vendor c/common

Also update the e2e pull test to account for the changes when pulling
from the dir transport.  Images pulled via the dir transport are not
tagged anymore; the path is not a reliable source.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>

55 files changed, 618 insertions, 323 deletions

diff --git a/vendor/github.com/containers/common/libimage/copier.go b/vendor/github.com/containers/common/libimage/copier.go
index 4f5c7d0a1..459989579 100644
--- a/vendor/github.com/containers/common/libimage/copier.go
+++ b/vendor/github.com/containers/common/libimage/copier.go
@@ -218,15 +218,7 @@ func (r *Runtime) newCopier(options *CopyOptions) (*copier, error) {
 
 	c.systemContext.DockerArchiveAdditionalTags = options.dockerArchiveAdditionalTags
 
-	if options.Architecture != "" {
-		c.systemContext.ArchitectureChoice = options.Architecture
-	}
-	if options.OS != "" {
-		c.systemContext.OSChoice = options.OS
-	}
-	if options.Variant != "" {
-		c.systemContext.VariantChoice = options.Variant
-	}
+	c.systemContext.OSChoice, c.systemContext.ArchitectureChoice, c.systemContext.VariantChoice = NormalizePlatform(options.OS, options.Architecture, options.Variant)
 
 	if options.SignaturePolicyPath != "" {
 		c.systemContext.SignaturePolicyPath = options.SignaturePolicyPath
diff --git a/vendor/github.com/containers/common/libimage/filters.go b/vendor/github.com/containers/common/libimage/filters.go
index dfa34dd44..063f07149 100644
--- a/vendor/github.com/containers/common/libimage/filters.go
+++ b/vendor/github.com/containers/common/libimage/filters.go
@@ -19,26 +19,53 @@ import (
 // indicates that the image matches the criteria.
 type filterFunc func(*Image) (bool, error)
 
+// Apply the specified filters.  At least one filter of each key must apply.
+func (i *Image) applyFilters(filters map[string][]filterFunc) (bool, error) {
+	matches := false
+	for key := range filters { // and
+		matches = false
+		for _, filter := range filters[key] { // or
+			var err error
+			matches, err = filter(i)
+			if err != nil {
+				// Some images may have been corrupted in the
+				// meantime, so do an extra check and make the
+				// error non-fatal (see containers/podman/issues/12582).
+				if errCorrupted := i.isCorrupted(""); errCorrupted != nil {
+					logrus.Errorf(errCorrupted.Error())
+					return false, nil
+				}
+				return false, err
+			}
+			if matches {
+				break
+			}
+		}
+		if !matches {
+			return false, nil
+		}
+	}
+	return matches, nil
+}
+
 // filterImages returns a slice of images which are passing all specified
 // filters.
-func filterImages(images []*Image, filters []filterFunc) ([]*Image, error) {
-	if len(filters) == 0 {
+func (r *Runtime) filterImages(ctx context.Context, images []*Image, options *ListImagesOptions) ([]*Image, error) {
+	if len(options.Filters) == 0 || len(images) == 0 {
 		return images, nil
 	}
+
+	filters, err := r.compileImageFilters(ctx, options)
+	if err != nil {
+		return nil, err
+	}
 	result := []*Image{}
 	for i := range images {
-		include := true
-		var err error
-		for _, filter := range filters {
-			include, err = filter(images[i])
-			if err != nil {
-				return nil, err
-			}
-			if !include {
-				break
-			}
+		match, err := images[i].applyFilters(filters)
+		if err != nil {
+			return nil, err
 		}
-		if include {
+		if match {
 			result = append(result, images[i])
 		}
 	}
@@ -48,7 +75,7 @@ func filterImages(images []*Image, filters []filterFunc) ([]*Image, error) {
 // compileImageFilters creates `filterFunc`s for the specified filters.  The
 // required format is `key=value` with the following supported keys:
 //           after, since, before, containers, dangling, id, label, readonly, reference, intermediate
-func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOptions) ([]filterFunc, error) {
+func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOptions) (map[string][]filterFunc, error) {
 	logrus.Tracef("Parsing image filters %s", options.Filters)
 
 	var tree *layerTree
@@ -63,12 +90,14 @@ func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOp
 		return tree, nil
 	}
 
-	filterFuncs := []filterFunc{}
-	for _, filter := range options.Filters {
+	filters := map[string][]filterFunc{}
+	duplicate := map[string]string{}
+	for _, f := range options.Filters {
 		var key, value string
-		split := strings.SplitN(filter, "=", 2)
+		var filter filterFunc
+		split := strings.SplitN(f, "=", 2)
 		if len(split) != 2 {
-			return nil, errors.Errorf("invalid image filter %q: must be in the format %q", filter, "filter=value")
+			return nil, errors.Errorf("invalid image filter %q: must be in the format %q", f, "filter=value")
 		}
 
 		key = split[0]
@@ -76,87 +105,148 @@ func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOp
 		switch key {
 
 		case "after", "since":
-			img, _, err := r.LookupImage(value, nil)
+			img, err := r.time(key, value)
 			if err != nil {
-				return nil, errors.Wrapf(err, "could not find local image for filter %q", filter)
+				return nil, err
 			}
-			filterFuncs = append(filterFuncs, filterAfter(img.Created()))
+			key = "since"
+			filter = filterAfter(img.Created())
 
 		case "before":
-			img, _, err := r.LookupImage(value, nil)
+			img, err := r.time(key, value)
 			if err != nil {
-				return nil, errors.Wrapf(err, "could not find local image for filter %q", filter)
+				return nil, err
 			}
-			filterFuncs = append(filterFuncs, filterBefore(img.Created()))
+			filter = filterBefore(img.Created())
 
 		case "containers":
-			switch value {
-			case "false", "true":
-			case "external":
-				if options.IsExternalContainerFunc == nil {
-					return nil, fmt.Errorf("libimage error: external containers filter without callback")
-				}
-			default:
-				return nil, fmt.Errorf("unsupported value %q for containers filter", value)
+			if err := r.containers(duplicate, key, value, options.IsExternalContainerFunc); err != nil {
+				return nil, err
 			}
-			filterFuncs = append(filterFuncs, filterContainers(value, options.IsExternalContainerFunc))
+			filter = filterContainers(value, options.IsExternalContainerFunc)
 
 		case "dangling":
-			dangling, err := strconv.ParseBool(value)
+			dangling, err := r.bool(duplicate, key, value)
 			if err != nil {
-				return nil, errors.Wrapf(err, "non-boolean value %q for dangling filter", value)
+				return nil, err
 			}
 			t, err := getTree()
 			if err != nil {
 				return nil, err
 			}
-			filterFuncs = append(filterFuncs, filterDangling(ctx, dangling, t))
+
+			filter = filterDangling(ctx, dangling, t)
 
 		case "id":
-			filterFuncs = append(filterFuncs, filterID(value))
+			filter = filterID(value)
 
 		case "intermediate":
-			intermediate, err := strconv.ParseBool(value)
+			intermediate, err := r.bool(duplicate, key, value)
 			if err != nil {
-				return nil, errors.Wrapf(err, "non-boolean value %q for intermediate filter", value)
+				return nil, err
 			}
 			t, err := getTree()
 			if err != nil {
 				return nil, err
 			}
-			filterFuncs = append(filterFuncs, filterIntermediate(ctx, intermediate, t))
+
+			filter = filterIntermediate(ctx, intermediate, t)
 
 		case "label":
-			filterFuncs = append(filterFuncs, filterLabel(ctx, value))
+			filter = filterLabel(ctx, value)
 
 		case "readonly":
-			readOnly, err := strconv.ParseBool(value)
+			readOnly, err := r.bool(duplicate, key, value)
 			if err != nil {
-				return nil, errors.Wrapf(err, "non-boolean value %q for readonly filter", value)
+				return nil, err
 			}
-			filterFuncs = append(filterFuncs, filterReadOnly(readOnly))
-
-		case "reference":
-			filterFuncs = append(filterFuncs, filterReferences(value))
+			filter = filterReadOnly(readOnly)
 
-		case "until":
-			ts, err := timetype.GetTimestamp(value, time.Now())
+		case "manifest":
+			manifest, err := r.bool(duplicate, key, value)
 			if err != nil {
 				return nil, err
 			}
-			seconds, nanoseconds, err := timetype.ParseTimestamps(ts, 0)
+			filter = filterManifest(ctx, manifest)
+
+		case "reference":
+			filter = filterReferences(value)
+
+		case "until":
+			until, err := r.until(value)
 			if err != nil {
 				return nil, err
 			}
-			until := time.Unix(seconds, nanoseconds)
-			filterFuncs = append(filterFuncs, filterBefore(until))
+			filter = filterBefore(until)
 
 		default:
 			return nil, errors.Errorf("unsupported image filter %q", key)
 		}
+		filters[key] = append(filters[key], filter)
+	}
+
+	return filters, nil
+}
+
+func (r *Runtime) containers(duplicate map[string]string, key, value string, externalFunc IsExternalContainerFunc) error {
+	if exists, ok := duplicate[key]; ok && exists != value {
+		return errors.Errorf("specifying %q filter more than once with different values is not supported", key)
+	}
+	duplicate[key] = value
+	switch value {
+	case "false", "true":
+	case "external":
+		if externalFunc == nil {
+			return fmt.Errorf("libimage error: external containers filter without callback")
+		}
+	default:
+		return fmt.Errorf("unsupported value %q for containers filter", value)
+	}
+	return nil
+}
+
+func (r *Runtime) until(value string) (time.Time, error) {
+	var until time.Time
+	ts, err := timetype.GetTimestamp(value, time.Now())
+	if err != nil {
+		return until, err
 	}
+	seconds, nanoseconds, err := timetype.ParseTimestamps(ts, 0)
+	if err != nil {
+		return until, err
+	}
+	return time.Unix(seconds, nanoseconds), nil
+}
+
+func (r *Runtime) time(key, value string) (*Image, error) {
+	img, _, err := r.LookupImage(value, nil)
+	if err != nil {
+		return nil, errors.Wrapf(err, "could not find local image for filter filter %q=%q", key, value)
+	}
+	return img, nil
+}
+
+func (r *Runtime) bool(duplicate map[string]string, key, value string) (bool, error) {
+	if exists, ok := duplicate[key]; ok && exists != value {
+		return false, errors.Errorf("specifying %q filter more than once with different values is not supported", key)
+	}
+	duplicate[key] = value
+	set, err := strconv.ParseBool(value)
+	if err != nil {
+		return false, errors.Wrapf(err, "non-boolean value %q for %s filter", key, value)
+	}
+	return set, nil
+}
 
