILDTAGS=no_btrfs make ./bin/containerd
-  BUILDTAGS=no_btrfs make ./bin/containerd-shim
-  BUILDTAGS=no_btrfs make ./bin/containerd-shim-runc-v1
   BUILDTAGS=no_btrfs make ./bin/containerd-shim-runc-v2
   BUILDTAGS=no_btrfs make ./bin/ctr
   cp -R bin "${BOSH_INSTALL_TARGET}"
diff --git a/packages/containerd/spec b/packages/containerd/spec
index 2537b84a..37ae3544 100644
--- a/packages/containerd/spec
+++ b/packages/containerd/spec
@@ -5,840 +5,4 @@ dependencies:
   - golang-1.23-linux
 
 files:
-  - guardian/go.mod
-  - guardian/go.sum
-  - guardian/vendor/modules.txt
-  - guardian/vendor/dario.cat/mergo/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/backuptar/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/internal/fs/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/internal/socket/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/internal/stringbuffer/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/pkg/bindfilter/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/pkg/etw/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/pkg/etwlogrus/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/pkg/fs/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/pkg/guid/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/pkg/security/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/go-winio/vhd/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/Makefile # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/stats/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/computestorage/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/ext4/dmverity/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/ext4/internal/compactext4/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/ext4/internal/format/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/ext4/tar2ext4/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/hcn/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/cni/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/cow/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/hcs/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/hcs/schema1/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/hcs/schema2/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/hcserror/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/hns/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/interop/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/jobobject/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/log/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/logfields/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/longpath/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/memory/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/mergemaps/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/oc/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/protocol/guestrequest/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/queue/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/regstate/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/runhcs/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/safefile/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/security/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/timeout/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/vmcompute/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/wclayer/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/internal/winapi/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/osversion/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/pkg/go-runhcs/*.go # gosub
-  - guardian/vendor/github.com/Microsoft/hcsshim/pkg/ociwclayer/*.go # gosub
-  - guardian/vendor/github.com/beorn7/perks/quantile/*.go # gosub
-  - guardian/vendor/github.com/blang/semver/v4/*.go # gosub
-  - guardian/vendor/github.com/cenkalti/backoff/v4/*.go # gosub
-  - guardian/vendor/github.com/cespare/xxhash/v2/*.go # gosub
-  - guardian/vendor/github.com/cespare/xxhash/v2/*.s # gosub
-  - guardian/vendor/github.com/cilium/ebpf/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/Makefile # gosub
-  - guardian/vendor/github.com/cilium/ebpf/asm/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/btf/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/internal/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/internal/kconfig/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/internal/sys/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/internal/tracefs/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/internal/unix/*.go # gosub
-  - guardian/vendor/github.com/cilium/ebpf/link/*.go # gosub
-  - guardian/vendor/github.com/containerd/aufs/*.go # gosub
-  - guardian/vendor/github.com/containerd/aufs/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/cgroups/stats/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/cgroups/v3/*.go # gosub
-  - guardian/vendor/github.com/containerd/cgroups/v3/Makefile # gosub
-  - guardian/vendor/github.com/containerd/cgroups/v3/cgroup1/*.go # gosub
-  - guardian/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/*.go # gosub
-  - guardian/vendor/github.com/containerd/cgroups/v3/cgroup2/*.go # gosub
-  - guardian/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/*.go # gosub
-  - guardian/vendor/github.com/containerd/console/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/Makefile # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/events/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/runtime/sandbox/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/runtime/task/v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/runtime/task/v3/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/containers/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/content/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/diff/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/events/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/images/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/introspection/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/leases/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/namespaces/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/sandbox/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/snapshots/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/streaming/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/tasks/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/transfer/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/ttrpc/events/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/services/version/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/types/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/types/task/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/api/types/transfer/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/archive/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/archive/compression/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/archive/tarheader/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cio/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/containerd/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/containerd-shim/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/containerd-shim-runc-v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