diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..866e114fa7
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,16 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Preserve this vendored upstream source byte-for-byte.
+vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto whitespace=-trailing-space
diff --git a/Makefile b/Makefile
index 1002e2f039..71ae4f58fe 100644
--- a/Makefile
+++ b/Makefile
@@ -74,6 +74,11 @@ build-images:
 	    --ldflags="$(LDFLAGS)" \
 	    $(IMAGES)
 
+.PHONY: build-ateom-kata-image
+build-ateom-kata-image:
+	@test -n "$(IMAGE)" || (echo "IMAGE is required" >&2; exit 1)
+	LDFLAGS="$(LDFLAGS)" hack/build-ateom-kata-image.sh "$(IMAGE)"
+
 .PHONY: build-atectl
 build-atectl:
 	$(GO) build -ldflags "$(LDFLAGS)" -o $(ATECTL) ./cmd/kubectl-ate
diff --git a/_LICENSES/github.com/containerd/cgroups/v3/LICENSE b/_LICENSES/github.com/containerd/cgroups/v3/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/_LICENSES/github.com/containerd/cgroups/v3/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/_LICENSES/github.com/containerd/containerd/api/LICENSE b/_LICENSES/github.com/containerd/containerd/api/LICENSE
new file mode 100644
index 0000000000..584149b6ee
--- /dev/null
+++ b/_LICENSES/github.com/containerd/containerd/api/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/_LICENSES/github.com/containerd/containerd/api/types/LICENSE b/_LICENSES/github.com/containerd/containerd/api/types/LICENSE
new file mode 100644
index 0000000000..584149b6ee
--- /dev/null
+++ b/_LICENSES/github.com/containerd/containerd/api/types/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/_LICENSES/k8s.io/cri-api/pkg/apis/runtime/v1/LICENSE b/_LICENSES/k8s.io/cri-api/pkg/apis/runtime/v1/LICENSE
new file mode 100644
index 0000000000..8dada3edaf
--- /dev/null
+++ b/_LICENSES/k8s.io/cri-api/pkg/apis/runtime/v1/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/benchmarking/locust/common/ateapi_pb2.py b/benchmarking/locust/common/ateapi_pb2.py
index 469d796d52..2336dd0609 100644
--- a/benchmarking/locust/common/ateapi_pb2.py
+++ b/benchmarking/locust/common/ateapi_pb2.py
@@ -40,7 +40,7 @@
 from google.protobuf import timestamp_pb2 as google_dot_protobuf_dot_timestamp__pb2
 
 
-DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0c\x61teapi.proto\x12\x06\x61teapi\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"]\n\x10\x45xternalSnapshot\x12\x14\n\x0csnapshot_uri\x18\x01 \x01(\t\x12\x33\n\rcontent_scope\x18\x02 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\"\x86\x01\n\x11LocalSnapshotInfo\x12\x15\n\rsnapshot_name\x18\x01 \x01(\t\x12%\n\x1dnode_vms_with_local_snapshots\x18\x02 \x03(\t\x12\x33\n\rcontent_scope\x18\x03 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\"w\n\x08Selector\x12\x37\n\x0cmatch_labels\x18\x01 \x03(\x0b\x32!.ateapi.Selector.MatchLabelsEntry\x1a\x32\n\x10MatchLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xb2\x01\n\x10ResourceMetadata\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x0b\n\x03uid\x18\x03 \x01(\t\x12\x0f\n\x07version\x18\x04 \x01(\x03\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdc\x02\n\x0e\x45xternalVolume\x12\x13\n\x0bvolume_name\x18\x01 \x01(\t\x12\x19\n\x11storage_volume_id\x18\x02 \x01(\t\x12\x13\n\x0bvolume_type\x18\x03 \x01(\t\x12-\n\x06status\x18\x04 \x01(\x0e\x32\x1d.ateapi.ExternalVolume.Status\x12\x41\n\x0evolume_context\x18\x05 \x03(\x0b\x32).ateapi.ExternalVolume.VolumeContextEntry\x1a\x34\n\x12VolumeContextEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"]\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n\x0eSTATUS_PENDING\x10\x01\x12\x12\n\x0eSTATUS_CREATED\x10\x02\x12\x13\n\x0fSTATUS_DELETING\x10\x03\"\xd5\x01\n\x05\x41\x63tor\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12)\n\x0e\x61\x63tor_template\x18\x04 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12)\n\x0fworker_selector\x18\x05 \x01(\x0b\x32\x10.ateapi.Selector\x12%\n\nsource_tag\x18\x06 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12#\n\x06status\x18\x07 \x01(\x0b\x32\x13.ateapi.ActorStatus\"]\n\x0c\x45gressPolicy\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12!\n\x05rules\x18\x02 \x03(\x0b\x32\x12.ateapi.EgressRule\"{\n\nEgressRule\x12\'\n\thostnames\x18\x01 \x01(\x0b\x32\x14.ateapi.HostnameRule\x12\x1f\n\x05\x63idrs\x18\x02 \x01(\x0b\x32\x10.ateapi.CIDRRule\x12#\n\x03\x61ll\x18\x03 \x01(\x0b\x32\x16.google.protobuf.Empty\"L\n\x0cHostnameRule\x12\x10\n\x08patterns\x18\x01 \x03(\t\x12*\n\x07\x65\x66\x66\x65\x63ts\x18\x02 \x01(\x0b\x32\x19.ateapi.EgressRuleEffects\"\x19\n\x08\x43IDRRule\x12\r\n\x05\x63idrs\x18\x01 \x03(\t\"U\n\x11\x45gressRuleEffects\x12@\n\x15inject_static_headers\x18\x01 \x03(\x0b\x32!.ateapi.CredentialHeaderInjection\"S\n\x19\x43redentialHeaderInjection\x12\x0e\n\x06header\x18\x01 \x01(\t\x12\x0e\n\x06prefix\x18\x02 \x01(\t\x12\x16\n\x0e\x63redential_uri\x18\x03 \x01(\t\"\xf0\x02\n\x0b\x41\x63torStatus\x12!\n\x05state\x18\x01 \x01(\x0e\x32\x12.ateapi.ActorState\x12\x33\n\x11worker_assignment\x18\x02 \x01(\x0b\x32\x18.ateapi.WorkerAssignment\x12 \n\x18in_progress_snapshot_uri\x18\x03 \x01(\t\x12\x33\n\x11\x65xternal_snapshot\x18\x04 \x01(\x0b\x32\x18.ateapi.ExternalSnapshot\x12\x36\n\x13local_snapshot_info\x18\x05 \x01(\x0b\x32\x19.ateapi.LocalSnapshotInfo\x12-\n\ractor_volumes\x18\x07 \x03(\x0b\x32\x16.ateapi.ExternalVolume\x12\'\n\x1fin_progress_local_snapshot_name\x18\x08 \x01(\t\x12\"\n\x1a\x63urrent_actor_template_uid\x18\x0b \x01(\t\"\xa7\x01\n\x10WorkerAssignment\x12!\n\x06worker\x18\x06 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x18\n\x10worker_namespace\x18\x01 \x01(\t\x12\x13\n\x0bworker_pool\x18\x02 \x01(\t\x12\x12\n\nworker_pod\x18\x03 \x01(\t\x12\x16\n\x0eworker_pod_uid\x18\x04 \x01(\t\x12\x15\n\rworker_pod_ip\x18\x05 \x01(\t\"\x87\x01\n\tTagStatus\x12*\n\x08snapshot\x18\x01 \x01(\x0b\x32\x18.ateapi.ExternalSnapshot\x12\x1a\n\x12\x61\x63tor_template_uid\x18\x02 \x01(\t\x12\x18\n\x10storage_location\x18\x03 \x01(\t\x12\x18\n\x10source_actor_uid\x18\x04 \x01(\t\"\x9e\x01\n\x03Tag\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12!\n\x06status\x18\x02 \x01(\x0b\x32\x11.ateapi.TagStatus\x12\x1f\n\x05scope\x18\x03 \x01(\x0e\x32\x10.ateapi.TagScope\x12\'\n\x0csource_actor\x18\x04 \x01(\x0b\x32\x11.ateapi.ObjectRef\"6\n\x08\x41tespace\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\"+\n\tObjectRef\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\"\xe3\x02\n\rActorTemplate\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12)\n\x0fworker_selector\x18\x02 \x01(\x0b\x32\x10.ateapi.Selector\x12%\n\ncontainers\x18\x03 \x03(\x0b\x32\x11.ateapi.Container\x12\x1f\n\x07volumes\x18\x04 \x03(\x0b\x32\x0e.ateapi.Volume\x12\x31\n\x10snapshots_config\x18\x05 \x01(\x0b\x32\x17.ateapi.SnapshotsConfig\x12-\n\x0esandbox_config\x18\x06 \x01(\x0b\x32\x15.ateapi.SandboxConfig\x12$\n\tresources\x18\x07 \x01(\x0b\x32\x11.ateapi.Resources\x12+\n\x06status\x18\x08 \x01(\x0b\x32\x1b.ateapi.ActorTemplateStatus\"+\n\tResources\x12\x1e\n\x06limits\x18\x01 \x03(\x0b\x32\x0e.ateapi.Limits\"(\n\x06Limits\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x10\n\x08quantity\x18\x02 \x01(\t\"\x91\x01\n\x14GoldenSnapshotStatus\x12%\n\ngolden_tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12;\n\x17take_golden_snapshot_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"S\n\x13\x41\x63torTemplateStatus\x12<\n\x16golden_snapshot_status\x18\x01 \x01(\x0b\x32\x1c.ateapi.GoldenSnapshotStatus\"Q\n\rSandboxConfig\x12+\n\rsandbox_class\x18\x01 \x01(\x0e\x32\x14.ateapi.SandboxClass\x12\x13\n\x0b\x63onfig_name\x18\x02 \x01(\t\"\xb7\x01\n\x0fSnapshotsConfig\x12.\n\x08on_pause\x18\x01 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\x12/\n\ton_commit\x18\x02 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\x12)\n\ton_resume\x18\x03 \x01(\x0b\x32\x16.ateapi.OnResumeConfig\x12\x18\n\x10storage_location\x18\x04 \x01(\t\"9\n\x0eOnResumeConfig\x12\'\n\tfrom_data\x18\x01 \x01(\x0e\x32\x14.ateapi.ResumeSource\"\x92\x02\n\tContainer\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05image\x18\x02 \x01(\t\x12\x0f\n\x07\x63ommand\x18\x03 \x03(\t\x12\x0c\n\x04\x61rgs\x18\x04 \x03(\t\x12\x1b\n\x03\x65nv\x18\x05 \x03(\x0b\x32\x0e.ateapi.EnvVar\x12\'\n\x06readyz\x18\x06 \x01(\x0b\x32\x17.ateapi.ContainerReadyz\x12*\n\rvolume_mounts\x18\x07 \x03(\x0b\x32\x13.ateapi.VolumeMount\x12\x31\n\x10security_context\x18\x08 \x01(\x0b\x32\x17.ateapi.SecurityContext\x12$\n\tresources\x18\t \x01(\x0b\x32\x11.ateapi.Resources\"=\n\x0fSecurityContext\x12*\n\x0c\x63\x61pabilities\x18\x01 \x01(\x0b\x32\x14.ateapi.Capabilities\")\n\x0c\x43\x61pabilities\x12\x0b\n\x03\x61\x64\x64\x18\x01 \x03(\t\x12\x0c\n\x04\x64rop\x18\x02 \x03(\t\"%\n\x06\x45nvVar\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\"S\n\x0f\x43ontainerReadyz\x12\'\n\x08http_get\x18\x01 \x01(\x0b\x32\x15.ateapi.HTTPGetAction\x12\x17\n\x0ftimeout_seconds\x18\x02 \x01(\x05\"+\n\rHTTPGetAction\x12\x0c\n\x04path\x18\x01 \x01(\t\x12\x0c\n\x04port\x18\x02 \x01(\x05\"\xec\x01\n\x06Volume\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x33\n\x0b\x64urable_dir\x18\x02 \x01(\x0b\x32\x1e.ateapi.DurableDirVolumeSource\x12@\n\x18\x65xternal_volume_template\x18\x03 \x01(\x0b\x32\x1e.ateapi.ExternalVolumeTemplate\x12\x33\n\x0bsystem_info\x18\x05 \x01(\x0b\x32\x1e.ateapi.SystemInfoVolumeSource\x12(\n\x05image\x18\x06 \x01(\x0b\x32\x19.ateapi.ImageVolumeSource\"&\n\x11ImageVolumeSource\x12\x11\n\treference\x18\x01 \x01(\t\"\x18\n\x16\x44urableDirVolumeSource\"F\n\x16\x45xternalVolumeTemplate\x12\x10\n\x08\x63\x61pacity\x18\x01 \x01(\t\x12\x1a\n\x12storage_class_name\x18\x02 \x01(\t\"L\n\x16SystemInfoVolumeSource\x12\x32\n\x0c\x64\x61ta_sources\x18\x01 \x03(\x0b\x32\x1c.ateapi.SystemInfoDataSource\"\x84\x01\n\x14SystemInfoDataSource\x12\x37\n\x0e\x61\x63tor_metadata\x18\x01 \x01(\x0b\x32\x1f.ateapi.ActorMetadataDataSource\x12\x33\n\x0ctrust_bundle\x18\x02 \x01(\x0b\x32\x1d.ateapi.TrustBundleDataSource\"C\n\x17\x41\x63torMetadataDataSource\x12(\n\x05items\x18\x01 \x03(\x0b\x32\x19.ateapi.ActorMetadataItem\"L\n\x11\x41\x63torMetadataItem\x12)\n\x05\x66ield\x18\x01 \x01(\x0e\x32\x1a.ateapi.ActorMetadataField\x12\x0c\n\x04path\x18\x02 \x01(\t\"3\n\x15TrustBundleDataSource\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\"/\n\x0bVolumeMount\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nmount_path\x18\x02 \x01(\t\";\n\x15\x43reateAtespaceRequest\x12\"\n\x08\x61tespace\x18\x01 \x01(\x0b\x32\x10.ateapi.Atespace\"9\n\x12GetAtespaceRequest\x12#\n\x08\x61tespace\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"=\n\x14ListAtespacesRequest\x12\x11\n\tpage_size\x18\x01 \x01(\x05\x12\x12\n\npage_token\x18\x02 \x01(\t\"U\n\x15ListAtespacesResponse\x12#\n\tatespaces\x18\x01 \x03(\x0b\x32\x10.ateapi.Atespace\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"<\n\x15\x44\x65leteAtespaceRequest\x12#\n\x08\x61tespace\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"K\n\x1a\x43reateActorTemplateRequest\x12-\n\x0e\x61\x63tor_template\x18\x01 \x01(\x0b\x32\x15.ateapi.ActorTemplate\"D\n\x17GetActorTemplateRequest\x12)\n\x0e\x61\x63tor_template\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"T\n\x19ListActorTemplatesRequest\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"e\n\x1aListActorTemplatesResponse\x12.\n\x0f\x61\x63tor_templates\x18\x01 \x03(\x0b\x32\x15.ateapi.ActorTemplate\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"G\n\x1a\x44\x65leteActorTemplateRequest\x12)\n\x0e\x61\x63tor_template\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"3\n\x0fGetActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"2\n\x12\x43reateActorRequest\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"2\n\x12UpdateActorRequest\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"7\n\x13SuspendActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"4\n\x14SuspendActorResponse\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"5\n\x11PauseActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"2\n\x12PauseActorResponse\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"6\n\x12ResumeActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"D\n\x13ResumeActorResponse\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\x12\x0f\n\x07resumed\x18\x02 \x01(\x08\"I\n\x12\x44\x65leteActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tany_state\x18\x02 \x01(\x08\"?\n\x1bGetActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"o\n\x1e\x43reateActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12+\n\regress_policy\x18\x02 \x01(\x0b\x32\x14.ateapi.EgressPolicy\"o\n\x1eUpdateActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12+\n\regress_policy\x18\x02 \x01(\x0b\x32\x14.ateapi.EgressPolicy\"B\n\x1e\x44\x65leteActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"/\n\rGetTagRequest\x12\x1e\n\x03tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"\\\n\x13MintActorJWTRequest\x12 \n\x05\x61\x63tor\x18\x05 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tactor_uid\x18\x07 \x01(\t\x12\x10\n\x08\x61udience\x18\x01 \x03(\t\")\n\x14MintActorJWTResponse\x12\x11\n\tactor_jwt\x18\x01 \x01(\t\"\xa9\x01\n\x1bMintActorCertificateRequest\x12 \n\x05\x61\x63tor\x18\x06 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tactor_uid\x18\x07 \x01(\t\x12#\n\x1b\x63\x65rtificate_signing_request\x18\x02 \x01(\x0c\x12\x30\n\x07purpose\x18\x04 \x01(\x0e\x32\x1f.ateapi.ActorCertificatePurpose\":\n\x1cMintActorCertificateResponse\x12\x1a\n\x12\x61\x63tor_certificates\x18\x01 \x03(\x0c\"D\n\x17GetActorSnapshotRequest\x12)\n\x0e\x61\x63tor_snapshot\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"K\n\x1aGetActorSnapshotTagRequest\x12-\n\x12\x61\x63tor_snapshot_tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"J\n\x0fListTagsRequest\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"F\n\x10ListTagsResponse\x12\x19\n\x04tags\x18\x01 \x03(\x0b\x32\x0b.ateapi.Tag\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\",\n\x10\x43reateTagRequest\x12\x18\n\x03tag\x18\x01 \x01(\x0b\x32\x0b.ateapi.Tag\",\n\x10UpdateTagRequest\x12\x18\n\x03tag\x18\x01 \x01(\x0b\x32\x0b.ateapi.Tag\"2\n\x10\x44\x65leteTagRequest\x12\x1e\n\x03tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"-\n\rDeleteOptions\x12\x0f\n\x07version\x18\x01 \x01(\x03\x12\x0b\n\x03uid\x18\x02 \x01(\t\"m\n!ListWorkerActorAssignmentsRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"q\n\"ListWorkerActorAssignmentsResponse\x12\x32\n\x11\x61\x63tor_assignments\x18\x01 \x03(\x0b\x32\x17.ateapi.ActorAssignment\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\";\n\x12ListWorkersRequest\x12\x11\n\tpage_size\x18\x01 \x01(\x05\x12\x12\n\npage_token\x18\x02 \x01(\t\"O\n\x13ListWorkersResponse\x12\x1f\n\x07workers\x18\x01 \x03(\x0b\x32\x0e.ateapi.Worker\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"5\n\x10GetWorkerRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"5\n\x13\x43reateWorkerRequest\x12\x1e\n\x06worker\x18\x01 \x01(\x0b\x32\x0e.ateapi.Worker\"5\n\x13UpdateWorkerRequest\x12\x1e\n\x06worker\x18\x01 \x01(\x0b\x32\x0e.ateapi.Worker\"`\n\x13\x44\x65leteWorkerRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12&\n\x07options\x18\x02 \x01(\x0b\x32\x15.ateapi.DeleteOptions\"7\n\x12\x44rainWorkerRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"L\n\x11ListActorsRequest\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"L\n\x12ListActorsResponse\x12\x1d\n\x06\x61\x63tors\x18\x01 \x03(\x0b\x32\r.ateapi.Actor\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"\xc6\x02\n\x06Worker\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12\x18\n\x10worker_namespace\x18\x02 \x01(\t\x12\x13\n\x0bworker_pool\x18\x03 \x01(\t\x12\x12\n\nworker_pod\x18\x04 \x01(\t\x12\x16\n\x0eworker_pod_uid\x18\x05 \x01(\t\x12\x11\n\tnode_name\x18\x06 \x01(\t\x12\n\n\x02ip\x18\x07 \x01(\t\x12\x15\n\rsandbox_class\x18\x08 \x01(\t\x12*\n\x06labels\x18\t \x03(\x0b\x32\x1a.ateapi.Worker.LabelsEntry\x12$\n\x06status\x18\x0b \x01(\x0b\x32\x14.ateapi.WorkerStatus\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x89\x01\n\x0cWorkerStatus\x12\"\n\x05state\x18\x01 \x01(\x0e\x32\x13.ateapi.WorkerState\x12)\n\x08\x63\x61pacity\x18\x02 \x01(\x0b\x32\x17.ateapi.WorkerResources\x12*\n\tallocated\x18\x03 \x01(\x0b\x32\x17.ateapi.WorkerResources\"G\n\x0fWorkerResources\x12$\n\tresources\x18\x01 \x01(\x0b\x32\x11.ateapi.Resources\x12\x0e\n\x06\x61\x63tors\x18\x02 \x01(\x05\"\xc7\x01\n\x0f\x41\x63torAssignment\x12*\n\x08metadata\x18\x06 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12 \n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tactor_uid\x18\x03 \x01(\t\x12-\n\x12\x61\x63tor_template_ref\x18\x04 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12$\n\tresources\x18\x05 \x01(\x0b\x32\x11.ateapi.Resources\"h\n\x18SetWorkerCapacityRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12)\n\x08\x63\x61pacity\x18\x02 \x01(\x0b\x32\x17.ateapi.WorkerResources\";\n\x19SetWorkerCapacityResponse\x12\x1e\n\x06worker\x18\x01 \x01(\x0b\x32\x0e.ateapi.Worker*\x80\x01\n\x14SnapshotContentScope\x12&\n\"SNAPSHOT_CONTENT_SCOPE_UNSPECIFIED\x10\x00\x12\x1f\n\x1bSNAPSHOT_CONTENT_SCOPE_FULL\x10\x01\x12\x1f\n\x1bSNAPSHOT_CONTENT_SCOPE_DATA\x10\x02*V\n\x08TagScope\x12\x19\n\x15TAG_SCOPE_UNSPECIFIED\x10\x00\x12\x16\n\x12TAG_SCOPE_ATESPACE\x10\x01\x12\x17\n\x13TAG_SCOPE_PUBLISHED\x10\x02*\xf7\x01\n\nActorState\x12\x1b\n\x17\x41\x43TOR_STATE_UNSPECIFIED\x10\x00\x12\x18\n\x14\x41\x43TOR_STATE_RESUMING\x10\x01\x12\x17\n\x13\x41\x43TOR_STATE_RUNNING\x10\x02\x12\x1a\n\x16\x41\x43TOR_STATE_SUSPENDING\x10\x03\x12\x19\n\x15\x41\x43TOR_STATE_SUSPENDED\x10\x04\x12\x17\n\x13\x41\x43TOR_STATE_PAUSING\x10\x05\x12\x16\n\x12\x41\x43TOR_STATE_PAUSED\x10\x06\x12\x17\n\x13\x41\x43TOR_STATE_CRASHED\x10\x07\x12\x18\n\x14\x41\x43TOR_STATE_DELETING\x10\x08*b\n\x0cSandboxClass\x12\x1d\n\x19SANDBOX_CLASS_UNSPECIFIED\x10\x00\x12\x18\n\x14SANDBOX_CLASS_GVISOR\x10\x01\x12\x19\n\x15SANDBOX_CLASS_MICROVM\x10\x02*d\n\x0cResumeSource\x12\x1d\n\x19RESUME_SOURCE_UNSPECIFIED\x10\x00\x12\x1b\n\x17RESUME_SOURCE_COLD_BOOT\x10\x01\x12\x18\n\x14RESUME_SOURCE_GOLDEN\x10\x02*\x9a\x01\n\x12\x41\x63torMetadataField\x12$\n ACTOR_METADATA_FIELD_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x41\x43TOR_METADATA_FIELD_NAME\x10\x01\x12!\n\x1d\x41\x43TOR_METADATA_FIELD_ATESPACE\x10\x02\x12\x1c\n\x18\x41\x43TOR_METADATA_FIELD_UID\x10\x03*k\n\x17\x41\x63torCertificatePurpose\x12)\n%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x01*_\n\x0bWorkerState\x12\x1c\n\x18WORKER_STATE_UNSPECIFIED\x10\x00\x12\x17\n\x13WORKER_STATE_ACTIVE\x10\x01\x12\x19\n\x15WORKER_STATE_DRAINING\x10\x02\x32\xa5\x13\n\x07\x43ontrol\x12\x34\n\x08GetActor\x12\x17.ateapi.GetActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n\x0b\x43reateActor\x12\x1a.ateapi.CreateActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n\x0bUpdateActor\x12\x1a.ateapi.UpdateActorRequest\x1a\r.ateapi.Actor\"\x00\x12K\n\x0cSuspendActor\x12\x1b.ateapi.SuspendActorRequest\x1a\x1c.ateapi.SuspendActorResponse\"\x00\x12\x45\n\nPauseActor\x12\x19.ateapi.PauseActorRequest\x1a\x1a.ateapi.PauseActorResponse\"\x00\x12H\n\x0bResumeActor\x12\x1a.ateapi.ResumeActorRequest\x1a\x1b.ateapi.ResumeActorResponse\"\x00\x12:\n\x0b\x44\x65leteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12S\n\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n\x17\x43reateActorEgressPolicy\x12&.ateapi.CreateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n\x17UpdateActorEgressPolicy\x12&.ateapi.UpdateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n\x17\x44\x65leteActorEgressPolicy\x12&.ateapi.DeleteActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12K\n\x0cMintActorJWT\x12\x1b.ateapi.MintActorJWTRequest\x1a\x1c.ateapi.MintActorJWTResponse\"\x00\x12\x63\n\x14MintActorCertificate\x12#.ateapi.MintActorCertificateRequest\x1a$.ateapi.MintActorCertificateResponse\"\x00\x12\x34\n\tCreateTag\x12\x18.ateapi.CreateTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12.\n\x06GetTag\x12\x15.ateapi.GetTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12?\n\x08ListTags\x12\x17.ateapi.ListTagsRequest\x1a\x18.ateapi.ListTagsResponse\"\x00\x12\x34\n\tUpdateTag\x12\x18.ateapi.UpdateTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12\x34\n\tDeleteTag\x12\x18.ateapi.DeleteTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12H\n\x0bListWorkers\x12\x1a.ateapi.ListWorkersRequest\x1a\x1b.ateapi.ListWorkersResponse\"\x00\x12\x37\n\tGetWorker\x12\x18.ateapi.GetWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12=\n\x0c\x43reateWorker\x12\x1b.ateapi.CreateWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12=\n\x0cUpdateWorker\x12\x1b.ateapi.UpdateWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12=\n\x0c\x44\x65leteWorker\x12\x1b.ateapi.DeleteWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12;\n\x0b\x44rainWorker\x12\x1a.ateapi.DrainWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12u\n\x1aListWorkerActorAssignments\x12).ateapi.ListWorkerActorAssignmentsRequest\x1a*.ateapi.ListWorkerActorAssignmentsResponse\"\x00\x12\x45\n\nListActors\x12\x19.ateapi.ListActorsRequest\x1a\x1a.ateapi.ListActorsResponse\"\x00\x12\x43\n\x0e\x43reateAtespace\x12\x1d.ateapi.CreateAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12=\n\x0bGetAtespace\x12\x1a.ateapi.GetAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12N\n\rListAtespaces\x12\x1c.ateapi.ListAtespacesRequest\x1a\x1d.ateapi.ListAtespacesResponse\"\x00\x12\x43\n\x0e\x44\x65leteAtespace\x12\x1d.ateapi.DeleteAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12R\n\x13\x43reateActorTemplate\x12\".ateapi.CreateActorTemplateRequest\x1a\x15.ateapi.ActorTemplate\"\x00\x12L\n\x10GetActorTemplate\x12\x1f.ateapi.GetActorTemplateRequest\x1a\x15.ateapi.ActorTemplate\"\x00\x12]\n\x12ListActorTemplates\x12!.ateapi.ListActorTemplatesRequest\x1a\".ateapi.ListActorTemplatesResponse\"\x00\x12R\n\x13\x44\x65leteActorTemplate\x12\".ateapi.DeleteActorTemplateRequest\x1a\x15.ateapi.ActorTemplate\"\x00\x32i\n\rWorkerService\x12X\n\x11SetWorkerCapacity\x12 .ateapi.SetWorkerCapacityRequest\x1a!.ateapi.SetWorkerCapacityResponseB9Z7github.com/agent-substrate/substrate/pkg/proto/ateapipbb\x06proto3')
+DESCRIPTOR = _descriptor_pool.Default().AddSerializedFile(b'\n\x0c\x61teapi.proto\x12\x06\x61teapi\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"]\n\x10\x45xternalSnapshot\x12\x14\n\x0csnapshot_uri\x18\x01 \x01(\t\x12\x33\n\rcontent_scope\x18\x02 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\"\x86\x01\n\x11LocalSnapshotInfo\x12\x15\n\rsnapshot_name\x18\x01 \x01(\t\x12%\n\x1dnode_vms_with_local_snapshots\x18\x02 \x03(\t\x12\x33\n\rcontent_scope\x18\x03 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\"w\n\x08Selector\x12\x37\n\x0cmatch_labels\x18\x01 \x03(\x0b\x32!.ateapi.Selector.MatchLabelsEntry\x1a\x32\n\x10MatchLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\xb2\x01\n\x10ResourceMetadata\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\x12\x0b\n\x03uid\x18\x03 \x01(\t\x12\x0f\n\x07version\x18\x04 \x01(\x03\x12/\n\x0b\x63reate_time\x18\x05 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12/\n\x0bupdate_time\x18\x06 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\"\xdc\x02\n\x0e\x45xternalVolume\x12\x13\n\x0bvolume_name\x18\x01 \x01(\t\x12\x19\n\x11storage_volume_id\x18\x02 \x01(\t\x12\x13\n\x0bvolume_type\x18\x03 \x01(\t\x12-\n\x06status\x18\x04 \x01(\x0e\x32\x1d.ateapi.ExternalVolume.Status\x12\x41\n\x0evolume_context\x18\x05 \x03(\x0b\x32).ateapi.ExternalVolume.VolumeContextEntry\x1a\x34\n\x12VolumeContextEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"]\n\x06Status\x12\x16\n\x12STATUS_UNSPECIFIED\x10\x00\x12\x12\n\x0eSTATUS_PENDING\x10\x01\x12\x12\n\x0eSTATUS_CREATED\x10\x02\x12\x13\n\x0fSTATUS_DELETING\x10\x03\"\xd5\x01\n\x05\x41\x63tor\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12)\n\x0e\x61\x63tor_template\x18\x04 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12)\n\x0fworker_selector\x18\x05 \x01(\x0b\x32\x10.ateapi.Selector\x12%\n\nsource_tag\x18\x06 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12#\n\x06status\x18\x07 \x01(\x0b\x32\x13.ateapi.ActorStatus\"]\n\x0c\x45gressPolicy\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12!\n\x05rules\x18\x02 \x03(\x0b\x32\x12.ateapi.EgressRule\"{\n\nEgressRule\x12\'\n\thostnames\x18\x01 \x01(\x0b\x32\x14.ateapi.HostnameRule\x12\x1f\n\x05\x63idrs\x18\x02 \x01(\x0b\x32\x10.ateapi.CIDRRule\x12#\n\x03\x61ll\x18\x03 \x01(\x0b\x32\x16.google.protobuf.Empty\"L\n\x0cHostnameRule\x12\x10\n\x08patterns\x18\x01 \x03(\t\x12*\n\x07\x65\x66\x66\x65\x63ts\x18\x02 \x01(\x0b\x32\x19.ateapi.EgressRuleEffects\"\x19\n\x08\x43IDRRule\x12\r\n\x05\x63idrs\x18\x01 \x03(\t\"U\n\x11\x45gressRuleEffects\x12@\n\x15inject_static_headers\x18\x01 \x03(\x0b\x32!.ateapi.CredentialHeaderInjection\"S\n\x19\x43redentialHeaderInjection\x12\x0e\n\x06header\x18\x01 \x01(\t\x12\x0e\n\x06prefix\x18\x02 \x01(\t\x12\x16\n\x0e\x63redential_uri\x18\x03 \x01(\t\"\xf0\x02\n\x0b\x41\x63torStatus\x12!\n\x05state\x18\x01 \x01(\x0e\x32\x12.ateapi.ActorState\x12\x33\n\x11worker_assignment\x18\x02 \x01(\x0b\x32\x18.ateapi.WorkerAssignment\x12 \n\x18in_progress_snapshot_uri\x18\x03 \x01(\t\x12\x33\n\x11\x65xternal_snapshot\x18\x04 \x01(\x0b\x32\x18.ateapi.ExternalSnapshot\x12\x36\n\x13local_snapshot_info\x18\x05 \x01(\x0b\x32\x19.ateapi.LocalSnapshotInfo\x12-\n\ractor_volumes\x18\x07 \x03(\x0b\x32\x16.ateapi.ExternalVolume\x12\'\n\x1fin_progress_local_snapshot_name\x18\x08 \x01(\t\x12\"\n\x1a\x63urrent_actor_template_uid\x18\x0b \x01(\t\"\xa7\x01\n\x10WorkerAssignment\x12!\n\x06worker\x18\x06 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x18\n\x10worker_namespace\x18\x01 \x01(\t\x12\x13\n\x0bworker_pool\x18\x02 \x01(\t\x12\x12\n\nworker_pod\x18\x03 \x01(\t\x12\x16\n\x0eworker_pod_uid\x18\x04 \x01(\t\x12\x15\n\rworker_pod_ip\x18\x05 \x01(\t\"\x87\x01\n\tTagStatus\x12*\n\x08snapshot\x18\x01 \x01(\x0b\x32\x18.ateapi.ExternalSnapshot\x12\x1a\n\x12\x61\x63tor_template_uid\x18\x02 \x01(\t\x12\x18\n\x10storage_location\x18\x03 \x01(\t\x12\x18\n\x10source_actor_uid\x18\x04 \x01(\t\"\x9e\x01\n\x03Tag\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12!\n\x06status\x18\x02 \x01(\x0b\x32\x11.ateapi.TagStatus\x12\x1f\n\x05scope\x18\x03 \x01(\x0e\x32\x10.ateapi.TagScope\x12\'\n\x0csource_actor\x18\x04 \x01(\x0b\x32\x11.ateapi.ObjectRef\"6\n\x08\x41tespace\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\"+\n\tObjectRef\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x0c\n\x04name\x18\x02 \x01(\t\"\xe3\x02\n\rActorTemplate\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12)\n\x0fworker_selector\x18\x02 \x01(\x0b\x32\x10.ateapi.Selector\x12%\n\ncontainers\x18\x03 \x03(\x0b\x32\x11.ateapi.Container\x12\x1f\n\x07volumes\x18\x04 \x03(\x0b\x32\x0e.ateapi.Volume\x12\x31\n\x10snapshots_config\x18\x05 \x01(\x0b\x32\x17.ateapi.SnapshotsConfig\x12-\n\x0esandbox_config\x18\x06 \x01(\x0b\x32\x15.ateapi.SandboxConfig\x12$\n\tresources\x18\x07 \x01(\x0b\x32\x11.ateapi.Resources\x12+\n\x06status\x18\x08 \x01(\x0b\x32\x1b.ateapi.ActorTemplateStatus\"+\n\tResources\x12\x1e\n\x06limits\x18\x01 \x03(\x0b\x32\x0e.ateapi.Limits\"(\n\x06Limits\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x10\n\x08quantity\x18\x02 \x01(\t\"\x91\x01\n\x14GoldenSnapshotStatus\x12%\n\ngolden_tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12;\n\x17take_golden_snapshot_at\x18\x02 \x01(\x0b\x32\x1a.google.protobuf.Timestamp\x12\x15\n\rerror_message\x18\x03 \x01(\t\"S\n\x13\x41\x63torTemplateStatus\x12<\n\x16golden_snapshot_status\x18\x01 \x01(\x0b\x32\x1c.ateapi.GoldenSnapshotStatus\"Q\n\rSandboxConfig\x12+\n\rsandbox_class\x18\x01 \x01(\x0e\x32\x14.ateapi.SandboxClass\x12\x13\n\x0b\x63onfig_name\x18\x02 \x01(\t\"\xb7\x01\n\x0fSnapshotsConfig\x12.\n\x08on_pause\x18\x01 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\x12/\n\ton_commit\x18\x02 \x01(\x0e\x32\x1c.ateapi.SnapshotContentScope\x12)\n\ton_resume\x18\x03 \x01(\x0b\x32\x16.ateapi.OnResumeConfig\x12\x18\n\x10storage_location\x18\x04 \x01(\t\"9\n\x0eOnResumeConfig\x12\'\n\tfrom_data\x18\x01 \x01(\x0e\x32\x14.ateapi.ResumeSource\"\x92\x02\n\tContainer\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05image\x18\x02 \x01(\t\x12\x0f\n\x07\x63ommand\x18\x03 \x03(\t\x12\x0c\n\x04\x61rgs\x18\x04 \x03(\t\x12\x1b\n\x03\x65nv\x18\x05 \x03(\x0b\x32\x0e.ateapi.EnvVar\x12\'\n\x06readyz\x18\x06 \x01(\x0b\x32\x17.ateapi.ContainerReadyz\x12*\n\rvolume_mounts\x18\x07 \x03(\x0b\x32\x13.ateapi.VolumeMount\x12\x31\n\x10security_context\x18\x08 \x01(\x0b\x32\x17.ateapi.SecurityContext\x12$\n\tresources\x18\t \x01(\x0b\x32\x11.ateapi.Resources\"=\n\x0fSecurityContext\x12*\n\x0c\x63\x61pabilities\x18\x01 \x01(\x0b\x32\x14.ateapi.Capabilities\")\n\x0c\x43\x61pabilities\x12\x0b\n\x03\x61\x64\x64\x18\x01 \x03(\t\x12\x0c\n\x04\x64rop\x18\x02 \x03(\t\"%\n\x06\x45nvVar\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t\"S\n\x0f\x43ontainerReadyz\x12\'\n\x08http_get\x18\x01 \x01(\x0b\x32\x15.ateapi.HTTPGetAction\x12\x17\n\x0ftimeout_seconds\x18\x02 \x01(\x05\"+\n\rHTTPGetAction\x12\x0c\n\x04path\x18\x01 \x01(\t\x12\x0c\n\x04port\x18\x02 \x01(\x05\"\xec\x01\n\x06Volume\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x33\n\x0b\x64urable_dir\x18\x02 \x01(\x0b\x32\x1e.ateapi.DurableDirVolumeSource\x12@\n\x18\x65xternal_volume_template\x18\x03 \x01(\x0b\x32\x1e.ateapi.ExternalVolumeTemplate\x12\x33\n\x0bsystem_info\x18\x05 \x01(\x0b\x32\x1e.ateapi.SystemInfoVolumeSource\x12(\n\x05image\x18\x06 \x01(\x0b\x32\x19.ateapi.ImageVolumeSource\"&\n\x11ImageVolumeSource\x12\x11\n\treference\x18\x01 \x01(\t\"\x18\n\x16\x44urableDirVolumeSource\"F\n\x16\x45xternalVolumeTemplate\x12\x10\n\x08\x63\x61pacity\x18\x01 \x01(\t\x12\x1a\n\x12storage_class_name\x18\x02 \x01(\t\"L\n\x16SystemInfoVolumeSource\x12\x32\n\x0c\x64\x61ta_sources\x18\x01 \x03(\x0b\x32\x1c.ateapi.SystemInfoDataSource\"\x84\x01\n\x14SystemInfoDataSource\x12\x37\n\x0e\x61\x63tor_metadata\x18\x01 \x01(\x0b\x32\x1f.ateapi.ActorMetadataDataSource\x12\x33\n\x0ctrust_bundle\x18\x02 \x01(\x0b\x32\x1d.ateapi.TrustBundleDataSource\"C\n\x17\x41\x63torMetadataDataSource\x12(\n\x05items\x18\x01 \x03(\x0b\x32\x19.ateapi.ActorMetadataItem\"L\n\x11\x41\x63torMetadataItem\x12)\n\x05\x66ield\x18\x01 \x01(\x0e\x32\x1a.ateapi.ActorMetadataField\x12\x0c\n\x04path\x18\x02 \x01(\t\"3\n\x15TrustBundleDataSource\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x0c\n\x04path\x18\x02 \x01(\t\"/\n\x0bVolumeMount\x12\x0c\n\x04name\x18\x01 \x01(\t\x12\x12\n\nmount_path\x18\x02 \x01(\t\";\n\x15\x43reateAtespaceRequest\x12\"\n\x08\x61tespace\x18\x01 \x01(\x0b\x32\x10.ateapi.Atespace\"9\n\x12GetAtespaceRequest\x12#\n\x08\x61tespace\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"=\n\x14ListAtespacesRequest\x12\x11\n\tpage_size\x18\x01 \x01(\x05\x12\x12\n\npage_token\x18\x02 \x01(\t\"U\n\x15ListAtespacesResponse\x12#\n\tatespaces\x18\x01 \x03(\x0b\x32\x10.ateapi.Atespace\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"<\n\x15\x44\x65leteAtespaceRequest\x12#\n\x08\x61tespace\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"K\n\x1a\x43reateActorTemplateRequest\x12-\n\x0e\x61\x63tor_template\x18\x01 \x01(\x0b\x32\x15.ateapi.ActorTemplate\"D\n\x17GetActorTemplateRequest\x12)\n\x0e\x61\x63tor_template\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"T\n\x19ListActorTemplatesRequest\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"e\n\x1aListActorTemplatesResponse\x12.\n\x0f\x61\x63tor_templates\x18\x01 \x03(\x0b\x32\x15.ateapi.ActorTemplate\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"G\n\x1a\x44\x65leteActorTemplateRequest\x12)\n\x0e\x61\x63tor_template\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"3\n\x0fGetActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"2\n\x12\x43reateActorRequest\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"2\n\x12UpdateActorRequest\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"7\n\x13SuspendActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"4\n\x14SuspendActorResponse\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"5\n\x11PauseActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"2\n\x12PauseActorResponse\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\"6\n\x12ResumeActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"D\n\x13ResumeActorResponse\x12\x1c\n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\r.ateapi.Actor\x12\x0f\n\x07resumed\x18\x02 \x01(\x08\"I\n\x12\x44\x65leteActorRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tany_state\x18\x02 \x01(\x08\"?\n\x1bGetActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"o\n\x1e\x43reateActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12+\n\regress_policy\x18\x02 \x01(\x0b\x32\x14.ateapi.EgressPolicy\"o\n\x1eUpdateActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12+\n\regress_policy\x18\x02 \x01(\x0b\x32\x14.ateapi.EgressPolicy\"B\n\x1e\x44\x65leteActorEgressPolicyRequest\x12 \n\x05\x61\x63tor\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"/\n\rGetTagRequest\x12\x1e\n\x03tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"\\\n\x13MintActorJWTRequest\x12 \n\x05\x61\x63tor\x18\x05 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tactor_uid\x18\x07 \x01(\t\x12\x10\n\x08\x61udience\x18\x01 \x03(\t\")\n\x14MintActorJWTResponse\x12\x11\n\tactor_jwt\x18\x01 \x01(\t\"\xa9\x01\n\x1bMintActorCertificateRequest\x12 \n\x05\x61\x63tor\x18\x06 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tactor_uid\x18\x07 \x01(\t\x12#\n\x1b\x63\x65rtificate_signing_request\x18\x02 \x01(\x0c\x12\x30\n\x07purpose\x18\x04 \x01(\x0e\x32\x1f.ateapi.ActorCertificatePurpose\":\n\x1cMintActorCertificateResponse\x12\x1a\n\x12\x61\x63tor_certificates\x18\x01 \x03(\x0c\"D\n\x17GetActorSnapshotRequest\x12)\n\x0e\x61\x63tor_snapshot\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"K\n\x1aGetActorSnapshotTagRequest\x12-\n\x12\x61\x63tor_snapshot_tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"J\n\x0fListTagsRequest\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"F\n\x10ListTagsResponse\x12\x19\n\x04tags\x18\x01 \x03(\x0b\x32\x0b.ateapi.Tag\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\",\n\x10\x43reateTagRequest\x12\x18\n\x03tag\x18\x01 \x01(\x0b\x32\x0b.ateapi.Tag\",\n\x10UpdateTagRequest\x12\x18\n\x03tag\x18\x01 \x01(\x0b\x32\x0b.ateapi.Tag\"2\n\x10\x44\x65leteTagRequest\x12\x1e\n\x03tag\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"-\n\rDeleteOptions\x12\x0f\n\x07version\x18\x01 \x01(\x03\x12\x0b\n\x03uid\x18\x02 \x01(\t\"m\n!ListWorkerActorAssignmentsRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"q\n\"ListWorkerActorAssignmentsResponse\x12\x32\n\x11\x61\x63tor_assignments\x18\x01 \x03(\x0b\x32\x17.ateapi.ActorAssignment\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\";\n\x12ListWorkersRequest\x12\x11\n\tpage_size\x18\x01 \x01(\x05\x12\x12\n\npage_token\x18\x02 \x01(\t\"O\n\x13ListWorkersResponse\x12\x1f\n\x07workers\x18\x01 \x03(\x0b\x32\x0e.ateapi.Worker\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"5\n\x10GetWorkerRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"5\n\x13\x43reateWorkerRequest\x12\x1e\n\x06worker\x18\x01 \x01(\x0b\x32\x0e.ateapi.Worker\"5\n\x13UpdateWorkerRequest\x12\x1e\n\x06worker\x18\x01 \x01(\x0b\x32\x0e.ateapi.Worker\"`\n\x13\x44\x65leteWorkerRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12&\n\x07options\x18\x02 \x01(\x0b\x32\x15.ateapi.DeleteOptions\"7\n\x12\x44rainWorkerRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\"L\n\x11ListActorsRequest\x12\x10\n\x08\x61tespace\x18\x01 \x01(\t\x12\x11\n\tpage_size\x18\x02 \x01(\x05\x12\x12\n\npage_token\x18\x03 \x01(\t\"L\n\x12ListActorsResponse\x12\x1d\n\x06\x61\x63tors\x18\x01 \x03(\x0b\x32\r.ateapi.Actor\x12\x17\n\x0fnext_page_token\x18\x02 \x01(\t\"\xc6\x02\n\x06Worker\x12*\n\x08metadata\x18\x01 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12\x18\n\x10worker_namespace\x18\x02 \x01(\t\x12\x13\n\x0bworker_pool\x18\x03 \x01(\t\x12\x12\n\nworker_pod\x18\x04 \x01(\t\x12\x16\n\x0eworker_pod_uid\x18\x05 \x01(\t\x12\x11\n\tnode_name\x18\x06 \x01(\t\x12\n\n\x02ip\x18\x07 \x01(\t\x12\x15\n\rsandbox_class\x18\x08 \x01(\t\x12*\n\x06labels\x18\t \x03(\x0b\x32\x1a.ateapi.Worker.LabelsEntry\x12$\n\x06status\x18\x0b \x01(\x0b\x32\x14.ateapi.WorkerStatus\x1a-\n\x0bLabelsEntry\x12\x0b\n\x03key\x18\x01 \x01(\t\x12\r\n\x05value\x18\x02 \x01(\t:\x02\x38\x01\"\x89\x01\n\x0cWorkerStatus\x12\"\n\x05state\x18\x01 \x01(\x0e\x32\x13.ateapi.WorkerState\x12)\n\x08\x63\x61pacity\x18\x02 \x01(\x0b\x32\x17.ateapi.WorkerResources\x12*\n\tallocated\x18\x03 \x01(\x0b\x32\x17.ateapi.WorkerResources\"G\n\x0fWorkerResources\x12$\n\tresources\x18\x01 \x01(\x0b\x32\x11.ateapi.Resources\x12\x0e\n\x06\x61\x63tors\x18\x02 \x01(\x05\"\xc7\x01\n\x0f\x41\x63torAssignment\x12*\n\x08metadata\x18\x06 \x01(\x0b\x32\x18.ateapi.ResourceMetadata\x12 \n\x05\x61\x63tor\x18\x02 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12\x11\n\tactor_uid\x18\x03 \x01(\t\x12-\n\x12\x61\x63tor_template_ref\x18\x04 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12$\n\tresources\x18\x05 \x01(\x0b\x32\x11.ateapi.Resources\"h\n\x18SetWorkerCapacityRequest\x12!\n\x06worker\x18\x01 \x01(\x0b\x32\x11.ateapi.ObjectRef\x12)\n\x08\x63\x61pacity\x18\x02 \x01(\x0b\x32\x17.ateapi.WorkerResources\";\n\x19SetWorkerCapacityResponse\x12\x1e\n\x06worker\x18\x01 \x01(\x0b\x32\x0e.ateapi.Worker*\x80\x01\n\x14SnapshotContentScope\x12&\n\"SNAPSHOT_CONTENT_SCOPE_UNSPECIFIED\x10\x00\x12\x1f\n\x1bSNAPSHOT_CONTENT_SCOPE_FULL\x10\x01\x12\x1f\n\x1bSNAPSHOT_CONTENT_SCOPE_DATA\x10\x02*V\n\x08TagScope\x12\x19\n\x15TAG_SCOPE_UNSPECIFIED\x10\x00\x12\x16\n\x12TAG_SCOPE_ATESPACE\x10\x01\x12\x17\n\x13TAG_SCOPE_PUBLISHED\x10\x02*\xf7\x01\n\nActorState\x12\x1b\n\x17\x41\x43TOR_STATE_UNSPECIFIED\x10\x00\x12\x18\n\x14\x41\x43TOR_STATE_RESUMING\x10\x01\x12\x17\n\x13\x41\x43TOR_STATE_RUNNING\x10\x02\x12\x1a\n\x16\x41\x43TOR_STATE_SUSPENDING\x10\x03\x12\x19\n\x15\x41\x43TOR_STATE_SUSPENDED\x10\x04\x12\x17\n\x13\x41\x43TOR_STATE_PAUSING\x10\x05\x12\x16\n\x12\x41\x43TOR_STATE_PAUSED\x10\x06\x12\x17\n\x13\x41\x43TOR_STATE_CRASHED\x10\x07\x12\x18\n\x14\x41\x43TOR_STATE_DELETING\x10\x08*z\n\x0cSandboxClass\x12\x1d\n\x19SANDBOX_CLASS_UNSPECIFIED\x10\x00\x12\x18\n\x14SANDBOX_CLASS_GVISOR\x10\x01\x12\x19\n\x15SANDBOX_CLASS_MICROVM\x10\x02\x12\x16\n\x12SANDBOX_CLASS_KATA\x10\x03*d\n\x0cResumeSource\x12\x1d\n\x19RESUME_SOURCE_UNSPECIFIED\x10\x00\x12\x1b\n\x17RESUME_SOURCE_COLD_BOOT\x10\x01\x12\x18\n\x14RESUME_SOURCE_GOLDEN\x10\x02*\x9a\x01\n\x12\x41\x63torMetadataField\x12$\n ACTOR_METADATA_FIELD_UNSPECIFIED\x10\x00\x12\x1d\n\x19\x41\x43TOR_METADATA_FIELD_NAME\x10\x01\x12!\n\x1d\x41\x43TOR_METADATA_FIELD_ATESPACE\x10\x02\x12\x1c\n\x18\x41\x43TOR_METADATA_FIELD_UID\x10\x03*k\n\x17\x41\x63torCertificatePurpose\x12)\n%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x01*_\n\x0bWorkerState\x12\x1c\n\x18WORKER_STATE_UNSPECIFIED\x10\x00\x12\x17\n\x13WORKER_STATE_ACTIVE\x10\x01\x12\x19\n\x15WORKER_STATE_DRAINING\x10\x02\x32\xa5\x13\n\x07\x43ontrol\x12\x34\n\x08GetActor\x12\x17.ateapi.GetActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n\x0b\x43reateActor\x12\x1a.ateapi.CreateActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n\x0bUpdateActor\x12\x1a.ateapi.UpdateActorRequest\x1a\r.ateapi.Actor\"\x00\x12K\n\x0cSuspendActor\x12\x1b.ateapi.SuspendActorRequest\x1a\x1c.ateapi.SuspendActorResponse\"\x00\x12\x45\n\nPauseActor\x12\x19.ateapi.PauseActorRequest\x1a\x1a.ateapi.PauseActorResponse\"\x00\x12H\n\x0bResumeActor\x12\x1a.ateapi.ResumeActorRequest\x1a\x1b.ateapi.ResumeActorResponse\"\x00\x12:\n\x0b\x44\x65leteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12S\n\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n\x17\x43reateActorEgressPolicy\x12&.ateapi.CreateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n\x17UpdateActorEgressPolicy\x12&.ateapi.UpdateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n\x17\x44\x65leteActorEgressPolicy\x12&.ateapi.DeleteActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12K\n\x0cMintActorJWT\x12\x1b.ateapi.MintActorJWTRequest\x1a\x1c.ateapi.MintActorJWTResponse\"\x00\x12\x63\n\x14MintActorCertificate\x12#.ateapi.MintActorCertificateRequest\x1a$.ateapi.MintActorCertificateResponse\"\x00\x12\x34\n\tCreateTag\x12\x18.ateapi.CreateTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12.\n\x06GetTag\x12\x15.ateapi.GetTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12?\n\x08ListTags\x12\x17.ateapi.ListTagsRequest\x1a\x18.ateapi.ListTagsResponse\"\x00\x12\x34\n\tUpdateTag\x12\x18.ateapi.UpdateTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12\x34\n\tDeleteTag\x12\x18.ateapi.DeleteTagRequest\x1a\x0b.ateapi.Tag\"\x00\x12H\n\x0bListWorkers\x12\x1a.ateapi.ListWorkersRequest\x1a\x1b.ateapi.ListWorkersResponse\"\x00\x12\x37\n\tGetWorker\x12\x18.ateapi.GetWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12=\n\x0c\x43reateWorker\x12\x1b.ateapi.CreateWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12=\n\x0cUpdateWorker\x12\x1b.ateapi.UpdateWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12=\n\x0c\x44\x65leteWorker\x12\x1b.ateapi.DeleteWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12;\n\x0b\x44rainWorker\x12\x1a.ateapi.DrainWorkerRequest\x1a\x0e.ateapi.Worker\"\x00\x12u\n\x1aListWorkerActorAssignments\x12).ateapi.ListWorkerActorAssignmentsRequest\x1a*.ateapi.ListWorkerActorAssignmentsResponse\"\x00\x12\x45\n\nListActors\x12\x19.ateapi.ListActorsRequest\x1a\x1a.ateapi.ListActorsResponse\"\x00\x12\x43\n\x0e\x43reateAtespace\x12\x1d.ateapi.CreateAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12=\n\x0bGetAtespace\x12\x1a.ateapi.GetAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12N\n\rListAtespaces\x12\x1c.ateapi.ListAtespacesRequest\x1a\x1d.ateapi.ListAtespacesResponse\"\x00\x12\x43\n\x0e\x44\x65leteAtespace\x12\x1d.ateapi.DeleteAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12R\n\x13\x43reateActorTemplate\x12\".ateapi.CreateActorTemplateRequest\x1a\x15.ateapi.ActorTemplate\"\x00\x12L\n\x10GetActorTemplate\x12\x1f.ateapi.GetActorTemplateRequest\x1a\x15.ateapi.ActorTemplate\"\x00\x12]\n\x12ListActorTemplates\x12!.ateapi.ListActorTemplatesRequest\x1a\".ateapi.ListActorTemplatesResponse\"\x00\x12R\n\x13\x44\x65leteActorTemplate\x12\".ateapi.DeleteActorTemplateRequest\x1a\x15.ateapi.ActorTemplate\"\x00\x32i\n\rWorkerService\x12X\n\x11SetWorkerCapacity\x12 .ateapi.SetWorkerCapacityRequest\x1a!.ateapi.SetWorkerCapacityResponseB9Z7github.com/agent-substrate/substrate/pkg/proto/ateapipbb\x06proto3')
 