-	return filterFuncs, nil
+// filterManifest filters whether or not the image is a manifest list
+func filterManifest(ctx context.Context, value bool) filterFunc {
+	return func(img *Image) (bool, error) {
+		isManifestList, err := img.IsManifestList(ctx)
+		if err != nil {
+			return false, err
+		}
+		return isManifestList == value, nil
+	}
 }
 
 // filterReferences creates a reference filter for matching the specified value.
diff --git a/vendor/github.com/containers/common/libimage/load.go b/vendor/github.com/containers/common/libimage/load.go
index 74a1870e0..4dfac7106 100644
--- a/vendor/github.com/containers/common/libimage/load.go
+++ b/vendor/github.com/containers/common/libimage/load.go
@@ -35,17 +35,6 @@ func (r *Runtime) Load(ctx context.Context, path string, options *LoadOptions) (
 	var loadErrors []error
 
 	for _, f := range []func() ([]string, string, error){
-		// DOCKER-ARCHIVE - must be first (see containers/podman/issues/10809)
-		func() ([]string, string, error) {
-			logrus.Debugf("-> Attempting to load %q as a Docker archive", path)
-			ref, err := dockerArchiveTransport.ParseReference(path)
-			if err != nil {
-				return nil, dockerArchiveTransport.Transport.Name(), err
-			}
-			images, err := r.loadMultiImageDockerArchive(ctx, ref, &options.CopyOptions)
-			return images, dockerArchiveTransport.Transport.Name(), err
-		},
-
 		// OCI
 		func() ([]string, string, error) {
 			logrus.Debugf("-> Attempting to load %q as an OCI directory", path)
@@ -68,6 +57,17 @@ func (r *Runtime) Load(ctx context.Context, path string, options *LoadOptions) (
 			return images, ociArchiveTransport.Transport.Name(), err
 		},
 
+		// DOCKER-ARCHIVE
+		func() ([]string, string, error) {
+			logrus.Debugf("-> Attempting to load %q as a Docker archive", path)
+			ref, err := dockerArchiveTransport.ParseReference(path)
+			if err != nil {
+				return nil, dockerArchiveTransport.Transport.Name(), err
+			}
+			images, err := r.loadMultiImageDockerArchive(ctx, ref, &options.CopyOptions)
+			return images, dockerArchiveTransport.Transport.Name(), err
+		},
+
 		// DIR
 		func() ([]string, string, error) {
 			logrus.Debugf("-> Attempting to load %q as a Docker dir", path)
diff --git a/vendor/github.com/containers/common/libimage/normalize.go b/vendor/github.com/containers/common/libimage/normalize.go
index bfea807c8..7ceb62830 100644
--- a/vendor/github.com/containers/common/libimage/normalize.go
+++ b/vendor/github.com/containers/common/libimage/normalize.go
@@ -1,13 +1,51 @@
 package libimage
 
 import (
+	"runtime"
 	"strings"
 
+	"github.com/containerd/containerd/platforms"
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
 
+// NormalizePlatform normalizes (according to the OCI spec) the specified os,
+// arch and variant.  If left empty, the individual item will not be normalized.
+func NormalizePlatform(rawOS, rawArch, rawVariant string) (os, arch, variant string) {
+	os, arch, variant = rawOS, rawArch, rawVariant
+	if os == "" {
+		os = runtime.GOOS
+	}
+	if arch == "" {
+		arch = runtime.GOARCH
+	}
+	rawPlatform := os + "/" + arch
+	if variant != "" {
+		rawPlatform += "/" + variant
+	}
+
+	normalizedPlatform, err := platforms.Parse(rawPlatform)
+	if err != nil {
+		logrus.Debugf("Error normalizing platform: %v", err)
+		return rawOS, rawArch, rawVariant
+	}
+	logrus.Debugf("Normalized platform %s to %s", rawPlatform, normalizedPlatform)
+	os = rawOS
+	if rawOS != "" {
+		os = normalizedPlatform.OS
+	}
+	arch = rawArch
+	if rawArch != "" {
+		arch = normalizedPlatform.Architecture
+	}
+	variant = rawVariant
+	if rawVariant != "" {
+		variant = normalizedPlatform.Variant
+	}
+	return os, arch, variant
+}
+
 // NormalizeName normalizes the provided name according to the conventions by
 // Podman and Buildah.  If tag and digest are missing, the "latest" tag will be
 // used.  If it's a short name, it will be prefixed with "localhost/".
diff --git a/vendor/github.com/containers/common/libimage/pull.go b/vendor/github.com/containers/common/libimage/pull.go
index 59221d935..84ce107ee 100644
--- a/vendor/github.com/containers/common/libimage/pull.go
+++ b/vendor/github.com/containers/common/libimage/pull.go
@@ -21,6 +21,7 @@ import (
 	"github.com/containers/image/v5/types"
 	"github.com/containers/storage"
 	digest "github.com/opencontainers/go-digest"
+	ociSpec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
 )
@@ -169,6 +170,20 @@ func (r *Runtime) Pull(ctx context.Context, name string, pullPolicy config.PullP
 	return localImages, pullError
 }
 
+// nameFromAnnotations returns a reference string to be used as an image name,
+// or an empty string.  The annotations map may be nil.
+func nameFromAnnotations(annotations map[string]string) string {
+	if annotations == nil {
+		return ""
+	}
+	// buildkit/containerd are using a custom annotation see
+	// containers/podman/issues/12560.
+	if annotations["io.containerd.image.name"] != "" {
+		return annotations["io.containerd.image.name"]
+	}
+	return annotations[ociSpec.AnnotationRefName]
+}
+
 // copyFromDefault is the default copier for a number of transports.  Other
 // transports require some specific dancing, sometimes Yoga.
 func (r *Runtime) copyFromDefault(ctx context.Context, ref types.ImageReference, options *CopyOptions) ([]string, error) {
@@ -201,15 +216,16 @@ func (r *Runtime) copyFromDefault(ctx context.Context, ref types.ImageReference,
 		if err != nil {
 			return nil, err
 		}
-		// if index.json has no reference name, compute the image ID instead
-		if manifestDescriptor.Annotations == nil || manifestDescriptor.Annotations["org.opencontainers.image.ref.name"] == "" {
+		storageName = nameFromAnnotations(manifestDescriptor.Annotations)
+		switch len(storageName) {
+		case 0:
+			// If there's no reference name in the annotations, compute an ID.
 			storageName, err = getImageID(ctx, ref, nil)
 			if err != nil {
 				return nil, err
 			}
 			imageName = "sha256:" + storageName[1:]
-		} else {
-			storageName = manifestDescriptor.Annotations["org.opencontainers.image.ref.name"]
+		default:
 			named, err := NormalizeName(storageName)
 			if err != nil {
 				return nil, err
@@ -227,8 +243,14 @@ func (r *Runtime) copyFromDefault(ctx context.Context, ref types.ImageReference,
 		imageName = named.String()
 
 	default:
-		storageName = toLocalImageName(ref.StringWithinTransport())
-		imageName = storageName
+		// Path-based transports (e.g., dir) may include invalid
+		// characters, so we should pessimistically generate an ID
+		// instead of looking at the StringWithinTransport().
+		storageName, err = getImageID(ctx, ref, nil)
+		if err != nil {
+			return nil, err
+		}
+		imageName = "sha256:" + storageName[1:]
 	}
 
 	// Create a storage reference.
diff --git a/vendor/github.com/containers/common/libimage/runtime.go b/vendor/github.com/containers/common/libimage/runtime.go
index c0eee4212..86e7eee56 100644
--- a/vendor/github.com/containers/common/libimage/runtime.go
+++ b/vendor/github.com/containers/common/libimage/runtime.go
@@ -253,6 +253,8 @@ func (r *Runtime) LookupImage(name string, options *LookupImageOptions) (*Image,
 	if options.Variant == "" {
 		options.Variant = r.systemContext.VariantChoice
 	}
+	// Normalize platform to be OCI compatible (e.g., "aarch64" -> "arm64").
+	options.OS, options.Architecture, options.Variant = NormalizePlatform(options.OS, options.Architecture, options.Variant)
 