/containerd-shim-runc-v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/containerd/builtins/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/containerd/command/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/app/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/containers/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/content/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/deprecations/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/events/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/images/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/info/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/install/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/leases/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/namespaces/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/oci/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/plugins/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/pprof/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/run/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/sandboxes/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/shim/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/snapshots/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/tasks/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/cmd/ctr/commands/version/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/containers/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/content/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/content/local/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/content/proxy/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/contrib/apparmor/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/contrib/nvidia/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/contrib/seccomp/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/contrib/seccomp/kernelversion/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/defaults/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/apply/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/lcow/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/proxy/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/walking/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/walking/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/diff/windows/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/errdefs/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/events/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/events/exchange/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/events/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/filters/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/gc/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/gc/scheduler/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/identifiers/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/images/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/images/archive/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/images/converter/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/images/converter/uncompress/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/labels/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/leases/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/leases/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/leases/proxy/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/log/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metadata/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metadata/boltutil/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metadata/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/cgroups/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/cgroups/common/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/cgroups/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/cgroups/v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/types/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/metrics/types/v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/mount/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/namespaces/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/oci/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/apparmor/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/atomic/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/atomicfile/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/blockio/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cap/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cleanup/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/annotations/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/config/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/constants/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/instrument/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/io/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/labels/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/nri/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/opts/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/sbserver/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/sbserver/podsandbox/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/server/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/server/bandwidth/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/container/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/image/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/label/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/sandbox/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/snapshot/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/store/stats/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/streaming/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/streaming/internal/wsstream/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/streaming/portforward/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/streaming/remotecommand/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/cri/util/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/deprecation/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/dialer/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/epoch/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/hasher/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/ioutil/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/kmutex/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/netns/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/nri/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/nri/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/oom/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/oom/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/oom/v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/os/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/process/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/progress/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/randutil/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/rdt/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/registrar/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/runtimeoptions/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/schedcore/