 _globals = globals()
 _builder.BuildMessageAndEnumDescriptors(DESCRIPTOR, _globals)
@@ -61,15 +61,15 @@
   _globals['_ACTORSTATE']._serialized_start=9577
   _globals['_ACTORSTATE']._serialized_end=9824
   _globals['_SANDBOXCLASS']._serialized_start=9826
-  _globals['_SANDBOXCLASS']._serialized_end=9924
-  _globals['_RESUMESOURCE']._serialized_start=9926
-  _globals['_RESUMESOURCE']._serialized_end=10026
-  _globals['_ACTORMETADATAFIELD']._serialized_start=10029
-  _globals['_ACTORMETADATAFIELD']._serialized_end=10183
-  _globals['_ACTORCERTIFICATEPURPOSE']._serialized_start=10185
-  _globals['_ACTORCERTIFICATEPURPOSE']._serialized_end=10292
-  _globals['_WORKERSTATE']._serialized_start=10294
-  _globals['_WORKERSTATE']._serialized_end=10389
+  _globals['_SANDBOXCLASS']._serialized_end=9948
+  _globals['_RESUMESOURCE']._serialized_start=9950
+  _globals['_RESUMESOURCE']._serialized_end=10050
+  _globals['_ACTORMETADATAFIELD']._serialized_start=10053
+  _globals['_ACTORMETADATAFIELD']._serialized_end=10207
+  _globals['_ACTORCERTIFICATEPURPOSE']._serialized_start=10209
+  _globals['_ACTORCERTIFICATEPURPOSE']._serialized_end=10316
+  _globals['_WORKERSTATE']._serialized_start=10318
+  _globals['_WORKERSTATE']._serialized_end=10413
   _globals['_EXTERNALSNAPSHOT']._serialized_start=86
   _globals['_EXTERNALSNAPSHOT']._serialized_end=179
   _globals['_LOCALSNAPSHOTINFO']._serialized_start=182
@@ -270,8 +270,8 @@
   _globals['_SETWORKERCAPACITYREQUEST']._serialized_end=9294
   _globals['_SETWORKERCAPACITYRESPONSE']._serialized_start=9296
   _globals['_SETWORKERCAPACITYRESPONSE']._serialized_end=9355
-  _globals['_CONTROL']._serialized_start=10392
-  _globals['_CONTROL']._serialized_end=12861
-  _globals['_WORKERSERVICE']._serialized_start=12863
-  _globals['_WORKERSERVICE']._serialized_end=12968
+  _globals['_CONTROL']._serialized_start=10416
+  _globals['_CONTROL']._serialized_end=12885
+  _globals['_WORKERSERVICE']._serialized_start=12887
+  _globals['_WORKERSERVICE']._serialized_end=12992
 # @@protoc_insertion_point(module_scope)
diff --git a/build/ateom-kata/Dockerfile b/build/ateom-kata/Dockerfile
new file mode 100644
index 0000000000..202578d770
--- /dev/null
+++ b/build/ateom-kata/Dockerfile
@@ -0,0 +1,21 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+FROM registry.fedoraproject.org/fedora:43
+
+RUN dnf -y install e2fsprogs iproute iproute-tc util-linux && dnf clean all
+
+COPY ateom-kata /ateom-kata
+
+ENTRYPOINT ["/ateom-kata"]
diff --git a/cmd/ateapi/internal/controlapi/converter.go b/cmd/ateapi/internal/controlapi/converter.go
index 5d1e80080b..caaab9929e 100644
--- a/cmd/ateapi/internal/controlapi/converter.go
+++ b/cmd/ateapi/internal/controlapi/converter.go
@@ -35,6 +35,8 @@ func sandboxClassString(in ateapipb.SandboxClass) string {
 		return string(atev1alpha1.SandboxClassGvisor)
 	case ateapipb.SandboxClass_SANDBOX_CLASS_MICROVM:
 		return string(atev1alpha1.SandboxClassMicroVM)
+	case ateapipb.SandboxClass_SANDBOX_CLASS_KATA:
+		return string(atev1alpha1.SandboxClassKata)
 	default:
 		return ""
 	}
diff --git a/cmd/ateapi/internal/controlapi/zz_generated.validation.go b/cmd/ateapi/internal/controlapi/zz_generated.validation.go
index dc7abf7379..e3a24fed84 100644
--- a/cmd/ateapi/internal/controlapi/zz_generated.validation.go
+++ b/cmd/ateapi/internal/controlapi/zz_generated.validation.go
@@ -5408,7 +5408,7 @@ func Validate_SandboxConfig(
 			if earlyReturn {
 				return // do not proceed
 			}
-			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 2); len(e) != 0 {
+			if e := validate.Maximum(ctx, op, fldPath, obj, oldObj, 3); len(e) != 0 {
 				errs = append(errs, e...)
 			}
 			if e := validate.Minimum(ctx, op, fldPath, obj, oldObj, 1); len(e) != 0 {
diff --git a/cmd/atecontroller/internal/controllers/workerpool_apply.go b/cmd/atecontroller/internal/controllers/workerpool_apply.go
index 1524bd1fad..f5e7ea14dd 100644
--- a/cmd/atecontroller/internal/controllers/workerpool_apply.go
+++ b/cmd/atecontroller/internal/controllers/workerpool_apply.go
@@ -188,6 +188,7 @@ func buildDeploymentApplyConfig(wp *atev1alpha1.WorkerPool, otel ateomOTelSettin
 
 	applyWorkerPoolPodTemplate(podSpecAC, containerAC, wp.Spec.Template)
 	maybeApplyMicroVMPodShape(podSpecAC, containerAC, wp.Spec.SandboxClass)
+	maybeApplyKataPodShape(podSpecAC, containerAC, wp.Spec.SandboxClass)
 	podSpecAC.WithContainers(containerAC)
 	podSpecAC.WithTerminationGracePeriodSeconds(workerTerminationGracePeriodSeconds)
 
@@ -306,8 +307,9 @@ var ateomMicroVMCapabilities = slices.Concat(ateomGvisorCapabilities, []corev1.C
 })
 
 // ateomSecurityContext returns the ateom container security context for a sandbox
-// class. Neither class runs privileged; they differ in their capability set.
-// Both declare seccomp Unconfined because their sandbox child pivot_root()s,
+// class. gVisor and microVM run unprivileged with different capability sets;
+// Kata currently runs privileged for shim, VM, and network setup. All classes
+// declare seccomp Unconfined because their sandbox child pivot_root()s,
 // which the default profile denies. An empty class defaults to gVisor.
 func ateomSecurityContext(class atev1alpha1.SandboxClass) *corev1ac.SecurityContextApplyConfiguration {
 	// Both runtimes mount inside the worker — runsc pivots root and the worker
@@ -324,6 +326,9 @@ func ateomSecurityContext(class atev1alpha1.SandboxClass) *corev1ac.SecurityCont
 		WithAppArmorProfile(corev1ac.AppArmorProfile().
 			WithType(corev1.AppArmorProfileTypeUnconfined))
 
+	if class == atev1alpha1.SandboxClassKata {
+		return sc.WithPrivileged(true)
+	}
 	if class == atev1alpha1.SandboxClassMicroVM {
 		// Give up the default seccomp profile so virtiofsd keeps its own sandbox,
 		// which pivot_root()s — a syscall the profile denies whatever capabilities
@@ -428,8 +433,49 @@ func maybeApplyMicroVMPodShape(
 const (
 	tunDeviceVolume = "dev-net-tun"
 	tunDevicePath   = "/dev/net/tun"
+	kataAssetsPath  = "/opt/ateom-kata"
+	kataVMStatePath = "/run/vc/vm"
 )
 
+// maybeApplyKataPodShape adds only resources required by the runtime-rs shim.
+// Shared WorkerPool behavior and other runtime pod shapes remain unchanged.
+func maybeApplyKataPodShape(
+	podSpec *corev1ac.PodSpecApplyConfiguration,
+	ateom *corev1ac.ContainerApplyConfiguration,
+	class atev1alpha1.SandboxClass,
+) {
+	if class != atev1alpha1.SandboxClassKata {
+		return
+	}
+	ateom.WithCommand("/ateom-kata")
+	ateom.Args = []string{
+		"--pod-uid=$(POD_UID)",
+		"--atunnel-listen-address=:443",
+		"--atunnel-connect-listen-address=:8443",
+		"--atunnel-credential-bundle=" + atunnelIdentityMountPath + "/credential-bundle.pem",
+		"--atunnel-trust-bundle=" + atunnelIdentityMountPath + "/trust-bundle.pem",
+	}
+	addDeviceResourceLimits(ateom, deviceplugin.ResourceKVM)
+	ateom.WithVolumeMounts(
+		corev1ac.VolumeMount().WithName(tunDeviceVolume).WithMountPath(tunDevicePath),
+		corev1ac.VolumeMount().WithName("run-sandboxd").WithMountPath("/run/sandboxd"),
+		corev1ac.VolumeMount().WithName("run-kata").WithMountPath("/run/kata-containers"),
+		corev1ac.VolumeMount().WithName("kata-runtime").WithMountPath(kataAssetsPath).WithReadOnly(true),
+		corev1ac.VolumeMount().WithName("vm-template").WithMountPath(kataVMStatePath),
+		corev1ac.VolumeMount().WithName("kata-shm").WithMountPath("/dev/shm"),
+	)
+	podSpec.WithVolumes(
+		corev1ac.Volume().WithName(tunDeviceVolume).WithHostPath(corev1ac.HostPathVolumeSource().WithPath(tunDevicePath).WithType(corev1.HostPathCharDev)),
+		corev1ac.Volume().WithName("run-sandboxd").WithEmptyDir(corev1ac.EmptyDirVolumeSource()),
+		corev1ac.Volume().WithName("run-kata").WithEmptyDir(corev1ac.EmptyDirVolumeSource()),
+		corev1ac.Volume().WithName("kata-runtime").WithHostPath(corev1ac.HostPathVolumeSource().WithPath(kataAssetsPath).WithType(corev1.HostPathDirectory)),
+		corev1ac.Volume().WithName("vm-template").WithHostPath(corev1ac.HostPathVolumeSource().WithPath(kataVMStatePath).WithType(corev1.HostPathDirectory)),
+		corev1ac.Volume().WithName("kata-shm").WithEmptyDir(corev1ac.EmptyDirVolumeSource().
+			WithMedium(corev1.StorageMediumMemory).
+			WithSizeLimit(resource.MustParse("4Gi"))),
+	)
+}
+
 // addDeviceResourceLimits requests one unit of each named extended resource,
 // merging into whatever limits the pod template already set.
 func addDeviceResourceLimits(containerAC *corev1ac.ContainerApplyConfiguration, resourceNames ...string) {
diff --git a/cmd/atecontroller/internal/controllers/workerpool_apply_test.go b/cmd/atecontroller/internal/controllers/workerpool_apply_test.go
index 7c7b4fe316..110369221d 100644
--- a/cmd/atecontroller/internal/controllers/workerpool_apply_test.go
+++ b/cmd/atecontroller/internal/controllers/workerpool_apply_test.go
@@ -331,6 +331,42 @@ func TestMicroVMPodShape(t *testing.T) {
 }
 