 	// First, check if we have an exact match in the storage. Maybe an ID
 	// or a fully-qualified image name.
@@ -404,9 +406,15 @@ func (r *Runtime) lookupImageInDigestsAndRepoTags(name string, options *LookupIm
 		digest := digested.Digest()
 		for _, image := range allImages {
 			for _, d := range image.Digests() {
-				if d == digest {
-					return image, name, nil
+				if d != digest {
+					continue
+				}
+				// Also make sure that the matching image fits all criteria (e.g., manifest list).
+				if _, err := r.lookupImageInLocalStorage(name, image.ID(), options); err != nil {
+					return nil, "", err
 				}
+				return image, name, nil
+
 			}
 		}
 		return nil, "", errors.Wrap(storage.ErrImageUnknown, name)
@@ -489,13 +497,16 @@ func (r *Runtime) imageReferenceMatchesContext(ref types.ImageReference, options
 	}
 
 	if options.Architecture != "" && options.Architecture != data.Architecture {
-		return false, err
+		logrus.Debugf("architecture %q does not match architecture %q of image %s", options.Architecture, data.Architecture, ref)
+		return false, nil
 	}
 	if options.OS != "" && options.OS != data.Os {
-		return false, err
+		logrus.Debugf("OS %q does not match OS %q of image %s", options.OS, data.Os, ref)
+		return false, nil
 	}
 	if options.Variant != "" && options.Variant != data.Variant {
-		return false, err
+		logrus.Debugf("variant %q does not match variant %q of image %s", options.Variant, data.Variant, ref)
+		return false, nil
 	}
 
 	return true, nil
@@ -551,16 +562,7 @@ func (r *Runtime) ListImages(ctx context.Context, names []string, options *ListI
 		}
 	}
 
-	var filters []filterFunc
-	if len(options.Filters) > 0 {
-		compiledFilters, err := r.compileImageFilters(ctx, options)
-		if err != nil {
-			return nil, err
-		}
-		filters = append(filters, compiledFilters...)
-	}
-
-	return filterImages(images, filters)
+	return r.filterImages(ctx, images, options)
 }
 
 // RemoveImagesOptions allow for customizing image removal.
diff --git a/vendor/github.com/containers/common/pkg/cgroups/cgroups.go b/vendor/github.com/containers/common/pkg/cgroups/cgroups.go
index d0bcd8bfd..0bf275f38 100644
--- a/vendor/github.com/containers/common/pkg/cgroups/cgroups.go
+++ b/vendor/github.com/containers/common/pkg/cgroups/cgroups.go
@@ -365,6 +365,29 @@ func readFileAsUint64(path string) (uint64, error) {
 	return ret, nil
 }
 
+func readFileByKeyAsUint64(path, key string) (uint64, error) {
+	content, err := ioutil.ReadFile(path)
+	if err != nil {
+		return 0, err
+	}
+	for _, line := range strings.Split(string(content), "\n") {
+		fields := strings.SplitN(line, " ", 2)
+		if fields[0] == key {
+			v := cleanString(string(fields[1]))
+			if v == "max" {
+				return math.MaxUint64, nil
+			}
+			ret, err := strconv.ParseUint(v, 10, 64)
+			if err != nil {
+				return ret, errors.Wrapf(err, "parse %s from %s", v, path)
+			}
+			return ret, nil
+		}
+	}
+
+	return 0, fmt.Errorf("no key named %s from %s", key, path)
+}
+
 // New creates a new cgroup control
 func New(path string, resources *spec.LinuxResources) (*CgroupControl, error) {
 	cgroup2, err := IsCgroup2UnifiedMode()
@@ -509,32 +532,6 @@ func (c *CgroupControl) Delete() error {
 	return c.DeleteByPath(c.path)
 }
 
-// rmDirRecursively delete recursively a cgroup directory.
-// It differs from os.RemoveAll as it doesn't attempt to unlink files.
-// On cgroupfs we are allowed only to rmdir empty directories.
-func rmDirRecursively(path string) error {
-	if err := os.Remove(path); err == nil || os.IsNotExist(err) {
-		return nil
-	}
-	entries, err := ioutil.ReadDir(path)
-	if err != nil {
-		return err
-	}
-	for _, i := range entries {
-		if i.IsDir() {
-			if err := rmDirRecursively(filepath.Join(path, i.Name())); err != nil {
-				return err
-			}
-		}
-	}
-	if err := os.Remove(path); err != nil {
-		if !os.IsNotExist(err) {
-			return errors.Wrapf(err, "remove %s", path)
-		}
-	}
-	return nil
-}
-
 // DeleteByPathConn deletes the specified cgroup path using the specified
 // dbus connection if needed.
 func (c *CgroupControl) DeleteByPathConn(path string, conn *systemdDbus.Conn) error {
diff --git a/vendor/github.com/containers/common/pkg/cgroups/cgroups_supported.go b/vendor/github.com/containers/common/pkg/cgroups/cgroups_supported.go
index fe17db7f7..c1fe194b2 100644
--- a/vendor/github.com/containers/common/pkg/cgroups/cgroups_supported.go
+++ b/vendor/github.com/containers/common/pkg/cgroups/cgroups_supported.go
@@ -5,11 +5,13 @@ package cgroups
 import (
 	"bufio"
 	"fmt"
+	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"syscall"
+	"time"
 
 	"github.com/pkg/errors"
 	"golang.org/x/sys/unix"
@@ -88,3 +90,40 @@ func UserOwnsCurrentSystemdCgroup() (bool, error) {
 	}
 	return true, nil
 }
+
+// rmDirRecursively delete recursively a cgroup directory.
+// It differs from os.RemoveAll as it doesn't attempt to unlink files.
+// On cgroupfs we are allowed only to rmdir empty directories.
+func rmDirRecursively(path string) error {
+	if err := os.Remove(path); err == nil || os.IsNotExist(err) {
+		return nil
+	}
+	entries, err := ioutil.ReadDir(path)
+	if err != nil {
+		return err
+	}
+	for _, i := range entries {
+		if i.IsDir() {
+			if err := rmDirRecursively(filepath.Join(path, i.Name())); err != nil {
+				return err
+			}
+		}
+	}
+
+	attempts := 0
+	for {
+		err := os.Remove(path)
+		if err == nil || os.IsNotExist(err) {
+			return nil
+		}
+		if errors.Is(err, unix.EBUSY) {
+			// attempt up to 5 seconds if the cgroup is busy
+			if attempts < 500 {
+				time.Sleep(time.Millisecond * 10)
+				attempts++
+				continue
+			}
+		}
+		return errors.Wrapf(err, "remove %s", path)
+	}
+}
diff --git a/vendor/github.com/containers/common/pkg/cgroups/cgroups_unsupported.go b/vendor/github.com/containers/common/pkg/cgroups/cgroups_unsupported.go
index cd140fbf3..95d424170 100644
--- a/vendor/github.com/containers/common/pkg/cgroups/cgroups_unsupported.go
+++ b/vendor/github.com/containers/common/pkg/cgroups/cgroups_unsupported.go
@@ -2,6 +2,10 @@
 
 package cgroups
 
+import (
+	"os"
+)
+
 // IsCgroup2UnifiedMode returns whether we are running in cgroup 2 cgroup2 mode.
 func IsCgroup2UnifiedMode() (bool, error) {
 	return false, nil
@@ -12,3 +16,7 @@ func IsCgroup2UnifiedMode() (bool, error) {
 func UserOwnsCurrentSystemdCgroup() (bool, error) {
 	return false, nil
 }
+
+func rmDirRecursively(path string) error {
+	return os.RemoveAll(path)
+}
diff --git a/vendor/github.com/containers/common/pkg/cgroups/memory.go b/vendor/github.com/containers/common/pkg/cgroups/memory.go
index b3991f7e3..10d65893c 100644
--- a/vendor/github.com/containers/common/pkg/cgroups/memory.go
+++ b/vendor/github.com/containers/common/pkg/cgroups/memory.go
@@ -7,8 +7,7 @@ import (
 	spec "github.com/opencontainers/runtime-spec/specs-go"
 )
 
-type memHandler struct {
-}
+type memHandler struct{}
 
 func getMemoryHandler() *memHandler {
 	return &memHandler{}
@@ -41,22 +40,23 @@ func (c *memHandler) Stat(ctr *CgroupControl, m *Metrics) error {
 	usage := MemoryUsage{}
 
 	var memoryRoot string
-	filenames := map[string]string{}
+	var limitFilename string
 
 	if ctr.cgroup2 {
 		memoryRoot = filepath.Join(cgroupRoot, ctr.path)
-		filenames["usage"] = "memory.current"
-		filenames["limit"] = "memory.max"
+		limitFilename = "memory.max"
+		if usage.Usage, err = readFileByKeyAsUint64(filepath.Join(memoryRoot, "memory.stat"), "anon"); err != nil {
+			return err
+		}
 	} else {
 		memoryRoot = ctr.getCgroupv1Path(Memory)
-		filenames["usage"] = "memory.usage_in_bytes"
-		filenames["limit"] = "memory.limit_in_bytes"
+		limitFilename = "memory.limit_in_bytes"
+		if usage.Usage, err = readFileAsUint64(filepath.Join(memoryRoot, "memory.usage_in_bytes")); err != nil {
+			return err
+		}
 	}
-	usage.Usage, err = readFileAsUint64(filepath.Join(memoryRoot, filenames["usage"]))
-	if err != nil {
-		return err
-	}
-	usage.Limit, err = readFileAsUint64(filepath.Join(memoryRoot, filenames["limit"]))
+
+	usage.Limit, err = readFileAsUint64(filepath.Join(memoryRoot, limitFilename))
 	if err != nil {
 		return err
 	}
diff --git a/vendor/github.com/containers/common/pkg/cgroups/pids.go b/vendor/github.com/containers/common/pkg/cgroups/pids.go
index b2bfebe4d..58cb32b3b 100644
--- a/vendor/github.com/containers/common/pkg/cgroups/pids.go
+++ b/vendor/github.com/containers/common/pkg/cgroups/pids.go
@@ -34,6 +34,9 @@ func (c *pidHandler) Apply(ctr *CgroupControl, res *spec.LinuxResources) error {
 
 // Create the cgroup
 func (c *pidHandler) Create(ctr *CgroupControl) (bool, error) {
+	if ctr.cgroup2 {
+		return false, nil
+	}
 	return ctr.createCgroupDirectory(Pids)
 }
 
diff --git a/vendor/github.com/containers/common/pkg/config/config.go b/vendor/github.com/containers/common/pkg/config/config.go
index f419601e9..7f89b9252 100644
--- a/vendor/github.com/containers/common/pkg/config/config.go
+++ b/vendor/github.com/containers/common/pkg/config/config.go
@@ -48,6 +48,18 @@ const (
 	BoltDBStateStore RuntimeStateStore = iota
 )
 