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/seccomp/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/seed/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/seutil/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/shutdown/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/snapshotters/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/stdio/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/streaming/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/timeout/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/archive/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/image/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/local/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/plugins/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/proxy/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/registry/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/transfer/streaming/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/truncindex/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/ttrpcutil/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/pkg/unpack/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/platforms/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/plugins/sandbox/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/plugins/streaming/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/plugins/transfer/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/protobuf/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/protobuf/proto/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/protobuf/types/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/reference/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/remotes/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/remotes/docker/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/remotes/docker/auth/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/remotes/docker/config/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/remotes/docker/schema1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/remotes/errors/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/rootfs/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/linux/runctypes/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/opts/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/restart/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/restart/monitor/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v1/linux/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v1/shim/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v1/shim/client/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v1/shim/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/manager/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/options/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/pause/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/task/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/task/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/runc/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/runtime/v2/shim/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/sandbox/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/sandbox/proxy/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/containers/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/content/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/content/contentserver/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/diff/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/events/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/healthcheck/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/images/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/introspection/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/leases/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/namespaces/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/opt/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/sandbox/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/server/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/server/config/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/snapshots/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/streaming/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/tasks/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/transfer/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/version/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/services/warning/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/blockfile/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/blockfile/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/devmapper/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/devmapper/blkdiscard/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/devmapper/dmsetup/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/devmapper/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/lcow/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/native/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/native/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/overlay/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/overlay/overlayutils/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/overlay/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/proxy/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/storage/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/snapshots/windows/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/sys/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/sys/reaper/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/third_party/k8s.io/cri-api/pkg/apis/runtime/v1alpha2/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/tracing/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/tracing/plugin/*.go # gosub
-  - guardian/vendor/github.com/containerd/containerd/version/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/Makefile # gosub
-  - guardian/vendor/github.com/containerd/continuity/devices/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/driver/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/fs/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/pathdriver/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/proto/*.go # gosub
-  - guardian/vendor/github.com/containerd/continuity/sysx/*.go # gosub
-  - guardian/vendor/github.com/containerd/errdefs/*.go # gosub
-  - guardian/vendor/github.com/containerd/fifo/*.go # gosub
-  - guardian/vendor/github.com/containerd/fifo/Makefile # gosub
-  - guardian/vendor/github.com/containerd/go-cni/*.go # gosub
-  - guardian/vendor/github.com/containerd/go-cni/Makefile # gosub
-  - guardian/vendor/github.com/containerd/go-runc/*.go # gosub
-  - guardian/vendor/github.com/containerd/imgcrypt/*.go # gosub
-  - guardian/vendor/github.com/containerd/imgcrypt/Makefile # gosub
-  - guardian/vendor/github.com/containerd/imgcrypt/images/encryption/*.go # gosub
-  - guardian/vendor/github.com/containerd/log/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/Makefile # gosub
-  - guardian/vendor/github.com/containerd/nri/pkg/adaptation/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/pkg/api/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/pkg/log/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/pkg/net/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/pkg/net/multiplex/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/pkg/runtime-tools/generate/*.go # gosub
