Dockerfile: bump containerd to v2.3.0

[ChengyuZhu6]

Depends-on: #4887

[AkihiroSuda]

Thanks

[AkihiroSuda]

CI failing

[haytok]

Checking the CI logs, it appears the test is failing because containerd.sock does not exist in the rootless environment.

🟠 time="2026-05-07T05:36:46Z" level=fatal msg="lstat /run/containerd/containerd.sock: no such file or directory"

I can reproduce this error on my local rootless environment running containerd 2976f38cc.

[ChengyuZhu6]

CI failing

I had retried many times, but ...

[ChengyuZhu6]

Checking the CI logs, it appears the test is failing because containerd.sock does not exist in the rootless environment.

🟠 time="2026-05-07T05:36:46Z" level=fatal msg="lstat /run/containerd/containerd.sock: no such file or directory"

I can reproduce this error on my local rootless environment running containerd 2976f38cc.

This might be a regression introduced between v2.3.0-beta.2 and v2.3.0? I'll check the diffs between the two versions
to identify what changed.

[haytok]

I bisected this regression to containerd commit c15ec2485 ("Add server plugins for grpc and ttrpc"), which is included in v2.3.0 GA but not in v2.3.0-beta.2.

Verified locally on a rootless setup:

• c15ec2485^: containerd's gRPC socket is created → works
• c15ec2485: gRPC socket is NOT created → reproduces the failure

[AkihiroSuda]

Reported:

• [v2.3.0-rc.0 regression] rootless: "/run/containerd/containerd.sock": no such file or directory containerd#13362

Is anybody working on the fix?

[haytok]

Thanks for creating the issue on containerd!

As a CI workaround for the v2.3.0 rootless regression, I confirmed that disabling the CRI plugin allows the rootless tests to work.

diff --git a/Dockerfile.d/test-integration-rootless.sh b/Dockerfile.d/test-integration-rootless.sh
index 63f38346..2e533f18 100755
--- a/Dockerfile.d/test-integration-rootless.sh
+++ b/Dockerfile.d/test-integration-rootless.sh
@@ -34,6 +34,10 @@ if [[ "$(id -u)" = "0" ]]; then
        systemctl start ssh
        exec ssh -o StrictHostKeyChecking=no rootless@localhost "$0" "$@"
 else
+       mkdir -p "/home/rootless/.config/containerd"
+       echo 'version = 2' > "/home/rootless/.config/containerd/config.toml"
+       echo 'disabled_plugins = ["io.containerd.grpc.v1.cri"]' >> "/home/rootless/.config/containerd/config.toml"
        containerd-rootless-setuptool.sh install
        if grep -q "options use-vc" /etc/resolv.conf; then
                containerd-rootless-setuptool.sh nsenter -- sh -euc 'echo "options use-vc" >>/etc/resolv.conf'

ref: haytok#1 https://github.com/haytok/nerdctl/actions/runs/25618882476

[AkihiroSuda]

Fix is coming:

• server: tolerate failed gRPC plugins when starting listeners containerd#13363