+// ProxyEnv is a list of Proxy Environment variables
+var ProxyEnv = []string{
+	"http_proxy",
+	"https_proxy",
+	"ftp_proxy",
+	"no_proxy",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"FTP_PROXY",
+	"NO_PROXY",
+}
+
 // Config contains configuration options for container tools
 type Config struct {
 	// Containers specify settings that configure how containers will run ont the system
@@ -897,8 +909,7 @@ func (c *Config) GetDefaultEnvEx(envHost, httpProxy bool) []string {
 	if envHost {
 		env = append(env, os.Environ()...)
 	} else if httpProxy {
-		proxy := []string{"http_proxy", "https_proxy", "ftp_proxy", "no_proxy", "HTTP_PROXY", "HTTPS_PROXY", "FTP_PROXY", "NO_PROXY"}
-		for _, p := range proxy {
+		for _, p := range ProxyEnv {
 			if val, ok := os.LookupEnv(p); ok {
 				env = append(env, fmt.Sprintf("%s=%s", p, val))
 			}
diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go
index cd7fea4a1..561158b12 100644
--- a/vendor/github.com/containers/common/pkg/config/default.go
+++ b/vendor/github.com/containers/common/pkg/config/default.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/containers/common/pkg/apparmor"
 	"github.com/containers/common/pkg/cgroupv2"
+	"github.com/containers/common/pkg/util"
 	"github.com/containers/storage/pkg/homedir"
 	"github.com/containers/storage/pkg/unshare"
 	"github.com/containers/storage/types"
@@ -202,7 +203,6 @@ func DefaultConfig() (*Config, error) {
 			UserNSSize:         DefaultUserNSSize,
 		},
 		Network: NetworkConfig{
-			NetworkBackend:   "cni",
 			DefaultNetwork:   "podman",
 			DefaultSubnet:    DefaultSubnet,
 			NetworkConfigDir: cniConfig,
@@ -371,7 +371,7 @@ func defaultTmpDir() (string, error) {
 		return "/run/libpod", nil
 	}
 
-	runtimeDir, err := getRuntimeDir()
+	runtimeDir, err := util.GetRuntimeDir()
 	if err != nil {
 		return "", err
 	}
diff --git a/vendor/github.com/containers/common/pkg/seccomp/errno_list.go b/vendor/github.com/containers/common/pkg/seccomp/errno_list.go
index 55b92ecc8..a1009012d 100644
--- a/vendor/github.com/containers/common/pkg/seccomp/errno_list.go
+++ b/vendor/github.com/containers/common/pkg/seccomp/errno_list.go
@@ -1,3 +1,5 @@
+// +build linux,seccomp
+
 package seccomp
 
 import (
diff --git a/vendor/github.com/containers/common/pkg/util/util.go b/vendor/github.com/containers/common/pkg/util/util.go
new file mode 100644
index 000000000..98890a686
--- /dev/null
+++ b/vendor/github.com/containers/common/pkg/util/util.go
@@ -0,0 +1,24 @@
+package util
+
+import "regexp"
+
+// StringInSlice determines if a string is in a string slice, returns bool
+func StringInSlice(s string, sl []string) bool {
+	for _, i := range sl {
+		if i == s {
+			return true
+		}
+	}
+	return false
+}
+
+// StringMatchRegexSlice determines if a given string matches one of the given regexes, returns bool
+func StringMatchRegexSlice(s string, re []string) bool {
+	for _, r := range re {
+		m, err := regexp.MatchString(r, s)
+		if err == nil && m {
+			return true
+		}
+	}
+	return false
+}
diff --git a/vendor/github.com/containers/common/pkg/config/util_supported.go b/vendor/github.com/containers/common/pkg/util/util_supported.go
index 33e4a9e8f..422e28742 100644
--- a/vendor/github.com/containers/common/pkg/config/util_supported.go
+++ b/vendor/github.com/containers/common/pkg/util/util_supported.go
@@ -1,6 +1,6 @@
 // +build linux darwin
 
-package config
+package util
 
 import (
 	"fmt"
@@ -19,8 +19,8 @@ var (
 	rootlessRuntimeDir     string
 )
 
-// getRuntimeDir returns the runtime directory
-func getRuntimeDir() (string, error) {
+// GetRuntimeDir returns the runtime directory
+func GetRuntimeDir() (string, error) {
 	var rootlessRuntimeDirError error
 
 	rootlessRuntimeDirOnce.Do(func() {
diff --git a/vendor/github.com/containers/common/pkg/config/util_windows.go b/vendor/github.com/containers/common/pkg/util/util_windows.go
index 995301f5d..2add712f1 100644
--- a/vendor/github.com/containers/common/pkg/config/util_windows.go
+++ b/vendor/github.com/containers/common/pkg/util/util_windows.go
@@ -1,12 +1,12 @@
 // +build windows
 
-package config
+package util
 
 import (
 	"github.com/pkg/errors"
 )
 
 // getRuntimeDir returns the runtime directory
-func getRuntimeDir() (string, error) {
+func GetRuntimeDir() (string, error) {
 	return "", errors.New("this function is not implemented for windows")
 }
diff --git a/vendor/github.com/containers/image/v5/copy/copy.go b/vendor/github.com/containers/image/v5/copy/copy.go
index 8b785668f..383215182 100644
--- a/vendor/github.com/containers/image/v5/copy/copy.go
+++ b/vendor/github.com/containers/image/v5/copy/copy.go
@@ -1073,20 +1073,15 @@ func (c *copier) newProgressPool() *mpb.Progress {
 	return mpb.New(mpb.WithWidth(40), mpb.WithOutput(c.progressOutput))
 }
 
-// customPartialBlobCounter provides a decorator function for the partial blobs retrieval progress bar
-func customPartialBlobCounter(filler interface{}, wcc ...decor.WC) decor.Decorator {
-	producer := func(filler interface{}) decor.DecorFunc {
-		return func(s decor.Statistics) string {
-			if s.Total == 0 {
-				pairFmt := "%.1f / %.1f (skipped: %.1f)"
-				return fmt.Sprintf(pairFmt, decor.SizeB1024(s.Current), decor.SizeB1024(s.Total), decor.SizeB1024(s.Refill))
-			}
-			pairFmt := "%.1f / %.1f (skipped: %.1f = %.2f%%)"
-			percentage := 100.0 * float64(s.Refill) / float64(s.Total)
-			return fmt.Sprintf(pairFmt, decor.SizeB1024(s.Current), decor.SizeB1024(s.Total), decor.SizeB1024(s.Refill), percentage)
-		}
-	}
-	return decor.Any(producer(filler), wcc...)
+// customPartialBlobDecorFunc implements mpb.DecorFunc for the partial blobs retrieval progress bar
+func customPartialBlobDecorFunc(s decor.Statistics) string {
+	if s.Total == 0 {
+		pairFmt := "%.1f / %.1f (skipped: %.1f)"
+		return fmt.Sprintf(pairFmt, decor.SizeB1024(s.Current), decor.SizeB1024(s.Total), decor.SizeB1024(s.Refill))
+	}
+	pairFmt := "%.1f / %.1f (skipped: %.1f = %.2f%%)"
+	percentage := 100.0 * float64(s.Refill) / float64(s.Total)
+	return fmt.Sprintf(pairFmt, decor.SizeB1024(s.Current), decor.SizeB1024(s.Total), decor.SizeB1024(s.Refill), percentage)
 }
 
 // createProgressBar creates a mpb.Bar in pool.  Note that if the copier's reportWriter
@@ -1111,7 +1106,6 @@ func (c *copier) createProgressBar(pool *mpb.Progress, partial bool, info types.
 	// Use a normal progress bar when we know the size (i.e., size > 0).
 	// Otherwise, use a spinner to indicate that something's happening.
 	var bar *mpb.Bar
-	sstyle := mpb.SpinnerStyle(".", "..", "...", "....", "").PositionLeft()
 	if info.Size > 0 {
 		if partial {
 			bar = pool.AddBar(info.Size,
@@ -1120,7 +1114,7 @@ func (c *copier) createProgressBar(pool *mpb.Progress, partial bool, info types.
 					decor.OnComplete(decor.Name(prefix), onComplete),
 				),
 				mpb.AppendDecorators(
-					customPartialBlobCounter(sstyle.Build()),
+					decor.Any(customPartialBlobDecorFunc),
 				),
 			)
 		} else {
@@ -1135,8 +1129,8 @@ func (c *copier) createProgressBar(pool *mpb.Progress, partial bool, info types.
 			)
 		}
 	} else {
-		bar = pool.Add(0,
-			sstyle.Build(),
+		bar = pool.New(0,
+			mpb.SpinnerStyle(".", "..", "...", "....", "").PositionLeft(),
 			mpb.BarFillerClearOnComplete(),
 			mpb.PrependDecorators(
 				decor.OnComplete(decor.Name(prefix), onComplete),
diff --git a/vendor/github.com/containers/image/v5/docker/docker_client.go b/vendor/github.com/containers/image/v5/docker/docker_client.go
index 3fe9a11d0..833323b42 100644
--- a/vendor/github.com/containers/image/v5/docker/docker_client.go
+++ b/vendor/github.com/containers/image/v5/docker/docker_client.go
@@ -711,7 +711,7 @@ func (c *dockerClient) getBearerToken(ctx context.Context, challenge challenge,
 		return nil, err
 	}
 	defer res.Body.Close()
-	if err := httpResponseToError(res, "Requesting bear token"); err != nil {
+	if err := httpResponseToError(res, "Requesting bearer token"); err != nil {
 		return nil, err
 	}
 	tokenBlob, err := iolimits.ReadAtMost(res.Body, iolimits.MaxAuthTokenBodySize)
diff --git a/vendor/github.com/containers/image/v5/pkg/docker/config/config.go b/vendor/github.com/containers/image/v5/pkg/docker/config/config.go
index 76362a66e..8fa530549 100644
--- a/vendor/github.com/containers/image/v5/pkg/docker/config/config.go
+++ b/vendor/github.com/containers/image/v5/pkg/docker/config/config.go
@@ -190,14 +190,12 @@ func GetAllCredentials(sys *types.SystemContext) (map[string]types.DockerAuthCon
 	for key := range allKeys {
 		authConf, err := GetCredentials(sys, key)
 		if err != nil {
-			if credentials.IsErrCredentialsNotFoundMessage(err.Error()) {
-				// Ignore if the credentials could not be found (anymore).
-				continue
-			}
 			// Note: we rely on the logging in `GetCredentials`.
 			return nil, err
 		}
-		authConfigs[key] = authConf
+		if authConf != (types.DockerAuthConfig{}) {
+			authConfigs[key] = authConf
+		}
 	}
 