-  - guardian/vendor/github.com/containerd/nri/types/v1/*.go # gosub
-  - guardian/vendor/github.com/containerd/platforms/*.go # gosub
-  - guardian/vendor/github.com/containerd/ttrpc/*.go # gosub
-  - guardian/vendor/github.com/containerd/ttrpc/Makefile # gosub
-  - guardian/vendor/github.com/containerd/typeurl/*.go # gosub
-  - guardian/vendor/github.com/containerd/typeurl/v2/*.go # gosub
-  - guardian/vendor/github.com/containerd/zfs/*.go # gosub
-  - guardian/vendor/github.com/containerd/zfs/plugin/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/libcni/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/invoke/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/types/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/types/020/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/types/040/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/types/100/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/types/create/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/types/internal/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/utils/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/cni/pkg/version/*.go # gosub
-  - guardian/vendor/github.com/containernetworking/plugins/pkg/ns/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/Makefile # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/blockcipher/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/config/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/config/keyprovider-config/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/crypto/pkcs11/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/keywrap/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/keywrap/jwe/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/keywrap/keyprovider/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/keywrap/pgp/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/keywrap/pkcs11/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/keywrap/pkcs7/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/spec/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/utils/*.go # gosub
-  - guardian/vendor/github.com/containers/ocicrypt/utils/keyprovider/*.go # gosub
-  - guardian/vendor/github.com/coreos/go-systemd/v22/daemon/*.go # gosub
-  - guardian/vendor/github.com/coreos/go-systemd/v22/dbus/*.go # gosub
-  - guardian/vendor/github.com/cpuguy83/go-md2man/v2/md2man/*.go # gosub
-  - guardian/vendor/github.com/davecgh/go-spew/spew/*.go # gosub
-  - guardian/vendor/github.com/distribution/reference/*.go # gosub
-  - guardian/vendor/github.com/distribution/reference/Makefile # gosub
-  - guardian/vendor/github.com/docker/go-events/*.go # gosub
-  - guardian/vendor/github.com/docker/go-metrics/*.go # gosub
-  - guardian/vendor/github.com/docker/go-units/*.go # gosub
-  - guardian/vendor/github.com/emicklei/go-restful/v3/*.go # gosub
-  - guardian/vendor/github.com/emicklei/go-restful/v3/Makefile # gosub
-  - guardian/vendor/github.com/emicklei/go-restful/v3/log/*.go # gosub
-  - guardian/vendor/github.com/felixge/httpsnoop/*.go # gosub
-  - guardian/vendor/github.com/felixge/httpsnoop/Makefile # gosub
-  - guardian/vendor/github.com/fsnotify/fsnotify/*.go # gosub
-  - guardian/vendor/github.com/go-jose/go-jose/v4/*.go # gosub
-  - guardian/vendor/github.com/go-jose/go-jose/v4/cipher/*.go # gosub
-  - guardian/vendor/github.com/go-jose/go-jose/v4/json/*.go # gosub
-  - guardian/vendor/github.com/go-logr/logr/*.go # gosub
-  - guardian/vendor/github.com/go-logr/logr/funcr/*.go # gosub
-  - guardian/vendor/github.com/go-logr/stdr/*.go # gosub
-  - guardian/vendor/github.com/godbus/dbus/v5/*.go # gosub
-  - guardian/vendor/github.com/gogo/protobuf/gogoproto/*.go # gosub
-  - guardian/vendor/github.com/gogo/protobuf/gogoproto/Makefile # gosub
-  - guardian/vendor/github.com/gogo/protobuf/proto/*.go # gosub
-  - guardian/vendor/github.com/gogo/protobuf/proto/Makefile # gosub
-  - guardian/vendor/github.com/gogo/protobuf/protoc-gen-gogo/descriptor/*.go # gosub
-  - guardian/vendor/github.com/gogo/protobuf/protoc-gen-gogo/descriptor/Makefile # gosub
-  - guardian/vendor/github.com/gogo/protobuf/sortkeys/*.go # gosub
-  - guardian/vendor/github.com/gogo/protobuf/types/*.go # gosub
-  - guardian/vendor/github.com/golang/groupcache/lru/*.go # gosub
-  - guardian/vendor/github.com/golang/protobuf/proto/*.go # gosub
-  - guardian/vendor/github.com/google/go-cmp/cmp/*.go # gosub
-  - guardian/vendor/github.com/google/go-cmp/cmp/internal/diff/*.go # gosub
-  - guardian/vendor/github.com/google/go-cmp/cmp/internal/flags/*.go # gosub
-  - guardian/vendor/github.com/google/go-cmp/cmp/internal/function/*.go # gosub
-  - guardian/vendor/github.com/google/go-cmp/cmp/internal/value/*.go # gosub
-  - guardian/vendor/github.com/google/gofuzz/*.go # gosub
-  - guardian/vendor/github.com/google/gofuzz/bytesource/*.go # gosub
-  - guardian/vendor/github.com/google/uuid/*.go # gosub
-  - guardian/vendor/github.com/grpc-ecosystem/go-grpc-middleware/*.go # gosub
-  - guardian/vendor/github.com/grpc-ecosystem/go-grpc-prometheus/*.go # gosub
-  - guardian/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule/*.go # gosub
-  - guardian/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/*.go # gosub
-  - guardian/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/utilities/*.go # gosub
-  - guardian/vendor/github.com/hashicorp/errwrap/*.go # gosub
-  - guardian/vendor/github.com/hashicorp/go-multierror/*.go # gosub
-  - guardian/vendor/github.com/hashicorp/go-multierror/Makefile # gosub
-  - guardian/vendor/github.com/intel/goresctrl/pkg/blockio/*.go # gosub
-  - guardian/vendor/github.com/intel/goresctrl/pkg/cgroups/*.go # gosub
-  - guardian/vendor/github.com/intel/goresctrl/pkg/kubernetes/*.go # gosub
-  - guardian/vendor/github.com/intel/goresctrl/pkg/log/*.go # gosub
-  - guardian/vendor/github.com/intel/goresctrl/pkg/rdt/*.go # gosub
-  - guardian/vendor/github.com/intel/goresctrl/pkg/utils/*.go # gosub
-  - guardian/vendor/github.com/json-iterator/go/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/fse/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/huff0/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/huff0/*.s # gosub
-  - guardian/vendor/github.com/klauspost/compress/internal/cpuinfo/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/internal/cpuinfo/*.s # gosub
-  - guardian/vendor/github.com/klauspost/compress/internal/snapref/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/zstd/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/zstd/*.s # gosub
-  - guardian/vendor/github.com/klauspost/compress/zstd/internal/xxhash/*.go # gosub
-  - guardian/vendor/github.com/klauspost/compress/zstd/internal/xxhash/*.s # gosub
-  - guardian/vendor/github.com/klauspost/cpuid/v2/*.go # gosub
-  - guardian/vendor/github.com/klauspost/cpuid/v2/*.s # gosub
-  - guardian/vendor/github.com/miekg/pkcs11/*.go # gosub
-  - guardian/vendor/github.com/miekg/pkcs11/*.h # gosub
-  - guardian/vendor/github.com/minio/sha256-simd/*.go # gosub
-  - guardian/vendor/github.com/minio/sha256-simd/*.s # gosub