 // containerMountsPath reports whether c mounts anything at path.
+
+func TestKataPodShapeIsRuntimeLocal(t *testing.T) {
+	wp := testWorkerPoolApplyConfig(nil)
+	wp.Spec.SandboxClass = atev1alpha1.SandboxClassKata
+	pod := buildDeploymentApplyConfig(wp, ateomOTelSettings{}).Spec.Template.Spec
+	container := pod.Containers[0]
+
+	if len(container.Command) != 1 || container.Command[0] != "/ateom-kata" {
+		t.Fatalf("command = %v, want /ateom-kata", container.Command)
+	}
+	if container.SecurityContext == nil || container.SecurityContext.Privileged == nil || !*container.SecurityContext.Privileged {
+		t.Fatal("Kata worker must be privileged for shim, VM and network setup")
+	}
+	if got, ok := deviceLimit(container, deviceplugin.ResourceKVM); !ok || got != "1" {
+		t.Fatalf("%s limit = %q (present=%v), want 1", deviceplugin.ResourceKVM, got, ok)
+	}
+	for _, path := range []string{tunDevicePath, "/run/sandboxd", "/run/kata-containers", kataAssetsPath, kataVMStatePath, "/dev/shm"} {
+		if !containerMountsPath(container, path) {
+			t.Errorf("Kata container does not mount %s", path)
+		}
+	}
+	for _, volume := range pod.Volumes {
+		if volume.Name == nil || *volume.Name != "kata-shm" {
+			continue
+		}
+		if volume.EmptyDir == nil || volume.EmptyDir.Medium == nil || *volume.EmptyDir.Medium != corev1.StorageMediumMemory {
+			t.Fatal("Kata /dev/shm must use a memory-backed emptyDir")
+		}
+		if volume.EmptyDir.SizeLimit == nil || volume.EmptyDir.SizeLimit.String() != "4Gi" {
+			t.Fatalf("Kata /dev/shm size = %v, want 4Gi", volume.EmptyDir.SizeLimit)
+		}
+		return
+	}
+	t.Fatal("Kata /dev/shm volume is missing")
+}
+
 func containerMountsPath(c corev1ac.ContainerApplyConfiguration, path string) bool {
 	for _, m := range c.VolumeMounts {
 		if m.MountPath != nil && *m.MountPath == path {
diff --git a/cmd/atelet/kata_transport.go b/cmd/atelet/kata_transport.go
new file mode 100644
index 0000000000..649412f242
--- /dev/null
+++ b/cmd/atelet/kata_transport.go
@@ -0,0 +1,293 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+
+	"github.com/agent-substrate/substrate/cmd/atelet/internal/ategcs"
+	"github.com/agent-substrate/substrate/internal/ateerrors"
+	"github.com/agent-substrate/substrate/internal/proto/ateompb"
+	"github.com/agent-substrate/substrate/internal/resources"
+	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
+	"github.com/google/uuid"
+)
+
+const (
+	kataTransportSchemaVersion = 1
+	kataCRProfileQEMU          = "ateom-kata-qemu-cr-v1"
+	kataCRProfileDragonball    = "ateom-kata-dragonball-cr-v1"
+)
+
+func (s *AteomHerder) fetchExternalSnapshotRecord(ctx context.Context, uri resources.SnapshotURI) (*sandboxAssetsRecord, error) {
+	var lastErr error
+	for _, name := range []string{kataAssetManifestName, sandboxManifestName} {
+		manifestURI, err := uri.ObjectURI(name)
+		if err != nil {
+			return nil, err
+		}
+		manifest, err := ategcs.FetchFromGCS(ctx, s.gcsClient, manifestURI)
+		if err != nil {
+			lastErr = err
+			continue
+		}
+		rec, err := unmarshalSandboxRecord(manifest)
+		if err != nil {
+			return nil, fmt.Errorf("while unmarshalling %s: %w", name, err)
+		}
+		if snapshotAssetManifestName(rec.SandboxClass) != name {
+			return nil, fmt.Errorf("snapshot manifest %s does not match sandbox class %q", name, rec.SandboxClass)
+		}
+		return rec, nil
+	}
+	return nil, fmt.Errorf("while fetching snapshot manifest: %w", lastErr)
+}
+
+func readLocalSnapshotManifest(dir string) ([]byte, string, error) {
+	var lastErr error
+	for _, name := range []string{kataAssetManifestName, sandboxManifestName} {
+		manifest, err := os.ReadFile(filepath.Join(dir, name))
+		if err != nil {
+			lastErr = err
+			if errors.Is(err, os.ErrNotExist) {
+				continue
+			}
+			return nil, name, err
+		}
+		return manifest, name, nil
+	}
+	return nil, sandboxManifestName, lastErr
+}
+
+func validateKataIndexPath(rel string) error {
+	if rel == "" || strings.Contains(rel, "\\") || filepath.IsAbs(rel) {
+		return fmt.Errorf("invalid checkpoint relative path %q", rel)
+	}
+	clean := filepath.ToSlash(filepath.Clean(rel))
+	if clean != rel || clean == ".." || strings.HasPrefix(clean, "../") {
+		return fmt.Errorf("checkpoint path escapes snapshot: %q", rel)
+	}
+	return nil
+}
+
+func kataOperationID(kind, actorUID, snapshot string) string {
+	return uuid.NewSHA1(uuid.NameSpaceOID, []byte(kind+"\x00"+actorUID+"\x00"+snapshot)).String()
+}
+
+func validKataCRProfile(profile string) bool {
+	switch profile {
+	case kataCRProfileQEMU, kataCRProfileDragonball:
+		return true
+	default:
+		return false
+	}
+}
+
+type kataTransportManifest struct {
+	SchemaVersion      int                 `json:"schemaVersion"`
+	OperationID        string              `json:"operationId"`
+	Profile            string              `json:"profile"`
+	RuntimeFingerprint string              `json:"runtimeFingerprint"`
+	SourceNode         string              `json:"sourceNode"`
+	Files              []kataTransportFile `json:"files"`
+}
+
+type kataTransportFile struct {
+	Path   string `json:"path"`
+	Size   int64  `json:"size"`
+	SHA256 string `json:"sha256"`
+}
+
+// validateDownloadedKataTransport is the reader-first compatibility boundary.
+// Snapshots written before transport v1 have no kata-files.json and remain
+// readable. Once a writer advertises the file in SnapshotFiles, every v1 field
+// and the complete downloaded closure are mandatory before RestoreWorkload.
+func validateDownloadedKataTransport(root string, rec *sandboxAssetsRecord, currentNode string) error {
+	_, err := readValidatedKataTransport(root, rec, currentNode)
+	return err
+}
+
+func readValidatedKataTransport(root string, rec *sandboxAssetsRecord, currentNode string) (*kataTransportManifest, error) {
+	if rec.SandboxClass != string(atev1alpha1.SandboxClassKata) {
+		return nil, nil
+	}
+	found := false
+	for _, name := range rec.SnapshotFiles {
+		if name == kataFileIndexName {
+			found = true
+			break
+		}
+	}
+	if !found {
+		return nil, nil
+	}
+	if currentNode == "" {
+		return nil, fmt.Errorf("%w: NODE_NAME is required to enforce same-node Kata restore", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	b, err := os.ReadFile(filepath.Join(root, kataFileIndexName))
+	if err != nil {
+		return nil, fmt.Errorf("%w: read Kata transport manifest: %v", ateerrors.ReasonInvalidSandboxAsset, err)
+	}
+	var manifest kataTransportManifest
+	dec := json.NewDecoder(bytes.NewReader(b))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&manifest); err != nil {
+		return nil, fmt.Errorf("%w: decode Kata transport manifest: %v", ateerrors.ReasonInvalidSandboxAsset, err)
+	}
+	if err := dec.Decode(&struct{}{}); err != io.EOF {
+		return nil, fmt.Errorf("%w: Kata transport manifest has trailing JSON data", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	if manifest.SchemaVersion != kataTransportSchemaVersion || validateOperationID(manifest.OperationID) != nil {
+		return nil, fmt.Errorf("%w: invalid Kata transport schema version or operation ID", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	if !validKataCRProfile(manifest.Profile) {
+		return nil, fmt.Errorf("%w: Kata transport profile %q is unsupported", ateerrors.ReasonInvalidSandboxAsset, manifest.Profile)
+	}
+	if !validRuntimeFingerprint(manifest.RuntimeFingerprint) {
+		return nil, fmt.Errorf("%w: invalid Kata runtime fingerprint", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	if manifest.SourceNode != currentNode {
+		return nil, fmt.Errorf("%w: Kata snapshot is pinned to node %q, current node is %q", ateerrors.ReasonInvalidSandboxAsset, manifest.SourceNode, currentNode)
+	}
+	want := make([]string, 0, len(rec.SnapshotFiles)-1)
+	for _, name := range rec.SnapshotFiles {
+		if name != kataFileIndexName {
+			want = append(want, name)
+		}
+	}
+	sort.Strings(want)
+	got := make([]string, 0, len(manifest.Files))
+	seen := map[string]bool{}
+	for _, file := range manifest.Files {
+		if err := validateKataIndexPath(file.Path); err != nil {
+			return nil, err
+		}
+		if file.Path == kataFileIndexName || seen[file.Path] || file.Size < 0 || len(file.SHA256) != 64 {
+			return nil, fmt.Errorf("%w: invalid or duplicate Kata transport file %q", ateerrors.ReasonInvalidSandboxAsset, file.Path)
+		}
+		seen[file.Path] = true
+		path := filepath.Join(root, filepath.FromSlash(file.Path))
+		info, err := os.Lstat(path)
+		if err != nil || !info.Mode().IsRegular() || info.Size() != file.Size {
+			return nil, fmt.Errorf("%w: Kata transport file %q is missing, non-regular, or has the wrong size", ateerrors.ReasonInvalidSandboxAsset, file.Path)
+		}
+		digest, err := fileSHA256(path)
+		if err != nil {
+			return nil, err
+		}
+		if digest != file.SHA256 {
+			return nil, fmt.Errorf("%w: Kata transport file %q SHA-256 mismatch", ateerrors.ReasonInvalidSandboxAsset, file.Path)
+		}
+		got = append(got, file.Path)
+	}
+	sort.Strings(got)
+	if !equalStrings(got, want) {
+		return nil, fmt.Errorf("%w: Kata transport closure %v does not match snapshot files %v", ateerrors.ReasonInvalidSandboxAsset, got, want)
+	}
+	return &manifest, nil
+}
+
+func writeKataTransport(root, operationID, sourceNode string, compatibility *ateompb.RuntimeCompatibility, files []string) error {
+	if err := validateOperationID(operationID); err != nil {
+		return err
+	}
+	if sourceNode == "" || compatibility == nil || !validKataCRProfile(compatibility.GetProfile()) || !validRuntimeFingerprint(compatibility.GetRuntimeFingerprint()) {
+		return fmt.Errorf("%w: incomplete Kata runtime compatibility", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	manifest := kataTransportManifest{SchemaVersion: kataTransportSchemaVersion, OperationID: operationID, Profile: compatibility.GetProfile(), RuntimeFingerprint: compatibility.GetRuntimeFingerprint(), SourceNode: sourceNode}
+	seen := map[string]bool{}
+	for _, name := range files {
+		if err := validateKataIndexPath(name); err != nil {
+			return err
+		}
+		if name == kataFileIndexName || seen[name] {
+			return fmt.Errorf("%w: invalid or duplicate Kata checkpoint file %q", ateerrors.ReasonInvalidSandboxAsset, name)
+		}
+		seen[name] = true
+		path := filepath.Join(root, filepath.FromSlash(name))
+		info, err := os.Lstat(path)
+		if err != nil || !info.Mode().IsRegular() {
+			return fmt.Errorf("%w: Kata checkpoint file %q is missing or non-regular", ateerrors.ReasonInvalidSandboxAsset, name)
+		}
+		digest, err := fileSHA256(path)
+		if err != nil {
+			return err
+		}
+		manifest.Files = append(manifest.Files, kataTransportFile{Path: name, Size: info.Size(), SHA256: digest})
+	}
+	sort.Slice(manifest.Files, func(i, j int) bool { return manifest.Files[i].Path < manifest.Files[j].Path })
+	b, err := json.Marshal(manifest)
+	if err != nil {
+		return err
+	}
+	tmp, err := os.CreateTemp(root, ".kata-files-*")
+	if err != nil {
+		return err
+	}
+	tmpName := tmp.Name()
+	defer os.Remove(tmpName)
+	if _, err := tmp.Write(b); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Sync(); err != nil {
+		tmp.Close()
+		return err
+	}
+	if err := tmp.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmpName, filepath.Join(root, kataFileIndexName))
+}
+
+func validateOperationID(id string) error {
+	if len(id) == 0 || len(id) > 128 {
+		return fmt.Errorf("operation_id must be present and at most 128 bytes")
+	}
+	if _, err := uuid.Parse(id); err != nil {
+		return fmt.Errorf("operation_id must be a UUID: %w", err)
+	}
+	return nil
+}
+
+func validRuntimeFingerprint(fingerprint string) bool {
+	if len(fingerprint) != 64 || strings.ToLower(fingerprint) != fingerprint {
+		return false
+	}
+	_, err := hex.DecodeString(fingerprint)
+	return err == nil
+}
+
+func equalStrings(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
diff --git a/cmd/atelet/kata_transport_test.go b/cmd/atelet/kata_transport_test.go
new file mode 100644
index 0000000000..591621c4df
--- /dev/null
+++ b/cmd/atelet/kata_transport_test.go
@@ -0,0 +1,106 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/agent-substrate/substrate/internal/proto/ateompb"
+)
+
+func TestValidateDownloadedKataTransport(t *testing.T) {
+	root := t.TempDir()
+	state := []byte("qemu-state")
+	statePath := filepath.Join(root, "vm.state")
+	if err := os.WriteFile(statePath, state, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	digest, err := fileSHA256(statePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	manifest := kataTransportManifest{
+		SchemaVersion: kataTransportSchemaVersion,
+		OperationID:   "8d830f4d-0813-44ef-8495-3d95af80e27c", Profile: kataCRProfileQEMU,
+		RuntimeFingerprint: strings.Repeat("a", 64), SourceNode: "node-a",
+		Files: []kataTransportFile{{Path: "vm.state", Size: int64(len(state)), SHA256: digest}},
+	}
+	b, err := json.Marshal(manifest)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, kataFileIndexName), b, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	rec := &sandboxAssetsRecord{SandboxClass: "kata", SnapshotFiles: []string{"vm.state", kataFileIndexName}}
+	if err := validateDownloadedKataTransport(root, rec, "node-a"); err != nil {
+		t.Fatal(err)
+	}
+	if err := validateDownloadedKataTransport(root, rec, "node-b"); err == nil {
+		t.Fatal("cross-node Kata restore accepted")
+	}
+	if err := os.WriteFile(statePath, []byte("corrupt"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := validateDownloadedKataTransport(root, rec, "node-a"); err == nil {
+		t.Fatal("corrupt downloaded closure accepted")
+	}
+}
+
+func TestValidateDownloadedKataTransportLegacyCompatibility(t *testing.T) {
+	rec := &sandboxAssetsRecord{SandboxClass: "kata", SnapshotFiles: []string{"vm.state"}}
+	if err := validateDownloadedKataTransport(t.TempDir(), rec, "node-a"); err != nil {
+		t.Fatalf("legacy snapshot rejected: %v", err)
+	}
+	rec.SnapshotFiles = append(rec.SnapshotFiles, kataFileIndexName)
+	if err := validateDownloadedKataTransport(t.TempDir(), rec, ""); err == nil {
+		t.Fatalf("v1 snapshot accepted without node identity: %+v", rec)
+	}
+}
+
+func TestWriteKataTransport(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "vm.state"), []byte("state"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	operationID := "8d830f4d-0813-44ef-8495-3d95af80e27c"
+	compatibility := &ateompb.RuntimeCompatibility{Profile: kataCRProfileQEMU, RuntimeFingerprint: strings.Repeat("b", 64)}
+	if err := writeKataTransport(root, operationID, "node-a", compatibility, []string{"vm.state"}); err != nil {
+		t.Fatal(err)
+	}
+	rec := &sandboxAssetsRecord{SandboxClass: "kata", SnapshotFiles: []string{"vm.state", kataFileIndexName}}
+	manifest, err := readValidatedKataTransport(root, rec, "node-a")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if manifest.OperationID != operationID || manifest.RuntimeFingerprint != compatibility.RuntimeFingerprint || len(manifest.Files) != 1 {
+		t.Fatalf("unexpected transport manifest: %+v", manifest)
+	}
+}
+
+func TestKataTransportRejectsNonHexFingerprint(t *testing.T) {
+	root := t.TempDir()
+	if err := os.WriteFile(filepath.Join(root, "vm.state"), []byte("state"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	compatibility := &ateompb.RuntimeCompatibility{Profile: kataCRProfileQEMU, RuntimeFingerprint: strings.Repeat("z", 64)}
+	if err := writeKataTransport(root, "8d830f4d-0813-44ef-8495-3d95af80e27c", "node-a", compatibility, []string{"vm.state"}); err == nil {
+		t.Fatal("writer accepted a non-hex runtime fingerprint")
+	}
+}
diff --git a/cmd/atelet/main.go b/cmd/atelet/main.go
index 6155e49aa0..589f7ca3da 100644
--- a/cmd/atelet/main.go
+++ b/cmd/atelet/main.go
@@ -513,7 +513,7 @@ func (s *AteomHerder) Run(ctx context.Context, req *ateletpb.RunRequest) (resp *
 		return nil, err
 	}
 	if err := s.prepareOCIBundles(ctx, actorUID, actorRef,
-		req.GetSpec(), sandboxRec.PauseImage, req.GetTargetAteomUid(),
+		req.GetSpec(), sandboxRec.PauseImage, req.GetTargetAteomUid(), sandboxRec.SandboxClass,
 	); err != nil {
 		return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidContainerConfig)
 	}
@@ -647,8 +647,7 @@ func (s *AteomHerder) Checkpoint(ctx context.Context, req *ateletpb.CheckpointRe
 		return nil, status.Errorf(codes.InvalidArgument, "invalid workload spec: %v", err)
 	}
 
-	tAteom := time.Now()
-	resp, err := client.CheckpointWorkload(ctx, &ateompb.CheckpointWorkloadRequest{
+	checkpointReq := &ateompb.CheckpointWorkloadRequest{
 		Atespace:              actorRef.Atespace,
 		ActorName:             actorRef.Name,
 		ActorTemplateAtespace: req.GetActorTemplateAtespace(),
@@ -658,7 +657,12 @@ func (s *AteomHerder) Checkpoint(ctx context.Context, req *ateletpb.CheckpointRe
 		Spec:                  spec,
 		Scope:                 toAteomSnapshotScope(req.GetScope()),
 		ActorUid:              actorUID,
-	})
+	}
+	if sandboxRec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+		checkpointReq.OperationId = kataOperationID("checkpoint", actorUID, fmt.Sprintf("%d:%s:%s", req.GetType(), req.GetExternalConfig().GetSnapshotUri(), req.GetLocalConfig().GetSnapshotName()))
+	}
+	tAteom := time.Now()
+	resp, err := client.CheckpointWorkload(ctx, checkpointReq)
 	dAteom = time.Since(tAteom)
 	if err != nil {
 		// TODO: Ateom should classify checkpoint failures, and set "should-crash"
@@ -669,7 +673,14 @@ func (s *AteomHerder) Checkpoint(ctx context.Context, req *ateletpb.CheckpointRe
 
 	s.systemInfoVolumes.Deregister(actorUID)
 
-	sandboxRec.SnapshotFiles = resp.GetSnapshotFiles()
+	sandboxRec.SnapshotFiles = append([]string(nil), resp.GetSnapshotFiles()...)
+	if sandboxRec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+		operationID := kataOperationID("checkpoint", actorUID, fmt.Sprintf("%d:%s:%s", req.GetType(), req.GetExternalConfig().GetSnapshotUri(), req.GetLocalConfig().GetSnapshotName()))
+		if err := writeKataTransport(checkpointDir, operationID, os.Getenv("NODE_NAME"), resp.GetRuntimeCompatibility(), sandboxRec.SnapshotFiles); err != nil {
+			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidSandboxAsset, ateerrors.ReasonTerminalFileSystemError)
+		}
+		sandboxRec.SnapshotFiles = append(sandboxRec.SnapshotFiles, kataFileIndexName)
+	}
 	if len(sandboxRec.SnapshotFiles) == 0 && shouldHaveSnapshots(req) {
 		return nil, ateerrors.NewGRPCError(ctx, codes.DataLoss, ateerrors.ReasonInvalidCheckpointResult, ateerrors.ActorCrashedMetadata(), errors.New("ateom reported no snapshot files for checkpoint"))
 	}
@@ -745,8 +756,21 @@ func (s *AteomHerder) moveLocalCheckpoint(ctx context.Context, req *ateletpb.Che
 
 	// Move exactly the files ateom reported.
 	for _, fileName := range rec.SnapshotFiles {
+		if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) && fileName == kataFileIndexName {
+			continue
+		}
+		if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+			if err := validateKataIndexPath(fileName); err != nil {
+				return err
+			}
+		}
 		src := filepath.Join(checkpointDir, fileName)
 		dst := filepath.Join(localCheckpointPath, fileName)
+		if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+			if err := os.MkdirAll(filepath.Dir(dst), 0o700); err != nil {
+				return fmt.Errorf("while creating checkpoint parent: %w", err)
+			}
+		}
 		recordSnapshotSize(ctx, fileName, src, req.GetActorTemplateAtespace(), req.GetActorTemplateName())
 
 		if err := os.Rename(src, dst); err != nil {
@@ -759,9 +783,17 @@ func (s *AteomHerder) moveLocalCheckpoint(ctx context.Context, req *ateletpb.Che
 	if err != nil {
 		return fmt.Errorf("while marshaling snapshot manifest: %w", err)
 	}
-	if err := os.WriteFile(filepath.Join(localCheckpointPath, sandboxManifestName), manifest, 0o600); err != nil {
+	if err := os.WriteFile(filepath.Join(localCheckpointPath, snapshotAssetManifestName(rec.SandboxClass)), manifest, 0o600); err != nil {
 		return fmt.Errorf("while writing snapshot manifest: %w", err)
 	}
+	if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) && slices.Contains(rec.SnapshotFiles, kataFileIndexName) {
+		src := filepath.Join(checkpointDir, kataFileIndexName)
+		dst := filepath.Join(localCheckpointPath, kataFileIndexName)
+		recordSnapshotSize(ctx, kataFileIndexName, src, req.GetActorTemplateAtespace(), req.GetActorTemplateName())
+		if err := os.Rename(src, dst); err != nil {
+			return fmt.Errorf("failed to publish Kata transport manifest: %w", err)
+		}
+	}
 
 	return nil
 }
@@ -797,6 +829,14 @@ func (s *AteomHerder) uploadExternalCheckpoint(ctx context.Context, req *ateletp
 func (s *AteomHerder) uploadSnapshot(ctx context.Context, uri resources.SnapshotURI, srcDir string, rec *sandboxAssetsRecord, templateAtespace, templateName string) error {
 	g, gCtx := errgroup.WithContext(ctx)
 	for _, fileName := range rec.SnapshotFiles {
+		if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) && fileName == kataFileIndexName {
+			continue
+		}
+		if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+			if err := validateKataIndexPath(fileName); err != nil {
+				return err
+			}
+		}
 		local := filepath.Join(srcDir, fileName)
 		recordSnapshotSize(ctx, fileName, local, templateAtespace, templateName)
 		g.Go(func() error {
@@ -818,13 +858,22 @@ func (s *AteomHerder) uploadSnapshot(ctx context.Context, uri resources.Snapshot
 	if err != nil {
 		return fmt.Errorf("while marshaling snapshot manifest: %w", err)
 	}
-	manifestURI, err := uri.ObjectURI(sandboxManifestName)
+	manifestURI, err := uri.ObjectURI(snapshotAssetManifestName(rec.SandboxClass))
 	if err != nil {
 		return fmt.Errorf("while addressing snapshot manifest in GCS: %w", err)
 	}
 	if err := ategcs.SendBytesToGCS(ctx, s.gcsClient, manifestURI, manifest); err != nil {
 		return fmt.Errorf("while uploading snapshot manifest: %w", err)
 	}
+	if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) && slices.Contains(rec.SnapshotFiles, kataFileIndexName) {
+		indexURI, err := uri.ObjectURI(kataFileIndexName + ".zstd")
+		if err != nil {
+			return fmt.Errorf("while addressing Kata transport manifest in GCS: %w", err)
+		}
+		if err := ategcs.SendLocalFileToGCSWithZstd(ctx, s.gcsClient, indexURI, filepath.Join(srcDir, kataFileIndexName)); err != nil {
+			return fmt.Errorf("while uploading Kata transport manifest: %w", err)
+		}
+	}
 	return nil
 }
 
@@ -882,12 +931,11 @@ func (s *AteomHerder) UploadPausedCheckpoint(ctx context.Context, req *ateletpb.
 // returns the sandbox class recorded in the snapshot manifest (empty when the
 // manifest was not read). Parameterized by localDir for tests.
 func (s *AteomHerder) uploadLocalCheckpointDir(ctx context.Context, req *ateletpb.UploadPausedCheckpointRequest, localDir string, uri resources.SnapshotURI) (string, error) {
-	manifestURI, err := uri.ObjectURI(sandboxManifestName)
-	if err != nil {
-		return "", fmt.Errorf("while addressing snapshot manifest in GCS: %w", err)
+	manifest, manifestName, err := readLocalSnapshotManifest(localDir)
+	manifestURI, uriErr := uri.ObjectURI(manifestName)
+	if uriErr != nil {
+		return "", fmt.Errorf("while addressing snapshot manifest in GCS: %w", uriErr)
 	}
-
-	manifest, err := os.ReadFile(filepath.Join(localDir, sandboxManifestName))
 	if errors.Is(err, os.ErrNotExist) {
 		// The local snapshot is gone. A previous invocation may have uploaded
 		// and pruned it: the remote manifest is uploaded last, so its presence
@@ -951,6 +999,9 @@ func narrowFullCaptureToData(rec *sandboxAssetsRecord) error {
 		rec.Scope = ateattr.SnapshotScopeData
 		return nil
 
+	case atev1alpha1.SandboxClassKata:
+		return status.Error(codes.FailedPrecondition, "kata cannot extract a Data-scope snapshot from a Full checkpoint")
+
 	default:
 		// The manifest's class is unvalidated input from disk/object storage.
 		return status.Errorf(codes.FailedPrecondition, "unknown sandbox class %q in snapshot manifest", rec.SandboxClass)
@@ -1041,19 +1092,11 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 		if err != nil {
 			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidObjectURL)
 		}
-		manifestURI, err := uri.ObjectURI(sandboxManifestName)
-		if err != nil {
-			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidObjectURL)
-		}
-		manifest, err := ategcs.FetchFromGCS(ctx, s.gcsClient, manifestURI)
-		if err != nil {
-			return nil, ateerrors.CrashIfReason(ctx, fmt.Errorf("while fetching snapshot manifest: %w", err), ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonFailedGetExternalObject)
-		}
-		if sandboxRec, err = unmarshalSandboxRecord(manifest); err != nil {
-			return nil, ateerrors.CrashIfReason(ctx, fmt.Errorf("while unmarshalling sandbox record: %w", err), ateerrors.ReasonInvalidSandboxAsset)
+		if sandboxRec, err = s.fetchExternalSnapshotRecord(ctx, uri); err != nil {
+			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonFailedGetExternalObject, ateerrors.ReasonInvalidSandboxAsset)
 		}
 	case ateletpb.CheckpointType_CHECKPOINT_TYPE_LOCAL:
-		manifest, err := os.ReadFile(filepath.Join(ateompath.LocalSnapshotDir(actorUID, req.GetLocalConfig().GetSnapshotName()), sandboxManifestName))
+		manifest, _, err := readLocalSnapshotManifest(ateompath.LocalSnapshotDir(actorUID, req.GetLocalConfig().GetSnapshotName()))
 		if err != nil {
 			if isTerminalFileSystemErr(err) {
 				return nil, ateerrors.NewGRPCError(ctx, codes.DataLoss, ateerrors.ReasonTerminalFileSystemError, ateerrors.ActorCrashedMetadata(), err)
@@ -1079,16 +1122,8 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 		if err != nil {
 			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidObjectURL)
 		}
-		manifestURI, err := goldenURI.ObjectURI(sandboxManifestName)
-		if err != nil {
-			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidObjectURL)
-		}
-		manifest, err := ategcs.FetchFromGCS(ctx, s.gcsClient, manifestURI)
-		if err != nil {
-			return nil, ateerrors.CrashIfReason(ctx, fmt.Errorf("while fetching golden snapshot manifest: %w", err), ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonFailedGetExternalObject)
-		}
-		if goldenRec, err = unmarshalSandboxRecord(manifest); err != nil {
-			return nil, ateerrors.CrashIfReason(ctx, fmt.Errorf("while unmarshalling golden sandbox record: %w", err), ateerrors.ReasonInvalidSandboxAsset)
+		if goldenRec, err = s.fetchExternalSnapshotRecord(ctx, goldenURI); err != nil {
+			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonFailedGetExternalObject, ateerrors.ReasonInvalidSandboxAsset)
 		}
 		if goldenRec.SandboxClass != sandboxRec.SandboxClass {
 			return nil, status.Errorf(codes.FailedPrecondition, "golden snapshot sandbox class %q does not match actor snapshot sandbox class %q", goldenRec.SandboxClass, sandboxRec.SandboxClass)
@@ -1147,7 +1182,7 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 				if err := s.downloadCombinedCheckpoint(gctx, req.GetExternalConfig().GetSnapshotUri(), req.GetGoldenSnapshotUri(), checkpointDir, sandboxRec.SnapshotFiles, goldenRec.SnapshotFiles); err != nil {
 					return ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonFailedGetExternalObject, ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonTerminalFileSystemError)
 				}
-			} else if err := s.downloadExternalCheckpoint(gctx, req.GetExternalConfig().GetSnapshotUri(), checkpointDir, sandboxRec.SnapshotFiles); err != nil {
+			} else if err := s.downloadExternalCheckpoint(gctx, req.GetExternalConfig().GetSnapshotUri(), checkpointDir, sandboxRec.SnapshotFiles, sandboxRec.SandboxClass == string(atev1alpha1.SandboxClassKata)); err != nil {
 				return ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonFailedGetExternalObject, ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonTerminalFileSystemError)
 			}
 		case ateletpb.CheckpointType_CHECKPOINT_TYPE_LOCAL:
@@ -1160,14 +1195,14 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 			// the golden's from object storage, concurrently.
 			gLocal, gLocalCtx := errgroup.WithContext(gctx)
 			gLocal.Go(func() error {
-				if err := s.copyLocalCheckpoint(gLocalCtx, req.GetLocalConfig().GetSnapshotName(), ateompath.LocalCheckpointsDir(actorUID), checkpointDir, sandboxRec.SnapshotFiles); err != nil {
+				if err := s.copyLocalCheckpoint(gLocalCtx, req.GetLocalConfig().GetSnapshotName(), ateompath.LocalCheckpointsDir(actorUID), checkpointDir, sandboxRec.SnapshotFiles, sandboxRec.SandboxClass == string(atev1alpha1.SandboxClassKata)); err != nil {
 					return ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonTerminalFileSystemError)
 				}
 				return nil
 			})
 			if combineWithGolden {
 				gLocal.Go(func() error {
-					if err := s.downloadExternalCheckpoint(gLocalCtx, req.GetGoldenSnapshotUri(), checkpointDir, goldenOnlyFiles(sandboxRec.SnapshotFiles, goldenRec.SnapshotFiles)); err != nil {
+					if err := s.downloadExternalCheckpoint(gLocalCtx, req.GetGoldenSnapshotUri(), checkpointDir, goldenOnlyFiles(sandboxRec.SnapshotFiles, goldenRec.SnapshotFiles), false); err != nil {
 						return ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonFailedGetExternalObject, ateerrors.ReasonInvalidObjectURL, ateerrors.ReasonTerminalFileSystemError)
 					}
 					return nil
@@ -1193,7 +1228,7 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 			return err
 		}
 		t := time.Now()
-		err = s.prepareOCIBundles(gctx, actorUID, actorRef, req.GetSpec(), runtimeRec.PauseImage, req.GetTargetAteomUid())
+		err = s.prepareOCIBundles(gctx, actorUID, actorRef, req.GetSpec(), runtimeRec.PauseImage, req.GetTargetAteomUid(), runtimeRec.SandboxClass)
 		dBundles = time.Since(t)
 		if err != nil {
 			prepFailedPhase = ateattr.SnapshotPhaseOCIUnpack
@@ -1212,6 +1247,14 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 		return nil, err
 	}
 
+	var kataTransport *kataTransportManifest
+	if sandboxRec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+		kataTransport, err = readValidatedKataTransport(checkpointDir, sandboxRec, os.Getenv("NODE_NAME"))
+		if err != nil {
+			return nil, ateerrors.CrashIfReason(ctx, err, ateerrors.ReasonInvalidSandboxAsset)
+		}
+	}
+
 	client, err := s.dialAteom(ctx, req.GetTargetAteomUid())
 	if err != nil {
 		return nil, err
@@ -1227,7 +1270,7 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 	// The ateom_restore phase is opaque from here; ateom logs its own breakdown of
 	// this call as "Actor restore phases".
 	tAteom := time.Now()
-	_, err = client.RestoreWorkload(ctx, &ateompb.RestoreWorkloadRequest{
+	restoreReq := &ateompb.RestoreWorkloadRequest{
 		Atespace:              actorRef.Atespace,
 		ActorName:             actorRef.Name,
 		ActorTemplateAtespace: req.GetActorTemplateAtespace(),
@@ -1244,7 +1287,15 @@ func (s *AteomHerder) Restore(ctx context.Context, req *ateletpb.RestoreRequest)
 		// already staged into the restore dir by the combined download above;
 		// ateom restores from the shared dir and never fetches this URI.
 		GoldenSnapshotUri: req.GetGoldenSnapshotUri(),
-	})
+	}
+	if kataTransport != nil {
+		restoreReq.OperationId = kataOperationID("restore", actorUID, fmt.Sprintf("%d:%s:%s", req.GetType(), req.GetExternalConfig().GetSnapshotUri(), req.GetLocalConfig().GetSnapshotName()))
+		restoreReq.RuntimeCompatibility = &ateompb.RuntimeCompatibility{
+			Profile:            kataTransport.Profile,
+			RuntimeFingerprint: kataTransport.RuntimeFingerprint,
+		}
+	}
+	_, err = client.RestoreWorkload(ctx, restoreReq)
 	dAteom = time.Since(tAteom)
 	if err != nil {
 		// TODO: classify the errors returned by Ateom and crash the actor if needed.
@@ -1337,13 +1388,23 @@ func (s *AteomHerder) Terminate(ctx context.Context, req *ateletpb.TerminateRequ
 	return &ateletpb.TerminateResponse{}, nil
 }
 
-func (s *AteomHerder) copyLocalCheckpoint(ctx context.Context, snapshotName string, srcDir, dstDir string, files []string) error {
+func (s *AteomHerder) copyLocalCheckpoint(ctx context.Context, snapshotName string, srcDir, dstDir string, files []string, kata bool) error {
 	for _, fileName := range files {
 		if ctx.Err() != nil {
 			return fmt.Errorf("context cancelled: %w", ctx.Err())
 		}
+		if kata {
+			if err := validateKataIndexPath(fileName); err != nil {
+				return err
+			}
+		}
 		src := filepath.Join(srcDir, snapshotName, fileName)
 		dst := filepath.Join(dstDir, fileName)
+		if kata {
+			if err := os.MkdirAll(filepath.Dir(dst), 0o700); err != nil {
+				return fmt.Errorf("while creating checkpoint parent: %w", err)
+			}
+		}
 		if _, err := sparsefile.CopyFile(src, dst); err != nil {
 			return fmt.Errorf("failed to copy %s to %s: %w", src, dst, err)
 		}
@@ -1377,15 +1438,15 @@ func goldenOnlyFiles(actorFiles, goldenFiles []string) []string {
 func (s *AteomHerder) downloadCombinedCheckpoint(ctx context.Context, actorURI, goldenURI, dstDir string, actorFiles, goldenFiles []string) error {
 	g, gctx := errgroup.WithContext(ctx)
 	g.Go(func() error {
-		return s.downloadExternalCheckpoint(gctx, actorURI, dstDir, actorFiles)
+		return s.downloadExternalCheckpoint(gctx, actorURI, dstDir, actorFiles, false)
 	})
 	g.Go(func() error {
-		return s.downloadExternalCheckpoint(gctx, goldenURI, dstDir, goldenOnlyFiles(actorFiles, goldenFiles))
+		return s.downloadExternalCheckpoint(gctx, goldenURI, dstDir, goldenOnlyFiles(actorFiles, goldenFiles), false)
 	})
 	return g.Wait()
 }
 
-func (s *AteomHerder) downloadExternalCheckpoint(ctx context.Context, snapshotURI string, dstDir string, files []string) error {
+func (s *AteomHerder) downloadExternalCheckpoint(ctx context.Context, snapshotURI string, dstDir string, files []string, kata bool) error {
 	uri, err := resources.ParseSnapshotURI(snapshotURI)
 	if err != nil {
 		return err
@@ -1393,8 +1454,18 @@ func (s *AteomHerder) downloadExternalCheckpoint(ctx context.Context, snapshotUR
 	g, gCtx := errgroup.WithContext(ctx)
 	for _, fileName := range files {
 		fileName := fileName
+		if kata {
+			if err := validateKataIndexPath(fileName); err != nil {
+				return err
+			}
+		}
 		local := filepath.Join(dstDir, fileName)
 		g.Go(func() error {
+			if kata {
+				if err := os.MkdirAll(filepath.Dir(local), 0o700); err != nil {
+					return fmt.Errorf("while creating checkpoint parent: %w", err)
+				}
+			}
 			objectURI, err := uri.ObjectURI(fileName + ".zstd")
 			if err != nil {
 				return fmt.Errorf("while addressing %s in GCS: %w", fileName, err)
@@ -1424,7 +1495,12 @@ func (s *AteomHerder) prepareOCIBundles(
 	spec *ateletpb.WorkloadSpec,
 	pauseImage string,
 	targetAteomUid string,
+	sandboxClass string,
 ) error {
+	if sandboxClass == string(atev1alpha1.SandboxClassKata) && len(spec.GetVolumes()) != 0 {
+		return status.Error(codes.Unimplemented, "kata workers do not yet support workload volumes")
+	}
+
 	// Prepare host folders for volume types that need them.
 	for _, vol := range spec.GetVolumes() {
 		switch vol.GetSource().(type) {
@@ -1438,27 +1514,30 @@ func (s *AteomHerder) prepareOCIBundles(
 
 	g, gCtx := errgroup.WithContext(ctx)
 