 	return authConfigs, nil
@@ -285,7 +283,7 @@ func getCredentialsWithHomeDir(sys *types.SystemContext, key, homeDir string) (t
 				return types.DockerAuthConfig{}, "", err
 			}
 
-			if (authConfig.Username != "" && authConfig.Password != "") || authConfig.IdentityToken != "" {
+			if authConfig != (types.DockerAuthConfig{}) {
 				return authConfig, path.path, nil
 			}
 		}
diff --git a/vendor/github.com/vbauerster/mpb/v7/README.md b/vendor/github.com/vbauerster/mpb/v7/README.md
index ee1b21231..413f9e1db 100644
--- a/vendor/github.com/vbauerster/mpb/v7/README.md
+++ b/vendor/github.com/vbauerster/mpb/v7/README.md
@@ -36,10 +36,10 @@ func main() {
 
     total := 100
     name := "Single Bar:"
-    // adding a single bar, which will inherit container's width
-    bar := p.Add(int64(total),
-        // progress bar filler with customized style
-        mpb.NewBarFiller(mpb.BarStyle().Lbound("╢").Filler("▌").Tip("▌").Padding("░").Rbound("╟")),
+    // create a single bar, which will inherit container's width
+    bar := p.New(int64(total),
+        // BarFillerBuilder with custom style
+        mpb.BarStyle().Lbound("╢").Filler("▌").Tip("▌").Padding("░").Rbound("╟"),
         mpb.PrependDecorators(
             // display our name with one space on the right
             decor.Name(name, decor.WC{W: len(name) + 1, C: decor.DidentRight}),
@@ -65,7 +65,7 @@ func main() {
 
 ```go
     var wg sync.WaitGroup
-    // passed &wg will be accounted at p.Wait() call
+    // passed wg will be accounted at p.Wait() call
     p := mpb.New(mpb.WithWaitGroup(&wg))
     total, numBars := 100, 3
     wg.Add(numBars)
@@ -103,7 +103,7 @@ func main() {
             }
         }()
     }
-    // Waiting for passed &wg and for all bars to complete and flush
+    // wait for passed wg and for all bars to complete and flush
     p.Wait()
 ```
 
diff --git a/vendor/github.com/vbauerster/mpb/v7/bar.go b/vendor/github.com/vbauerster/mpb/v7/bar.go
index d07dc165c..35644a411 100644
--- a/vendor/github.com/vbauerster/mpb/v7/bar.go
+++ b/vendor/github.com/vbauerster/mpb/v7/bar.go
@@ -165,12 +165,12 @@ func (b *Bar) TraverseDecorators(cb func(decor.Decorator)) {
 }
 
 // SetTotal sets total dynamically.
-// If total is less than or equal to zero it takes progress' current value.
+// If total is negative it takes progress' current value.
 func (b *Bar) SetTotal(total int64, triggerComplete bool) {
 	select {
 	case b.operateState <- func(s *bState) {
 		s.triggerComplete = triggerComplete
-		if total <= 0 {
+		if total < 0 {
 			s.total = s.current
 		} else {
 			s.total = total
diff --git a/vendor/github.com/vbauerster/mpb/v7/bar_filler.go b/vendor/github.com/vbauerster/mpb/v7/bar_filler.go
index a69087c47..81177fc2e 100644
--- a/vendor/github.com/vbauerster/mpb/v7/bar_filler.go
+++ b/vendor/github.com/vbauerster/mpb/v7/bar_filler.go
@@ -9,31 +9,42 @@ import (
 // BarFiller interface.
 // Bar (without decorators) renders itself by calling BarFiller's Fill method.
 //
-//	reqWidth is requested width, set by `func WithWidth(int) ContainerOption`.
+//	reqWidth is requested width set by `func WithWidth(int) ContainerOption`.
 //	If not set, it defaults to terminal width.
 //
-// Default implementations can be obtained via:
-//
-//	func NewBarFiller(BarStyle()) BarFiller
-//	func NewBarFiller(SpinnerStyle()) BarFiller
-//
 type BarFiller interface {
 	Fill(w io.Writer, reqWidth int, stat decor.Statistics)
 }
 
 // BarFillerBuilder interface.
+// Default implementations are:
+//
+//	BarStyle()
+//	SpinnerStyle()
+//	NopStyle()
+//
 type BarFillerBuilder interface {
 	Build() BarFiller
 }
 
-// BarFillerFunc is function type adapter to convert function into BarFiller.
+// BarFillerFunc is function type adapter to convert compatible function
+// into BarFiller interface.
 type BarFillerFunc func(w io.Writer, reqWidth int, stat decor.Statistics)
 
 func (f BarFillerFunc) Fill(w io.Writer, reqWidth int, stat decor.Statistics) {
 	f(w, reqWidth, stat)
 }
 
+// BarFillerBuilderFunc is function type adapter to convert compatible
+// function into BarFillerBuilder interface.
+type BarFillerBuilderFunc func() BarFiller
+
+func (f BarFillerBuilderFunc) Build() BarFiller {
+	return f()
+}
+
 // NewBarFiller constructs a BarFiller from provided BarFillerBuilder.
+// Deprecated. Prefer using `*Progress.New(...)` directly.
 func NewBarFiller(b BarFillerBuilder) BarFiller {
 	return b.Build()
 }
diff --git a/vendor/github.com/vbauerster/mpb/v7/bar_filler_nop.go b/vendor/github.com/vbauerster/mpb/v7/bar_filler_nop.go
new file mode 100644
index 000000000..1a7086fec
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v7/bar_filler_nop.go
@@ -0,0 +1,14 @@
+package mpb
+
+import (
+	"io"
+
+	"github.com/vbauerster/mpb/v7/decor"
+)
+
+// NopStyle provides BarFillerBuilder which builds NOP BarFiller.
+func NopStyle() BarFillerBuilder {
+	return BarFillerBuilderFunc(func() BarFiller {
+		return BarFillerFunc(func(io.Writer, int, decor.Statistics) {})
+	})
+}
diff --git a/vendor/github.com/vbauerster/mpb/v7/bar_option.go b/vendor/github.com/vbauerster/mpb/v7/bar_option.go
index 46b7de0bf..660e7c487 100644
--- a/vendor/github.com/vbauerster/mpb/v7/bar_option.go
+++ b/vendor/github.com/vbauerster/mpb/v7/bar_option.go
@@ -5,12 +5,20 @@ import (
 	"io"
 
 	"github.com/vbauerster/mpb/v7/decor"
-	"github.com/vbauerster/mpb/v7/internal"
 )
 
 // BarOption is a func option to alter default behavior of a bar.
 type BarOption func(*bState)
 
+func skipNil(decorators []decor.Decorator) (filtered []decor.Decorator) {
+	for _, d := range decorators {
+		if d != nil {
+			filtered = append(filtered, d)
+		}
+	}
+	return
+}
+
 func (s *bState) addDecorators(dest *[]decor.Decorator, decorators ...decor.Decorator) {
 	type mergeWrapper interface {
 		MergeUnwrap() []decor.Decorator
@@ -26,14 +34,14 @@ func (s *bState) addDecorators(dest *[]decor.Decorator, decorators ...decor.Deco
 // AppendDecorators let you inject decorators to the bar's right side.
 func AppendDecorators(decorators ...decor.Decorator) BarOption {
 	return func(s *bState) {
-		s.addDecorators(&s.aDecorators, decorators...)
+		s.addDecorators(&s.aDecorators, skipNil(decorators)...)
 	}
 }
 
 // PrependDecorators let you inject decorators to the bar's left side.
 func PrependDecorators(decorators ...decor.Decorator) BarOption {
 	return func(s *bState) {
-		s.addDecorators(&s.pDecorators, decorators...)
+		s.addDecorators(&s.pDecorators, skipNil(decorators)...)
 	}
 }
 
@@ -138,9 +146,12 @@ func BarNoPop() BarOption {
 	}
 }
 
-// BarOptional will invoke provided option only when pick is true.
-func BarOptional(option BarOption, pick bool) BarOption {
-	return BarOptOn(option, internal.Predicate(pick))
+// BarOptional will invoke provided option only when cond is true.
+func BarOptional(option BarOption, cond bool) BarOption {
+	if cond {
+		return option
+	}
+	return nil
 }
 