-  - guardian/vendor/github.com/mistifyio/go-zfs/v3/*.go # gosub
-  - guardian/vendor/github.com/mistifyio/go-zfs/v3/Makefile # gosub
-  - guardian/vendor/github.com/moby/locker/*.go # gosub
-  - guardian/vendor/github.com/moby/spdystream/*.go # gosub
-  - guardian/vendor/github.com/moby/spdystream/spdy/*.go # gosub
-  - guardian/vendor/github.com/moby/sys/mountinfo/*.go # gosub
-  - guardian/vendor/github.com/moby/sys/sequential/*.go # gosub
-  - guardian/vendor/github.com/moby/sys/signal/*.go # gosub
-  - guardian/vendor/github.com/moby/sys/symlink/*.go # gosub
-  - guardian/vendor/github.com/moby/sys/user/*.go # gosub
-  - guardian/vendor/github.com/moby/sys/userns/*.go # gosub
-  - guardian/vendor/github.com/modern-go/concurrent/*.go # gosub
-  - guardian/vendor/github.com/modern-go/reflect2/*.go # gosub
-  - guardian/vendor/github.com/modern-go/reflect2/*.s # gosub
-  - guardian/vendor/github.com/opencontainers/go-digest/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/go-digest/digestset/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/image-spec/identity/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/image-spec/specs-go/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/image-spec/specs-go/v1/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runtime-spec/specs-go/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runtime-tools/generate/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runtime-tools/generate/seccomp/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runtime-tools/validate/capabilities/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/selinux/go-selinux/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/selinux/go-selinux/label/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/selinux/pkg/pwalkdir/*.go # gosub
-  - guardian/vendor/github.com/pelletier/go-toml/*.go # gosub
-  - guardian/vendor/github.com/pelletier/go-toml/Makefile # gosub
-  - guardian/vendor/github.com/pkg/errors/*.go # gosub
-  - guardian/vendor/github.com/pkg/errors/Makefile # gosub
-  - guardian/vendor/github.com/prometheus/client_golang/prometheus/*.go # gosub
-  - guardian/vendor/github.com/prometheus/client_golang/prometheus/collectors/*.go # gosub
-  - guardian/vendor/github.com/prometheus/client_golang/prometheus/internal/*.go # gosub
-  - guardian/vendor/github.com/prometheus/client_golang/prometheus/promhttp/*.go # gosub
-  - guardian/vendor/github.com/prometheus/client_model/go/*.go # gosub
-  - guardian/vendor/github.com/prometheus/common/expfmt/*.go # gosub
-  - guardian/vendor/github.com/prometheus/common/internal/bitbucket.org/ww/goautoneg/*.go # gosub
-  - guardian/vendor/github.com/prometheus/common/model/*.go # gosub
-  - guardian/vendor/github.com/prometheus/procfs/*.go # gosub
-  - guardian/vendor/github.com/prometheus/procfs/Makefile # gosub
-  - guardian/vendor/github.com/prometheus/procfs/internal/fs/*.go # gosub
-  - guardian/vendor/github.com/prometheus/procfs/internal/util/*.go # gosub
-  - guardian/vendor/github.com/russross/blackfriday/v2/*.go # gosub
-  - guardian/vendor/github.com/sirupsen/logrus/*.go # gosub
-  - guardian/vendor/github.com/smallstep/pkcs7/*.go # gosub
-  - guardian/vendor/github.com/smallstep/pkcs7/Makefile # gosub
-  - guardian/vendor/github.com/smallstep/pkcs7/internal/legacy/x509/*.go # gosub
-  - guardian/vendor/github.com/spf13/pflag/*.go # gosub
-  - guardian/vendor/github.com/stefanberger/go-pkcs11uri/*.go # gosub
-  - guardian/vendor/github.com/stefanberger/go-pkcs11uri/Makefile # gosub
-  - guardian/vendor/github.com/syndtr/gocapability/capability/*.go # gosub
-  - guardian/vendor/github.com/tchap/go-patricia/v2/patricia/*.go # gosub
-  - guardian/vendor/github.com/urfave/cli/*.go # gosub
-  - guardian/vendor/github.com/vishvananda/netlink/*.go # gosub
-  - guardian/vendor/github.com/vishvananda/netlink/Makefile # gosub
-  - guardian/vendor/github.com/vishvananda/netlink/nl/*.go # gosub
-  - guardian/vendor/github.com/vishvananda/netns/*.go # gosub
-  - guardian/vendor/go.etcd.io/bbolt/*.go # gosub
-  - guardian/vendor/go.etcd.io/bbolt/Makefile # gosub
-  - guardian/vendor/go.opencensus.io/*.go # gosub
-  - guardian/vendor/go.opencensus.io/Makefile # gosub
-  - guardian/vendor/go.opencensus.io/internal/*.go # gosub
-  - guardian/vendor/go.opencensus.io/trace/*.go # gosub
-  - guardian/vendor/go.opencensus.io/trace/internal/*.go # gosub
-  - guardian/vendor/go.opencensus.io/trace/tracestate/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/auto/sdk/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/auto/sdk/internal/telemetry/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc/internal/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/request/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconv/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp/internal/semconvutil/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/Makefile # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/attribute/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/baggage/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/codes/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/internal/tracetransform/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/envconfig/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/otlpconfig/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc/internal/retry/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/envconfig/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/otlpconfig/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp/internal/retry/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/internal/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/internal/attribute/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/internal/baggage/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/internal/global/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/metric/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/metric/embedded/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/metric/noop/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/propagation/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/sdk/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/sdk/instrumentation/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/sdk/internal/env/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/sdk/internal/x/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/sdk/resource/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/sdk/trace/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/semconv/v1.17.0/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/semconv/v1.20.0/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/semconv/v1.21.0/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/semconv/v1.26.0/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/trace/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/trace/embedded/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/otel/trace/noop/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/proto/otlp/collector/trace/v1/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/proto/otlp/common/v1/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/proto/otlp/resource/v1/*.go # gosub