-	// Pause container.
-	g.Go(func() error {
-		if err := prepareOCIDirectory(
-			gCtx,
-			s.imageCache,
-			actorUID,
-			ocispec.PauseContainer,
-			pauseImage,
-			[]string{"/pause"},
-			nil,
-			nil,
-			ateompath.AteomNetNSPath(targetAteomUid),
-			nil, // pause is sandbox infra; it mounts no volumes.
-			nil,
-			nil, // pause only reaps; it needs no capabilities.
-			nil, // pause carries no user-declared limits.
-		); err != nil {
-			return wrapFileSystemErr("while creating pause OCI bundle", err)
-		}
-		return nil
-	})
+	// Kata's shim creates the pod sandbox; all other classes retain the
+	// shared pause-container behavior.
+	if sandboxClass != string(atev1alpha1.SandboxClassKata) {
+		g.Go(func() error {
+			if err := prepareOCIDirectory(
+				gCtx,
+				s.imageCache,
+				actorUID,
+				ocispec.PauseContainer,
+				pauseImage,
+				[]string{"/pause"},
+				nil,
+				nil,
+				ateompath.AteomNetNSPath(targetAteomUid),
+				nil, // pause is sandbox infra; it mounts no volumes.
+				nil,
+				nil, // pause only reaps; it needs no capabilities.
+				nil, // pause carries no user-declared limits.
+			); err != nil {
+				return wrapFileSystemErr("while creating pause OCI bundle", err)
+			}
+			return nil
+		})
+	}
 
 	// Application containers.
 	for _, ctr := range spec.GetContainers() {
diff --git a/cmd/atelet/sandbox_assets.go b/cmd/atelet/sandbox_assets.go
index 58a81b1de2..2d7d6a65d6 100644
--- a/cmd/atelet/sandbox_assets.go
+++ b/cmd/atelet/sandbox_assets.go
@@ -42,6 +42,7 @@ import (
 	"github.com/agent-substrate/substrate/internal/ateompath"
 	"github.com/agent-substrate/substrate/internal/proto/ateletpb"
 	"github.com/agent-substrate/substrate/internal/resources"
+	atev1alpha1 "github.com/agent-substrate/substrate/pkg/api/v1alpha1"
 )
 
 // sandboxManifestName is the object/file name of the per-snapshot manifest that
@@ -49,6 +50,23 @@ import (
 // next to the checkpoint images so a snapshot is self-describing.
 const sandboxManifestName = "manifest.json"
 
+const (
+	kataAssetManifestName = "sandbox-assets.json"
+	kataFileIndexName     = "kata-files.json"
+
+	kataRuntimeBundleAssetName = "ateom-kata-runtime-bundle"
+	kataRuntimeConfigAssetName = "ateom-kata-runtime-config"
+	kataBundleManifestName     = "bundle-manifest.json"
+	kataBundleManifestVersion  = 1
+)
+
+func snapshotAssetManifestName(sandboxClass string) string {
+	if sandboxClass == string(atev1alpha1.SandboxClassKata) {
+		return kataAssetManifestName
+	}
+	return sandboxManifestName
+}
+
 // maxAssetBytes guards disk against an unbounded download URL; a var so tests can lower it.
 // ponytail: 8GiB ceiling, make it a flag if a rootfs ever needs more.
 var maxAssetBytes int64 = 8 << 30
@@ -70,6 +88,22 @@ type assetEntry struct {
 	SHA256 string `json:"sha256"`
 }
 
+// kataBundleManifest describes every regular file in the independently
+// distributed Kata runtime bundle. Names are the stable keys forwarded in
+// RuntimeAssetPaths; paths are relative to the extracted bundle root.
+type kataBundleManifest struct {
+	Version int                   `json:"version"`
+	Files   []kataBundleFileEntry `json:"files"`
+}
+
+type kataBundleFileEntry struct {
+	Name       string `json:"name"`
+	Path       string `json:"path"`
+	Size       int64  `json:"size"`
+	SHA256     string `json:"sha256"`
+	Executable bool   `json:"executable"`
+}
+
 // sandboxAssetsRecord is the sandbox runtime an actor is running, projected onto
 // the local node's architecture: the sandbox class and pause image plus the
 // asset set keyed by asset name (gVisor uses a single "gvisor" release-tarball
@@ -127,6 +161,16 @@ func recordFromRequest(sa *ateletpb.SandboxAssets) (*sandboxAssetsRecord, error)
 	for name, f := range archAssets.GetFiles() {
 		rec.Assets[name] = assetEntry{URL: f.GetUrl(), SHA256: f.GetSha256()}
 	}
+	if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) {
+		if len(rec.Assets) != 2 {
+			return nil, fmt.Errorf("kata sandbox_assets must contain exactly %q and %q for architecture %q", kataRuntimeBundleAssetName, kataRuntimeConfigAssetName, arch)
+		}
+		for _, name := range []string{kataRuntimeBundleAssetName, kataRuntimeConfigAssetName} {
+			if _, ok := rec.Assets[name]; !ok {
+				return nil, fmt.Errorf("kata sandbox_assets is missing required asset %q for architecture %q", name, arch)
+			}
+		}
+	}
 	return rec, nil
 }
 
@@ -143,11 +187,20 @@ func (s *AteomHerder) ensureSandboxAssets(ctx context.Context, rec *sandboxAsset
 		}
 		return nil, fmt.Errorf("while creating static files dir: %w", err)
 	}
+
 	paths := make(map[string]string, len(rec.Assets))
 	for name, entry := range rec.Assets {
 		var p string
 		var err error
-		if name == gvisorAssetName {
+		if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) && name == kataRuntimeBundleAssetName {
+			var bundlePaths map[string]string
+			p, bundlePaths, err = s.fetchKataRuntimeBundle(ctx, entry)
+			for bundleName, bundlePath := range bundlePaths {
+				paths[bundleName] = bundlePath
+			}
+		} else if rec.SandboxClass == string(atev1alpha1.SandboxClassKata) && name == kataRuntimeConfigAssetName {
+			p, err = s.fetchKataRuntimeConfig(ctx, entry)
+		} else if name == gvisorAssetName {
 			p, err = s.fetchGVisorRelease(ctx, entry)
 		} else {
 			p, err = s.fetchAsset(ctx, entry)
@@ -160,6 +213,308 @@ func (s *AteomHerder) ensureSandboxAssets(ctx context.Context, rec *sandboxAsset
 	return paths, nil
 }
 
+func kataRuntimeBundleDir(sha string) string {
+	return filepath.Join(ateompath.StaticFilesDir, kataRuntimeBundleAssetName+"-"+sha)
+}
+
+func kataRuntimeConfigPath(sha string) string {
+	return filepath.Join(ateompath.StaticFilesDir, kataRuntimeConfigAssetName+"-"+sha+".toml")
+}
+
+func (s *AteomHerder) fetchKataRuntimeConfig(ctx context.Context, entry assetEntry) (string, error) {
+	if err := resources.ValidateSHA256(entry.SHA256); err != nil {
+		return "", wrapFileSystemErr("while validating Kata runtime config hash", err)
+	}
+	if local, ok := localKataAssetPath(entry.URL); ok {
+		if err := verifyLocalAsset(local, entry.SHA256, false); err != nil {
+			return "", err
+		}
+		return local, nil
+	}
+	path := kataRuntimeConfigPath(entry.SHA256)
+	if fi, err := os.Lstat(path); err == nil {
+		if !fi.Mode().IsRegular() {
+			return "", fmt.Errorf("%w: cached Kata runtime config is not a regular file", ateerrors.ReasonInvalidSandboxAsset)
+		}
+		got, err := fileSHA256(path)
+		if err != nil {
+			return "", err
+		}
+		if got != entry.SHA256 {
+			return "", fmt.Errorf("%w: cached Kata runtime config SHA-256 %s, want %s", ateerrors.ReasonInvalidSandboxAsset, got, entry.SHA256)
+		}
+		return path, nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return "", wrapFileSystemErr("while stat-ing Kata runtime config", err)
+	}
+	tmp, err := s.downloadVerified(ctx, entry, kataRuntimeConfigAssetName+"-download-")
+	if err != nil {
+		return "", err
+	}
+	defer os.Remove(tmp)
+	if err := os.Chmod(tmp, 0o600); err != nil {
+		return "", wrapFileSystemErr("while setting Kata runtime config mode", err)
+	}
+	if err := os.Rename(tmp, path); err != nil {
+		return "", wrapFileSystemErr("while publishing Kata runtime config", err)
+	}
+	return path, nil
+}
+
+func (s *AteomHerder) fetchKataRuntimeBundle(ctx context.Context, entry assetEntry) (string, map[string]string, error) {
+	if err := resources.ValidateSHA256(entry.SHA256); err != nil {
+		return "", nil, wrapFileSystemErr("while validating Kata runtime bundle hash", err)
+	}
+	if local, ok := localKataAssetPath(entry.URL); ok {
+		if err := verifyLocalAsset(local, entry.SHA256, true); err != nil {
+			return "", nil, err
+		}
+		paths, err := validateKataRuntimeBundle(local)
+		return local, paths, err
+	}
+	bundleDir := kataRuntimeBundleDir(entry.SHA256)
+	if fi, err := os.Lstat(bundleDir); err == nil {
+		if !fi.IsDir() {
+			return "", nil, fmt.Errorf("%w: cached Kata runtime bundle is not a directory", ateerrors.ReasonInvalidSandboxAsset)
+		}
+		paths, err := validateKataRuntimeBundle(bundleDir)
+		return bundleDir, paths, err
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return "", nil, wrapFileSystemErr("while stat-ing Kata runtime bundle", err)
+	}
+
+	tarball, err := s.downloadVerified(ctx, entry, kataRuntimeBundleAssetName+"-download-")
+	if err != nil {
+		return "", nil, err
+	}
+	defer os.Remove(tarball)
+	tmpDir, err := os.MkdirTemp(ateompath.StaticFilesDir, kataRuntimeBundleAssetName+"-extract-")
+	if err != nil {
+		return "", nil, wrapFileSystemErr("while creating Kata runtime bundle extraction dir", err)
+	}
+	defer func() { _ = os.RemoveAll(tmpDir) }()
+	if err := extractKataRuntimeBundle(ctx, tarball, tmpDir); err != nil {
+		return "", nil, err
+	}
+	paths, err := validateKataRuntimeBundle(tmpDir)
+	if err != nil {
+		return "", nil, err
+	}
+	if err := os.Chmod(tmpDir, 0o700); err != nil {
+		return "", nil, wrapFileSystemErr("while setting Kata runtime bundle mode", err)
+	}
+	if err := os.Rename(tmpDir, bundleDir); err != nil {
+		if errors.Is(err, syscall.EEXIST) || errors.Is(err, syscall.ENOTEMPTY) {
+			paths, validateErr := validateKataRuntimeBundle(bundleDir)
+			return bundleDir, paths, validateErr
+		}
+		return "", nil, wrapFileSystemErr("while publishing Kata runtime bundle", err)
+	}
+	for name, path := range paths {
+		paths[name] = filepath.Join(bundleDir, strings.TrimPrefix(path, tmpDir+string(os.PathSeparator)))
+	}
+	return bundleDir, paths, nil
+}
+
+// localKataAssetPath enables node-preinstalled Kata assets. It is deliberately
+// opt-in via file:// and never follows a relative path from an untrusted URL.
+func localKataAssetPath(raw string) (string, bool) {
+	if !strings.HasPrefix(raw, "file://") {
+		return "", false
+	}
+	p := strings.TrimPrefix(raw, "file://")
+	return filepath.Clean(p), filepath.IsAbs(p)
+}
+
+func verifyLocalAsset(path, want string, bundle bool) error {
+	fi, err := os.Lstat(path)
+	if err != nil {
+		return wrapFileSystemErr("while stat-ing local Kata asset", err)
+	}
+	if bundle {
+		if !fi.IsDir() {
+			return fmt.Errorf("%w: local Kata bundle is not a directory", ateerrors.ReasonInvalidSandboxAsset)
+		}
+		path = filepath.Join(path, kataBundleManifestName)
+	} else if !fi.Mode().IsRegular() {
+		return fmt.Errorf("%w: local Kata config is not a regular file", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	got, err := fileSHA256(path)
+	if err != nil {
+		return err
+	}
+	if got != want {
+		return fmt.Errorf("%w: local Kata asset SHA-256 %s, want %s", ateerrors.ReasonInvalidSandboxAsset, got, want)
+	}
+	return nil
+}
+
+func extractKataRuntimeBundle(ctx context.Context, tarPath, destDir string) error {
+	f, err := os.Open(tarPath)
+	if err != nil {
+		return wrapFileSystemErr("while opening Kata runtime bundle", err)
+	}
+	defer f.Close()
+	gzr, err := gzip.NewReader(f)
+	if err != nil {
+		return fmt.Errorf("%w: Kata runtime bundle must be a .tar.gz archive: %w", ateerrors.ReasonInvalidSandboxAsset, err)
+	}
+	defer gzr.Close()
+	tr := tar.NewReader(gzr)
+	var total int64
+	for {
+		if err := ctx.Err(); err != nil {
+			return err
+		}
+		hdr, err := tr.Next()
+		if err == io.EOF {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("%w: while reading Kata runtime bundle: %w", ateerrors.ReasonInvalidSandboxAsset, err)
+		}
+		name, err := cleanBundleRelativePath(hdr.Name)
+		if err != nil {
+			return err
+		}
+		dest := filepath.Join(destDir, filepath.FromSlash(name))
+		switch hdr.Typeflag {
+		case tar.TypeDir:
+			if err := os.MkdirAll(dest, 0o700); err != nil {
+				return wrapFileSystemErr("while creating Kata runtime bundle directory", err)
+			}
+		case tar.TypeReg:
+			if hdr.Size < 0 || total > maxAssetBytes-hdr.Size {
+				return fmt.Errorf("%w: Kata runtime bundle inflates past the %d-byte cap", ateerrors.ReasonInvalidSandboxAsset, maxAssetBytes)
+			}
+			total += hdr.Size
+			if err := os.MkdirAll(filepath.Dir(dest), 0o700); err != nil {
+				return wrapFileSystemErr("while creating Kata runtime bundle parent", err)
+			}
+			if err := writeTarFile(dest, io.LimitReader(tr, hdr.Size), fs.FileMode(hdr.Mode)&0o777); err != nil {
+				return err
+			}
+		default:
+			return fmt.Errorf("%w: Kata runtime bundle entry %q has forbidden type %d", ateerrors.ReasonInvalidSandboxAsset, hdr.Name, hdr.Typeflag)
+		}
+	}
+}
+
+func cleanBundleRelativePath(name string) (string, error) {
+	if name == "" || strings.ContainsRune(name, '\\') {
+		return "", fmt.Errorf("%w: invalid Kata runtime bundle path %q", ateerrors.ReasonInvalidSandboxAsset, name)
+	}
+	clean := filepath.ToSlash(filepath.Clean(name))
+	if clean == "." || filepath.IsAbs(name) || clean == ".." || strings.HasPrefix(clean, "../") {
+		return "", fmt.Errorf("%w: Kata runtime bundle path %q escapes the extraction root", ateerrors.ReasonInvalidSandboxAsset, name)
+	}
+	return clean, nil
+}
+
+func validateKataRuntimeBundle(root string) (map[string]string, error) {
+	manifestPath := filepath.Join(root, kataBundleManifestName)
+	b, err := os.ReadFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("%w: read Kata bundle manifest: %v", ateerrors.ReasonInvalidSandboxAsset, err)
+	}
+	var manifest kataBundleManifest
+	dec := json.NewDecoder(bytes.NewReader(b))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&manifest); err != nil {
+		return nil, fmt.Errorf("%w: decode Kata bundle manifest: %v", ateerrors.ReasonInvalidSandboxAsset, err)
+	}
+	if err := dec.Decode(&struct{}{}); err != io.EOF {
+		return nil, fmt.Errorf("%w: Kata bundle manifest has trailing JSON data", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	if manifest.Version != kataBundleManifestVersion {
+		return nil, fmt.Errorf("%w: Kata bundle manifest version %d, require %d", ateerrors.ReasonInvalidSandboxAsset, manifest.Version, kataBundleManifestVersion)
+	}
+	paths := make(map[string]string, len(manifest.Files))
+	declared := map[string]bool{kataBundleManifestName: true}
+	for _, entry := range manifest.Files {
+		if entry.Name == "" || paths[entry.Name] != "" {
+			return nil, fmt.Errorf("%w: empty or duplicate Kata bundle file name %q", ateerrors.ReasonInvalidSandboxAsset, entry.Name)
+		}
+		rel, err := cleanBundleRelativePath(entry.Path)
+		if err != nil {
+			return nil, err
+		}
+		if declared[rel] {
+			return nil, fmt.Errorf("%w: duplicate Kata bundle path %q", ateerrors.ReasonInvalidSandboxAsset, rel)
+		}
+		if err := resources.ValidateSHA256(entry.SHA256); err != nil {
+			return nil, fmt.Errorf("%w: invalid SHA-256 for Kata bundle file %q", ateerrors.ReasonInvalidSandboxAsset, entry.Name)
+		}
+		path := filepath.Join(root, filepath.FromSlash(rel))
+		fi, err := os.Lstat(path)
+		if err != nil || !fi.Mode().IsRegular() {
+			return nil, fmt.Errorf("%w: Kata bundle file %q is missing or not regular", ateerrors.ReasonInvalidSandboxAsset, rel)
+		}
+		if fi.Size() != entry.Size {
+			return nil, fmt.Errorf("%w: Kata bundle file %q size %d, want %d", ateerrors.ReasonInvalidSandboxAsset, rel, fi.Size(), entry.Size)
+		}
+		isExecutable := fi.Mode().Perm()&0o111 != 0
+		if isExecutable != entry.Executable {
+			return nil, fmt.Errorf("%w: Kata bundle file %q executable=%t, want %t", ateerrors.ReasonInvalidSandboxAsset, rel, isExecutable, entry.Executable)
+		}
+		got, err := fileSHA256(path)
+		if err != nil {
+			return nil, err
+		}
+		if got != entry.SHA256 {
+			return nil, fmt.Errorf("%w: Kata bundle file %q SHA-256 %s, want %s", ateerrors.ReasonInvalidSandboxAsset, rel, got, entry.SHA256)
+		}
+		declared[rel] = true
+		paths[entry.Name] = path
+	}
+	vmmKey := "kata-qemu"
+	if paths["kata-dragonball"] != "" {
+		vmmKey = "kata-dragonball"
+	}
+	for _, required := range []string{"kata-shim", vmmKey, "kata-kernel"} {
+		if paths[required] == "" {
+			return nil, fmt.Errorf("%w: Kata bundle manifest is missing %q", ateerrors.ReasonInvalidSandboxAsset, required)
+		}
+	}
+	if (paths["kata-image"] == "") == (paths["kata-initrd"] == "") {
+		return nil, fmt.Errorf("%w: Kata bundle manifest must contain exactly one of kata-image or kata-initrd", ateerrors.ReasonInvalidSandboxAsset)
+	}
+	if err := filepath.WalkDir(root, func(path string, d fs.DirEntry, walkErr error) error {
+		if walkErr != nil {
+			return walkErr
+		}
+		if d.IsDir() {
+			return nil
+		}
+		rel, err := filepath.Rel(root, path)
+		if err != nil {
+			return err
+		}
+		rel = filepath.ToSlash(rel)
+		if !declared[rel] {
+			return fmt.Errorf("%w: undeclared Kata bundle entry %q", ateerrors.ReasonInvalidSandboxAsset, rel)
+		}
+		return nil
+	}); err != nil {
+		return nil, err
+	}
+	return paths, nil
+}
+
+func fileSHA256(path string) (string, error) {
+	f, err := os.Open(path)
+	if err != nil {
+		return "", wrapFileSystemErr("while opening file for SHA-256", err)
+	}
+	h := sha256.New()
+	_, copyErr := io.Copy(h, f)
+	closeErr := f.Close()
+	if copyErr != nil || closeErr != nil {
+		return "", fmt.Errorf("%w: hash file %q: %v %v", ateerrors.ReasonInvalidSandboxAsset, path, copyErr, closeErr)
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
 // runscPathFor returns the local path of the gVisor `runsc` binary from a
 // fetched asset-path map, or "" if the runtime has none (e.g. micro-VM).
 func runscPathFor(paths map[string]string) string {
@@ -173,7 +528,7 @@ func runscPathFor(paths map[string]string) string {
 // the shared static-files cache and returns its local path. On a cache hit it
 // returns immediately.
 func (s *AteomHerder) fetchAsset(ctx context.Context, entry assetEntry) (string, error) {
-	if err := resources.ValidateRunscHash(entry.SHA256); err != nil {
+	if err := resources.ValidateSHA256(entry.SHA256); err != nil {
 		return "", wrapFileSystemErr("while validating asset hash", err)
 	}
 
@@ -210,7 +565,7 @@ func (s *AteomHerder) fetchAsset(ctx context.Context, entry assetEntry) (string,
 // the shared static-files cache, returning the local path of the extracted
 // `runsc` binary.
 func (s *AteomHerder) fetchGVisorRelease(ctx context.Context, entry assetEntry) (string, error) {
-	if err := resources.ValidateRunscHash(entry.SHA256); err != nil {
+	if err := resources.ValidateSHA256(entry.SHA256); err != nil {
 		return "", wrapFileSystemErr("while validating asset hash", err)
 	}
 
diff --git a/cmd/atelet/sandbox_prewarm.go b/cmd/atelet/sandbox_prewarm.go
index 5b360f7b19..75364844be 100644
--- a/cmd/atelet/sandbox_prewarm.go
+++ b/cmd/atelet/sandbox_prewarm.go
@@ -155,6 +155,13 @@ func (p *sandboxPrewarmer) skipConfig(ctx context.Context, cfg *v1alpha1.Sandbox
 			return true
 		}
 		return false
+	case v1alpha1.SandboxClassKata:
+		if !p.microvmCapable {
+			slog.DebugContext(ctx, "Skipping sandbox asset prewarm: node has no /dev/kvm, cannot run Kata workers",
+				slog.String("config", cfg.Name))
+			return true
+		}
+		return false
 	default:
 		// An unknown class has no backend in this atelet (likely version skew
 		// with a newer control plane); nothing to prewarm.
diff --git a/cmd/atelet/sandbox_prewarm_test.go b/cmd/atelet/sandbox_prewarm_test.go
index 71030d34d3..167fd6e147 100644
--- a/cmd/atelet/sandbox_prewarm_test.go
+++ b/cmd/atelet/sandbox_prewarm_test.go
@@ -122,6 +122,10 @@ func TestPrewarmEnqueueFilters(t *testing.T) {
 		ObjectMeta: metav1.ObjectMeta{Name: "microvm-default"},
 		Spec:       v1alpha1.SandboxConfigSpec{SandboxClass: v1alpha1.SandboxClassMicroVM},
 	}
+	kata := &v1alpha1.SandboxConfig{
+		ObjectMeta: metav1.ObjectMeta{Name: "kata-default"},
+		Spec:       v1alpha1.SandboxConfigSpec{SandboxClass: v1alpha1.SandboxClassKata},
+	}
 	gvisor := gvisorConfig("gvisor-default", "gs://bucket/runsc", fmt.Sprintf("%x", sha256.Sum256([]byte("runsc"))))
 
 	t.Run("node without KVM", func(t *testing.T) {
@@ -129,6 +133,7 @@ func TestPrewarmEnqueueFilters(t *testing.T) {
 
 		p.enqueue(ctx, "not a sandbox config")
 		p.enqueue(ctx, microvm)
+		p.enqueue(ctx, kata)
 		p.enqueue(ctx, &v1alpha1.SandboxConfig{
 			ObjectMeta: metav1.ObjectMeta{Name: "future-class"},
 			Spec:       v1alpha1.SandboxConfigSpec{SandboxClass: "future-class"},
@@ -151,9 +156,10 @@ func TestPrewarmEnqueueFilters(t *testing.T) {
 	t.Run("node with KVM", func(t *testing.T) {
 		p := newSandboxPrewarmer(nil, nil, nil, true)
 		p.enqueue(ctx, microvm)
+		p.enqueue(ctx, kata)
 		p.enqueue(ctx, gvisor)
-		if p.queue.Len() != 2 {
-			t.Errorf("queue holds %d configs, want both microvm and gvisor queued", p.queue.Len())
+		if p.queue.Len() != 3 {
+			t.Errorf("queue holds %d configs, want microvm, kata, and gvisor queued", p.queue.Len())
 		}
 	})
 }
diff --git a/cmd/atelet/statspoller.go b/cmd/atelet/statspoller.go
index cfee8efd83..53e6b6d8c6 100644
--- a/cmd/atelet/statspoller.go
+++ b/cmd/atelet/statspoller.go
@@ -381,6 +381,8 @@ func sandboxClassLabel(c ateompb.SandboxClass) string {
 		return "gvisor"
 	case ateompb.SandboxClass_SANDBOX_CLASS_MICROVM:
 		return "microvm"
+	case ateompb.SandboxClass_SANDBOX_CLASS_KATA:
+		return "kata"
 	default:
 		return ateattr.SandboxClassUnknown
 	}
diff --git a/cmd/atelet/statspoller_test.go b/cmd/atelet/statspoller_test.go
index 64fd00fc93..e233f7e5fe 100644
--- a/cmd/atelet/statspoller_test.go
+++ b/cmd/atelet/statspoller_test.go
@@ -158,6 +158,7 @@ func TestStatsPollerCollectAggregates(t *testing.T) {
 		"uid-3": {resp: executingResponse("ns-b", "tmpl-b", ateompb.SandboxClass_SANDBOX_CLASS_MICROVM, ateompb.StatsSource_STATS_SOURCE_GUEST_AGENT, 42, 40)},
 		"uid-4": {resp: availableResponse()},
 		"uid-5": {resp: pendingResponse("uid-5-actor")},
+		"uid-6": {resp: executingResponse("ns-c", "tmpl-c", ateompb.SandboxClass_SANDBOX_CLASS_KATA, ateompb.StatsSource_STATS_SOURCE_GUEST_AGENT, 84, 80)},
 	}
 	p, closers := newPollerFixture(t, fakes)
 