 // BarOptOn will invoke provided option only when higher order predicate
diff --git a/vendor/github.com/vbauerster/mpb/v7/container_option.go b/vendor/github.com/vbauerster/mpb/v7/container_option.go
index a858c3c51..e523a1759 100644
--- a/vendor/github.com/vbauerster/mpb/v7/container_option.go
+++ b/vendor/github.com/vbauerster/mpb/v7/container_option.go
@@ -5,8 +5,6 @@ import (
 	"io/ioutil"
 	"sync"
 	"time"
-
-	"github.com/vbauerster/mpb/v7/internal"
 )
 
 // ContainerOption is a func option to alter default behavior of a bar
@@ -101,9 +99,12 @@ func PopCompletedMode() ContainerOption {
 	}
 }
 
-// ContainerOptional will invoke provided option only when pick is true.
-func ContainerOptional(option ContainerOption, pick bool) ContainerOption {
-	return ContainerOptOn(option, internal.Predicate(pick))
+// ContainerOptional will invoke provided option only when cond is true.
+func ContainerOptional(option ContainerOption, cond bool) ContainerOption {
+	if cond {
+		return option
+	}
+	return nil
 }
 
 // ContainerOptOn will invoke provided option only when higher order
diff --git a/vendor/github.com/vbauerster/mpb/v7/decor/merge.go b/vendor/github.com/vbauerster/mpb/v7/decor/merge.go
index e41406a64..847671155 100644
--- a/vendor/github.com/vbauerster/mpb/v7/decor/merge.go
+++ b/vendor/github.com/vbauerster/mpb/v7/decor/merge.go
@@ -17,6 +17,9 @@ import (
 //    +----+--------+---------+--------+
 //
 func Merge(decorator Decorator, placeholders ...WC) Decorator {
+	if decorator == nil {
+		return nil
+	}
 	if _, ok := decorator.Sync(); !ok || len(placeholders) == 0 {
 		return decorator
 	}
diff --git a/vendor/github.com/vbauerster/mpb/v7/decor/on_abort.go b/vendor/github.com/vbauerster/mpb/v7/decor/on_abort.go
index 7ece120a2..10ff67009 100644
--- a/vendor/github.com/vbauerster/mpb/v7/decor/on_abort.go
+++ b/vendor/github.com/vbauerster/mpb/v7/decor/on_abort.go
@@ -9,6 +9,9 @@ package decor
 //	`message` message to display on abort event
 //
 func OnAbort(decorator Decorator, message string) Decorator {
+	if decorator == nil {
+		return nil
+	}
 	d := &onAbortWrapper{
 		Decorator: decorator,
 		msg:       message,
diff --git a/vendor/github.com/vbauerster/mpb/v7/decor/on_complete.go b/vendor/github.com/vbauerster/mpb/v7/decor/on_complete.go
index c7c9e4d31..2ada2b31b 100644
--- a/vendor/github.com/vbauerster/mpb/v7/decor/on_complete.go
+++ b/vendor/github.com/vbauerster/mpb/v7/decor/on_complete.go
@@ -8,6 +8,9 @@ package decor
 //	`message` message to display on complete event
 //
 func OnComplete(decorator Decorator, message string) Decorator {
+	if decorator == nil {
+		return nil
+	}
 	d := &onCompleteWrapper{
 		Decorator: decorator,
 		msg:       message,
diff --git a/vendor/github.com/vbauerster/mpb/v7/decor/on_condition.go b/vendor/github.com/vbauerster/mpb/v7/decor/on_condition.go
new file mode 100644
index 000000000..a9db0653a
--- /dev/null
+++ b/vendor/github.com/vbauerster/mpb/v7/decor/on_condition.go
@@ -0,0 +1,27 @@
+package decor
+
+// OnPredicate returns decorator if predicate evaluates to true.
+//
+//	`decorator` Decorator
+//
+//	`predicate` func() bool
+//
+func OnPredicate(decorator Decorator, predicate func() bool) Decorator {
+	if predicate() {
+		return decorator
+	}
+	return nil
+}
+
+// OnCondition returns decorator if condition is true.
+//
+//	`decorator` Decorator
+//
+//	`cond` bool
+//
+func OnCondition(decorator Decorator, cond bool) Decorator {
+	if cond {
+		return decorator
+	}
+	return nil
+}
diff --git a/vendor/github.com/vbauerster/mpb/v7/go.mod b/vendor/github.com/vbauerster/mpb/v7/go.mod
index 32008c66c..19a6f8044 100644
--- a/vendor/github.com/vbauerster/mpb/v7/go.mod
+++ b/vendor/github.com/vbauerster/mpb/v7/go.mod
@@ -4,7 +4,7 @@ require (
 	github.com/VividCortex/ewma v1.2.0
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/mattn/go-runewidth v0.0.13
-	golang.org/x/sys v0.0.0-20211124211545-fe61309f8881
+	golang.org/x/sys v0.0.0-20211214234402-4825e8c3871d
 )
 
 go 1.14
diff --git a/vendor/github.com/vbauerster/mpb/v7/go.sum b/vendor/github.com/vbauerster/mpb/v7/go.sum
index 6fed396bb..b4388d9ea 100644
--- a/vendor/github.com/vbauerster/mpb/v7/go.sum
+++ b/vendor/github.com/vbauerster/mpb/v7/go.sum
@@ -6,5 +6,5 @@ github.com/mattn/go-runewidth v0.0.13 h1:lTGmDsbAYt5DmK6OnoV7EuIF1wEIFAcxld6ypU4
 github.com/mattn/go-runewidth v0.0.13/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
 github.com/rivo/uniseg v0.2.0 h1:S1pD9weZBuJdFmowNwbpi7BJ8TNftyUImj/0WQi72jY=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881 h1:TyHqChC80pFkXWraUUf6RuB5IqFdQieMLwwCJokV2pc=
-golang.org/x/sys v0.0.0-20211124211545-fe61309f8881/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.0.0-20211214234402-4825e8c3871d h1:1oIt9o40TWWI9FUaveVpUvBe13FNqBNVXy3ue2fcfkw=
+golang.org/x/sys v0.0.0-20211214234402-4825e8c3871d/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
diff --git a/vendor/github.com/vbauerster/mpb/v7/internal/predicate.go b/vendor/github.com/vbauerster/mpb/v7/internal/predicate.go
deleted file mode 100644
index 1e4dd24d9..000000000
--- a/vendor/github.com/vbauerster/mpb/v7/internal/predicate.go
+++ /dev/null
@@ -1,6 +0,0 @@
-package internal
-
-// Predicate helper for internal use.
-func Predicate(pick bool) func() bool {
-	return func() bool { return pick }
-}
diff --git a/vendor/github.com/vbauerster/mpb/v7/progress.go b/vendor/github.com/vbauerster/mpb/v7/progress.go
index c60c65694..46485f719 100644
--- a/vendor/github.com/vbauerster/mpb/v7/progress.go
+++ b/vendor/github.com/vbauerster/mpb/v7/progress.go
@@ -99,17 +99,19 @@ func NewWithContext(ctx context.Context, options ...ContainerOption) *Progress {
 	return p
 }
 
-// AddBar creates a bar with default bar filler. Different filler can
-// be chosen and applied via `*Progress.Add(...) *Bar` method.
+// AddBar creates a bar with default bar filler.
 func (p *Progress) AddBar(total int64, options ...BarOption) *Bar {
-	return p.Add(total, NewBarFiller(BarStyle()), options...)
+	return p.New(total, BarStyle(), options...)
 }
 
-// AddSpinner creates a bar with default spinner filler. Different
-// filler can be chosen and applied via `*Progress.Add(...) *Bar`
-// method.
+// AddSpinner creates a bar with default spinner filler.
 func (p *Progress) AddSpinner(total int64, options ...BarOption) *Bar {
-	return p.Add(total, NewBarFiller(SpinnerStyle()), options...)
+	return p.New(total, SpinnerStyle(), options...)
+}
+
+// New creates a bar with provided BarFillerBuilder.
+func (p *Progress) New(total int64, builder BarFillerBuilder, options ...BarOption) *Bar {
+	return p.Add(total, builder.Build(), options...)
 }
 
 // Add creates a bar which renders itself by provided filler.
@@ -117,7 +119,7 @@ func (p *Progress) AddSpinner(total int64, options ...BarOption) *Bar {
 // Panics if *Progress instance is done, i.e. called after *Progress.Wait().
 func (p *Progress) Add(total int64, filler BarFiller, options ...BarOption) *Bar {
 	if filler == nil {
-		filler = BarFillerFunc(func(io.Writer, int, decor.Statistics) {})
+		filler = NopStyle().Build()
 	}
 	p.bwg.Add(1)
 	result := make(chan *Bar)
diff --git a/vendor/github.com/vbauerster/mpb/v7/proxyreader.go b/vendor/github.com/vbauerster/mpb/v7/proxyreader.go
index 2f20053bd..a16f5ec8a 100644
--- a/vendor/github.com/vbauerster/mpb/v7/proxyreader.go
+++ b/vendor/github.com/vbauerster/mpb/v7/proxyreader.go
@@ -15,7 +15,7 @@ func (x *proxyReader) Read(p []byte) (int, error) {
 	n, err := x.ReadCloser.Read(p)
 	x.bar.IncrBy(n)
 	if err == io.EOF {
-		go x.bar.SetTotal(0, true)
+		go x.bar.SetTotal(-1, true)
 	}
 	return n, err
 }
@@ -30,7 +30,7 @@ func (x *proxyWriterTo) WriteTo(w io.Writer) (int64, error) {
 	n, err := x.wt.WriteTo(w)
 	x.bar.IncrInt64(n)
 	if err == io.EOF {
-		go x.bar.SetTotal(0, true)
+		go x.bar.SetTotal(-1, true)
 	}
 	return n, err
 }
diff --git a/vendor/golang.org/x/sys/plan9/syscall_plan9.go b/vendor/golang.org/x/sys/plan9/syscall_plan9.go
index 84e147148..723b1f400 100644
--- a/vendor/golang.org/x/sys/plan9/syscall_plan9.go
+++ b/vendor/golang.org/x/sys/plan9/syscall_plan9.go
@@ -132,8 +132,10 @@ func Pipe(p []int) (err error) {
 	}
 	var pp [2]int32
 	err = pipe(&pp)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return
 }
 
diff --git a/vendor/golang.org/x/sys/unix/mkerrors.sh b/vendor/golang.org/x/sys/unix/mkerrors.sh
index 4945739ea..a47b035f9 100644
--- a/vendor/golang.org/x/sys/unix/mkerrors.sh
+++ b/vendor/golang.org/x/sys/unix/mkerrors.sh
@@ -261,6 +261,7 @@ struct ltchars {
 #include <linux/vm_sockets.h>
 #include <linux/wait.h>
 #include <linux/watchdog.h>
+#include <linux/wireguard.h>
 
