[18.09 backport] Update containerd to v1.2.8

[thaJeztah]

backport of moby#39364 and moby#39786 for 18.09

created on top of #194 - only the last commit is new

From the release notes: https://github.com/containerd/containerd/releases/tag/v1.2.7

Welcome to the v1.2.7 release of containerd!

The seventh patch release for containerd 1.2 introduces OCI image
descriptor annotation support and contains fixes for containerd shim logs,
container stop/deletion, cri plugin and selinux.

It also contains several important bug fixes for goroutine and file
descriptor leakage in containerd and containerd shims.

Notable Updates

• Support annotations in the OCI image descriptor, and filtering image by annotations. [release/1.2 backport] Add missing annotations map to Descriptor for gRPC transfer  containerd/containerd#3254
• Support context timeout in ttrpc which can help avoid containerd hangs when a shim is unresponsive. Add support for request timeout propgation. containerd/ttrpc#31
• Fix a bug that containerd shim leaks goroutine and file descriptor after containerd restarts. Handle EOF to prevent file descriptor leak containerd/ttrpc#37
• Fix a bug that a container can't be deleted if first deletion attempt is canceled or timeout. [release/1.2] Return NotFound error for kill and delete in deleted state. containerd/containerd#3264
• Fix a bug that containerd leaks file descriptor when using v2 containerd shims, e.g. containerd-shim-runc-v1. [cherry-pick release/1.2] Fix fd leak of shim log containerd/containerd#3273
• Fix a bug that a container with lingering processes can't terminate when it shares pid namespace with another container. docker cannot terminate a container when processes linger after TERM moby/moby#38978
• Fix a bug that containerd can't read shim logs after restart. [cherry-pick release/1.2] containerd-shim: redirect output into stdout fifo containerd/containerd#3282
• Fix a bug that shim_debug option is not honored for existing containerd shims after containerd restarts. [cherry-pick release/1.2] v1: Respect the shim_debug flag when load tasks containerd/containerd#3283
• cri: Fix a bug that a container can't be stopped when the exit event is not successfully published by the containerd shim. Cannot stop the container: stop timeout containerd/containerd#3125, Containers can't be stopped because TaskExit event failed to be published for runc.v2. containerd/containerd#3177
• cri: Fix a bug that exec process is not cleaned up if grpc context is canceled or timeout. contaienrd/cri#1159
• Fix a selinux keyring labeling issue by updating runc to v1.0.0-rc.8 and selinux library to v1.2.2. fix can't use empty str as label in some old kernels opencontainers/selinux#50
• Update ttrpc to f82148331ad2181edea8f3f649a1f7add6c3f9c2. [release/1.2] cherry-pick: Bump ttrpc containerd/containerd#3316
• Update cri to 49ca74043390bc2eeea7a45a46005fbec58a3f88. [release/1.2] Update cri to 49ca74043390bc2eeea7a45a46005fbec58a3f88 containerd/containerd#3330

[thaJeztah]

marked as "WIP" because upstream wasn't merged yet

[thaJeztah]

Rebased, because #194 was merged

[thaJeztah]

rebased again to trigger CI

[thaJeztah]

rebased (again) because CI results were purged (again 😞)

[kolyshkin]

LGTM

[kolyshkin]

[2019-09-24T19:24:05.764Z] === RUN   TestBuildWithHugeFile
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] ----------------------------------------------------------------------
[2019-09-24T19:24:52.405Z] FAIL: check_test.go:347: DockerSwarmSuite.TearDownTest
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] check_test.go:352:
[2019-09-24T19:24:52.405Z]     d.Stop(c)
[2019-09-24T19:24:52.405Z] /go/src/github.com/docker/docker/internal/test/daemon/daemon.go:414:
[2019-09-24T19:24:52.405Z]     t.Fatalf("Error while stopping the daemon %s : %v", d.id, err)
[2019-09-24T19:24:52.405Z] ... Error: Error while stopping the daemon d474da107fa40 : remove /go/src/github.com/docker/docker/bundles/test-integration/3/DockerSwarmSuite.TestAPISwarmLeaveOnPendingJoin/d474da107fa40/docker.pid: no such file or directory
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] ----------------------------------------------------------------------
[2019-09-24T19:24:52.405Z] PANIC: docker_api_swarm_test.go:432: DockerSwarmSuite.TestAPISwarmLeaveOnPendingJoin
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] Creating a new daemon at: /go/src/github.com/docker/docker/bundles/test-integration/3/DockerSwarmSuite.TestAPISwarmLeaveOnPendingJoin
[2019-09-24T19:24:52.405Z] [de1b69f6c1e27] waiting for daemon to start
[2019-09-24T19:24:52.405Z] [de1b69f6c1e27] daemon started
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] Creating a new daemon at: /go/src/github.com/docker/docker/bundles/test-integration/3/DockerSwarmSuite.TestAPISwarmLeaveOnPendingJoin
[2019-09-24T19:24:52.405Z] [d474da107fa40] waiting for daemon to start
[2019-09-24T19:24:52.405Z] [d474da107fa40] daemon started
[2019-09-24T19:24:52.405Z] 
[2019-09-24T19:24:52.405Z] waited for 156.299308ms (out of 30s)
[2019-09-24T19:24:52.405Z] [de1b69f6c1e27] exiting daemon
[2019-09-24T19:24:52.405Z] [d474da107fa40] daemon stop timeout
[2019-09-24T19:24:52.405Z] Attempt #2: daemon is still running with pid 14382
[2019-09-24T19:24:52.405Z] Attempt #3: daemon is still running with pid 14382
[2019-09-24T19:24:52.405Z] Attempt #4: daemon is still running with pid 14382
[2019-09-24T19:24:52.405Z] Attempt #5: daemon is still running with pid 14382
[2019-09-24T19:24:52.405Z] tried to interrupt daemon for 6 times, now try to kill it
[2019-09-24T19:24:52.405Z] ... Panic: Fixture has panicked (see related PANIC)