@@ -170,6 +171,9 @@ func TestStatsPollerCollectAggregates(t *testing.T) {
 		{templateNamespace: "ns-b", templateName: "tmpl-b", sandboxClass: "microvm", source: "guest-agent"}: {
 			sampledActors: 1, memoryCurrentBytes: 42, memoryWorkingSetBytes: 40,
 		},
+		{templateNamespace: "ns-c", templateName: "tmpl-c", sandboxClass: "kata", source: "guest-agent"}: {
+			sampledActors: 1, memoryCurrentBytes: 84, memoryWorkingSetBytes: 80,
+		},
 	}
 	if diff := cmp.Diff(want, got, cmp.AllowUnexported(templateAggregate{}, templateKey{}, workerPoolRef{})); diff != "" {
 		t.Errorf("collect() mismatch (-want +got):\n%s", diff)
diff --git a/cmd/ateom-kata/lifecycle_stats.go b/cmd/ateom-kata/lifecycle_stats.go
new file mode 100644
index 0000000000..5e7323b24e
--- /dev/null
+++ b/cmd/ateom-kata/lifecycle_stats.go
@@ -0,0 +1,221 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"sync/atomic"
+	"time"
+
+	"github.com/agent-substrate/substrate/internal/ateompath"
+	"github.com/agent-substrate/substrate/internal/imagecache"
+	"github.com/agent-substrate/substrate/internal/proto/ateompb"
+	"github.com/agent-substrate/substrate/internal/resources"
+	"github.com/agent-substrate/substrate/internal/sandboxd"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+)
+
+type activeKataWorkload struct {
+	key         string
+	attribution resources.ActorAttribution
+	sandbox     *sandboxd.Sandbox
+	client      runtimeClient
+}
+
+type activeKataState struct {
+	value atomic.Pointer[activeKataWorkload]
+}
+
+type kataDrainState struct {
+	value atomic.Bool
+}
+
+type runtimeStatsClient interface {
+	Stats(context.Context, *sandboxd.Sandbox) (*sandboxd.TaskStats, error)
+}
+
+type runtimeDrainClient interface {
+	Drain(context.Context, *sandboxd.Sandbox) error
+}
+
+func (s *service) setActive(atespace, actorName, uid, templateAtespace, templateName, key string, sb *sandboxd.Sandbox, client runtimeClient) {
+	s.active.value.Store(&activeKataWorkload{
+		key: key,
+		attribution: resources.ActorAttribution{
+			Ref:              resources.ActorRef{Atespace: atespace, Name: actorName},
+			UID:              uid,
+			TemplateAtespace: templateAtespace,
+			TemplateName:     templateName,
+		},
+		sandbox: sb,
+		client:  client,
+	})
+}
+
+func (s *service) clearActive(key string) {
+	active := s.active.value.Load()
+	if active != nil && active.key == key {
+		s.active.value.CompareAndSwap(active, nil)
+	}
+}
+
+func (s *service) rejectIfDraining() error {
+	if s.draining.value.Load() {
+		return status.Error(codes.Unavailable, "Kata worker is draining")
+	}
+	return nil
+}
+
+func (s *service) GetWorkloadStats(ctx context.Context, req *ateompb.GetWorkloadStatsRequest) (*ateompb.GetWorkloadStatsResponse, error) {
+	if req.GetActorUid() == "" {
+		return nil, status.Error(codes.InvalidArgument, "actor_uid is required")
+	}
+	active := s.active.value.Load()
+	if active == nil || active.attribution.UID != req.GetActorUid() {
+		return nil, status.Errorf(codes.NotFound, "Kata worker is not executing actor %q", req.GetActorUid())
+	}
+	sample, err := sampleKataWorkload(ctx, active)
+	if err != nil {
+		return nil, status.Errorf(codes.FailedPrecondition, "Kata workload is not measurable yet: %v", err)
+	}
+	if s.active.value.Load() != active {
+		return nil, status.Errorf(codes.NotFound, "Kata worker stopped executing actor %q while sampling", req.GetActorUid())
+	}
+	return &ateompb.GetWorkloadStatsResponse{Sample: sample}, nil
+}
+
+func (s *service) GetActiveWorkloadStats(ctx context.Context, _ *ateompb.GetActiveWorkloadStatsRequest) (*ateompb.GetActiveWorkloadStatsResponse, error) {
+	active := s.active.value.Load()
+	if active == nil {
+		return &ateompb.GetActiveWorkloadStatsResponse{}, nil
+	}
+	sample, err := sampleKataWorkload(ctx, active)
+	if err != nil {
+		return &ateompb.GetActiveWorkloadStatsResponse{
+			Samples: []*ateompb.WorkloadStatsSample{pendingKataSample(active)},
+		}, nil
+	}
+	if latest := s.active.value.Load(); latest != active {
+		if latest == nil {
+			return &ateompb.GetActiveWorkloadStatsResponse{}, nil
+		}
+		return &ateompb.GetActiveWorkloadStatsResponse{
+			Samples: []*ateompb.WorkloadStatsSample{pendingKataSample(latest)},
+		}, nil
+	}
+	return &ateompb.GetActiveWorkloadStatsResponse{
+		Samples: []*ateompb.WorkloadStatsSample{sample},
+	}, nil
+}
+
+func sampleKataWorkload(ctx context.Context, active *activeKataWorkload) (*ateompb.WorkloadStatsSample, error) {
+	client, ok := active.client.(runtimeStatsClient)
+	if !ok {
+		return nil, errors.New("runtime does not expose Task Stats")
+	}
+	stats, err := client.Stats(ctx, active.sandbox)
+	if err != nil {
+		return nil, err
+	}
+	a := active.attribution
+	return &ateompb.WorkloadStatsSample{
+		Atespace:              a.Ref.Atespace,
+		ActorName:             a.Ref.Name,
+		ActorUid:              a.UID,
+		ActorTemplateAtespace: a.TemplateAtespace,
+		ActorTemplateName:     a.TemplateName,
+		SandboxClass:          ateompb.SandboxClass_SANDBOX_CLASS_KATA,
+		Source:                ateompb.StatsSource_STATS_SOURCE_GUEST_AGENT,
+		MemoryCurrentBytes:    stats.MemoryCurrentBytes,
+		MemoryPeakBytes:       stats.MemoryPeakBytes,
+		MemoryWorkingSetBytes: stats.MemoryWorkingSetBytes,
+		CpuUsageUsec:          stats.CPUUsageUsec,
+		ObservedAtUnixNano:    time.Now().UnixNano(),
+	}, nil
+}
+
+func pendingKataSample(active *activeKataWorkload) *ateompb.WorkloadStatsSample {
+	a := active.attribution
+	return &ateompb.WorkloadStatsSample{
+		Atespace:              a.Ref.Atespace,
+		ActorName:             a.Ref.Name,
+		ActorUid:              a.UID,
+		ActorTemplateAtespace: a.TemplateAtespace,
+		ActorTemplateName:     a.TemplateName,
+		SandboxClass:          ateompb.SandboxClass_SANDBOX_CLASS_KATA,
+		ObservedAtUnixNano:    time.Now().UnixNano(),
+	}
+}
+
+func (s *service) setActiveRPC(name string, cancel context.CancelFunc) {
+	s.activeRPCMu.Lock()
+	defer s.activeRPCMu.Unlock()
+	s.activeRPC = &activeRPCInfo{name: name, cancel: cancel}
+}
+
+func (s *service) clearActiveRPC() {
+	s.activeRPCMu.Lock()
+	defer s.activeRPCMu.Unlock()
+	s.activeRPC = nil
+}
+
+func (s *service) cancelActiveActivationRPC() {
+	s.activeRPCMu.Lock()
+	defer s.activeRPCMu.Unlock()
+	if s.activeRPC != nil && (s.activeRPC.name == rpcRunWorkload || s.activeRPC.name == rpcRestoreWorkload) {
+		s.activeRPC.cancel()
+	}
+}
+
+func (s *service) gracefulShutdown(ctx context.Context) error {
+	s.draining.value.Store(true)
+	s.cancelActiveActivationRPC()
+	if !s.mu.LockContext(ctx) {
+		return ctx.Err()
+	}
+	defer s.mu.Unlock()
+	active := s.active.value.Load()
+	if active == nil {
+		return nil
+	}
+	var errs []error
+	if client, ok := active.client.(runtimeDrainClient); ok {
+		if err := client.Drain(ctx, active.sandbox); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	cleanupCtx, cancel := context.WithTimeout(ctx, 5*time.Second)
+	defer cancel()
+	if err := s.deleteRuntime(cleanupCtx, active.key, active.sandbox, active.client); err != nil {
+		errs = append(errs, err)
+	}
+	if s.ingress != nil {
+		if err := s.ingress.Deactivate(cleanupCtx); err != nil {
+			errs = append(errs, err)
+		}
+	}
+	if err := imagecache.UnmountAllUnder(ateompath.OCIBundleDir(active.attribution.UID)); err != nil && !errors.Is(err, os.ErrNotExist) {
+		errs = append(errs, err)
+	}
+	if err := s.network.Cleanup(cleanupCtx); err != nil {
+		errs = append(errs, err)
+	}
+	return errors.Join(errs...)
+}
diff --git a/cmd/ateom-kata/main.go b/cmd/ateom-kata/main.go
new file mode 100644
index 0000000000..bb221fffda
--- /dev/null
+++ b/cmd/ateom-kata/main.go
@@ -0,0 +1,891 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+// Command ateom-kata implements Ateom and the minimal Kata runtime lifecycle
+// required by a Worker Pod.
+package main
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log/slog"
+	"net"
+	"net/url"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"sort"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	"github.com/agent-substrate/substrate/internal/ateomcapacity"
+	"github.com/agent-substrate/substrate/internal/ateomnet"
+	"github.com/agent-substrate/substrate/internal/ateompath"
+	"github.com/agent-substrate/substrate/internal/atunnel"
+	"github.com/agent-substrate/substrate/internal/imagecache"
+	"github.com/agent-substrate/substrate/internal/proto/ateompb"
+	"github.com/agent-substrate/substrate/internal/readyz"
+	"github.com/agent-substrate/substrate/internal/sandboxd"
+	"github.com/agent-substrate/substrate/internal/serverboot"
+	"github.com/vishvananda/netns"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/reflection"
+	"google.golang.org/protobuf/proto"
+	runtimev1 "k8s.io/cri-api/pkg/apis/runtime/v1"
+)
+
+var (
+	podUID                      = flag.String("pod-uid", "", "Worker Pod UID")
+	sandboxdRoot                = flag.String("sandboxd-root", filepath.Join(ateompath.BasePath, "ateom-kata", "sandboxd"), "persistent Kata shim bundle root")
+	atunnelListenAddress        = flag.String("atunnel-listen-address", "0.0.0.0:443", "Actor ingress HTTPS")
+	atunnelConnectListenAddress = flag.String("atunnel-connect-listen-address", "0.0.0.0:444", "Actor ingress mTLS CONNECT")
+	workerCredentialBundle      = flag.String("atunnel-credential-bundle", "/run/podidentity.podcert.ate.dev/credential-bundle.pem", "Worker credential bundle")
+	podIdentityTrustBundle      = flag.String("atunnel-trust-bundle", "/run/podidentity.podcert.ate.dev/trust-bundle.pem", "Router client trust bundle")
+	atunnelClientIdentity       = flag.String("atunnel-client-identity", "spiffe://cluster.local/ns/ate-system/sa/atenet-router", "Allowed router SPIFFE identity")
+	readinessListenAddress      = flag.String("readiness-listen-address", "0.0.0.0:8080", "Address for HTTP readiness checks")
+)
+
+const (
+	kataRuntimeBundleAssetName = "ateom-kata-runtime-bundle"
+	kataRuntimeConfigAssetName = "ateom-kata-runtime-config"
+	rpcRunWorkload             = "RunWorkload"
+	rpcRestoreWorkload         = "RestoreWorkload"
+)
+
+type activeRPCInfo struct {
+	name   string
+	cancel context.CancelFunc
+}
+
+// cancelableMutex keeps shutdown from waiting forever behind a wedged RPC.
+type cancelableMutex struct {
+	ch chan struct{}
+}
+
+func newCancelableMutex() *cancelableMutex {
+	ch := make(chan struct{}, 1)
+	ch <- struct{}{}
+	return &cancelableMutex{ch: ch}
+}
+
+func (m *cancelableMutex) Lock() { <-m.ch }
+
+func (m *cancelableMutex) Unlock() { m.ch <- struct{}{} }
+
+func (m *cancelableMutex) LockContext(ctx context.Context) bool {
+	select {
+	case <-m.ch:
+		return true
+	case <-ctx.Done():
+		return false
+	}
+}
+
+func main() {
+	flag.Parse()
+	if err := run(); err != nil {
+		slog.Error("ateom-kata exited", "error", err)
+		os.Exit(1)
+	}
+}
+
+func run() error {
+	if *podUID == "" {
+		return errors.New("--pod-uid is required")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	ateomDir := ateompath.AteomPath(*podUID)
+	if err := os.MkdirAll(ateomDir, 0o700); err != nil {
+		return err
+	}
+	socket := ateompath.AteomSocketPath(*podUID)
+	_ = os.Remove(socket)
+	listener, err := net.Listen("unix", socket)
+	if err != nil {
+		return err
+	}
+	defer listener.Close()
+	interiorNetNS, err := ateomnet.CreateNetNSWithoutSwitching(ateompath.AteomNetNSName(*podUID))
+	if err != nil {
+		return fmt.Errorf("create Kata actor netns: %w", err)
+	}
+	defer interiorNetNS.Close()
+	network := &netNSActorNetwork{handle: interiorNetNS, path: ateompath.AteomNetNSPath(*podUID)}
+	ingress, err := runKataIngress(ctx)
+	if err != nil {
+		return err
+	}
+	service := newServiceWithRuntimeFactory(newKataRuntime, network, ingress)
+	server := grpc.NewServer()
+	ateompb.RegisterAteomServer(server, service)
+	reflection.Register(server)
+	readiness := &serverboot.Readiness{}
+	go serverboot.StartReadinessServer(ctx, *readinessListenAddress, readiness)
+	go func() {
+		err := ateomcapacity.Report(ctx, ateomcapacity.ReportConfig{
+			SocketPath:           ateompath.AteomSupportSocket,
+			CredentialBundlePath: *workerCredentialBundle,
+			TrustBundlePath:      *podIdentityTrustBundle,
+		})
+		if err != nil && ctx.Err() == nil {
+			slog.ErrorContext(ctx, "failed to report Kata worker capacity", "error", err)
+		}
+	}()
+
+	sigCh := make(chan os.Signal, 1)
+	signal.Notify(sigCh, syscall.SIGTERM)
+	defer signal.Stop(sigCh)
+	go func() {
+		sig := <-sigCh
+		slog.InfoContext(ctx, "received signal; draining Kata worker", "signal", sig.String())
+		readiness.MarkNotReady()
+		drainCtx, drainCancel := context.WithTimeout(context.Background(), 20*time.Second)
+		if err := service.gracefulShutdown(drainCtx); err != nil {
+			slog.ErrorContext(ctx, "kata worker drain completed with errors", "error", err)
+		}
+		drainExpired := drainCtx.Err() != nil
+		drainCancel()
+		cancel()
+		if drainExpired {
+			server.Stop()
+			return
+		}
+		server.GracefulStop()
+	}()
+
+	slog.InfoContext(ctx, "ateom-kata serving", "socket", socket, "runtime", "embedded-kata")
+	return server.Serve(listener)
+}
+
+// runKataIngress terminates router mTLS in the Worker Pod and forwards to
+// the active Kata VM through its actor veth. It deliberately has no egress
+// listener: egress needs the separate actor certificate-broker lifecycle.
+func runKataIngress(ctx context.Context) (*atunnel.Server, error) {
+	upstream, err := url.Parse("http://" + net.JoinHostPort(ateomnet.ActorVethIP, "80"))
+	if err != nil {
+		return nil, err
+	}
+	ingress, err := atunnel.NewServer(atunnel.Config{CredentialBundlePath: *workerCredentialBundle, TrustBundlePath: *podIdentityTrustBundle, AllowedClientID: *atunnelClientIdentity, Upstream: upstream})
+	if err != nil {
+		return nil, fmt.Errorf("configure Kata ingress atunnel: %w", err)
+	}
+	httpsListener, err := net.Listen("tcp", *atunnelListenAddress)
+	if err != nil {
+		return nil, fmt.Errorf("listen Kata ingress HTTPS: %w", err)
+	}
+	connectListener, err := net.Listen("tcp", *atunnelConnectListenAddress)
+	if err != nil {
+		_ = httpsListener.Close()
+		return nil, fmt.Errorf("listen Kata ingress CONNECT: %w", err)
+	}
+	serve := func(name string, fn func(context.Context, net.Listener) error, l net.Listener) {
+		go func() {
+			if err := fn(ctx, l); err != nil && ctx.Err() == nil {
+				slog.Error("kata ingress listener stopped", "listener", name, "error", err)
+				os.Exit(1)
+			}
+		}()
+	}
+	serve("https", ingress.Serve, httpsListener)
+	serve("connect", ingress.ServeConnect, connectListener)
+	return ingress, nil
+}
+
+type actorIngress interface {
+	Activate(string, string) error
+	Deactivate(context.Context) error
+}
+
+type runtimeClient interface {
+	Run(context.Context, *sandboxd.Sandbox) error
+	Checkpoint(context.Context, string, string, string, map[string]string) error
+	Restore(context.Context, *sandboxd.Sandbox, string, string) error
+	Delete(context.Context, string, []string) error
+}
+
+type runtimeClientFactory func(map[string]string) (runtimeClient, error)
+
+var _ runtimeClient = (*sandboxd.Runtime)(nil)
+
+type actorNetwork interface {
+	Setup(context.Context) error
+	Cleanup(context.Context) error
+	Path() string
+}
+
+type netNSActorNetwork struct {
+	handle netns.NsHandle
+	path   string
+}
+
+func (n *netNSActorNetwork) Setup(ctx context.Context) error {
+	return ateomnet.SetupActorNetwork(ctx, ateomnet.NetworkConfig{InteriorNetNS: n.handle})
+}
+
+func (n *netNSActorNetwork) Cleanup(ctx context.Context) error {
+	return ateomnet.CleanupActorNetwork(ctx, n.handle)
+}
+
+func (n *netNSActorNetwork) Path() string { return n.path }
+
+type service struct {
+	ateompb.UnimplementedAteomServer
+	mu                *cancelableMutex
+	client            runtimeClient
+	runtimeFactory    runtimeClientFactory
+	network           actorNetwork
+	ingress           actorIngress
+	runs              map[string]*sandboxd.Sandbox
+	runClients        map[string]runtimeClient
+	runtimeIdentities map[string]string
+	waitReady         func(context.Context, []*ateompb.Container, string) error
+	active            activeKataState
+	draining          kataDrainState
+	activeRPCMu       sync.Mutex
+	activeRPC         *activeRPCInfo
+}
+
+func newService(client runtimeClient, network actorNetwork) *service {
+	return &service{
+		mu: newCancelableMutex(), client: client, network: network, runs: map[string]*sandboxd.Sandbox{},
+		runClients: map[string]runtimeClient{}, runtimeIdentities: map[string]string{},
+		waitReady: readyz.WaitAll,
+	}
+}
+
+func newServiceWithRuntimeFactory(factory runtimeClientFactory, network actorNetwork, ingress actorIngress) *service {
+	s := newService(nil, network)
+	s.ingress = ingress
+	s.runtimeFactory = factory
+	return s
+}
+
+func newKataRuntime(paths map[string]string) (runtimeClient, error) {
+	if _, err := validateKataRuntimeAssetPaths(paths); err != nil {
+		return nil, err
+	}
+	shims, err := sandboxd.NewShimManager(sandboxd.ShimManagerConfig{
+		Binary: paths["kata-shim"], Root: *sandboxdRoot, KataConfig: paths[kataRuntimeConfigAssetName],
+	})
+	if err != nil {
+		return nil, err
+	}
+	tasks := sandboxd.NewTaskManager(shims)
+	return sandboxd.NewRuntime(sandboxd.NewSandboxController(shims, tasks), tasks), nil
+}
+
+func validateKataRuntimeAssetPaths(paths map[string]string) (string, error) {
+	if (paths["kata-qemu"] == "") == (paths["kata-dragonball"] == "") {
+		return "", errors.New("runtime_asset_paths must contain exactly one of kata-qemu or kata-dragonball")
+	}
+	vmmKey := "kata-qemu"
+	if paths["kata-dragonball"] != "" {
+		vmmKey = "kata-dragonball"
+	}
+	required := []string{kataRuntimeBundleAssetName, kataRuntimeConfigAssetName, "kata-shim", vmmKey, "kata-kernel"}
+	for _, name := range required {
+		if paths[name] == "" {
+			return "", fmt.Errorf("runtime_asset_paths is missing %q", name)
+		}
+	}
+	if (paths["kata-image"] == "") == (paths["kata-initrd"] == "") {
+		return "", errors.New("runtime_asset_paths must contain exactly one of kata-image or kata-initrd")
+	}
+	bundle := filepath.Clean(paths[kataRuntimeBundleAssetName])
+	if !filepath.IsAbs(bundle) {
+		return "", errors.New("kata runtime bundle path must be absolute")
+	}
+	bundleInfo, err := os.Lstat(bundle)
+	if err != nil || !bundleInfo.IsDir() {
+		return "", fmt.Errorf("kata runtime bundle is missing or not a directory: %v", err)
+	}
+	for name, path := range paths {
+		if name == kataRuntimeBundleAssetName {
+			continue
+		}
+		if !filepath.IsAbs(path) {
+			return "", fmt.Errorf("runtime asset %q path must be absolute", name)
+		}
+		info, err := os.Stat(path)
+		if err != nil || !info.Mode().IsRegular() {
+			return "", fmt.Errorf("runtime asset %q is missing or not regular: %v", name, err)
+		}
+		if name != kataRuntimeConfigAssetName {
+			rel, err := filepath.Rel(bundle, path)
+			if err != nil || rel == "." || rel == ".." || strings.HasPrefix(rel, ".."+string(os.PathSeparator)) {
+				return "", fmt.Errorf("runtime asset %q is outside the verified bundle", name)
+			}
+		}
+	}
+	for _, executable := range []string{"kata-shim", vmmKey} {
+		info, _ := os.Stat(paths[executable])
+		if info.Mode().Perm()&0o111 == 0 {
+			return "", fmt.Errorf("runtime asset %q is not executable", executable)
+		}
+	}
+	config, err := os.ReadFile(paths[kataRuntimeConfigAssetName])
+	if err != nil {
+		return "", fmt.Errorf("read Kata runtime config: %w", err)
+	}
+	configText := string(config)
+	if strings.Contains(configText, "/etc/kata-containers/") {
+		return "", errors.New("kata runtime config references a forbidden host default path")
+	}
+	for _, name := range []string{"kata-kernel", "kata-image", "kata-initrd"} {
+		if path := paths[name]; path != "" && !strings.Contains(configText, path) {
+			return "", fmt.Errorf("kata runtime config does not reference verified asset %q", name)
+		}
+	}
+	sharedFSCount := 0
+	passFDZero := false
+	for _, raw := range strings.Split(configText, "\n") {
+		line := strings.TrimSpace(strings.SplitN(raw, "#", 2)[0])
+		if strings.HasPrefix(line, "shared_fs") && strings.Contains(line, "=") {
+			sharedFSCount++
+			if line != `shared_fs = "none"` && line != `shared_fs="none"` {
+				return "", fmt.Errorf("kata runtime config has unsupported %q", line)
+			}
+		}
+		if strings.HasPrefix(line, "passfd_listener_port") && strings.Contains(line, "=") {
+			parts := strings.SplitN(line, "=", 2)
+			passFDZero = strings.TrimSpace(parts[1]) == "0"
+		}
+	}
+	if sharedFSCount != 1 {
+		return "", fmt.Errorf("kata runtime config has %d active shared_fs entries, require exactly one", sharedFSCount)
+	}
+	if !passFDZero {
+		return "", errors.New("kata runtime config must set passfd_listener_port = 0")
+	}
+	keys := make([]string, 0, len(paths))
+	for key := range paths {
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	h := sha256.New()
+	for _, key := range keys {
+		_, _ = io.WriteString(h, key+"\x00"+filepath.Clean(paths[key])+"\x00")
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+func (s *service) runtimeForActivation(paths map[string]string) (runtimeClient, string, error) {
+	if s.runtimeFactory == nil {
+		return s.client, "", nil
+	}
+	identity, err := validateKataRuntimeAssetPaths(paths)
+	if err != nil {
+		return nil, "", err
+	}
+	client, err := s.runtimeFactory(paths)
+	return client, identity, err
+}
+
+func (s *service) RunWorkload(ctx context.Context, req *ateompb.RunWorkloadRequest) (_ *ateompb.RunWorkloadResponse, retErr error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if err := s.rejectIfDraining(); err != nil {
+		return nil, err
+	}
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	s.setActiveRPC(rpcRunWorkload, cancel)
+	defer s.clearActiveRPC()
+	ns, tmpl, id := req.GetActorTemplateAtespace(), req.GetActorTemplateName(), req.GetActorUid()
+	key := actorKey(ns, tmpl, id)
+	if err := s.rejectIfActorRunning(key); err != nil {
+		return nil, err
+	}
+	client, runtimeIdentity, err := s.runtimeForActivation(req.GetRuntimeAssetPaths())
+	if err != nil {
+		return nil, fmt.Errorf("validate Kata runtime assets: %w", err)
+	}
+	sb, err := buildSandbox(ns, tmpl, id, req.GetSpec(), false, s.network.Path())
+	if err != nil {
+		return nil, err
+	}
+	if err := s.network.Setup(ctx); err != nil {
+		return nil, fmt.Errorf("setup Kata actor netns: %w", err)
+	}
+	runtimeStarted := false
+	defer func() {
+		if retErr != nil {
+			cleanupCtx := context.WithoutCancel(ctx)
+			if runtimeStarted {
+				if err := s.deleteRuntime(cleanupCtx, key, sb, client); err != nil {
+					retErr = errors.Join(retErr, fmt.Errorf("rollback Kata sandbox after Run failure: %w", err))
+				}
+			}
+			if s.ingress != nil && req.GetAtespace() != "" {
+				_ = s.ingress.Deactivate(cleanupCtx)
+			}
+			if err := s.network.Cleanup(cleanupCtx); err != nil {
+				slog.WarnContext(cleanupCtx, "kata actor netns cleanup failed after Run failure", "error", err)
+			}
+		}
+	}()
+	if err := setupBundleRootfs(sb); err != nil {
+		return nil, err
+	}
+	defer func() {
+		if err := imagecache.UnmountAllUnder(ateompath.OCIBundleDir(id)); err != nil {
+			slog.WarnContext(ctx, "bundle rootfs cleanup failed", "error", err)
+		}
+	}()
+	if err := prepareSandboxIO(sb); err != nil {
+		return nil, err
+	}
+	if err := client.Run(ctx, sb); err != nil {
+		return nil, err
+	}
+	runtimeStarted = true
+	s.rememberRun(key, sb, client, runtimeIdentity)
+	s.setActive(req.GetAtespace(), req.GetActorName(), id, ns, tmpl, key, sb, client)
+	if err := s.waitReady(ctx, req.GetSpec().GetContainers(), ateomnet.ActorVethIP); err != nil {
+		return nil, fmt.Errorf("wait for Kata actor readiness: %w", err)
+	}
+	if s.ingress != nil && req.GetAtespace() != "" {
+		if err := s.ingress.Activate(req.GetAtespace(), req.GetActorName()); err != nil {
+			return nil, fmt.Errorf("activate Kata actor ingress: %w", err)
+		}
+	}
+	return &ateompb.RunWorkloadResponse{}, nil
+}
+
+func (s *service) CheckpointWorkload(ctx context.Context, req *ateompb.CheckpointWorkloadRequest) (*ateompb.CheckpointWorkloadResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	ns, tmpl, id := req.GetActorTemplateAtespace(), req.GetActorTemplateName(), req.GetActorUid()
+	key := actorKey(ns, tmpl, id)
+	sb := s.runs[key]
+	if sb == nil {
+		return nil, fmt.Errorf("actor %q is not running", key)
+	}
+	if err := sandboxd.ValidateOperationID(req.GetOperationId()); err != nil {
+		return nil, fmt.Errorf("invalid operation ID: %w", err)
+	}
+	client := s.runClients[key]
+	if client == nil {
+		client = s.client
+	}
+	if s.runtimeFactory != nil {
+		identity, err := validateKataRuntimeAssetPaths(req.GetRuntimeAssetPaths())
+		if err != nil {
+			return nil, fmt.Errorf("validate Kata runtime assets: %w", err)
+		}
+		if identity != s.runtimeIdentities[key] {
+			return nil, errors.New("checkpoint runtime assets differ from the active actor runtime")
+		}
+	}
+	inventory := make(map[string]string, len(sb.Tasks))
+	for _, task := range sb.Tasks {
+		inventory[task.CheckpointKey] = task.TaskID
+	}
+	if err := client.Checkpoint(ctx, sb.SandboxID, ateompath.CheckpointStateDir(id), req.GetOperationId(), inventory); err != nil {
+		return nil, err
+	}
+	ids := make([]string, 0, len(sb.Tasks))
+	for _, task := range sb.Tasks {
+		ids = append(ids, task.TaskID)
+	}
+	if err := client.Delete(context.WithoutCancel(ctx), sb.SandboxID, ids); err != nil {
+		return nil, fmt.Errorf("checkpoint succeeded but cleanup failed: %w", err)
+	}
+	if s.ingress != nil && req.GetAtespace() != "" {
+		if err := s.ingress.Deactivate(context.WithoutCancel(ctx)); err != nil {
+			slog.WarnContext(ctx, "deactivate Kata actor ingress", "error", err)
+		}
+	}
+	// A successful Delete means the actor is no longer running even if
+	// inspecting the checkpoint output below fails. Do not retain stale state.
+	delete(s.runs, key)
+	delete(s.runClients, key)
+	delete(s.runtimeIdentities, key)
+	s.clearActive(key)
+	if err := s.network.Cleanup(context.WithoutCancel(ctx)); err != nil {
+		return nil, fmt.Errorf("checkpoint succeeded but actor netns cleanup failed: %w", err)
+	}
+	files, err := checkpointFiles(ateompath.CheckpointStateDir(id))
+	if err != nil {
+		return nil, err
+	}
+	compatibility, err := sandboxd.CheckpointCompatibility(ateompath.CheckpointStateDir(id))
+	if err != nil {
+		return nil, err
+	}
+	return &ateompb.CheckpointWorkloadResponse{SnapshotFiles: files, RuntimeCompatibility: &ateompb.RuntimeCompatibility{Profile: compatibility.Profile, RuntimeFingerprint: compatibility.Fingerprint}}, nil
+}
+
+func (s *service) RestoreWorkload(ctx context.Context, req *ateompb.RestoreWorkloadRequest) (_ *ateompb.RestoreWorkloadResponse, retErr error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if err := s.rejectIfDraining(); err != nil {
+		return nil, err
+	}
+	ctx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	s.setActiveRPC(rpcRestoreWorkload, cancel)
+	defer s.clearActiveRPC()
+	ns, tmpl, id := req.GetActorTemplateAtespace(), req.GetActorTemplateName(), req.GetActorUid()
+	key := actorKey(ns, tmpl, id)
+	if err := s.rejectIfActorRunning(key); err != nil {
+		return nil, err
+	}
+	if err := sandboxd.ValidateOperationID(req.GetOperationId()); err != nil {
+		return nil, fmt.Errorf("invalid operation ID: %w", err)
+	}
+	if expected := req.GetRuntimeCompatibility(); expected != nil {
+		actual, err := sandboxd.CheckpointCompatibility(ateompath.RestoreStateDir(id))
+		if err != nil {
+			return nil, err
+		}
+		if expected.GetProfile() != actual.Profile || expected.GetRuntimeFingerprint() != actual.Fingerprint {
+			return nil, errors.New("transport compatibility does not match Kata checkpoint manifest")
+		}
+	}
+	client, runtimeIdentity, err := s.runtimeForActivation(req.GetRuntimeAssetPaths())
+	if err != nil {
+		return nil, fmt.Errorf("validate Kata runtime assets: %w", err)
+	}
+	sb, err := buildSandbox(ns, tmpl, id, req.GetSpec(), true, s.network.Path())
+	if err != nil {
+		return nil, err
+	}
+	if err := s.network.Setup(ctx); err != nil {
+		return nil, fmt.Errorf("setup Kata actor netns for restore: %w", err)
+	}
+	runtimeStarted := false
+	defer func() {
+		if retErr != nil {
+			cleanupCtx := context.WithoutCancel(ctx)
+			if runtimeStarted {
+				if err := s.deleteRuntime(cleanupCtx, key, sb, client); err != nil {
+					retErr = errors.Join(retErr, fmt.Errorf("rollback Kata sandbox after Restore failure: %w", err))
+				}
+			}
+			if s.ingress != nil && req.GetAtespace() != "" {
+				_ = s.ingress.Deactivate(cleanupCtx)
+			}
+			if err := imagecache.UnmountAllUnder(ateompath.OCIBundleDir(id)); err != nil {
+				slog.WarnContext(cleanupCtx, "bundle rootfs cleanup failed after Restore failure", "error", err)
+			}
+			if err := s.network.Cleanup(cleanupCtx); err != nil {
+				slog.WarnContext(cleanupCtx, "kata actor netns cleanup failed after Restore failure", "error", err)
+			}
+		}
+	}()
+	if err := makeCheckpointReadOnly(ateompath.RestoreStateDir(id)); err != nil {
+		return nil, err
+	}
+	if err := prepareSandboxIO(sb); err != nil {
+		return nil, err
+	}
+	if err := client.Restore(ctx, sb, ateompath.RestoreStateDir(id), req.GetOperationId()); err != nil {
+		return nil, err
+	}
+	runtimeStarted = true
+	s.rememberRun(key, sb, client, runtimeIdentity)
+	s.setActive(req.GetAtespace(), req.GetActorName(), id, ns, tmpl, key, sb, client)
+	if err := s.waitReady(ctx, req.GetSpec().GetContainers(), ateomnet.ActorVethIP); err != nil {
+		return nil, fmt.Errorf("wait for restored Kata actor readiness: %w", err)
+	}
+	if s.ingress != nil && req.GetAtespace() != "" {
+		if err := s.ingress.Activate(req.GetAtespace(), req.GetActorName()); err != nil {
+			return nil, fmt.Errorf("activate restored Kata actor ingress: %w", err)
+		}
+	}
+	return &ateompb.RestoreWorkloadResponse{}, nil
+}
+
+func (s *service) TerminateWorkload(ctx context.Context, req *ateompb.TerminateWorkloadRequest) (*ateompb.TerminateWorkloadResponse, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	key := actorKey(req.GetActorTemplateAtespace(), req.GetActorTemplateName(), req.GetActorUid())
+	sb := s.runs[key]
+	if sb == nil {
+		if err := s.rejectIfActorRunning(key); err != nil {
+			return nil, err
+		}
+		return &ateompb.TerminateWorkloadResponse{}, nil
+	}
+	client := s.runClients[key]
+	if client == nil {
+		client = s.client
+	}
+	cleanupCtx := context.WithoutCancel(ctx)
+	if err := s.deleteRuntime(cleanupCtx, key, sb, client); err != nil {
+		return nil, fmt.Errorf("delete Kata sandbox: %w", err)
+	}
+
+	var errs []error
+	if s.ingress != nil && req.GetAtespace() != "" {
+		if err := s.ingress.Deactivate(cleanupCtx); err != nil {
+			errs = append(errs, fmt.Errorf("deactivate Kata actor ingress: %w", err))
+		}
+	}
+	if err := imagecache.UnmountAllUnder(ateompath.OCIBundleDir(req.GetActorUid())); err != nil && !errors.Is(err, os.ErrNotExist) {
+		errs = append(errs, fmt.Errorf("unmount Kata actor bundles: %w", err))
+	}
+	if err := s.network.Cleanup(cleanupCtx); err != nil {
+		errs = append(errs, fmt.Errorf("clean up Kata actor netns: %w", err))
+	}
+	if err := errors.Join(errs...); err != nil {
+		return nil, err
+	}
+	return &ateompb.TerminateWorkloadResponse{}, nil
+}
+
+func (s *service) rememberRun(key string, sb *sandboxd.Sandbox, client runtimeClient, runtimeIdentity string) {
+	s.runs[key] = sb
+	s.runClients[key] = client
+	s.runtimeIdentities[key] = runtimeIdentity
+}
+
+func (s *service) deleteRuntime(ctx context.Context, key string, sb *sandboxd.Sandbox, client runtimeClient) error {
+	ids := make([]string, 0, len(sb.Tasks))
+	for _, task := range sb.Tasks {
+		ids = append(ids, task.TaskID)
+	}
+	if err := client.Delete(ctx, sb.SandboxID, ids); err != nil {
+		return err
+	}
+	delete(s.runs, key)
+	delete(s.runClients, key)
+	delete(s.runtimeIdentities, key)
+	s.clearActive(key)
+	return nil
+}
+
+func actorKey(namespace, template, actorID string) string {
+	return namespace + ":" + template + ":" + actorID
+}
+
+// A Worker owns one interior netns and therefore runs at most one Actor.
+// Reject before SetupActorNetwork, which deliberately removes stale links.
+func (s *service) rejectIfActorRunning(requested string) error {
+	for active := range s.runs {
+		return fmt.Errorf("cannot activate actor %q while actor %q is running", requested, active)
+	}
+	return nil
+}
+
+func buildSandbox(namespace, template, actorID string, spec *ateompb.WorkloadSpec, restoring bool, netNSPath string) (*sandboxd.Sandbox, error) {
+	if actorID == "" || spec == nil || len(spec.GetContainers()) == 0 || !filepath.IsAbs(netNSPath) {
+		return nil, errors.New("actor UID, containers and absolute netns path are required")
+	}
+	digest := sha256.Sum256([]byte(namespace + "\x00" + template + "\x00" + actorID))
+	runtimeID := "ate-" + hex.EncodeToString(digest[:16])
+	if restoring {
+		// Kata RestoreSandbox supports rebinding checkpoint keys to new runtime
+		// IDs. Never adopt a checkpoint under its source sandbox/task IDs.
+		runtimeID += "-r"
+	}
+	config, err := proto.Marshal(&runtimev1.PodSandboxConfig{
+		Metadata:    &runtimev1.PodSandboxMetadata{Name: template, Uid: actorID, Namespace: namespace},
+		Hostname:    actorID,
+		Annotations: map[string]string{"io.kubernetes.cri.sandbox-id": runtimeID},
+	})
+	if err != nil {
+		return nil, err
+	}
+	// runtime-rs discovers eth0 in this actor-owned interior netns and creates
+	// the VM endpoint. The Worker Pod's CNI netns remains owned by Substrate.
+	sb := &sandboxd.Sandbox{SandboxID: runtimeID, NetNSPath: netNSPath, PodSandboxConfig: config}
+	for _, container := range spec.GetContainers() {
+		bundle := ateompath.OCIBundlePath(actorID, container.GetName())
+		rootfs := filepath.Join(bundle, "rootfs.raw")
+		if restoring {
+			rootfs = ""
+		}
+		sb.Tasks = append(sb.Tasks, &sandboxd.Task{
+			CheckpointKey: container.GetName(), TaskID: runtimeID + "-" + container.GetName(), Bundle: bundle,
+			Stdout: filepath.Join(bundle, "stdout.fifo"), Stderr: filepath.Join(bundle, "stderr.fifo"),
+			RootfsFile: rootfs, RootfsFSType: "ext4", RootfsOptions: []string{"rw", "loop"},
+		})
+	}
+	return sb, nil
+}
+
+func setupBundleRootfs(sb *sandboxd.Sandbox) error {
+	for _, task := range sb.Tasks {
+		if err := imagecache.SetupBundleRootfs(task.Bundle); err != nil {
+			_ = imagecache.UnmountAllUnder(filepath.Dir(task.Bundle))
+			return fmt.Errorf("setup rootfs for task %q: %w", task.TaskID, err)
+		}
+		if err := ensureKataLinuxResources(task.Bundle); err != nil {
+			_ = imagecache.UnmountAllUnder(filepath.Dir(task.Bundle))
+			return fmt.Errorf("set Kata task resources for %q: %w", task.TaskID, err)
+		}
+	}
+	return nil
+}
+
+// ensureKataLinuxResources supplies a conservative CPU share only when the
+// image OCI spec does not declare Linux resources. runtime-rs requires a
+// non-empty resource object during task creation; explicit image resources
+// remain authoritative.
+func ensureKataLinuxResources(bundle string) error {
+	path := filepath.Join(bundle, "config.json")
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return err
+	}
+	var spec map[string]any
+	if err := json.Unmarshal(b, &spec); err != nil {
+		return err
+	}
+	linux, ok := spec["linux"].(map[string]any)
+	if !ok {
+		return errors.New("OCI spec has no linux section")
+	}
+
+	// The Kata sandbox already owns the actor netns. Passing the same network
+	// namespace again on a task asks the guest runtime to join a host namespace,
+	// which it cannot do. This transformation is Kata-local; the shared OCI
+	// builder remains unchanged for gVisor and microVM.
+	changed := false
+	if namespaces, ok := linux["namespaces"].([]any); ok {
+		filtered := namespaces[:0]
+		for _, namespace := range namespaces {
+			entry, _ := namespace.(map[string]any)
+			if entry["type"] == "network" {
+				changed = true
+				continue
+			}
+			filtered = append(filtered, namespace)
+		}
+		linux["namespaces"] = filtered
+	}
+	if resources, ok := linux["resources"]; !ok || resources == nil {
+		linux["resources"] = map[string]any{"cpu": map[string]any{"shares": 1024}}
+		changed = true
+	}
+	if !changed {
+		return nil
+	}
+	out, err := json.Marshal(spec)
+	if err != nil {
+		return err
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(path, out, info.Mode().Perm())
+}
+
+func checkpointFiles(root string) ([]string, error) {
+	if !filepath.IsAbs(root) {
+		return nil, errors.New("checkpoint root must be absolute")
+	}
+	var files []string
+	err := filepath.WalkDir(root, func(filePath string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		if !entry.Type().IsRegular() {
+			return fmt.Errorf("unsupported checkpoint entry %q", filePath)
+		}
+		rel, err := filepath.Rel(root, filePath)
+		if err != nil {
+			return err
+		}
+		rel = filepath.ToSlash(rel)
+		if rel == "." || rel == "" || rel == ".." || len(rel) >= 3 && rel[:3] == "../" {
+			return fmt.Errorf("checkpoint path escapes root: %q", rel)
+		}
+		files = append(files, rel)
+		return nil
+	})
+	if err != nil {
+		return nil, err
+	}
+	sort.Strings(files)
+	return files, nil
+}
+
+func makeCheckpointReadOnly(root string) error {
+	return filepath.WalkDir(root, func(filePath string, entry os.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if entry.IsDir() {
+			return nil
+		}
+		if !entry.Type().IsRegular() {
+			return fmt.Errorf("unsupported restore checkpoint entry %q", filePath)
+		}
+		if err := os.Chmod(filePath, 0o400); err != nil {
+			return fmt.Errorf("make restore checkpoint %q read-only: %w", filePath, err)
+		}
+		return nil
+	})
+}
+
+func prepareSandboxIO(sb *sandboxd.Sandbox) error {
+	for _, task := range sb.Tasks {
+		for _, stream := range []struct {
+			fifo, log string
+			writer    io.Writer
+		}{
+			{task.Stdout, filepath.Join(task.Bundle, "stdout.log"), os.Stdout},
+			{task.Stderr, filepath.Join(task.Bundle, "stderr.log"), os.Stderr},
+		} {
+			if info, err := os.Lstat(stream.fifo); errors.Is(err, os.ErrNotExist) {
+				if err := syscall.Mkfifo(stream.fifo, 0o600); err != nil {
+					return fmt.Errorf("create task FIFO %q: %w", stream.fifo, err)
+				}
+			} else if err != nil {
+				return err
+			} else if info.Mode()&os.ModeNamedPipe == 0 {
+				return fmt.Errorf("task IO path %q is not a FIFO", stream.fifo)
+			}
+			go consumeTaskIO(stream.fifo, stream.log, stream.writer)
+		}
+	}
+	return nil
+}
+
+func consumeTaskIO(fifoPath, logPath string, writer io.Writer) {
+	fifo, err := os.Open(fifoPath)
+	if err != nil {
+		slog.Error("open task FIFO", "path", fifoPath, "error", err)
+		return
+	}
+	defer fifo.Close()
+	logFile, err := os.OpenFile(logPath, os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)
+	if err != nil {
+		slog.Error("open task log", "path", logPath, "error", err)
+		return
+	}
+	defer logFile.Close()
+	if _, err := io.Copy(io.MultiWriter(writer, logFile), fifo); err != nil {
+		slog.Error("copy task IO", "path", fifoPath, "error", err)
+	}
+}
diff --git a/cmd/ateom-kata/main_test.go b/cmd/ateom-kata/main_test.go
new file mode 100644
index 0000000000..7dadfbe081
--- /dev/null
+++ b/cmd/ateom-kata/main_test.go
@@ -0,0 +1,450 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package main
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+	"time"
+
+	"github.com/agent-substrate/substrate/internal/ateompath"
+	"github.com/agent-substrate/substrate/internal/proto/ateompb"
+	"github.com/agent-substrate/substrate/internal/sandboxd"
+)
+
+func TestRestoreUsesFreshRuntimeIDs(t *testing.T) {
+	spec := &ateompb.WorkloadSpec{Containers: []*ateompb.Container{{Name: "app"}}}
+	const netNSPath = "/run/netns/ateom:test"
+	source, err := buildSandbox("ns", "template", "actor", spec, false, netNSPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	restored, err := buildSandbox("ns", "template", "actor", spec, true, netNSPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if source.SandboxID == restored.SandboxID || source.Tasks[0].TaskID == restored.Tasks[0].TaskID {
+		t.Fatalf("restore reused source IDs: source=%+v restored=%+v", source, restored)
+	}
+	if source.Tasks[0].CheckpointKey != restored.Tasks[0].CheckpointKey {
+		t.Fatal("restore changed checkpoint key")
+	}
+	if source.NetNSPath != netNSPath || restored.NetNSPath != netNSPath {
+		t.Fatalf("netns paths = %q, %q; want %q", source.NetNSPath, restored.NetNSPath, netNSPath)
+	}
+}
+
+type fakeActorNetwork struct {
+	path     string
+	cleanups int
+}
+
+type trackingRuntime struct {
+	deletes   int
+	drains    int
+	deleteErr error
+}
+
+func (*trackingRuntime) Run(context.Context, *sandboxd.Sandbox) error { return nil }
+func (*trackingRuntime) Checkpoint(context.Context, string, string, string, map[string]string) error {
+	return nil
+}
+func (*trackingRuntime) Restore(_ context.Context, sb *sandboxd.Sandbox, _, _ string) error {
+	// Let the FIFO consumers created by prepareSandboxIO connect and exit.
+	for _, task := range sb.Tasks {
+		for _, path := range []string{task.Stdout, task.Stderr} {
+			f, err := os.OpenFile(path, os.O_WRONLY, 0)
+			if err != nil {
+				return err
+			}
+			if err := f.Close(); err != nil {
+				return err
+			}
+		}
+	}
+	return nil
+}
+func (r *trackingRuntime) Delete(context.Context, string, []string) error {
+	r.deletes++
+	return r.deleteErr
+}
+func (r *trackingRuntime) Drain(context.Context, *sandboxd.Sandbox) error {
+	r.drains++
+	return nil
+}
+func (*trackingRuntime) Stats(context.Context, *sandboxd.Sandbox) (*sandboxd.TaskStats, error) {
+	return &sandboxd.TaskStats{MemoryCurrentBytes: 10, MemoryPeakBytes: 20, MemoryWorkingSetBytes: 8, CPUUsageUsec: 30}, nil
+}
+
+func (*fakeActorNetwork) Setup(context.Context) error { return nil }
+func (n *fakeActorNetwork) Cleanup(context.Context) error {
+	n.cleanups++
+	return nil
+}
+func (n *fakeActorNetwork) Path() string { return n.path }
+
+func TestRejectIfActorRunning(t *testing.T) {
+	svc := &service{runs: map[string]*sandboxd.Sandbox{}}
+	if err := svc.rejectIfActorRunning("requested"); err != nil {
+		t.Fatalf("empty worker rejected activation: %v", err)
+	}
+	svc.runs["active"] = &sandboxd.Sandbox{SandboxID: "sandbox-1"}
+	if err := svc.rejectIfActorRunning("requested"); err == nil {
+		t.Fatal("worker accepted a second actor")
+	}
+}
+
+func TestValidateKataRuntimeAssetPaths(t *testing.T) {
+	bundle := filepath.Join(t.TempDir(), "runtime-bundle")