 #include <mtd/ubi-user.h>
 #include <mtd/mtd-user.h>
@@ -606,6 +607,7 @@ ccflags="$@"
 		$2 ~ /^MTD/ ||
 		$2 ~ /^OTP/ ||
 		$2 ~ /^MEM/ ||
+		$2 ~ /^WG/ ||
 		$2 ~ /^BLK[A-Z]*(GET$|SET$|BUF$|PART$|SIZE)/ {printf("\t%s = C.%s\n", $2, $2)}
 		$2 ~ /^__WCOREFLAG$/ {next}
 		$2 ~ /^__W[A-Z0-9]+$/ {printf("\t%s = C.%s\n", substr($2,3), $2)}
diff --git a/vendor/golang.org/x/sys/unix/syscall_aix.go b/vendor/golang.org/x/sys/unix/syscall_aix.go
index 6192750ce..4f55c8d99 100644
--- a/vendor/golang.org/x/sys/unix/syscall_aix.go
+++ b/vendor/golang.org/x/sys/unix/syscall_aix.go
@@ -519,8 +519,10 @@ func Pipe(p []int) (err error) {
 	}
 	var pp [2]_C_int
 	err = pipe(&pp)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_darwin.go b/vendor/golang.org/x/sys/unix/syscall_darwin.go
index 8826f4143..0eaab9131 100644
--- a/vendor/golang.org/x/sys/unix/syscall_darwin.go
+++ b/vendor/golang.org/x/sys/unix/syscall_darwin.go
@@ -159,8 +159,10 @@ func Pipe(p []int) (err error) {
 	}
 	var x [2]int32
 	err = pipe(&x)
-	p[0] = int(x[0])
-	p[1] = int(x[1])
+	if err == nil {
+		p[0] = int(x[0])
+		p[1] = int(x[1])
+	}
 	return
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
index 5af108a50..2e37c3167 100644
--- a/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
+++ b/vendor/golang.org/x/sys/unix/syscall_dragonfly.go
@@ -101,7 +101,10 @@ func Pipe(p []int) (err error) {
 	if len(p) != 2 {
 		return EINVAL
 	}
-	p[0], p[1], err = pipe()
+	r, w, err := pipe()
+	if err == nil {
+		p[0], p[1] = r, w
+	}
 	return
 }
 
@@ -114,7 +117,10 @@ func Pipe2(p []int, flags int) (err error) {
 	var pp [2]_C_int
 	// pipe2 on dragonfly takes an fds array as an argument, but still
 	// returns the file descriptors.
-	p[0], p[1], err = pipe2(&pp, flags)
+	r, w, err := pipe2(&pp, flags)
+	if err == nil {
+		p[0], p[1] = r, w
+	}
 	return err
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_freebsd.go b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
index 18c392cf3..2f650ae66 100644
--- a/vendor/golang.org/x/sys/unix/syscall_freebsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_freebsd.go
@@ -110,8 +110,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go
index 4bc5baf77..f432b0684 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -131,8 +131,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_netbsd.go b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
index 853d5f0f4..696fed496 100644
--- a/vendor/golang.org/x/sys/unix/syscall_netbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_netbsd.go
@@ -110,14 +110,8 @@ func direntNamlen(buf []byte) (uint64, bool) {
 	return readInt(buf, unsafe.Offsetof(Dirent{}.Namlen), unsafe.Sizeof(Dirent{}.Namlen))
 }
 
-//sysnb	pipe() (fd1 int, fd2 int, err error)
-
 func Pipe(p []int) (err error) {
-	if len(p) != 2 {
-		return EINVAL
-	}
-	p[0], p[1], err = pipe()
-	return
+	return Pipe2(p, 0)
 }
 
 //sysnb	pipe2(p *[2]_C_int, flags int) (err error)
@@ -128,8 +122,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_openbsd.go b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
index 22b550385..11b1d419d 100644
--- a/vendor/golang.org/x/sys/unix/syscall_openbsd.go
+++ b/vendor/golang.org/x/sys/unix/syscall_openbsd.go
@@ -87,8 +87,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_solaris.go b/vendor/golang.org/x/sys/unix/syscall_solaris.go
index 8b88ac213..5c813921e 100644
--- a/vendor/golang.org/x/sys/unix/syscall_solaris.go
+++ b/vendor/golang.org/x/sys/unix/syscall_solaris.go
@@ -66,8 +66,10 @@ func Pipe(p []int) (err error) {
 	if n != 0 {
 		return err
 	}
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return nil
 }
 
@@ -79,8 +81,10 @@ func Pipe2(p []int, flags int) error {
 	}
 	var pp [2]_C_int
 	err := pipe2(&pp, flags)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return err
 }
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
index 5fb76a146..f8616f454 100644
--- a/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
+++ b/vendor/golang.org/x/sys/unix/syscall_zos_s390x.go
@@ -579,8 +579,10 @@ func Pipe(p []int) (err error) {
 	}
 	var pp [2]_C_int
 	err = pipe(&pp)
-	p[0] = int(pp[0])
-	p[1] = int(pp[1])
+	if err == nil {
+		p[0] = int(pp[0])
+		p[1] = int(pp[1])
+	}
 	return
 }
 
diff --git a/vendor/golang.org/x/sys/unix/zerrors_linux.go b/vendor/golang.org/x/sys/unix/zerrors_linux.go
index d175aae89..bcc45d108 100644
--- a/vendor/golang.org/x/sys/unix/zerrors_linux.go
+++ b/vendor/golang.org/x/sys/unix/zerrors_linux.go
@@ -2826,6 +2826,13 @@ const (
 	WDIOS_TEMPPANIC                             = 0x4
 	WDIOS_UNKNOWN                               = -0x1
 	WEXITED                                     = 0x4
+	WGALLOWEDIP_A_MAX                           = 0x3
+	WGDEVICE_A_MAX                              = 0x8
+	WGPEER_A_MAX                                = 0xa
+	WG_CMD_MAX                                  = 0x1
+	WG_GENL_NAME                                = "wireguard"
+	WG_GENL_VERSION                             = 0x1
+	WG_KEY_LEN                                  = 0x20
 	WIN_ACKMEDIACHANGE                          = 0xdb
 	WIN_CHECKPOWERMODE1                         = 0xe5
 	WIN_CHECKPOWERMODE2                         = 0x98
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
index 4726ab30a..51d0c0742 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_386.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
index fe71456db..df2efb6db 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_amd64.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
index 0b5b2f014..c8536c2c9 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
index bfca28648..8b981bfc2 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_netbsd_arm64.go
@@ -351,18 +351,6 @@ func Munlockall() (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func pipe() (fd1 int, fd2 int, err error) {
-	r0, r1, e1 := RawSyscall(SYS_PIPE, 0, 0, 0)
-	fd1 = int(r0)
-	fd2 = int(r1)
-	if e1 != 0 {
-		err = errnoErr(e1)
-	}
-	return
-}
-
-// THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
-
 func pipe2(p *[2]_C_int, flags int) (err error) {
 	_, _, e1 := RawSyscall(SYS_PIPE2, uintptr(unsafe.Pointer(p)), uintptr(flags), 0)
 	if e1 != 0 {
diff --git a/vendor/golang.org/x/sys/unix/ztypes_linux.go b/vendor/golang.org/x/sys/unix/ztypes_linux.go
index 37b521436..e76b7f6f9 100644
--- a/vendor/golang.org/x/sys/unix/ztypes_linux.go
+++ b/vendor/golang.org/x/sys/unix/ztypes_linux.go
@@ -867,6 +867,7 @@ const (
 	CTRL_CMD_NEWMCAST_GRP      = 0x7
 	CTRL_CMD_DELMCAST_GRP      = 0x8
 	CTRL_CMD_GETMCAST_GRP      = 0x9
+	CTRL_CMD_GETPOLICY         = 0xa
 	CTRL_ATTR_UNSPEC           = 0x0
 	CTRL_ATTR_FAMILY_ID        = 0x1
 	CTRL_ATTR_FAMILY_NAME      = 0x2
@@ -875,12 +876,19 @@ const (
 	CTRL_ATTR_MAXATTR          = 0x5
 	CTRL_ATTR_OPS              = 0x6
 	CTRL_ATTR_MCAST_GROUPS     = 0x7
+	CTRL_ATTR_POLICY           = 0x8
+	CTRL_ATTR_OP_POLICY        = 0x9
+	CTRL_ATTR_OP               = 0xa
 	CTRL_ATTR_OP_UNSPEC        = 0x0
 	CTRL_ATTR_OP_ID            = 0x1
 	CTRL_ATTR_OP_FLAGS         = 0x2
 	CTRL_ATTR_MCAST_GRP_UNSPEC = 0x0
 	CTRL_ATTR_MCAST_GRP_NAME   = 0x1
 	CTRL_ATTR_MCAST_GRP_ID     = 0x2
+	CTRL_ATTR_POLICY_UNSPEC    = 0x0
+	CTRL_ATTR_POLICY_DO        = 0x1
+	CTRL_ATTR_POLICY_DUMP      = 0x2
+	CTRL_ATTR_POLICY_DUMP_MAX  = 0x2
 )
 