-  - guardian/vendor/go.opentelemetry.io/proto/otlp/trace/v1/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/cast5/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/cryptobyte/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/cryptobyte/asn1/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/openpgp/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/openpgp/armor/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/openpgp/elgamal/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/openpgp/errors/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/openpgp/packet/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/openpgp/s2k/*.go # gosub
-  - guardian/vendor/golang.org/x/crypto/pbkdf2/*.go # gosub
-  - guardian/vendor/golang.org/x/exp/constraints/*.go # gosub
-  - guardian/vendor/golang.org/x/exp/maps/*.go # gosub
-  - guardian/vendor/golang.org/x/exp/slices/*.go # gosub
-  - guardian/vendor/golang.org/x/mod/semver/*.go # gosub
-  - guardian/vendor/golang.org/x/net/context/*.go # gosub
-  - guardian/vendor/golang.org/x/net/http/httpguts/*.go # gosub
-  - guardian/vendor/golang.org/x/net/http2/*.go # gosub
-  - guardian/vendor/golang.org/x/net/http2/hpack/*.go # gosub
-  - guardian/vendor/golang.org/x/net/idna/*.go # gosub
-  - guardian/vendor/golang.org/x/net/internal/socks/*.go # gosub
-  - guardian/vendor/golang.org/x/net/internal/timeseries/*.go # gosub
-  - guardian/vendor/golang.org/x/net/proxy/*.go # gosub
-  - guardian/vendor/golang.org/x/net/trace/*.go # gosub
-  - guardian/vendor/golang.org/x/net/websocket/*.go # gosub
-  - guardian/vendor/golang.org/x/oauth2/*.go # gosub
-  - guardian/vendor/golang.org/x/oauth2/internal/*.go # gosub
-  - guardian/vendor/golang.org/x/sync/errgroup/*.go # gosub
-  - guardian/vendor/golang.org/x/sync/semaphore/*.go # gosub
-  - guardian/vendor/golang.org/x/sys/unix/*.go # gosub
-  - guardian/vendor/golang.org/x/sys/unix/*.s # gosub
-  - guardian/vendor/golang.org/x/sys/unix/*.c # gosub
-  - guardian/vendor/golang.org/x/sys/windows/*.go # gosub
-  - guardian/vendor/golang.org/x/sys/windows/registry/*.go # gosub
-  - guardian/vendor/golang.org/x/sys/windows/svc/*.go # gosub
-  - guardian/vendor/golang.org/x/sys/windows/svc/debug/*.go # gosub
-  - guardian/vendor/golang.org/x/sys/windows/svc/mgr/*.go # gosub
-  - guardian/vendor/golang.org/x/term/*.go # gosub
-  - guardian/vendor/golang.org/x/text/secure/bidirule/*.go # gosub
-  - guardian/vendor/golang.org/x/text/transform/*.go # gosub
-  - guardian/vendor/golang.org/x/text/unicode/bidi/*.go # gosub
-  - guardian/vendor/golang.org/x/text/unicode/norm/*.go # gosub
-  - guardian/vendor/golang.org/x/time/rate/*.go # gosub
-  - guardian/vendor/google.golang.org/genproto/googleapis/api/httpbody/*.go # gosub
-  - guardian/vendor/google.golang.org/genproto/googleapis/rpc/code/*.go # gosub
-  - guardian/vendor/google.golang.org/genproto/googleapis/rpc/errdetails/*.go # gosub
-  - guardian/vendor/google.golang.org/genproto/googleapis/rpc/status/*.go # gosub
-  - guardian/vendor/google.golang.org/genproto/protobuf/field_mask/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/Makefile # gosub
-  - guardian/vendor/google.golang.org/grpc/attributes/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/backoff/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/base/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/grpclb/state/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/pickfirst/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/pickfirst/internal/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/pickfirst/pickfirstleaf/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/balancer/roundrobin/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/binarylog/grpc_binarylog_v1/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/channelz/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/codes/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/connectivity/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/credentials/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/credentials/insecure/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/encoding/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/encoding/gzip/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/encoding/proto/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/experimental/stats/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/grpclog/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/grpclog/internal/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/health/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/health/grpc_health_v1/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/backoff/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/balancer/gracefulswitch/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/balancerload/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/binarylog/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/buffer/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/channelz/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/credentials/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/envconfig/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/grpclog/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/grpcsync/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/grpcutil/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/idle/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/metadata/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/pretty/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/resolver/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/resolver/dns/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/resolver/dns/internal/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/resolver/passthrough/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/resolver/unix/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/serviceconfig/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/stats/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/status/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/syscall/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/transport/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/internal/transport/networktype/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/keepalive/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/mem/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/metadata/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/peer/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/resolver/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/resolver/dns/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/serviceconfig/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/stats/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/status/*.go # gosub