+	if err := os.MkdirAll(filepath.Join(bundle, "bin"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(filepath.Join(bundle, "share"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	paths := map[string]string{
+		kataRuntimeBundleAssetName: bundle,
+		"kata-shim":                filepath.Join(bundle, "bin", "containerd-shim-kata-v2"),
+		"kata-qemu":                filepath.Join(bundle, "bin", "qemu-system-x86_64"),
+		"kata-kernel":              filepath.Join(bundle, "share", "vmlinux"),
+		"kata-initrd":              filepath.Join(bundle, "share", "kata.initrd"),
+	}
+	for name, path := range paths {
+		if name == kataRuntimeBundleAssetName {
+			continue
+		}
+		mode := os.FileMode(0o600)
+		if name == "kata-shim" || name == "kata-qemu" {
+			mode = 0o700
+		}
+		if err := os.WriteFile(path, []byte(name), mode); err != nil {
+			t.Fatal(err)
+		}
+	}
+	config := filepath.Join(t.TempDir(), "configuration.toml")
+	paths[kataRuntimeConfigAssetName] = config
+	configText := "path = \"" + paths["kata-qemu"] + "\"\n" +
+		"kernel = \"" + paths["kata-kernel"] + "\"\n" +
+		"initrd = \"" + paths["kata-initrd"] + "\"\n" +
+		"shared_fs = \"none\"\npassfd_listener_port = 0\n"
+	if err := os.WriteFile(config, []byte(configText), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	identity, err := validateKataRuntimeAssetPaths(paths)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if identity == "" {
+		t.Fatal("runtime identity is empty")
+	}
+
+	t.Run("rejects host defaults", func(t *testing.T) {
+		bad := mapsClone(paths)
+		badConfig := filepath.Join(t.TempDir(), "configuration.toml")
+		bad[kataRuntimeConfigAssetName] = badConfig
+		if err := os.WriteFile(badConfig, []byte(configText+"firmware = \"/etc/kata-containers/firmware.fd\"\n"), 0o600); err != nil {
+			t.Fatal(err)
+		}
+		if _, err := validateKataRuntimeAssetPaths(bad); err == nil {
+			t.Fatal("host-default runtime config accepted")
+		}
+	})
+
+	t.Run("rejects bundle escape", func(t *testing.T) {
+		bad := mapsClone(paths)
+		outside := filepath.Join(t.TempDir(), "qemu")
+		if err := os.WriteFile(outside, []byte("qemu"), 0o700); err != nil {
+			t.Fatal(err)
+		}
+		bad["kata-qemu"] = outside
+		if _, err := validateKataRuntimeAssetPaths(bad); err == nil {
+			t.Fatal("runtime file outside verified bundle accepted")
+		}
+	})
+}
+
+func mapsClone(in map[string]string) map[string]string {
+	out := make(map[string]string, len(in))
+	for key, value := range in {
+		out[key] = value
+	}
+	return out
+}
+
+func TestCheckpointFiles(t *testing.T) {
+	root := t.TempDir()
+	if err := os.Mkdir(filepath.Join(root, "vm"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	for name, content := range map[string]string{
+		"manifest.json": "manifest",
+		"vm/memory":     "memory",
+		"vm/state":      "state",
+	} {
+		if err := os.WriteFile(filepath.Join(root, filepath.FromSlash(name)), []byte(content), 0o600); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	got, err := checkpointFiles(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := []string{"manifest.json", "vm/memory", "vm/state"}
+	if !reflect.DeepEqual(got, want) {
+		t.Fatalf("checkpointFiles() = %v, want %v", got, want)
+	}
+}
+
+func TestCheckpointFilesRejectsUnsafeEntries(t *testing.T) {
+	if _, err := checkpointFiles("relative/checkpoint"); err == nil {
+		t.Fatal("relative checkpoint root accepted")
+	}
+
+	root := t.TempDir()
+	outside := filepath.Join(t.TempDir(), "outside")
+	if err := os.WriteFile(outside, []byte("outside"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Symlink(outside, filepath.Join(root, "state")); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := checkpointFiles(root); err == nil {
+		t.Fatal("checkpoint symlink accepted")
+	}
+}
+
+type checkpointRuntime struct{}
+
+func (*checkpointRuntime) Run(context.Context, *sandboxd.Sandbox) error { return nil }
+func (*checkpointRuntime) Restore(context.Context, *sandboxd.Sandbox, string, string) error {
+	return nil
+}
+func (*checkpointRuntime) Delete(context.Context, string, []string) error { return nil }
+func (*checkpointRuntime) Checkpoint(_ context.Context, _ string, output, _ string, _ map[string]string) error {
+	if err := os.MkdirAll(output, 0o700); err != nil {
+		return err
+	}
+	return os.Symlink("missing", filepath.Join(output, "unsafe-link"))
+}
+
+func TestCheckpointDropsRunningStateAfterSuccessfulDelete(t *testing.T) {
+	const namespace, template, actorID = "ns", "template", "checkpoint-state-test"
+	checkpointDir := ateompath.CheckpointStateDir(actorID)
+	if err := os.RemoveAll(checkpointDir); err != nil {
+		t.Fatal(err)
+	}
+	defer os.RemoveAll(checkpointDir)
+
+	key := actorKey(namespace, template, actorID)
+	network := &fakeActorNetwork{path: "/run/netns/ateom:test"}
+	svc := newService(&checkpointRuntime{}, network)
+	svc.runs[key] = &sandboxd.Sandbox{
+		SandboxID: "sandbox-1",
+		Tasks:     []*sandboxd.Task{{CheckpointKey: "app", TaskID: "task-1"}},
+	}
+	_, err := svc.CheckpointWorkload(context.Background(), &ateompb.CheckpointWorkloadRequest{
+		ActorTemplateAtespace: namespace,
+		ActorTemplateName:     template,
+		ActorUid:              actorID,
+		OperationId:           "8d830f4d-0813-44ef-8495-3d95af80e27c",
+	})
+	if err == nil {
+		t.Fatal("checkpoint accepted an unsafe output entry")
+	}
+	if _, exists := svc.runs[key]; exists {
+		t.Fatal("actor remained marked running after successful sandbox deletion")
+	}
+	if network.cleanups != 1 {
+		t.Fatalf("actor netns cleanup count = %d, want 1", network.cleanups)
+	}
+}
+
+func TestRestoreReadinessFailureRollsBackRuntime(t *testing.T) {
+	origActorsDir := ateompath.ActorsDir
+	ateompath.ActorsDir = t.TempDir()
+	t.Cleanup(func() { ateompath.ActorsDir = origActorsDir })
+
+	const namespace, template, actorID = "ns", "template", "restore-ready-test"
+	if err := os.MkdirAll(ateompath.RestoreStateDir(actorID), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.MkdirAll(ateompath.OCIBundlePath(actorID, "app"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	runtime := &trackingRuntime{}
+	network := &fakeActorNetwork{path: "/run/netns/ateom:test"}
+	svc := newService(runtime, network)
+	wantErr := errors.New("not ready")
+	svc.waitReady = func(context.Context, []*ateompb.Container, string) error {
+		return wantErr
+	}
+
+	_, err := svc.RestoreWorkload(context.Background(), &ateompb.RestoreWorkloadRequest{
+		ActorTemplateAtespace: namespace,
+		ActorTemplateName:     template,
+		ActorUid:              actorID,
+		OperationId:           "8d830f4d-0813-44ef-8495-3d95af80e27c",
+		Spec:                  &ateompb.WorkloadSpec{Containers: []*ateompb.Container{{Name: "app"}}},
+	})
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("RestoreWorkload error = %v, want readiness failure", err)
+	}
+	if runtime.deletes != 1 {
+		t.Fatalf("runtime Delete calls = %d, want 1", runtime.deletes)
+	}
+	if network.cleanups != 1 {
+		t.Fatalf("network Cleanup calls = %d, want 1", network.cleanups)
+	}
+	if len(svc.runs) != 0 {
+		t.Fatalf("running state survived successful rollback: %+v", svc.runs)
+	}
+}
+
+func TestTerminateWorkloadDeletesRuntimeAndIsIdempotent(t *testing.T) {
+	origActorsDir := ateompath.ActorsDir
+	ateompath.ActorsDir = t.TempDir()
+	t.Cleanup(func() { ateompath.ActorsDir = origActorsDir })
+
+	const namespace, template, actorID = "ns", "template", "terminate-test"
+	key := actorKey(namespace, template, actorID)
+	runtime := &trackingRuntime{}
+	network := &fakeActorNetwork{path: "/run/netns/ateom:test"}
+	svc := newService(runtime, network)
+	svc.runs[key] = &sandboxd.Sandbox{SandboxID: "sandbox-1", Tasks: []*sandboxd.Task{{TaskID: "task-1"}}}
+	svc.runClients[key] = runtime
+
+	req := &ateompb.TerminateWorkloadRequest{
+		ActorTemplateAtespace: namespace,
+		ActorTemplateName:     template,
+		ActorUid:              actorID,
+	}
+	if _, err := svc.TerminateWorkload(context.Background(), req); err != nil {
+		t.Fatalf("TerminateWorkload: %v", err)
+	}
+	if runtime.deletes != 1 || network.cleanups != 1 || len(svc.runs) != 0 {
+		t.Fatalf("terminate result: deletes=%d cleanups=%d runs=%d", runtime.deletes, network.cleanups, len(svc.runs))
+	}
+	if _, err := svc.TerminateWorkload(context.Background(), req); err != nil {
+		t.Fatalf("idempotent TerminateWorkload: %v", err)
+	}
+	if runtime.deletes != 1 {
+		t.Fatalf("idempotent terminate called Delete again: %d", runtime.deletes)
+	}
+}
+
+func TestTerminateWorkloadRetainsStateWhenDeleteFails(t *testing.T) {
+	const namespace, template, actorID = "ns", "template", "terminate-retry-test"
+	key := actorKey(namespace, template, actorID)
+	runtime := &trackingRuntime{deleteErr: errors.New("delete failed")}
+	svc := newService(runtime, &fakeActorNetwork{path: "/run/netns/ateom:test"})
+	svc.runs[key] = &sandboxd.Sandbox{SandboxID: "sandbox-1"}
+	svc.runClients[key] = runtime
+
+	_, err := svc.TerminateWorkload(context.Background(), &ateompb.TerminateWorkloadRequest{
+		ActorTemplateAtespace: namespace, ActorTemplateName: template, ActorUid: actorID,
+	})
+	if err == nil {
+		t.Fatal("TerminateWorkload succeeded despite runtime Delete failure")
+	}
+	if svc.runs[key] == nil {
+		t.Fatal("terminate dropped retry state after runtime Delete failure")
+	}
+}
+
+func TestKataStatsAreAttributedToActiveActor(t *testing.T) {
+	runtime := &trackingRuntime{}
+	svc := newService(runtime, &fakeActorNetwork{path: "/run/netns/test"})
+	sb := &sandboxd.Sandbox{SandboxID: "sandbox", Tasks: []*sandboxd.Task{{TaskID: "task"}}}
+	svc.setActive("space", "actor", "uid", "templates", "template", "key", sb, runtime)
+
+	resp, err := svc.GetWorkloadStats(context.Background(), &ateompb.GetWorkloadStatsRequest{ActorUid: "uid"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := resp.GetSample()
+	if got.GetSandboxClass() != ateompb.SandboxClass_SANDBOX_CLASS_KATA ||
+		got.GetSource() != ateompb.StatsSource_STATS_SOURCE_GUEST_AGENT ||
+		got.GetMemoryCurrentBytes() != 10 || got.GetCpuUsageUsec() != 30 ||
+		got.GetAtespace() != "space" || got.GetActorName() != "actor" {
+		t.Fatalf("unexpected sample: %+v", got)
+	}
+}
+
+func TestGracefulShutdownDrainsThenDeletes(t *testing.T) {
+	runtime := &trackingRuntime{}
+	network := &fakeActorNetwork{path: "/run/netns/test"}
+	svc := newService(runtime, network)
+	sb := &sandboxd.Sandbox{SandboxID: "sandbox", Tasks: []*sandboxd.Task{{TaskID: "task"}}}
+	svc.runs["key"] = sb
+	svc.runClients["key"] = runtime
+	svc.setActive("space", "actor", "uid", "templates", "template", "key", sb, runtime)
+
+	if err := svc.gracefulShutdown(context.Background()); err != nil {
+		t.Fatal(err)
+	}
+	if runtime.drains != 1 || runtime.deletes != 1 || network.cleanups != 1 {
+		t.Fatalf("drains=%d deletes=%d cleanups=%d", runtime.drains, runtime.deletes, network.cleanups)
+	}
+	if svc.active.value.Load() != nil {
+		t.Fatal("active workload was retained after shutdown")
+	}
+	if err := svc.rejectIfDraining(); err == nil {
+		t.Fatal("draining worker accepted activation")
+	}
+}
+
+func TestGracefulShutdownCancelsInFlightActivation(t *testing.T) {
+	svc := newService(&trackingRuntime{}, &fakeActorNetwork{path: "/run/netns/test"})
+	svc.mu.Lock()
+	rpcCtx, cancelRPC := context.WithCancel(context.Background())
+	svc.setActiveRPC(rpcRunWorkload, cancelRPC)
+	released := make(chan struct{})
+	go func() {
+		<-rpcCtx.Done()
+		svc.clearActiveRPC()
+		svc.mu.Unlock()
+		close(released)
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err := svc.gracefulShutdown(ctx); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case <-released:
+	case <-time.After(time.Second):
+		t.Fatal("graceful shutdown did not cancel the active RunWorkload RPC")
+	}
+}
+
+func TestGracefulShutdownRespectsLockDeadline(t *testing.T) {
+	svc := newService(&trackingRuntime{}, &fakeActorNetwork{path: "/run/netns/test"})
+	svc.mu.Lock()
+	defer svc.mu.Unlock()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Millisecond)
+	defer cancel()
+	if err := svc.gracefulShutdown(ctx); !errors.Is(err, context.DeadlineExceeded) {
+		t.Fatalf("gracefulShutdown error = %v, want context deadline exceeded", err)
+	}
+}
diff --git a/go.mod b/go.mod
index 4edf49121d..b173590006 100644
--- a/go.mod
+++ b/go.mod
@@ -17,8 +17,10 @@ require (
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.101.0
 	github.com/aws/smithy-go v1.25.1
 	github.com/container-storage-interface/spec v1.12.0
-	github.com/containerd/ttrpc v1.2.8
 	github.com/distribution/reference v0.6.0
+	github.com/containerd/cgroups/v3 v3.0.5
+	github.com/containerd/containerd/api v1.12.0-beta.0
+	github.com/containerd/ttrpc v1.2.9
 	github.com/envoyproxy/go-control-plane v0.14.0
 	github.com/envoyproxy/go-control-plane/envoy v1.37.1-0.20260812071801-353463cc7248
 	github.com/fsnotify/fsnotify v1.9.0
@@ -64,6 +66,7 @@ require (
 	k8s.io/apiextensions-apiserver v0.36.1
 	k8s.io/apimachinery v0.37.0
 	k8s.io/client-go v0.37.0
+	k8s.io/cri-api v0.37.0
 	k8s.io/kubelet v0.37.0
 	k8s.io/metrics v0.36.1
 	k8s.io/utils v0.0.0-20260626114624-be93311217bd
diff --git a/go.sum b/go.sum
index c3824e7fbd..d03aa436ed 100644
--- a/go.sum
+++ b/go.sum
@@ -102,6 +102,10 @@ github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os
 github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/container-storage-interface/spec v1.12.0 h1:zrFOEqpR5AghNaaDG4qyedwPBqU2fU0dWjLQMP/azK0=
 github.com/container-storage-interface/spec v1.12.0/go.mod h1:txsm+MA2B2WDa5kW69jNbqPnvTtfvZma7T/zsAZ9qX8=
+github.com/containerd/cgroups/v3 v3.0.5 h1:44na7Ud+VwyE7LIoJ8JTNQOa549a8543BmzaJHo6Bzo=
+github.com/containerd/cgroups/v3 v3.0.5/go.mod h1:SA5DLYnXO8pTGYiAHXz94qvLQTKfVM5GEVisn4jpins=
+github.com/containerd/containerd/api v1.12.0-beta.0 h1:0eGYh95iM9nn8Fygpx+96LvYIuc5xOiHvwo5hrsvTlI=
+github.com/containerd/containerd/api v1.12.0-beta.0/go.mod h1:/tQDq0fxPDGz9vrSpfhmFMfoR7s/uzvYMCY/qKygl9Y=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
 github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
 github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
@@ -110,8 +114,8 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
-github.com/containerd/ttrpc v1.2.8 h1:xbVu6D4qF2jihdh9rDVOKqUMiFBQk6YctTdo1zk087Y=
-github.com/containerd/ttrpc v1.2.8/go.mod h1:wyZW2K79t4Hfcxl+GUvkZqRBzJlqFFvgEeeWXa42tyE=
+github.com/containerd/ttrpc v1.2.9 h1:ha0ak962T0s3CA/RoZ6S6xiWZQF24GrBaEpiGX1uihg=
+github.com/containerd/ttrpc v1.2.9/go.mod h1:jjtQRwXm4DL3KsHKW8vDiUOV6wO0hi6IPhmJhxU7aEs=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g=
@@ -506,6 +510,8 @@ k8s.io/apimachinery v0.36.0-alpha.2.0.20260904094813-f8600edbddc8 h1:DM+nt+gJGNT
 k8s.io/apimachinery v0.36.0-alpha.2.0.20260904094813-f8600edbddc8/go.mod h1:1Um7tr4O65Pd822NFLn+MI08uCzUIPahh2lCPsWzNgk=
 k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
 k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
+k8s.io/cri-api v0.37.0 h1:8a3Rpw5NNRivF+q8GO/ECK3BrWT06M4Er8ndzLvTF7k=
+k8s.io/cri-api v0.37.0/go.mod h1:6V8Gb6wznJYVPToj8CLxgbxsFeeGIswNZCE7cy+xT90=
 k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
 k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
 k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
diff --git a/hack/build-ateom-kata-image.sh b/hack/build-ateom-kata-image.sh
new file mode 100755
index 0000000000..1a18f3dd43
--- /dev/null
+++ b/hack/build-ateom-kata-image.sh
@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+set -euo pipefail
+
+repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
+image=${1:?usage: build-ateom-kata-image.sh IMAGE}
+context=$(mktemp -d)
+trap 'rm -rf "${context}"' EXIT
+
+cd "${repo_root}"
+CGO_ENABLED=0 GOOS=linux go build -mod=vendor -ldflags "${LDFLAGS:-}" -o "${context}/ateom-kata" ./cmd/ateom-kata
+cp build/ateom-kata/Dockerfile "${context}/Dockerfile"
+docker build -t "${image}" "${context}"
diff --git a/hack/generate-kata-runtime-manifest.sh b/hack/generate-kata-runtime-manifest.sh
new file mode 100755
index 0000000000..f342c5cbd6
--- /dev/null
+++ b/hack/generate-kata-runtime-manifest.sh
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -euo pipefail
+
+root=${1:?usage: generate-kata-runtime-manifest.sh KATA_ROOT}
+root=$(cd "$root" && pwd)
+manifest="$root/bundle-manifest.json"
+
+find_one() {
+  local path
+  for path in "$@"; do
+    if [[ -f "$root/$path" ]]; then
+      printf '%s' "$path"
+      return 0
+    fi
+  done
+  return 1
+}
+
+shim=$(find_one runtime-rs/bin/containerd-shim-kata-v2 bin/containerd-shim-kata-v2 bin/containerd-shim-kata-v2-rs) || { echo "missing Kata shim" >&2; exit 1; }
+qemu=$(find_one bin/qemu-system-x86_64 bin/qemu-system-aarch64) || { echo "missing Kata QEMU" >&2; exit 1; }
+kernel=$(find_one share/vmlinux share/kata-vmlinux share/kata-containers/vmlinux.container) || { echo "missing Kata kernel" >&2; exit 1; }
+initrd=$(find_one share/kata-initrd.img share/kata.initrd share/kata-initrd share/kata-containers/kata-alpine-3.22.initrd) || true
+image=$(find_one share/kata-image share/kata-image.img share/kata-containers/kata-containers.img) || true
+if [[ -n "$initrd" && -n "$image" ]] || [[ -z "$initrd" && -z "$image" ]]; then
+  echo "require exactly one Kata initrd or image" >&2
+  exit 1
+fi
+
+python3 - "$root" "$manifest" "$shim" "$qemu" "$kernel" "$initrd" "$image" <<'PY'
+import hashlib, json, os, stat, sys
+root, manifest, shim, qemu, kernel, initrd, image = sys.argv[1:]
+files = [("kata-shim", shim), ("kata-qemu", qemu), ("kata-kernel", kernel)]
+if initrd:
+    files.append(("kata-initrd", initrd))
+else:
+    files.append(("kata-image", image))
+known_paths = set(filespec[1] for filespec in files)
+for base, dirs, names in os.walk(root):
+    dirs.sort()
+    for filename in sorted(names):
+        rel = os.path.relpath(os.path.join(base, filename), root)
+        if rel == "bundle-manifest.json" or rel in known_paths:
+            continue
+        digest = hashlib.sha256(rel.encode()).hexdigest()[:16]
+        files.append((f"kata-qemu-support-{digest}", rel))
+out = []
+for name, rel in files:
+    path = os.path.join(root, rel)
+    if stat.S_ISLNK(os.lstat(path).st_mode):
+        raise SystemExit(f"Kata asset {rel!r} must not be a symlink")
+    real_path = os.path.realpath(path)
+    if os.path.commonpath((root, real_path)) != root:
+        raise SystemExit(f"Kata asset {rel!r} resolves outside {root!r}")
+    if not stat.S_ISREG(os.stat(real_path).st_mode):
+        raise SystemExit(f"Kata asset {rel!r} does not resolve to a regular file")
+    # The runtime verifier deliberately rejects symlinks.  Record the actual
+    # in-tree file used by Kata packages that expose stable symlink names.
+    rel = os.path.relpath(real_path, root)
+    h = hashlib.sha256()
+    with open(real_path, "rb") as f:
+        for block in iter(lambda: f.read(1024 * 1024), b""):
+            h.update(block)
+    mode = os.stat(real_path).st_mode
+    out.append({"name": name, "path": rel, "size": os.path.getsize(real_path),
+                "sha256": h.hexdigest(),
+                "executable": bool(mode & (stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH))})
+with open(manifest, "w", encoding="utf-8") as f:
+    json.dump({"format": "ateom-kata-runtime-bundle", "version": 1, "files": out},
+              f, indent=2, sort_keys=True)
+    f.write("\n")
+PY
+
+echo "wrote $manifest"
+echo "bundle sha256 (manifest): $(sha256sum "$manifest" | awk '{print $1}')"
diff --git a/hack/prepare-ateom-kata-assets.sh b/hack/prepare-ateom-kata-assets.sh
new file mode 100755
index 0000000000..fb9f401ccb
--- /dev/null
+++ b/hack/prepare-ateom-kata-assets.sh
@@ -0,0 +1,385 @@
+#!/usr/bin/env bash
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit -o nounset -o pipefail
+
+root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source_root="${KATA_ROOT:-/opt/kata}"
+output_root="${ATEOM_KATA_ROOT:-/opt/ateom-kata}"
+source_config=""
+shim_path=""
+qemu_data_root=""
+profile="qemu-cr"
+enable_template="false"
+template_source=""
+template_path="/run/vc/vm/ateom-kata-template"
+source_commit="${KATA_SOURCE_COMMIT:-}"
+
+usage() {
+	cat <<'EOF'
+Usage: prepare-ateom-kata-assets.sh [options]
+
+Options:
+  --source-root PATH       Kata static or an existing verified bundle (default: /opt/kata)
+  --source-config PATH     Kata configuration used as the profile base (required)
+  --shim-path PATH         ateom-kata shim override built from the matching Kata source
+  --qemu-data-root PATH    QEMU firmware/data directory (auto-detected for Kata static)
+  --output-root PATH       Substrate-owned asset root (default: /opt/ateom-kata)
+  --profile NAME           Profile name (default: qemu-cr)
+  --enable-template BOOL   true or false (default: false)
+  --template-source PATH   Existing QEMU template copied to the runtime template path
+  --template-path PATH     Runtime template path (default: /run/vc/vm/ateom-kata-template)
+  --source-commit SHA      Public Kata source commit recorded in the profile
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+	case "$1" in
+	--source-root) source_root=${2:?missing value}; shift 2 ;;
+	--source-config) source_config=${2:?missing value}; shift 2 ;;
+	--shim-path) shim_path=${2:?missing value}; shift 2 ;;
+	--qemu-data-root) qemu_data_root=${2:?missing value}; shift 2 ;;
+	--output-root) output_root=${2:?missing value}; shift 2 ;;
+	--profile) profile=${2:?missing value}; shift 2 ;;
+	--enable-template) enable_template=${2:?missing value}; shift 2 ;;
+	--template-source) template_source=${2:?missing value}; shift 2 ;;
+	--template-path) template_path=${2:?missing value}; shift 2 ;;
+	--source-commit) source_commit=${2:?missing value}; shift 2 ;;
+	-h | --help) usage; exit 0 ;;
+	*) echo "unknown option: $1" >&2; usage >&2; exit 2 ;;
+	esac
+done
+
+[[ -n "${source_config}" ]] || { echo "--source-config is required" >&2; exit 2; }
+[[ "${profile}" =~ ^[a-z0-9][a-z0-9-]*$ ]] || { echo "invalid profile name: ${profile}" >&2; exit 2; }
+[[ "${enable_template}" == "true" || "${enable_template}" == "false" ]] || {
+	echo "--enable-template must be true or false" >&2
+	exit 2
+}
+[[ "${source_commit}" =~ ^([0-9a-f]{40}|[0-9a-f]{64})$ ]] || {
+	echo "--source-commit must be a full lowercase Git object ID" >&2
+	exit 2
+}
+[[ -d "${source_root}" ]] || { echo "missing Kata source root: ${source_root}" >&2; exit 1; }
+[[ -r "${source_config}" ]] || { echo "missing Kata source config: ${source_config}" >&2; exit 1; }
+[[ "${output_root}" == /* && "${template_path}" == /* ]] || {
+	echo "output and template paths must be absolute" >&2
+	exit 2
+}
+
+verify_bundle() {
+	python3 - "$1" <<'PY'
+import hashlib
+import json
+import os
+import stat
+import sys
+
+root = os.path.realpath(sys.argv[1])
+manifest_path = os.path.join(root, "bundle-manifest.json")
+with open(manifest_path, encoding="utf-8") as f:
+    manifest = json.load(f)
+if manifest.get("version") != 1:
+    raise SystemExit("unsupported Kata bundle manifest version")
+declared = set()
+for entry in manifest.get("files", []):
+    rel = entry.get("path")
+    if not isinstance(rel, str) or not rel or os.path.isabs(rel):
+        raise SystemExit(f"invalid Kata asset path: {rel!r}")
+    if rel in declared:
+        raise SystemExit(f"duplicate Kata asset path: {rel!r}")
+    declared.add(rel)
+    path = os.path.join(root, rel)
+    if os.path.commonpath((root, os.path.realpath(path))) != root:
+        raise SystemExit(f"Kata asset escapes bundle: {rel!r}")
+    try:
+        mode = os.lstat(path).st_mode
+    except FileNotFoundError:
+        raise SystemExit(f"missing Kata asset: {rel!r}")
+    if stat.S_ISLNK(mode) or not stat.S_ISREG(mode):
+        raise SystemExit(f"Kata asset is not a regular file: {rel!r}")
+    if entry.get("size") != os.path.getsize(path):
+        raise SystemExit(f"Kata asset size mismatch: {rel!r}")
+    digest = hashlib.sha256()
+    with open(path, "rb") as asset:
+        for block in iter(lambda: asset.read(1024 * 1024), b""):
+            digest.update(block)
+    if digest.hexdigest() != entry.get("sha256"):
+        raise SystemExit(f"Kata asset digest mismatch: {rel!r}")
+actual = set()
+for base, _, names in os.walk(root):
+    for name in names:
+        rel = os.path.relpath(os.path.join(base, name), root)
+        if rel != "bundle-manifest.json":
+            actual.add(rel)
+if actual != declared:
+    raise SystemExit("Kata bundle contains files not described by its manifest")
+PY
+}
+
+install -d -m 0755 "${output_root}/bundles" "${output_root}/configs" "${output_root}/profiles"
+tmp_bundle="$(mktemp -d "${output_root}/bundles/.build-XXXXXX")"
+tmp_config=""
+cleanup() {
+	[[ -z "${tmp_config}" ]] || rm -f -- "${tmp_config}"
+	[[ ! -d "${tmp_bundle}" ]] || rm -rf -- "${tmp_bundle}"
+}
+trap cleanup EXIT
+
+declare -A source_paths
+declare -A source_relative_paths
+guest_key="$(python3 - "${source_config}" <<'PY'
+import re, sys
+
+section = ""
+active = []
+with open(sys.argv[1], encoding="utf-8") as f:
+    for line in f:
+        section_match = re.match(r"^\s*\[([^]]+)]\s*$", line)
+        if section_match:
+            section = section_match.group(1)
+            continue
+        if section != "hypervisor.qemu":
+            continue
+        setting = re.match(r'^\s*(initrd|image)\s*=\s*"([^"]*)"', line)
+        if setting and setting.group(2):
+            active.append("kata-" + setting.group(1))
+if len(active) != 1:
+    raise SystemExit("source config must select exactly one non-empty qemu initrd or image")
+print(active[0])
+PY
+)"
+ateom_manifest=false
+if [[ -r "${source_root}/bundle-manifest.json" ]]; then
+	verify_bundle "${source_root}"
+	if python3 - "${source_root}/bundle-manifest.json" "${guest_key}" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding="utf-8") as f:
+    manifest = json.load(f)
+names = {entry.get("name") for entry in manifest.get("files", [])}
+required = {"kata-shim", "kata-qemu", "kata-kernel", sys.argv[2]}
+has_ateom_format = manifest.get("format") == "ateom-kata-runtime-bundle"
+has_support_closure = any((name or "").startswith("kata-qemu-support-") for name in names)
+if manifest.get("version") != 1 or not required <= names or not (has_ateom_format or has_support_closure):
+    raise SystemExit(1)
+PY
+	then
+		ateom_manifest=true
+	fi
+fi
+if [[ "${ateom_manifest}" == "true" ]]; then
+	while IFS=$'\t' read -r name relative_path; do
+		source_paths["${name}"]="${source_root}/${relative_path}"
+		source_relative_paths["${name}"]="${relative_path}"
+	done < <(python3 - "${source_root}/bundle-manifest.json" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding="utf-8") as f:
+    manifest = json.load(f)
+if manifest.get("version") != 1:
+    raise SystemExit("unsupported source bundle manifest version")
+for entry in manifest.get("files", []):
+    print(f"{entry['name']}\t{entry['path']}")
+PY
+)
+else
+	find_source() {
+		local candidate
+		for candidate in "$@"; do
+			if [[ -f "${source_root}/${candidate}" ]]; then
+				printf '%s' "${source_root}/${candidate}"
+				return 0
+			fi
+		done
+		return 1
+	}
+	source_paths[kata-shim]="$(find_source runtime-rs/bin/containerd-shim-kata-v2 bin/containerd-shim-kata-v2 bin/containerd-shim-kata-v2-rs)" || true
+	source_paths[kata-qemu]="$(find_source bin/qemu-system-x86_64)" || true
+	for candidate in share/kata-qemu/qemu share/qemu; do
+		[[ -z "${qemu_data_root}" ]] || break
+		if [[ -d "${source_root}/${candidate}" ]]; then
+			qemu_data_root="${source_root}/${candidate}"
+			break
+		fi
+	done
+	source_paths[kata-kernel]="$(find_source share/vmlinux share/kata-vmlinux share/kata-containers/vmlinux.container)" || true
+	source_paths[kata-initrd]="$(find_source share/kata-initrd.img share/kata.initrd share/kata-initrd share/kata-containers/kata-containers-initrd.img share/kata-containers/kata-alpine-3.22.initrd)" || true
+	source_paths[kata-image]="$(find_source share/kata-image share/kata-image.img share/kata-containers/kata-containers.img)" || true
+fi
+
+for required in kata-shim kata-qemu kata-kernel; do
+	[[ -n "${source_paths[${required}]:-}" ]] || { echo "source root is missing ${required}" >&2; exit 1; }
+done
+
+if [[ -n "${qemu_data_root}" ]]; then
+	qemu_data_root="$(realpath -e "${qemu_data_root}")"
+	[[ -d "${qemu_data_root}" ]] || { echo "invalid QEMU data directory: ${qemu_data_root}" >&2; exit 1; }
+fi
+[[ -n "${source_paths[${guest_key}]:-}" ]] || {
+	echo "source root is missing ${guest_key} selected by ${source_config}" >&2
+	exit 1
+}
+
+copy_asset() {
+	local source_path=$1 destination=$2 real_source
+	real_source="$(realpath -e "${source_path}")"
+	case "${real_source}" in
+	"$(realpath -e "${source_root}")"/*) ;;
+	*) echo "source asset escapes ${source_root}: ${source_path}" >&2; exit 1 ;;
+	esac
+	install -d -m 0755 "$(dirname "${destination}")"
+	cp --reflink=auto --preserve=mode "${real_source}" "${destination}"
+}
+
+if [[ -n "${shim_path}" ]]; then
+	[[ -f "${shim_path}" ]] || { echo "missing shim override: ${shim_path}" >&2; exit 1; }
+	install -d -m 0755 "${tmp_bundle}/bin"
+	cp --reflink=auto --preserve=mode "$(realpath -e "${shim_path}")" "${tmp_bundle}/bin/containerd-shim-kata-v2"
+else
+	copy_asset "${source_paths[kata-shim]}" "${tmp_bundle}/bin/containerd-shim-kata-v2"
+fi
+
+if [[ -n "${qemu_data_root:-}" ]]; then
+	copy_asset "${source_paths[kata-qemu]}" "${tmp_bundle}/libexec/qemu-system-x86_64"
+	install -d -m 0755 "${tmp_bundle}/bin" "${tmp_bundle}/share/kata-qemu"
+	cp -aL --reflink=auto "${qemu_data_root}" "${tmp_bundle}/share/kata-qemu/qemu"
+	# The generated wrapper expands these variables when it runs.
+	# shellcheck disable=SC2016
+	printf '%s\n' \
+		'#!/bin/sh' \
+		'bundle_dir=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)' \
+		'exec "${bundle_dir}/libexec/qemu-system-x86_64" -L "${bundle_dir}/share/kata-qemu/qemu" "$@"' \
+		>"${tmp_bundle}/bin/qemu-system-x86_64"
+	chmod 0755 "${tmp_bundle}/bin/qemu-system-x86_64"
+else
+	copy_asset "${source_paths[kata-qemu]}" "${tmp_bundle}/bin/qemu-system-x86_64"
+	for name in "${!source_paths[@]}"; do
+		case "${name}" in kata-shim|kata-qemu|kata-kernel|kata-initrd|kata-image) continue ;; esac
+		copy_asset "${source_paths[${name}]}" "${tmp_bundle}/${source_relative_paths[${name}]}"
+	done
+fi
+copy_asset "${source_paths[kata-kernel]}" "${tmp_bundle}/share/kata-containers/vmlinux.container"
+if [[ "${guest_key}" == "kata-initrd" ]]; then
+	guest_path=share/kata-initrd.img
+	copy_asset "${source_paths[kata-initrd]}" "${tmp_bundle}/${guest_path}"
+else
+	guest_path=share/kata-containers/kata-containers.img
+	copy_asset "${source_paths[kata-image]}" "${tmp_bundle}/${guest_path}"
+fi
+
+"${root}/hack/generate-kata-runtime-manifest.sh" "${tmp_bundle}" >/dev/null
+bundle_sha="$(sha256sum "${tmp_bundle}/bundle-manifest.json" | awk '{print $1}')"
+bundle_dir="${output_root}/bundles/sha256-${bundle_sha}"
+if [[ -d "${bundle_dir}" ]]; then
+	verify_bundle "${bundle_dir}"
+	rm -rf -- "${tmp_bundle}"
+else
+	mv "${tmp_bundle}" "${bundle_dir}"
+fi
+
+config_dir="${output_root}/configs/sha256-${bundle_sha}"
+install -d -m 0755 "${config_dir}"
+config_path="${config_dir}/configuration-${profile}.toml"
+tmp_config="$(mktemp "${config_dir}/.configuration-${profile}.XXXXXX")"
+python3 - "${source_config}" "${tmp_config}" "${bundle_dir}" "${guest_key}" "${guest_path}" "${enable_template}" "${template_path}" <<'PY'
+import re, sys
+
+source, target, bundle, guest_key, guest_rel, enable_template, template_path = sys.argv[1:]
+values = {
+    "path": f'{bundle}/bin/qemu-system-x86_64',
+    "kernel": f'{bundle}/share/kata-containers/vmlinux.container',
+    "initrd" if guest_key == "kata-initrd" else "image": f'{bundle}/{guest_rel}',
+}
+array_values = {
+    "valid_hypervisor_paths": [f'{bundle}/bin/qemu-system-x86_64'],
+}
+section = ""
+seen = set()
+output = []
+with open(source, encoding="utf-8") as f:
+    for line in f:
+        section_match = re.match(r"^\s*\[([^]]+)]\s*$", line)
+        if section_match:
+            section = section_match.group(1)
+        setting = re.match(r"^(\s*)([a-z_]+)\s*=", line)
+        if setting and section == "hypervisor.qemu" and setting.group(2) in values:
+            key = setting.group(2)
+            line = f'{setting.group(1)}{key} = "{values[key]}"\n'
+            seen.add(key)
+        elif setting and section == "hypervisor.qemu" and setting.group(2) in array_values:
+            key = setting.group(2)
+            quoted = ", ".join(f'"{value}"' for value in array_values[key])
+            line = f'{setting.group(1)}{key} = [{quoted}]\n'
+            seen.add(key)
+        elif setting and section == "hypervisor.qemu.factory" and setting.group(2) == "enable_template":
+            line = f'{setting.group(1)}enable_template = {enable_template}\n'
+            seen.add("enable_template")
+        elif setting and section == "hypervisor.qemu.factory" and setting.group(2) == "template_path":
+            line = f'{setting.group(1)}template_path = "{template_path}"\n'
+            seen.add("template_path")
+        output.append(line)
+required = set(values) | set(array_values) | {"enable_template", "template_path"}
+missing = sorted(required - seen)
+if missing:
+    raise SystemExit("source config is missing active settings: " + ", ".join(missing))
+with open(target, "w", encoding="utf-8") as f:
+    f.writelines(output)
+PY
+chmod 0644 "${tmp_config}"
+mv -f "${tmp_config}" "${config_path}"
+tmp_config=""
+config_sha="$(sha256sum "${config_path}" | awk '{print $1}')"
+
+if [[ "${enable_template}" == "true" ]]; then
+	if [[ -n "${template_source}" ]]; then
+		[[ -d "${template_source}" ]] || { echo "missing template source: ${template_source}" >&2; exit 1; }
+		if [[ -e "${template_path}" ]]; then
+			echo "refusing to replace existing template path: ${template_path}" >&2
+			exit 1
+		fi
+		install -d -m 0755 "$(dirname "${template_path}")"
+		tmp_template="${template_path}.installing-$$"
+		trap 'rm -rf -- "${tmp_template}"; cleanup' EXIT
+		cp -a --reflink=auto "${template_source}" "${tmp_template}"
+		mv "${tmp_template}" "${template_path}"
+		trap cleanup EXIT
+	elif [[ ! -e "${template_path}" ]]; then
+		install -d -m 0755 "$(dirname "${template_path}")"
+		KATA_CONF_FILE="${config_path}" "${bundle_dir}/bin/containerd-shim-kata-v2" factory init
+	fi
+	[[ -r "${template_path}/memory" && -r "${template_path}/state" ]] || {
+		echo "template profile requires ${template_path}/{memory,state}" >&2
+		exit 1
+	}
+	KATA_CONF_FILE="${config_path}" "${bundle_dir}/bin/containerd-shim-kata-v2" factory status >/dev/null
+fi
+
+profile_path="${output_root}/profiles/${profile}.env"
+tmp_profile="$(mktemp "${output_root}/profiles/.${profile}.XXXXXX")"
+{
+	printf 'ATEOM_KATA_BUNDLE=%q\n' "${bundle_dir}"
+	printf 'ATEOM_KATA_BUNDLE_SHA256=%q\n' "${bundle_sha}"
+	printf 'ATEOM_KATA_CONFIG=%q\n' "${config_path}"
+	printf 'ATEOM_KATA_CONFIG_SHA256=%q\n' "${config_sha}"
+	printf 'ATEOM_KATA_ENABLE_TEMPLATE=%q\n' "${enable_template}"
+	printf 'ATEOM_KATA_TEMPLATE_PATH=%q\n' "${template_path}"
+	printf 'KATA_SOURCE_COMMIT=%q\n' "${source_commit}"
+} >"${tmp_profile}"
+chmod 0644 "${tmp_profile}"
+mv -f "${tmp_profile}" "${profile_path}"
+
+echo "ateom-kata profile: ${profile_path}"
+echo "runtime bundle: ${bundle_dir}"
+echo "runtime config: ${config_path}"
diff --git a/hack/tools/protoc-gen-go-ttrpc/go.mod b/hack/tools/protoc-gen-go-ttrpc/go.mod
new file mode 100644
index 0000000000..82219b6bd1
--- /dev/null
+++ b/hack/tools/protoc-gen-go-ttrpc/go.mod
@@ -0,0 +1,10 @@
+module github.com/agent-substrate/substrate/hack/tools/protoc-gen-go-ttrpc
+
+go 1.27.0
+
+require (
+	github.com/containerd/ttrpc v1.2.9 // indirect
+	google.golang.org/protobuf v1.36.11 // indirect
+)
+
+tool github.com/containerd/ttrpc/cmd/protoc-gen-go-ttrpc
diff --git a/hack/tools/protoc-gen-go-ttrpc/go.sum b/hack/tools/protoc-gen-go-ttrpc/go.sum
new file mode 100644
index 0000000000..8127a48d85
--- /dev/null
+++ b/hack/tools/protoc-gen-go-ttrpc/go.sum
@@ -0,0 +1,6 @@
+github.com/containerd/ttrpc v1.2.9 h1:ha0ak962T0s3CA/RoZ6S6xiWZQF24GrBaEpiGX1uihg=
+github.com/containerd/ttrpc v1.2.9/go.mod h1:jjtQRwXm4DL3KsHKW8vDiUOV6wO0hi6IPhmJhxU7aEs=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
+google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
diff --git a/hack/update/codegen.sh b/hack/update/codegen.sh
index df416c29fd..4fd101e9f8 100755
--- a/hack/update/codegen.sh
+++ b/hack/update/codegen.sh
@@ -57,6 +57,26 @@ function codegen::protobuf() {
     for dir in "${proto_dirs[@]}"; do
         local protoc_gen_go
         protoc_gen_go="$(./hack/run-tool.sh --print-bin-path protoc-gen-go)"
+        if [[ "${dir}" == "internal/sandboxd/sandboxapi" ]]; then
+            local protoc_gen_go_ttrpc
+            protoc_gen_go_ttrpc="$(./hack/run-tool.sh --print-bin-path protoc-gen-go-ttrpc)"
+            (
+                cd "${dir}" || exit 1
+                "${ROOT}"/hack/protoc.sh \
+                    -I "${ROOT}/vendor/github.com/containerd/containerd/api" -I . \
+                    --plugin=protoc-gen-go="${protoc_gen_go}" \
+                    --plugin=protoc-gen-go-ttrpc="${protoc_gen_go_ttrpc}" \
+                    --go_out=paths=source_relative:. \
+                    --go-ttrpc_out=paths=source_relative:. \
+                    --go-ttrpc_opt=prefix=TTRPC \
+                    ./*.proto
+                for generated in ./*_ttrpc.pb.go; do
+                    cat "${ROOT}/${GO_BOILERPLATE}" "${generated}" > "${generated}.tmp"
+                    mv "${generated}.tmp" "${generated}"
+                done
+            )
+            continue
+        fi
         local protoc_gen_go_rpc
         protoc_gen_go_rpc="$(./hack/run-tool.sh --print-bin-path protoc-gen-go-grpc)"
         (
diff --git a/internal/ateattr/ateattr.go b/internal/ateattr/ateattr.go
index e533ddb39c..d17dac8cfc 100644
--- a/internal/ateattr/ateattr.go
+++ b/internal/ateattr/ateattr.go
@@ -382,7 +382,7 @@ const SandboxClassUnknown = "unknown"
 // problem stays visible.
 func NormalizeSandboxClass(class string) string {
 	switch atev1alpha1.SandboxClass(class) {
-	case atev1alpha1.SandboxClassGvisor, atev1alpha1.SandboxClassMicroVM:
+	case atev1alpha1.SandboxClassGvisor, atev1alpha1.SandboxClassMicroVM, atev1alpha1.SandboxClassKata:
 		return class
 	default:
 		return SandboxClassUnknown
diff --git a/internal/ateomnet/kata_tap.go b/internal/ateomnet/kata_tap.go
new file mode 100644
index 0000000000..2783c84e5b
--- /dev/null
+++ b/internal/ateomnet/kata_tap.go
@@ -0,0 +1,115 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package ateomnet
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/vishvananda/netlink"
+	"github.com/vishvananda/netns"
+	"golang.org/x/sys/unix"
+)
+
+// SetupKataTap creates the persistent host TAP consumed by runtime-rs DAN and
+// cross-connects it to the actor veth with ingress redirect filters.
+func SetupKataTap(ctx context.Context, interiorNetNS netns.NsHandle, tapName string) error {
+	if tapName == "" {
+		return errors.New("kata TAP name is required")
+	}
+	return NetNSDo(ctx, interiorNetNS, func(context.Context) (retErr error) {
+		actorVeth, err := netlink.LinkByName(ActorVethName)
+		if err != nil {
+			return fmt.Errorf("acquire actor veth: %w", err)
+		}
+		if old, err := netlink.LinkByName(tapName); err == nil {
+			if err := netlink.LinkDel(old); err != nil {
+				return fmt.Errorf("remove stale Kata TAP %q: %w", tapName, err)
+			}
+		} else if _, notFound := errors.AsType[netlink.LinkNotFoundError](err); !notFound {
+			return fmt.Errorf("look up Kata TAP %q: %w", tapName, err)
+		}
+
+		tap := &netlink.Tuntap{
+			LinkAttrs: netlink.LinkAttrs{Name: tapName, MTU: actorVeth.Attrs().MTU},
+			Mode:      netlink.TUNTAP_MODE_TAP,
+			Flags:     netlink.TUNTAP_NO_PI | netlink.TUNTAP_VNET_HDR,
+			Queues:    1,
+		}
+		if err := netlink.LinkAdd(tap); err != nil {
+			return fmt.Errorf("create Kata TAP %q: %w", tapName, err)
+		}
+		for _, fd := range tap.Fds {
+			defer fd.Close()
+		}
+		defer func() {
+			if retErr != nil {
+				_ = netlink.LinkDel(tap)
+			}
+		}()
+		if err := netlink.LinkSetUp(tap); err != nil {
+			return fmt.Errorf("bring up Kata TAP %q: %w", tapName, err)
+		}
+
+		for _, pair := range [][2]netlink.Link{{actorVeth, tap}, {tap, actorVeth}} {
+			qdisc := &netlink.Ingress{QdiscAttrs: netlink.QdiscAttrs{
+				LinkIndex: pair[0].Attrs().Index,
+				Parent:    netlink.HANDLE_INGRESS,
+				Handle:    netlink.MakeHandle(0xffff, 0),
+			}}
+			if err := netlink.QdiscReplace(qdisc); err != nil {
+				return fmt.Errorf("add ingress qdisc to %q: %w", pair[0].Attrs().Name, err)
+			}
+			filter := &netlink.U32{
+				FilterAttrs: netlink.FilterAttrs{
+					LinkIndex: pair[0].Attrs().Index,
+					Parent:    netlink.MakeHandle(0xffff, 0),
+					Priority:  1,
+					Protocol:  unix.ETH_P_ALL,
+				},
+				ClassId:    netlink.MakeHandle(1, 1),
+				RedirIndex: pair[1].Attrs().Index,
+			}
+			if err := netlink.FilterAdd(filter); err != nil {
+				return fmt.Errorf("add redirect %s -> %s: %w", pair[0].Attrs().Name, pair[1].Attrs().Name, err)
+			}
+		}
+		return nil
+	})
+}
+
+// CleanupKataTap removes only the named TAP. Deleting the TAP also removes its
+// qdisc; CleanupActorNetwork separately owns the actor veth and nftables state.
+func CleanupKataTap(ctx context.Context, interiorNetNS netns.NsHandle, tapName string) error {
+	if tapName == "" {
+		return errors.New("kata TAP name is required")
+	}
+	return NetNSDo(ctx, interiorNetNS, func(context.Context) error {
+		tap, err := netlink.LinkByName(tapName)
+		if _, notFound := errors.AsType[netlink.LinkNotFoundError](err); notFound {
+			return nil
+		}
+		if err != nil {
+			return fmt.Errorf("look up Kata TAP %q: %w", tapName, err)
+		}
+		if err := netlink.LinkDel(tap); err != nil {
+			return fmt.Errorf("delete Kata TAP %q: %w", tapName, err)
+		}
+		return nil
+	})
+}
diff --git a/internal/proto/ateompb/ateom.pb.go b/internal/proto/ateompb/ateom.pb.go
index 59ce521b64..9c5ae71a08 100644
--- a/internal/proto/ateompb/ateom.pb.go
+++ b/internal/proto/ateompb/ateom.pb.go
@@ -109,6 +109,7 @@ const (
 	SandboxClass_SANDBOX_CLASS_GVISOR SandboxClass = 1
 	// Micro-VM (cmd/ateom-microvm).
 	SandboxClass_SANDBOX_CLASS_MICROVM SandboxClass = 2
+	SandboxClass_SANDBOX_CLASS_KATA    SandboxClass = 3
 )
 