 const (
@@ -3968,3 +3976,36 @@ type MountAttr struct {
 	Propagation uint64
 	Userns_fd   uint64
 }
+
+const (
+	WG_CMD_GET_DEVICE                      = 0x0
+	WG_CMD_SET_DEVICE                      = 0x1
+	WGDEVICE_F_REPLACE_PEERS               = 0x1
+	WGDEVICE_A_UNSPEC                      = 0x0
+	WGDEVICE_A_IFINDEX                     = 0x1
+	WGDEVICE_A_IFNAME                      = 0x2
+	WGDEVICE_A_PRIVATE_KEY                 = 0x3
+	WGDEVICE_A_PUBLIC_KEY                  = 0x4
+	WGDEVICE_A_FLAGS                       = 0x5
+	WGDEVICE_A_LISTEN_PORT                 = 0x6
+	WGDEVICE_A_FWMARK                      = 0x7
+	WGDEVICE_A_PEERS                       = 0x8
+	WGPEER_F_REMOVE_ME                     = 0x1
+	WGPEER_F_REPLACE_ALLOWEDIPS            = 0x2
+	WGPEER_F_UPDATE_ONLY                   = 0x4
+	WGPEER_A_UNSPEC                        = 0x0
+	WGPEER_A_PUBLIC_KEY                    = 0x1
+	WGPEER_A_PRESHARED_KEY                 = 0x2
+	WGPEER_A_FLAGS                         = 0x3
+	WGPEER_A_ENDPOINT                      = 0x4
+	WGPEER_A_PERSISTENT_KEEPALIVE_INTERVAL = 0x5
+	WGPEER_A_LAST_HANDSHAKE_TIME           = 0x6
+	WGPEER_A_RX_BYTES                      = 0x7
+	WGPEER_A_TX_BYTES                      = 0x8
+	WGPEER_A_ALLOWEDIPS                    = 0x9
+	WGPEER_A_PROTOCOL_VERSION              = 0xa
+	WGALLOWEDIP_A_UNSPEC                   = 0x0
+	WGALLOWEDIP_A_FAMILY                   = 0x1
+	WGALLOWEDIP_A_IPADDR                   = 0x2
+	WGALLOWEDIP_A_CIDR_MASK                = 0x3
+)
diff --git a/vendor/golang.org/x/sys/windows/exec_windows.go b/vendor/golang.org/x/sys/windows/exec_windows.go
index 7a11e83b7..855698bb2 100644
--- a/vendor/golang.org/x/sys/windows/exec_windows.go
+++ b/vendor/golang.org/x/sys/windows/exec_windows.go
@@ -9,8 +9,6 @@ package windows
 import (
 	errorspkg "errors"
 	"unsafe"
-
-	"golang.org/x/sys/internal/unsafeheader"
 )
 
 // EscapeArg rewrites command line argument s as prescribed
@@ -147,8 +145,12 @@ func NewProcThreadAttributeList(maxAttrCount uint32) (*ProcThreadAttributeListCo
 		}
 		return nil, err
 	}
+	alloc, err := LocalAlloc(LMEM_FIXED, uint32(size))
+	if err != nil {
+		return nil, err
+	}
 	// size is guaranteed to be ≥1 by InitializeProcThreadAttributeList.
-	al := &ProcThreadAttributeListContainer{data: (*ProcThreadAttributeList)(unsafe.Pointer(&make([]byte, size)[0]))}
+	al := &ProcThreadAttributeListContainer{data: (*ProcThreadAttributeList)(unsafe.Pointer(alloc))}
 	err = initializeProcThreadAttributeList(al.data, maxAttrCount, 0, &size)
 	if err != nil {
 		return nil, err
@@ -157,36 +159,17 @@ func NewProcThreadAttributeList(maxAttrCount uint32) (*ProcThreadAttributeListCo
 }
 
 // Update modifies the ProcThreadAttributeList using UpdateProcThreadAttribute.
-// Note that the value passed to this function will be copied into memory
-// allocated by LocalAlloc, the contents of which should not contain any
-// Go-managed pointers, even if the passed value itself is a Go-managed
-// pointer.
 func (al *ProcThreadAttributeListContainer) Update(attribute uintptr, value unsafe.Pointer, size uintptr) error {
-	alloc, err := LocalAlloc(LMEM_FIXED, uint32(size))
-	if err != nil {
-		return err
-	}
-	var src, dst []byte
-	hdr := (*unsafeheader.Slice)(unsafe.Pointer(&src))
-	hdr.Data = value
-	hdr.Cap = int(size)
-	hdr.Len = int(size)
-	hdr = (*unsafeheader.Slice)(unsafe.Pointer(&dst))
-	hdr.Data = unsafe.Pointer(alloc)
-	hdr.Cap = int(size)
-	hdr.Len = int(size)
-	copy(dst, src)
-	al.heapAllocations = append(al.heapAllocations, alloc)
-	return updateProcThreadAttribute(al.data, 0, attribute, unsafe.Pointer(alloc), size, nil, nil)
+	al.pointers = append(al.pointers, value)
+	return updateProcThreadAttribute(al.data, 0, attribute, value, size, nil, nil)
 }
 
 // Delete frees ProcThreadAttributeList's resources.
 func (al *ProcThreadAttributeListContainer) Delete() {
 	deleteProcThreadAttributeList(al.data)
-	for i := range al.heapAllocations {
-		LocalFree(Handle(al.heapAllocations[i]))
-	}
-	al.heapAllocations = nil
+	LocalFree(Handle(unsafe.Pointer(al.data)))
+	al.data = nil
+	al.pointers = nil
 }
 
 // List returns the actual ProcThreadAttributeList to be passed to StartupInfoEx.
diff --git a/vendor/golang.org/x/sys/windows/types_windows.go b/vendor/golang.org/x/sys/windows/types_windows.go
index 73087bf5e..655447e8f 100644
--- a/vendor/golang.org/x/sys/windows/types_windows.go
+++ b/vendor/golang.org/x/sys/windows/types_windows.go
@@ -938,8 +938,8 @@ type StartupInfoEx struct {
 type ProcThreadAttributeList struct{}
 
 type ProcThreadAttributeListContainer struct {
-	data            *ProcThreadAttributeList
-	heapAllocations []uintptr
+	data     *ProcThreadAttributeList
+	pointers []unsafe.Pointer
 }
 
 type ProcessInformation struct {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 68f9e5a99..9f3270b53 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -63,7 +63,7 @@ github.com/container-orchestrated-devices/container-device-interface/pkg
 github.com/container-orchestrated-devices/container-device-interface/specs-go
 # github.com/containerd/cgroups v1.0.1
 github.com/containerd/cgroups/stats/v1
-# github.com/containerd/containerd v1.5.8
+# github.com/containerd/containerd v1.5.9
 github.com/containerd/containerd/errdefs
 github.com/containerd/containerd/log
 github.com/containerd/containerd/pkg/userns
@@ -106,7 +106,7 @@ github.com/containers/buildah/pkg/rusage
 github.com/containers/buildah/pkg/sshagent
 github.com/containers/buildah/pkg/util
 github.com/containers/buildah/util
-# github.com/containers/common v0.46.1-0.20211209220542-24f363480347
+# github.com/containers/common v0.46.1-0.20220110152253-5476e2b8dc46
 ## explicit
 github.com/containers/common/libimage
 github.com/containers/common/libimage/manifests
@@ -139,11 +139,12 @@ github.com/containers/common/pkg/supplemented
 github.com/containers/common/pkg/sysinfo
 github.com/containers/common/pkg/timetype
 github.com/containers/common/pkg/umask
+github.com/containers/common/pkg/util
 github.com/containers/common/version
 # github.com/containers/conmon v2.0.20+incompatible
 ## explicit
 github.com/containers/conmon/runner/config
-# github.com/containers/image/v5 v5.17.1-0.20211207161909-6f3c8453e1a7
+# github.com/containers/image/v5 v5.17.1-0.20220106205022-73f80d60f0e1
 ## explicit
 github.com/containers/image/v5/copy
 github.com/containers/image/v5/directory
@@ -546,7 +547,7 @@ github.com/onsi/gomega/types
 # github.com/opencontainers/go-digest v1.0.0
 ## explicit
 github.com/opencontainers/go-digest
-# github.com/opencontainers/image-spec v1.0.2-0.20211123152302-43a7dee1ec31
+# github.com/opencontainers/image-spec v1.0.3-0.20211202193544-a5463b7f9c84
 ## explicit
 github.com/opencontainers/image-spec/specs-go
 github.com/opencontainers/image-spec/specs-go/v1
@@ -668,7 +669,7 @@ github.com/vbauerster/mpb/v6
 github.com/vbauerster/mpb/v6/cwriter
 github.com/vbauerster/mpb/v6/decor
 github.com/vbauerster/mpb/v6/internal
-# github.com/vbauerster/mpb/v7 v7.2.0
+# github.com/vbauerster/mpb/v7 v7.3.0
 github.com/vbauerster/mpb/v7
 github.com/vbauerster/mpb/v7/cwriter
 github.com/vbauerster/mpb/v7/decor
@@ -736,7 +737,7 @@ golang.org/x/net/trace
 ## explicit
 golang.org/x/sync/errgroup
 golang.org/x/sync/semaphore
-# golang.org/x/sys v0.0.0-20211205182925-97ca703d548d
+# golang.org/x/sys v0.0.0-20211214234402-4825e8c3871d
 ## explicit
 golang.org/x/sys/cpu
 golang.org/x/sys/execabs