-  - guardian/vendor/google.golang.org/grpc/tap/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/encoding/protodelim/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/encoding/protojson/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/encoding/prototext/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/encoding/protowire/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/descfmt/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/descopts/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/detrand/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/editiondefaults/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/editiondefaults/*.binpb # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/editionssupport/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/encoding/defval/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/encoding/json/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/encoding/messageset/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/encoding/tag/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/encoding/text/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/errors/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/filedesc/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/filetype/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/flags/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/genid/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/impl/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/order/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/pragma/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/protolazy/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/set/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/strs/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/internal/version/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/proto/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/protoadapt/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/reflect/protodesc/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/reflect/protoreflect/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/reflect/protoregistry/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/runtime/protoiface/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/runtime/protoimpl/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/descriptorpb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/gofeaturespb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/anypb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/durationpb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/emptypb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/fieldmaskpb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/structpb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/timestamppb/*.go # gosub
-  - guardian/vendor/google.golang.org/protobuf/types/known/wrapperspb/*.go # gosub
-  - guardian/vendor/gopkg.in/inf.v0/*.go # gosub
-  - guardian/vendor/gopkg.in/yaml.v2/*.go # gosub
-  - guardian/vendor/gopkg.in/yaml.v3/*.go # gosub
-  - guardian/vendor/k8s.io/api/authentication/v1/*.go # gosub
-  - guardian/vendor/k8s.io/api/core/v1/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/api/errors/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/api/meta/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/api/resource/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/api/validation/path/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/apis/meta/internalversion/scheme/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/unstructured/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/apis/meta/v1/validation/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/conversion/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/conversion/queryparams/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/fields/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/labels/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/schema/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/serializer/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/serializer/json/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/serializer/protobuf/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/serializer/recognizer/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/serializer/streaming/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/runtime/serializer/versioning/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/selection/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/types/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/errors/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/framer/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/httpstream/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/httpstream/spdy/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/intstr/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/json/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/naming/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/net/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/remotecommand/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/runtime/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/sets/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/validation/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/validation/field/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/wait/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/util/yaml/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/version/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/pkg/watch/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/third_party/forked/golang/netutil/*.go # gosub
-  - guardian/vendor/k8s.io/apimachinery/third_party/forked/golang/reflect/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/apis/audit/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/apis/audit/v1/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/audit/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/authentication/user/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/authorization/authorizer/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/endpoints/metrics/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/endpoints/request/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/endpoints/responsewriter/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/features/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/server/httplog/*.go # gosub
-  - guardian/vendor/k8s.io/apiserver/pkg/util/feature/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/pkg/apis/clientauthentication/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/pkg/apis/clientauthentication/install/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/pkg/apis/clientauthentication/v1beta1/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/pkg/version/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/plugin/pkg/client/auth/exec/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/rest/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/rest/watch/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/tools/clientcmd/api/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/tools/metrics/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/tools/remotecommand/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/transport/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/transport/spdy/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/util/cert/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/util/connrotation/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/util/exec/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/util/flowcontrol/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/util/keyutil/*.go # gosub
-  - guardian/vendor/k8s.io/client-go/util/workqueue/*.go # gosub
-  - guardian/vendor/k8s.io/component-base/featuregate/*.go # gosub
-  - guardian/vendor/k8s.io/component-base/metrics/*.go # gosub
-  - guardian/vendor/k8s.io/component-base/metrics/legacyregistry/*.go # gosub
-  - guardian/vendor/k8s.io/component-base/metrics/prometheus/feature/*.go # gosub
-  - guardian/vendor/k8s.io/component-base/metrics/prometheusextension/*.go # gosub
-  - guardian/vendor/k8s.io/component-base/version/*.go # gosub
-  - guardian/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/*.go # gosub
-  - guardian/vendor/k8s.io/klog/v2/*.go # gosub
-  - guardian/vendor/k8s.io/klog/v2/internal/buffer/*.go # gosub
-  - guardian/vendor/k8s.io/klog/v2/internal/clock/*.go # gosub
-  - guardian/vendor/k8s.io/klog/v2/internal/dbg/*.go # gosub
-  - guardian/vendor/k8s.io/klog/v2/internal/serialize/*.go # gosub
-  - guardian/vendor/k8s.io/klog/v2/internal/severity/*.go # gosub
-  - guardian/vendor/k8s.io/utils/clock/*.go # gosub
-  - guardian/vendor/k8s.io/utils/clock/testing/*.go # gosub
-  - guardian/vendor/k8s.io/utils/exec/*.go # gosub
-  - guardian/vendor/k8s.io/utils/integer/*.go # gosub
-  - guardian/vendor/k8s.io/utils/internal/third_party/forked/golang/net/*.go # gosub
-  - guardian/vendor/k8s.io/utils/net/*.go # gosub
-  - guardian/vendor/k8s.io/utils/strings/slices/*.go # gosub
-  - guardian/vendor/sigs.k8s.io/json/*.go # gosub
-  - guardian/vendor/sigs.k8s.io/json/Makefile # gosub
-  - guardian/vendor/sigs.k8s.io/json/internal/golang/encoding/json/*.go # gosub
-  - guardian/vendor/sigs.k8s.io/structured-merge-diff/v4/value/*.go # gosub
-  - guardian/vendor/sigs.k8s.io/yaml/*.go # gosub
-  - guardian/vendor/sigs.k8s.io/yaml/goyaml.v2/*.go # gosub
-  - guardian/vendor/tags.cncf.io/container-device-interface/internal/validation/*.go # gosub
-  - guardian/vendor/tags.cncf.io/container-device-interface/internal/validation/k8s/*.go # gosub
-  - guardian/vendor/tags.cncf.io/container-device-interface/pkg/cdi/*.go # gosub
-  - guardian/vendor/tags.cncf.io/container-device-interface/pkg/parser/*.go # gosub
-  - guardian/vendor/tags.cncf.io/container-device-interface/specs-go/*.go # gosub
+  - containerd/**/*
diff --git a/packages/runc/packaging b/packages/runc/packaging
index 6fa58c1b..38869681 100644
--- a/packages/runc/packaging
+++ b/packages/runc/packaging
@@ -34,6 +34,6 @@ if [[ "${DISTRIB_CODENAME}" == "xenial" ]]; then
 fi
 
 pushd src/guardian/vendor/github.com/opencontainers/runc
-  make BUILDTAGS='seccomp apparmor' static
+  make static
   cp runc "${GOBIN}/runc"
 popd
diff --git a/packages/runc/spec b/packages/runc/spec
index 9b4bfb62..c647fb76 100644
--- a/packages/runc/spec
+++ b/packages/runc/spec
@@ -11,16 +11,18 @@ files:
   - guardian/go.mod
   - guardian/go.sum
   - guardian/vendor/modules.txt
-  - guardian/vendor/github.com/checkpoint-restore/go-criu/v5/*.go # gosub
-  - guardian/vendor/github.com/checkpoint-restore/go-criu/v5/Makefile # gosub
-  - guardian/vendor/github.com/checkpoint-restore/go-criu/v5/rpc/*.go # gosub
+  - guardian/vendor/github.com/checkpoint-restore/go-criu/v6/*.go # gosub
+  - guardian/vendor/github.com/checkpoint-restore/go-criu/v6/Makefile # gosub
+  - guardian/vendor/github.com/checkpoint-restore/go-criu/v6/rpc/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/Makefile # gosub
   - guardian/vendor/github.com/cilium/ebpf/asm/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/btf/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/internal/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/internal/kallsyms/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/internal/kconfig/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/internal/sys/*.go # gosub
+  - guardian/vendor/github.com/cilium/ebpf/internal/sysenc/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/internal/tracefs/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/internal/unix/*.go # gosub
   - guardian/vendor/github.com/cilium/ebpf/link/*.go # gosub
@@ -32,6 +34,8 @@ files:
   - guardian/vendor/github.com/docker/go-units/*.go # gosub
   - guardian/vendor/github.com/godbus/dbus/v5/*.go # gosub
   - guardian/vendor/github.com/moby/sys/mountinfo/*.go # gosub
+  - guardian/vendor/github.com/moby/sys/user/*.go # gosub
+  - guardian/vendor/github.com/moby/sys/userns/*.go # gosub
   - guardian/vendor/github.com/mrunalp/fileutils/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/Makefile # gosub
@@ -40,8 +44,6 @@ files:
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/capabilities/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/devices/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/ebpf/devicefilter/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fs2/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/cgroups/fscommon/*.go # gosub
@@ -50,7 +52,10 @@ files:
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/configs/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/configs/validate/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/devices/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/dmz/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/intelrdt/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/internal/userns/*.c # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/keys/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/logs/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/nsenter/*.go # gosub
@@ -60,13 +65,12 @@ files:
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/seccomp/patchbpf/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/specconv/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/system/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runc/libcontainer/user/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runc/libcontainer/userns/*.go # gosub
-  - guardian/vendor/github.com/opencontainers/runc/libcontainer/userns/*.c # gosub
+  - guardian/vendor/github.com/opencontainers/runc/libcontainer/system/kernelversion/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/libcontainer/utils/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/types/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runc/types/features/*.go # gosub
   - guardian/vendor/github.com/opencontainers/runtime-spec/specs-go/*.go # gosub
+  - guardian/vendor/github.com/opencontainers/runtime-spec/specs-go/features/*.go # gosub
   - guardian/vendor/github.com/opencontainers/selinux/go-selinux/*.go # gosub
   - guardian/vendor/github.com/opencontainers/selinux/go-selinux/label/*.go # gosub
   - guardian/vendor/github.com/opencontainers/selinux/pkg/pwalkdir/*.go # gosub
@@ -81,8 +85,6 @@ files:
   - guardian/vendor/github.com/vishvananda/netlink/nl/*.go # gosub
   - guardian/vendor/github.com/vishvananda/netns/*.go # gosub
   - guardian/vendor/golang.org/x/exp/constraints/*.go # gosub
-  - guardian/vendor/golang.org/x/exp/maps/*.go # gosub
-  - guardian/vendor/golang.org/x/exp/slices/*.go # gosub
   - guardian/vendor/golang.org/x/net/bpf/*.go # gosub
   - guardian/vendor/golang.org/x/sys/unix/*.go # gosub
   - guardian/vendor/golang.org/x/sys/unix/*.s # gosub
diff --git a/src/containerd b/src/containerd
new file mode 160000
index 00000000..154b692b
--- /dev/null
+++ b/src/containerd
@@ -0,0 +1 @@
+Subproject commit 154b692b2bbac5f3422b25366b1abc9a0624b1c9