 // Enum value maps for SandboxClass.
@@ -117,11 +118,13 @@ var (
 		0: "SANDBOX_CLASS_UNSPECIFIED",
 		1: "SANDBOX_CLASS_GVISOR",
 		2: "SANDBOX_CLASS_MICROVM",
+		3: "SANDBOX_CLASS_KATA",
 	}
 	SandboxClass_value = map[string]int32{
 		"SANDBOX_CLASS_UNSPECIFIED": 0,
 		"SANDBOX_CLASS_GVISOR":      1,
 		"SANDBOX_CLASS_MICROVM":     2,
+		"SANDBOX_CLASS_KATA":        3,
 	}
 )
 
@@ -1052,6 +1055,7 @@ type CheckpointWorkloadRequest struct {
 	RuntimeAssetPaths map[string]string `protobuf:"bytes,9,rep,name=runtime_asset_paths,json=runtimeAssetPaths,proto3" json:"runtime_asset_paths,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
 	// What content to include in the checkpoint.
 	Scope         SnapshotScope `protobuf:"varint,10,opt,name=scope,proto3,enum=ateom.SnapshotScope" json:"scope,omitempty"`
+	OperationId   string        `protobuf:"bytes,11,opt,name=operation_id,json=operationId,proto3" json:"operation_id,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -1156,19 +1160,79 @@ func (x *CheckpointWorkloadRequest) GetScope() SnapshotScope {
 	return SnapshotScope_SNAPSHOT_SCOPE_UNSPECIFIED
 }
 
+func (x *CheckpointWorkloadRequest) GetOperationId() string {
+	if x != nil {
+		return x.OperationId
+	}
+	return ""
+}
+
+type RuntimeCompatibility struct {
+	state              protoimpl.MessageState `protogen:"open.v1"`
+	Profile            string                 `protobuf:"bytes,1,opt,name=profile,proto3" json:"profile,omitempty"`
+	RuntimeFingerprint string                 `protobuf:"bytes,2,opt,name=runtime_fingerprint,json=runtimeFingerprint,proto3" json:"runtime_fingerprint,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *RuntimeCompatibility) Reset() {
+	*x = RuntimeCompatibility{}
+	mi := &file_ateom_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeCompatibility) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeCompatibility) ProtoMessage() {}
+
+func (x *RuntimeCompatibility) ProtoReflect() protoreflect.Message {
+	mi := &file_ateom_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeCompatibility.ProtoReflect.Descriptor instead.
+func (*RuntimeCompatibility) Descriptor() ([]byte, []int) {
+	return file_ateom_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *RuntimeCompatibility) GetProfile() string {
+	if x != nil {
+		return x.Profile
+	}
+	return ""
+}
+
+func (x *RuntimeCompatibility) GetRuntimeFingerprint() string {
+	if x != nil {
+		return x.RuntimeFingerprint
+	}
+	return ""
+}
+
 type CheckpointWorkloadResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// snapshot_files lists the files ateom wrote into the checkpoint directory
 	// (relative names) for atelet to ship to object storage. Each runtime reports
 	// its own set (gVisor's image files, cloud-hypervisor's snapshot set, ...).
-	SnapshotFiles []string `protobuf:"bytes,1,rep,name=snapshot_files,json=snapshotFiles,proto3" json:"snapshot_files,omitempty"`
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	SnapshotFiles        []string              `protobuf:"bytes,1,rep,name=snapshot_files,json=snapshotFiles,proto3" json:"snapshot_files,omitempty"`
+	RuntimeCompatibility *RuntimeCompatibility `protobuf:"bytes,2,opt,name=runtime_compatibility,json=runtimeCompatibility,proto3" json:"runtime_compatibility,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *CheckpointWorkloadResponse) Reset() {
 	*x = CheckpointWorkloadResponse{}
-	mi := &file_ateom_proto_msgTypes[14]
+	mi := &file_ateom_proto_msgTypes[15]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1180,7 +1244,7 @@ func (x *CheckpointWorkloadResponse) String() string {
 func (*CheckpointWorkloadResponse) ProtoMessage() {}
 
 func (x *CheckpointWorkloadResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[14]
+	mi := &file_ateom_proto_msgTypes[15]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1193,7 +1257,7 @@ func (x *CheckpointWorkloadResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use CheckpointWorkloadResponse.ProtoReflect.Descriptor instead.
 func (*CheckpointWorkloadResponse) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{14}
+	return file_ateom_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *CheckpointWorkloadResponse) GetSnapshotFiles() []string {
@@ -1203,6 +1267,13 @@ func (x *CheckpointWorkloadResponse) GetSnapshotFiles() []string {
 	return nil
 }
 
+func (x *CheckpointWorkloadResponse) GetRuntimeCompatibility() *RuntimeCompatibility {
+	if x != nil {
+		return x.RuntimeCompatibility
+	}
+	return nil
+}
+
 type RestoreWorkloadRequest struct {
 	state                 protoimpl.MessageState `protogen:"open.v1"`
 	Atespace              string                 `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"`
@@ -1230,15 +1301,17 @@ type RestoreWorkloadRequest struct {
 	// (re)size the sandbox on a DATA-scope restore (fresh guest container). On a
 	// FULL micro-VM restore the size baked into the snapshot is authoritative and
 	// these are ignored. Zero means "unset": keep the runtime default.
-	CpuMilli      int64 `protobuf:"varint,14,opt,name=cpu_milli,json=cpuMilli,proto3" json:"cpu_milli,omitempty"`          // CPU limit in millicores (1000 = one core).
-	MemoryBytes   int64 `protobuf:"varint,15,opt,name=memory_bytes,json=memoryBytes,proto3" json:"memory_bytes,omitempty"` // Memory limit in bytes.
-	unknownFields protoimpl.UnknownFields
-	sizeCache     protoimpl.SizeCache
+	CpuMilli             int64                 `protobuf:"varint,14,opt,name=cpu_milli,json=cpuMilli,proto3" json:"cpu_milli,omitempty"`          // CPU limit in millicores (1000 = one core).
+	MemoryBytes          int64                 `protobuf:"varint,15,opt,name=memory_bytes,json=memoryBytes,proto3" json:"memory_bytes,omitempty"` // Memory limit in bytes.
+	OperationId          string                `protobuf:"bytes,16,opt,name=operation_id,json=operationId,proto3" json:"operation_id,omitempty"`
+	RuntimeCompatibility *RuntimeCompatibility `protobuf:"bytes,17,opt,name=runtime_compatibility,json=runtimeCompatibility,proto3" json:"runtime_compatibility,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
 }
 
 func (x *RestoreWorkloadRequest) Reset() {
 	*x = RestoreWorkloadRequest{}
-	mi := &file_ateom_proto_msgTypes[15]
+	mi := &file_ateom_proto_msgTypes[16]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1250,7 +1323,7 @@ func (x *RestoreWorkloadRequest) String() string {
 func (*RestoreWorkloadRequest) ProtoMessage() {}
 
 func (x *RestoreWorkloadRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[15]
+	mi := &file_ateom_proto_msgTypes[16]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1263,7 +1336,7 @@ func (x *RestoreWorkloadRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RestoreWorkloadRequest.ProtoReflect.Descriptor instead.
 func (*RestoreWorkloadRequest) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{15}
+	return file_ateom_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *RestoreWorkloadRequest) GetAtespace() string {
@@ -1364,6 +1437,20 @@ func (x *RestoreWorkloadRequest) GetMemoryBytes() int64 {
 	return 0
 }
 
+func (x *RestoreWorkloadRequest) GetOperationId() string {
+	if x != nil {
+		return x.OperationId
+	}
+	return ""
+}
+
+func (x *RestoreWorkloadRequest) GetRuntimeCompatibility() *RuntimeCompatibility {
+	if x != nil {
+		return x.RuntimeCompatibility
+	}
+	return nil
+}
+
 type RestoreWorkloadResponse struct {
 	state         protoimpl.MessageState `protogen:"open.v1"`
 	unknownFields protoimpl.UnknownFields
@@ -1372,7 +1459,7 @@ type RestoreWorkloadResponse struct {
 
 func (x *RestoreWorkloadResponse) Reset() {
 	*x = RestoreWorkloadResponse{}
-	mi := &file_ateom_proto_msgTypes[16]
+	mi := &file_ateom_proto_msgTypes[17]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1384,7 +1471,7 @@ func (x *RestoreWorkloadResponse) String() string {
 func (*RestoreWorkloadResponse) ProtoMessage() {}
 
 func (x *RestoreWorkloadResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[16]
+	mi := &file_ateom_proto_msgTypes[17]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1397,7 +1484,7 @@ func (x *RestoreWorkloadResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RestoreWorkloadResponse.ProtoReflect.Descriptor instead.
 func (*RestoreWorkloadResponse) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{16}
+	return file_ateom_proto_rawDescGZIP(), []int{17}
 }
 
 type GetWorkloadStatsRequest struct {
@@ -1413,7 +1500,7 @@ type GetWorkloadStatsRequest struct {
 
 func (x *GetWorkloadStatsRequest) Reset() {
 	*x = GetWorkloadStatsRequest{}
-	mi := &file_ateom_proto_msgTypes[17]
+	mi := &file_ateom_proto_msgTypes[18]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1425,7 +1512,7 @@ func (x *GetWorkloadStatsRequest) String() string {
 func (*GetWorkloadStatsRequest) ProtoMessage() {}
 
 func (x *GetWorkloadStatsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[17]
+	mi := &file_ateom_proto_msgTypes[18]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1438,7 +1525,7 @@ func (x *GetWorkloadStatsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetWorkloadStatsRequest.ProtoReflect.Descriptor instead.
 func (*GetWorkloadStatsRequest) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{17}
+	return file_ateom_proto_rawDescGZIP(), []int{18}
 }
 
 func (x *GetWorkloadStatsRequest) GetActorUid() string {
@@ -1502,7 +1589,7 @@ type WorkloadStatsSample struct {
 
 func (x *WorkloadStatsSample) Reset() {
 	*x = WorkloadStatsSample{}
-	mi := &file_ateom_proto_msgTypes[18]
+	mi := &file_ateom_proto_msgTypes[19]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1514,7 +1601,7 @@ func (x *WorkloadStatsSample) String() string {
 func (*WorkloadStatsSample) ProtoMessage() {}
 
 func (x *WorkloadStatsSample) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[18]
+	mi := &file_ateom_proto_msgTypes[19]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1527,7 +1614,7 @@ func (x *WorkloadStatsSample) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use WorkloadStatsSample.ProtoReflect.Descriptor instead.
 func (*WorkloadStatsSample) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{18}
+	return file_ateom_proto_rawDescGZIP(), []int{19}
 }
 
 func (x *WorkloadStatsSample) GetAtespace() string {
@@ -1623,7 +1710,7 @@ type GetWorkloadStatsResponse struct {
 
 func (x *GetWorkloadStatsResponse) Reset() {
 	*x = GetWorkloadStatsResponse{}
-	mi := &file_ateom_proto_msgTypes[19]
+	mi := &file_ateom_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1635,7 +1722,7 @@ func (x *GetWorkloadStatsResponse) String() string {
 func (*GetWorkloadStatsResponse) ProtoMessage() {}
 
 func (x *GetWorkloadStatsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[19]
+	mi := &file_ateom_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1648,7 +1735,7 @@ func (x *GetWorkloadStatsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetWorkloadStatsResponse.ProtoReflect.Descriptor instead.
 func (*GetWorkloadStatsResponse) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{19}
+	return file_ateom_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *GetWorkloadStatsResponse) GetSample() *WorkloadStatsSample {
@@ -1666,7 +1753,7 @@ type GetActiveWorkloadStatsRequest struct {
 
 func (x *GetActiveWorkloadStatsRequest) Reset() {
 	*x = GetActiveWorkloadStatsRequest{}
-	mi := &file_ateom_proto_msgTypes[20]
+	mi := &file_ateom_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1678,7 +1765,7 @@ func (x *GetActiveWorkloadStatsRequest) String() string {
 func (*GetActiveWorkloadStatsRequest) ProtoMessage() {}
 
 func (x *GetActiveWorkloadStatsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[20]
+	mi := &file_ateom_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1691,7 +1778,7 @@ func (x *GetActiveWorkloadStatsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActiveWorkloadStatsRequest.ProtoReflect.Descriptor instead.
 func (*GetActiveWorkloadStatsRequest) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{20}
+	return file_ateom_proto_rawDescGZIP(), []int{21}
 }
 
 type GetActiveWorkloadStatsResponse struct {
@@ -1711,7 +1798,7 @@ type GetActiveWorkloadStatsResponse struct {
 
 func (x *GetActiveWorkloadStatsResponse) Reset() {
 	*x = GetActiveWorkloadStatsResponse{}
-	mi := &file_ateom_proto_msgTypes[21]
+	mi := &file_ateom_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1723,7 +1810,7 @@ func (x *GetActiveWorkloadStatsResponse) String() string {
 func (*GetActiveWorkloadStatsResponse) ProtoMessage() {}
 
 func (x *GetActiveWorkloadStatsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_ateom_proto_msgTypes[21]
+	mi := &file_ateom_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1736,7 +1823,7 @@ func (x *GetActiveWorkloadStatsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetActiveWorkloadStatsResponse.ProtoReflect.Descriptor instead.
 func (*GetActiveWorkloadStatsResponse) Descriptor() ([]byte, []int) {
-	return file_ateom_proto_rawDescGZIP(), []int{21}
+	return file_ateom_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *GetActiveWorkloadStatsResponse) GetSamples() []*WorkloadStatsSample {
@@ -1820,7 +1907,7 @@ const file_ateom_proto_rawDesc = "" +
 	"\rHTTPGetAction\x12\x12\n" +
 	"\x04path\x18\x01 \x01(\tR\x04path\x12\x12\n" +
 	"\x04port\x18\x02 \x01(\x05R\x04port\"\x15\n" +
-	"\x13RunWorkloadResponse\"\xa1\x04\n" +
+	"\x13RunWorkloadResponse\"\xc4\x04\n" +
 	"\x19CheckpointWorkloadRequest\x12\x1a\n" +
 	"\batespace\x18\x01 \x01(\tR\batespace\x12\x1d\n" +
 	"\n" +
@@ -1834,12 +1921,17 @@ const file_ateom_proto_rawDesc = "" +
 	"\fsnapshot_uri\x18\b \x01(\tR\vsnapshotUri\x12g\n" +
 	"\x13runtime_asset_paths\x18\t \x03(\v27.ateom.CheckpointWorkloadRequest.RuntimeAssetPathsEntryR\x11runtimeAssetPaths\x12*\n" +
 	"\x05scope\x18\n" +
-	" \x01(\x0e2\x14.ateom.SnapshotScopeR\x05scope\x1aD\n" +
+	" \x01(\x0e2\x14.ateom.SnapshotScopeR\x05scope\x12!\n" +
+	"\foperation_id\x18\v \x01(\tR\voperationId\x1aD\n" +
 	"\x16RuntimeAssetPathsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
-	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"C\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"a\n" +
+	"\x14RuntimeCompatibility\x12\x18\n" +
+	"\aprofile\x18\x01 \x01(\tR\aprofile\x12/\n" +
+	"\x13runtime_fingerprint\x18\x02 \x01(\tR\x12runtimeFingerprint\"\x95\x01\n" +
 	"\x1aCheckpointWorkloadResponse\x12%\n" +
-	"\x0esnapshot_files\x18\x01 \x03(\tR\rsnapshotFiles\"\xe0\x05\n" +
+	"\x0esnapshot_files\x18\x01 \x03(\tR\rsnapshotFiles\x12P\n" +
+	"\x15runtime_compatibility\x18\x02 \x01(\v2\x1b.ateom.RuntimeCompatibilityR\x14runtimeCompatibility\"\xd5\x06\n" +
 	"\x16RestoreWorkloadRequest\x12\x1a\n" +
 	"\batespace\x18\x01 \x01(\tR\batespace\x12\x1d\n" +
 	"\n" +
@@ -1857,7 +1949,9 @@ const file_ateom_proto_rawDesc = "" +
 	"\x0eegress_gateway\x18\f \x01(\v2\x14.ateom.EgressGatewayH\x00R\regressGateway\x88\x01\x01\x12.\n" +
 	"\x13golden_snapshot_uri\x18\r \x01(\tR\x11goldenSnapshotUri\x12\x1b\n" +
 	"\tcpu_milli\x18\x0e \x01(\x03R\bcpuMilli\x12!\n" +
-	"\fmemory_bytes\x18\x0f \x01(\x03R\vmemoryBytes\x1aD\n" +
+	"\fmemory_bytes\x18\x0f \x01(\x03R\vmemoryBytes\x12!\n" +
+	"\foperation_id\x18\x10 \x01(\tR\voperationId\x12P\n" +
+	"\x15runtime_compatibility\x18\x11 \x01(\v2\x1b.ateom.RuntimeCompatibilityR\x14runtimeCompatibility\x1aD\n" +
 	"\x16RuntimeAssetPathsEntry\x12\x10\n" +
 	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
 	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01B\x11\n" +
@@ -1889,11 +1983,12 @@ const file_ateom_proto_rawDesc = "" +
 	"\x1aSNAPSHOT_SCOPE_UNSPECIFIED\x10\x00\x12\x17\n" +
 	"\x13SNAPSHOT_SCOPE_FULL\x10\x01\x12\x17\n" +
 	"\x13SNAPSHOT_SCOPE_DATA\x10\x02\x12!\n" +
-	"\x1dSNAPSHOT_SCOPE_DATA_ON_GOLDEN\x10\x03*b\n" +
+	"\x1dSNAPSHOT_SCOPE_DATA_ON_GOLDEN\x10\x03*z\n" +
 	"\fSandboxClass\x12\x1d\n" +
 	"\x19SANDBOX_CLASS_UNSPECIFIED\x10\x00\x12\x18\n" +
 	"\x14SANDBOX_CLASS_GVISOR\x10\x01\x12\x19\n" +
-	"\x15SANDBOX_CLASS_MICROVM\x10\x02*b\n" +
+	"\x15SANDBOX_CLASS_MICROVM\x10\x02\x12\x16\n" +
+	"\x12SANDBOX_CLASS_KATA\x10\x03*b\n" +
 	"\vStatsSource\x12\x1c\n" +
 	"\x18STATS_SOURCE_UNSPECIFIED\x10\x00\x12\x17\n" +
 	"\x13STATS_SOURCE_CGROUP\x10\x01\x12\x1c\n" +
@@ -1919,7 +2014,7 @@ func file_ateom_proto_rawDescGZIP() []byte {
 }
 
 var file_ateom_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
-var file_ateom_proto_msgTypes = make([]protoimpl.MessageInfo, 25)
+var file_ateom_proto_msgTypes = make([]protoimpl.MessageInfo, 26)
 var file_ateom_proto_goTypes = []any{
 	(SnapshotScope)(0),                     // 0: ateom.SnapshotScope
 	(SandboxClass)(0),                      // 1: ateom.SandboxClass
@@ -1938,22 +2033,23 @@ var file_ateom_proto_goTypes = []any{
 	(*HTTPGetAction)(nil),                  // 14: ateom.HTTPGetAction
 	(*RunWorkloadResponse)(nil),            // 15: ateom.RunWorkloadResponse
 	(*CheckpointWorkloadRequest)(nil),      // 16: ateom.CheckpointWorkloadRequest
-	(*CheckpointWorkloadResponse)(nil),     // 17: ateom.CheckpointWorkloadResponse
-	(*RestoreWorkloadRequest)(nil),         // 18: ateom.RestoreWorkloadRequest
-	(*RestoreWorkloadResponse)(nil),        // 19: ateom.RestoreWorkloadResponse
-	(*GetWorkloadStatsRequest)(nil),        // 20: ateom.GetWorkloadStatsRequest
-	(*WorkloadStatsSample)(nil),            // 21: ateom.WorkloadStatsSample
-	(*GetWorkloadStatsResponse)(nil),       // 22: ateom.GetWorkloadStatsResponse
-	(*GetActiveWorkloadStatsRequest)(nil),  // 23: ateom.GetActiveWorkloadStatsRequest
-	(*GetActiveWorkloadStatsResponse)(nil), // 24: ateom.GetActiveWorkloadStatsResponse
-	nil,                                    // 25: ateom.RunWorkloadRequest.RuntimeAssetPathsEntry
-	nil,                                    // 26: ateom.CheckpointWorkloadRequest.RuntimeAssetPathsEntry
-	nil,                                    // 27: ateom.RestoreWorkloadRequest.RuntimeAssetPathsEntry
+	(*RuntimeCompatibility)(nil),           // 17: ateom.RuntimeCompatibility
+	(*CheckpointWorkloadResponse)(nil),     // 18: ateom.CheckpointWorkloadResponse
+	(*RestoreWorkloadRequest)(nil),         // 19: ateom.RestoreWorkloadRequest
+	(*RestoreWorkloadResponse)(nil),        // 20: ateom.RestoreWorkloadResponse
+	(*GetWorkloadStatsRequest)(nil),        // 21: ateom.GetWorkloadStatsRequest
+	(*WorkloadStatsSample)(nil),            // 22: ateom.WorkloadStatsSample
+	(*GetWorkloadStatsResponse)(nil),       // 23: ateom.GetWorkloadStatsResponse
+	(*GetActiveWorkloadStatsRequest)(nil),  // 24: ateom.GetActiveWorkloadStatsRequest
+	(*GetActiveWorkloadStatsResponse)(nil), // 25: ateom.GetActiveWorkloadStatsResponse
+	nil,                                    // 26: ateom.RunWorkloadRequest.RuntimeAssetPathsEntry
+	nil,                                    // 27: ateom.CheckpointWorkloadRequest.RuntimeAssetPathsEntry
+	nil,                                    // 28: ateom.RestoreWorkloadRequest.RuntimeAssetPathsEntry
 }
 var file_ateom_proto_depIdxs = []int32{
 	7,  // 0: ateom.TerminateWorkloadRequest.spec:type_name -> ateom.WorkloadSpec
 	7,  // 1: ateom.RunWorkloadRequest.spec:type_name -> ateom.WorkloadSpec
-	25, // 2: ateom.RunWorkloadRequest.runtime_asset_paths:type_name -> ateom.RunWorkloadRequest.RuntimeAssetPathsEntry
+	26, // 2: ateom.RunWorkloadRequest.runtime_asset_paths:type_name -> ateom.RunWorkloadRequest.RuntimeAssetPathsEntry
 	6,  // 3: ateom.RunWorkloadRequest.egress_gateway:type_name -> ateom.EgressGateway
 	8,  // 4: ateom.WorkloadSpec.containers:type_name -> ateom.Container
 	13, // 5: ateom.Container.readyz:type_name -> ateom.Readyz
@@ -1963,33 +2059,35 @@ var file_ateom_proto_depIdxs = []int32{
 	12, // 9: ateom.Container.image_volume_mounts:type_name -> ateom.ImageVolumeMount
 	14, // 10: ateom.Readyz.http_get:type_name -> ateom.HTTPGetAction
 	7,  // 11: ateom.CheckpointWorkloadRequest.spec:type_name -> ateom.WorkloadSpec
-	26, // 12: ateom.CheckpointWorkloadRequest.runtime_asset_paths:type_name -> ateom.CheckpointWorkloadRequest.RuntimeAssetPathsEntry
+	27, // 12: ateom.CheckpointWorkloadRequest.runtime_asset_paths:type_name -> ateom.CheckpointWorkloadRequest.RuntimeAssetPathsEntry
 	0,  // 13: ateom.CheckpointWorkloadRequest.scope:type_name -> ateom.SnapshotScope
-	7,  // 14: ateom.RestoreWorkloadRequest.spec:type_name -> ateom.WorkloadSpec
-	27, // 15: ateom.RestoreWorkloadRequest.runtime_asset_paths:type_name -> ateom.RestoreWorkloadRequest.RuntimeAssetPathsEntry
-	0,  // 16: ateom.RestoreWorkloadRequest.scope:type_name -> ateom.SnapshotScope
-	6,  // 17: ateom.RestoreWorkloadRequest.egress_gateway:type_name -> ateom.EgressGateway
-	1,  // 18: ateom.WorkloadStatsSample.sandbox_class:type_name -> ateom.SandboxClass
-	2,  // 19: ateom.WorkloadStatsSample.source:type_name -> ateom.StatsSource
-	21, // 20: ateom.GetWorkloadStatsResponse.sample:type_name -> ateom.WorkloadStatsSample
-	21, // 21: ateom.GetActiveWorkloadStatsResponse.samples:type_name -> ateom.WorkloadStatsSample
-	5,  // 22: ateom.Ateom.RunWorkload:input_type -> ateom.RunWorkloadRequest
-	16, // 23: ateom.Ateom.CheckpointWorkload:input_type -> ateom.CheckpointWorkloadRequest
-	18, // 24: ateom.Ateom.RestoreWorkload:input_type -> ateom.RestoreWorkloadRequest
-	20, // 25: ateom.Ateom.GetWorkloadStats:input_type -> ateom.GetWorkloadStatsRequest
-	23, // 26: ateom.Ateom.GetActiveWorkloadStats:input_type -> ateom.GetActiveWorkloadStatsRequest
-	3,  // 27: ateom.Ateom.TerminateWorkload:input_type -> ateom.TerminateWorkloadRequest
-	15, // 28: ateom.Ateom.RunWorkload:output_type -> ateom.RunWorkloadResponse
-	17, // 29: ateom.Ateom.CheckpointWorkload:output_type -> ateom.CheckpointWorkloadResponse
-	19, // 30: ateom.Ateom.RestoreWorkload:output_type -> ateom.RestoreWorkloadResponse
-	22, // 31: ateom.Ateom.GetWorkloadStats:output_type -> ateom.GetWorkloadStatsResponse
-	24, // 32: ateom.Ateom.GetActiveWorkloadStats:output_type -> ateom.GetActiveWorkloadStatsResponse
-	4,  // 33: ateom.Ateom.TerminateWorkload:output_type -> ateom.TerminateWorkloadResponse
-	28, // [28:34] is the sub-list for method output_type
-	22, // [22:28] is the sub-list for method input_type
-	22, // [22:22] is the sub-list for extension type_name
-	22, // [22:22] is the sub-list for extension extendee
-	0,  // [0:22] is the sub-list for field type_name
+	17, // 14: ateom.CheckpointWorkloadResponse.runtime_compatibility:type_name -> ateom.RuntimeCompatibility
+	7,  // 15: ateom.RestoreWorkloadRequest.spec:type_name -> ateom.WorkloadSpec
+	28, // 16: ateom.RestoreWorkloadRequest.runtime_asset_paths:type_name -> ateom.RestoreWorkloadRequest.RuntimeAssetPathsEntry
+	0,  // 17: ateom.RestoreWorkloadRequest.scope:type_name -> ateom.SnapshotScope
+	6,  // 18: ateom.RestoreWorkloadRequest.egress_gateway:type_name -> ateom.EgressGateway
+	17, // 19: ateom.RestoreWorkloadRequest.runtime_compatibility:type_name -> ateom.RuntimeCompatibility
+	1,  // 20: ateom.WorkloadStatsSample.sandbox_class:type_name -> ateom.SandboxClass
+	2,  // 21: ateom.WorkloadStatsSample.source:type_name -> ateom.StatsSource
+	22, // 22: ateom.GetWorkloadStatsResponse.sample:type_name -> ateom.WorkloadStatsSample
+	22, // 23: ateom.GetActiveWorkloadStatsResponse.samples:type_name -> ateom.WorkloadStatsSample
+	5,  // 24: ateom.Ateom.RunWorkload:input_type -> ateom.RunWorkloadRequest
+	16, // 25: ateom.Ateom.CheckpointWorkload:input_type -> ateom.CheckpointWorkloadRequest
+	19, // 26: ateom.Ateom.RestoreWorkload:input_type -> ateom.RestoreWorkloadRequest
+	21, // 27: ateom.Ateom.GetWorkloadStats:input_type -> ateom.GetWorkloadStatsRequest
+	24, // 28: ateom.Ateom.GetActiveWorkloadStats:input_type -> ateom.GetActiveWorkloadStatsRequest
+	3,  // 29: ateom.Ateom.TerminateWorkload:input_type -> ateom.TerminateWorkloadRequest
+	15, // 30: ateom.Ateom.RunWorkload:output_type -> ateom.RunWorkloadResponse
+	18, // 31: ateom.Ateom.CheckpointWorkload:output_type -> ateom.CheckpointWorkloadResponse
+	20, // 32: ateom.Ateom.RestoreWorkload:output_type -> ateom.RestoreWorkloadResponse
+	23, // 33: ateom.Ateom.GetWorkloadStats:output_type -> ateom.GetWorkloadStatsResponse
+	25, // 34: ateom.Ateom.GetActiveWorkloadStats:output_type -> ateom.GetActiveWorkloadStatsResponse
+	4,  // 35: ateom.Ateom.TerminateWorkload:output_type -> ateom.TerminateWorkloadResponse
+	30, // [30:36] is the sub-list for method output_type
+	24, // [24:30] is the sub-list for method input_type
+	24, // [24:24] is the sub-list for extension type_name
+	24, // [24:24] is the sub-list for extension extendee
+	0,  // [0:24] is the sub-list for field type_name
 }
 
 func init() { file_ateom_proto_init() }
@@ -1998,14 +2096,14 @@ func file_ateom_proto_init() {
 		return
 	}
 	file_ateom_proto_msgTypes[2].OneofWrappers = []any{}
-	file_ateom_proto_msgTypes[15].OneofWrappers = []any{}
+	file_ateom_proto_msgTypes[16].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateom_proto_rawDesc), len(file_ateom_proto_rawDesc)),
 			NumEnums:      3,
-			NumMessages:   25,
+			NumMessages:   26,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/internal/proto/ateompb/ateom.proto b/internal/proto/ateompb/ateom.proto
index 15f57b09f1..08cb45bcfe 100644
--- a/internal/proto/ateompb/ateom.proto
+++ b/internal/proto/ateompb/ateom.proto
@@ -287,6 +287,12 @@ message CheckpointWorkloadRequest {
 
   // What content to include in the checkpoint.
   SnapshotScope scope = 10;
+  string operation_id = 11;
+}
+
+message RuntimeCompatibility {
+  string profile = 1;
+  string runtime_fingerprint = 2;
 }
 
 message CheckpointWorkloadResponse {
@@ -294,6 +300,7 @@ message CheckpointWorkloadResponse {
   // (relative names) for atelet to ship to object storage. Each runtime reports
   // its own set (gVisor's image files, cloud-hypervisor's snapshot set, ...).
   repeated string snapshot_files = 1;
+  RuntimeCompatibility runtime_compatibility = 2;
 }
 
 message RestoreWorkloadRequest {
@@ -332,6 +339,8 @@ message RestoreWorkloadRequest {
   // these are ignored. Zero means "unset": keep the runtime default.
   int64 cpu_milli = 14;    // CPU limit in millicores (1000 = one core).
   int64 memory_bytes = 15; // Memory limit in bytes.
+  string operation_id = 16;
+  RuntimeCompatibility runtime_compatibility = 17;
 }
 
 message RestoreWorkloadResponse {
@@ -354,6 +363,7 @@ enum SandboxClass {
   SANDBOX_CLASS_GVISOR = 1;
   // Micro-VM (cmd/ateom-microvm).
   SANDBOX_CLASS_MICROVM = 2;
+  SANDBOX_CLASS_KATA = 3;
 }
 
 // StatsSource is how a sample's measurements were obtained. The two are not
diff --git a/internal/resources/validate.go b/internal/resources/validate.go
index 103c944ed7..0863f0c714 100644
--- a/internal/resources/validate.go
+++ b/internal/resources/validate.go
@@ -111,19 +111,14 @@ func ValidateContainerNames(names []string) error {
 	return nil
 }
 
-// ValidateRunscHash ensures the runsc SHA-256 hash is exactly 64 hex
-// characters before it is used to build the on-disk binary path
-// (static-files/runsc-<hash>) and, on a cache hit, returned for ateom to
-// execute. Without this, a hash containing path separators or ".." could
-// point the cache-hit early return (and the download target) at an arbitrary
-// binary outside the static-files dir.
-func ValidateRunscHash(sha256Hash string) error {
+// ValidateSHA256 ensures a SHA-256 digest is exactly 64 hexadecimal characters
+// before it is used to derive an on-disk asset path.
+func ValidateSHA256(sha256Hash string) error {
 	if len(sha256Hash) != 64 {
-		return fmt.Errorf("invalid runsc sha256 hash: want 64 hex chars, got %d", len(sha256Hash))
+		return fmt.Errorf("invalid sha256 hash: want 64 hex chars, got %d", len(sha256Hash))
 	}
-	// Same decoder atelet's digest comparison uses.
 	if _, err := hex.DecodeString(sha256Hash); err != nil {
-		return fmt.Errorf("invalid runsc sha256 hash %q: must be hex", sha256Hash)
+		return fmt.Errorf("invalid sha256 hash %q: must be hex", sha256Hash)
 	}
 	return nil
 }
diff --git a/internal/resources/validate_test.go b/internal/resources/validate_test.go
index 7b718b454f..90b2f77c7b 100644
--- a/internal/resources/validate_test.go
+++ b/internal/resources/validate_test.go
@@ -146,7 +146,7 @@ func TestValidateContainerNames(t *testing.T) {
 	}
 }
 
-func TestValidateRunscHash(t *testing.T) {
+func TestValidateSHA256(t *testing.T) {
 	const valid = "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 
 	tests := []struct {
@@ -164,8 +164,8 @@ func TestValidateRunscHash(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := ValidateRunscHash(tt.hash); (err != nil) != tt.wantErr {
-				t.Errorf("ValidateRunscHash(%q) err = %v, wantErr %v", tt.hash, err, tt.wantErr)
+			if err := ValidateSHA256(tt.hash); (err != nil) != tt.wantErr {
+				t.Errorf("ValidateSHA256(%q) err = %v, wantErr %v", tt.hash, err, tt.wantErr)
 			}
 		})
 	}
diff --git a/internal/sandboxd/checkpoint.go b/internal/sandboxd/checkpoint.go
new file mode 100644
index 0000000000..94ecc8e9b1
--- /dev/null
+++ b/internal/sandboxd/checkpoint.go
@@ -0,0 +1,219 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+const kataCheckpointFormatVersion = 10
+const KataCheckpointProfile = "ateom-kata-qemu-cr-v1"
+const KataCheckpointProfileDragonball = "ateom-kata-dragonball-cr-v1"
+
+type RuntimeCompatibility struct {
+	Profile     string
+	Fingerprint string
+}
+
+type checkpointVMState struct {
+	File   string `json:"file"`
+	Size   uint64 `json:"size"`
+	SHA256 string `json:"sha256"`
+}
+
+type checkpointManifest struct {
+	FormatVersion uint32              `json:"format_version"`
+	Hypervisor    string              `json:"hypervisor"`
+	SandboxID     string              `json:"sandbox_id"`
+	Tasks         []checkpointTask    `json:"tasks"`
+	Rootfs        []checkpointRootfs  `json:"rootfs"`
+	BlockVolumes  []json.RawMessage   `json:"block_volumes"`
+	NetworkMACs   []json.RawMessage   `json:"network_macs"`
+	MemoryHotplug uint64              `json:"memory_hotplug_size"`
+	VCPUHotplug   uint32              `json:"vcpu_hotplug_count"`
+	VMState       []checkpointVMState `json:"vm_state"`
+	Fingerprint   string              `json:"runtime_fingerprint"`
+	OperationID   string              `json:"operation_id,omitempty"`
+	Template      *json.RawMessage    `json:"template,omitempty"`
+}
+
+type checkpointTask struct {
+	CheckpointKey string `json:"checkpoint_key"`
+	TaskID        string `json:"task_id"`
+}
+
+type checkpointRootfs struct {
+	CheckpointKey      string `json:"checkpoint_key"`
+	File               string `json:"file"`
+	Format             string `json:"format"`
+	DeviceID           string `json:"device_id"`
+	Index              uint64 `json:"index"`
+	DriverOption       string `json:"driver_option"`
+	VirtPath           string `json:"virt_path"`
+	IsDirect           *bool  `json:"is_direct"`
+	DiscardUnmap       bool   `json:"discard_unmap"`
+	AIO                string `json:"aio"`
+	QueueSize          uint32 `json:"queue_size"`
+	NumQueues          uint64 `json:"num_queues"`
+	LogicalSectorSize  uint32 `json:"logical_sector_size"`
+	PhysicalSectorSize uint32 `json:"physical_sector_size"`
+	SerialOverride     string `json:"serial_override"`
+	Size               uint64 `json:"size"`
+	SHA256             string `json:"sha256"`
+}
+
+// ValidateCheckpoint reads manifest.json first and validates every file named
+// by it. It intentionally understands only the integrity envelope, not Kata's
+// VM-state contents.
+func ValidateCheckpoint(root string, expectedOperationID ...string) error {
+	_, err := validateCheckpoint(root, expectedOperationID...)
+	return err
+}
+
+func CheckpointCompatibility(root string) (RuntimeCompatibility, error) {
+	manifest, err := validateCheckpoint(root)
+	if err != nil {
+		return RuntimeCompatibility{}, err
+	}
+	return RuntimeCompatibility{Profile: KataCheckpointProfile, Fingerprint: manifest.Fingerprint}, nil
+}
+
+func validateCheckpoint(root string, expectedOperationID ...string) (*checkpointManifest, error) {
+	if !filepath.IsAbs(root) {
+		return nil, errors.New("checkpoint path must be absolute")
+	}
+	manifestPath := filepath.Join(root, "manifest.json")
+	manifestBytes, err := readRegularFile(manifestPath)
+	if err != nil {
+		return nil, fmt.Errorf("read checkpoint manifest: %w", err)
+	}
+	var manifest checkpointManifest
+	dec := json.NewDecoder(strings.NewReader(string(manifestBytes)))
+	dec.DisallowUnknownFields()
+	if err := dec.Decode(&manifest); err != nil {
+		return nil, fmt.Errorf("decode checkpoint manifest: %w", err)
+	}
+	if manifest.FormatVersion != kataCheckpointFormatVersion || manifest.SandboxID == "" || manifest.Fingerprint == "" {
+		return nil, errors.New("checkpoint manifest lacks required identity fields")
+	}
+	if len(expectedOperationID) > 0 && manifest.OperationID != expectedOperationID[0] {
+		return nil, fmt.Errorf("checkpoint operation ID %q does not match request %q", manifest.OperationID, expectedOperationID[0])
+	}
+	if len(manifest.Tasks) == 0 || len(manifest.Rootfs) != len(manifest.Tasks) {
+		return nil, errors.New("checkpoint task/rootfs inventory is empty or mismatched")
+	}
+	if len(manifest.BlockVolumes) != 0 {
+		return nil, errors.New("checkpoint contains unsupported block volumes")
+	}
+	if len(manifest.VMState) == 0 {
+		return nil, errors.New("checkpoint has no VM state artifacts")
+	}
+	vmStateFiles := map[string]bool{}
+	for _, item := range manifest.VMState {
+		clean := filepath.Clean(item.File)
+		if filepath.Dir(clean) != "vm" || filepath.Base(clean) == "." || vmStateFiles[clean] {
+			return nil, fmt.Errorf("invalid or duplicate VM state path %q", item.File)
+		}
+		path, err := confinedPath(root, item.File)
+		if err != nil {
+			return nil, err
+		}
+		if err := validateFile(path, item.Size, item.SHA256); err != nil {
+			return nil, fmt.Errorf("validate VM state %q: %w", item.File, err)
+		}
+		vmStateFiles[clean] = true
+	}
+	taskKeys, taskIDs := map[string]bool{}, map[string]bool{}
+	for _, task := range manifest.Tasks {
+		if task.CheckpointKey == "" || !validID(task.TaskID) || taskKeys[task.CheckpointKey] || taskIDs[task.TaskID] {
+			return nil, fmt.Errorf("invalid or duplicate checkpoint task %q=%q", task.CheckpointKey, task.TaskID)
+		}
+		taskKeys[task.CheckpointKey], taskIDs[task.TaskID] = true, true
+	}
+	seen := map[string]bool{}
+	for _, item := range manifest.Rootfs {
+		if item.CheckpointKey == "" || !taskKeys[item.CheckpointKey] || seen[item.CheckpointKey] {
+			return nil, fmt.Errorf("invalid or duplicate rootfs key %q", item.CheckpointKey)
+		}
+		if item.Format != "raw" || item.DeviceID == "" || item.DriverOption == "" || item.VirtPath == "" || item.AIO == "" {
+			return nil, fmt.Errorf("rootfs %q lacks managed-device identity", item.CheckpointKey)
+		}
+		seen[item.CheckpointKey] = true
+		path, err := confinedPath(root, item.File)
+		if err != nil {
+			return nil, err
+		}
+		if err := validateFile(path, item.Size, item.SHA256); err != nil {
+			return nil, fmt.Errorf("validate rootfs %q: %w", item.CheckpointKey, err)
+		}
+	}
+	return &manifest, nil
+}
+
+func confinedPath(root, relative string) (string, error) {
+	if relative == "" || filepath.IsAbs(relative) {
+		return "", fmt.Errorf("invalid manifest path %q", relative)
+	}
+	clean := filepath.Clean(relative)
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("manifest path escapes checkpoint: %q", relative)
+	}
+	return filepath.Join(root, clean), nil
+}
+
+func readRegularFile(path string) ([]byte, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return nil, err
+	}
+	if !info.Mode().IsRegular() {
+		return nil, errors.New("not a regular file")
+	}
+	return os.ReadFile(path)
+}
+
+func validateFile(path string, size uint64, digest string) error {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return err
+	}
+	if !info.Mode().IsRegular() || uint64(info.Size()) != size {
+		return fmt.Errorf("invalid type or size: got %d, require %d", info.Size(), size)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+	h := sha256.New()
+	if _, err := io.Copy(h, f); err != nil {
+		return err
+	}
+	got := hex.EncodeToString(h.Sum(nil))
+	if len(digest) != sha256.Size*2 || got != strings.ToLower(digest) {
+		return fmt.Errorf("sha256 mismatch: got %s, require %s", got, digest)
+	}
+	return nil
+}
diff --git a/internal/sandboxd/controller.go b/internal/sandboxd/controller.go
new file mode 100644
index 0000000000..5d65d80cb9
--- /dev/null
+++ b/internal/sandboxd/controller.go
@@ -0,0 +1,455 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"regexp"
+	"sort"
+	"strings"
+	"sync"
+
+	sandboxapi "github.com/agent-substrate/substrate/internal/sandboxd/sandboxapi"
+	taskapi "github.com/containerd/containerd/api/runtime/task/v3"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+const podSandboxConfigTypeURL = "runtime.v1.PodSandboxConfig"
+const vmRestoredTaskCheckpoint = "vm-restored-v1"
+const operationIDOption = "io.agent-substrate.operation-id"
+
+type RestoreTask struct {
+	CheckpointKey string
+	TaskID        string
+	Bundle        string
+	Terminal      bool
+	Stdin         string
+	Stdout        string
+	Stderr        string
+	Options       *anypb.Any
+}
+
+type SandboxController struct {
+	shims *ShimManager
+	tasks *TaskManager
+	mu    sync.Mutex
+	netns map[string]networkState
+}
+
+type networkState struct {
+	path       string
+	interfaces map[string]bool // true when an ingress qdisc predated sandboxd
+}
+
+func NewSandboxController(shims *ShimManager, tasks *TaskManager) *SandboxController {
+	return &SandboxController{shims: shims, tasks: tasks, netns: map[string]networkState{}}
+}
+
+func (c *SandboxController) Create(ctx context.Context, sid, netns string, options *anypb.Any, annotations map[string]string) error {
+	if err := requireSandboxOptions(options); err != nil {
+		return err
+	}
+	if err := c.rememberNetNS(sid, netns); err != nil {
+		return err
+	}
+	inst, err := c.shims.Start(ctx, sid)
+	if err != nil {
+		return err
+	}
+	_, err = inst.Sandbox.CreateSandbox(ctx, &sandboxapi.CreateSandboxRequest{
+		SandboxId: sid, BundlePath: inst.Bundle, Options: options,
+		NetnsPath: netns, Annotations: cloneMap(annotations),
+	})
+	if err != nil {
+		_ = c.shutdown(context.WithoutCancel(ctx), sid)
+		return fmt.Errorf("create Kata sandbox %q: %w", sid, err)
+	}
+	return nil
+}
+
+func (c *SandboxController) Start(ctx context.Context, sid string) error {
+	inst, err := c.shims.Get(sid)
+	if err != nil {
+		return err
+	}
+	resp, err := inst.Sandbox.StartSandbox(ctx, &sandboxapi.StartSandboxRequest{SandboxId: sid})
+	if err != nil {
+		return fmt.Errorf("start Kata sandbox %q: %w", sid, err)
+	}
+	if resp.GetPid() == 0 || resp.GetCreatedAt() == nil {
+		return errors.New("kata StartSandbox returned no pid or creation time")
+	}
+	return nil
+}
+
+// Ping verifies the sandbox shim is responsive before starting a heavy operation.
+func (c *SandboxController) Ping(ctx context.Context, sid string) error {
+	inst, err := c.shims.Get(sid)
+	if err != nil {
+		return err
+	}
+	_, err = inst.Sandbox.PingSandbox(ctx, &sandboxapi.PingRequest{SandboxId: sid})
+	return err
+}
+
+// Status returns the sandbox state as reported by the shim.
+func (c *SandboxController) Status(ctx context.Context, sid string) (*sandboxapi.SandboxStatusResponse, error) {
+	inst, err := c.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Sandbox.SandboxStatus(ctx, &sandboxapi.SandboxStatusRequest{SandboxId: sid, Verbose: true})
+}
+
+func (c *SandboxController) Checkpoint(ctx context.Context, sid, output, operationID string, inventory map[string]string) error {
+	if err := c.Ping(ctx, sid); err != nil {
+		return fmt.Errorf("sandbox %q is not responsive before checkpoint: %w", sid, err)
+	}
+	st, err := c.Status(ctx, sid)
+	if err != nil {
+		return fmt.Errorf("sandbox %q status before checkpoint: %w", sid, err)
+	}
+	if st.GetState() != "SANDBOX_READY" {
+		return fmt.Errorf("sandbox %q is in state %q, require SANDBOX_READY", sid, st.GetState())
+	}
+	inst, err := c.shims.Get(sid)
+	if err != nil {
+		return err
+	}
+	if err := prepareEmptyDir(output); err != nil {
+		return fmt.Errorf("prepare checkpoint output: %w", err)
+	}
+	containers, err := checkpointContainers(inventory)
+	if err != nil {
+		return err
+	}
+	_, err = inst.Checkpoint.Checkpoint(ctx, &sandboxapi.CheckpointRequest{
+		SandboxId: sid, OutputPath: output, Containers: containers,
+		Options: map[string]string{operationIDOption: operationID},
+	})
+	if err != nil {
+		return fmt.Errorf("checkpoint Kata sandbox %q: %w", sid, err)
+	}
+	return ValidateCheckpoint(output, operationID)
+}
+
+func (c *SandboxController) Restore(ctx context.Context, sid, checkpoint, netns, operationID string, options *anypb.Any, tasks []RestoreTask) (_ *sandboxapi.RestoreResponse, retErr error) {
+	if err := requireSandboxOptions(options); err != nil {
+		return nil, err
+	}
+	if err := c.rememberNetNS(sid, netns); err != nil {
+		return nil, err
+	}
+	if err := ValidateCheckpoint(checkpoint); err != nil {
+		return nil, err
+	}
+	reqContainers, err := restoreContainers(tasks)
+	if err != nil {
+		return nil, err
+	}
+	inst, err := c.shims.Start(ctx, sid)
+	if err != nil {
+		return nil, err
+	}
+	defer func() {
+		if retErr != nil {
+			_ = c.shutdown(context.WithoutCancel(ctx), sid)
+		}
+	}()
+	resp, err := inst.Checkpoint.Restore(ctx, &sandboxapi.RestoreRequest{
+		SandboxId: sid, CheckpointPath: checkpoint, SandboxConfig: options,
+		NetnsPath: netns, Containers: reqContainers,
+		Options: map[string]string{operationIDOption: operationID},
+		AcceptedTaskRestoreModes: []sandboxapi.TaskRestoreMode{
+			sandboxapi.TaskRestoreMode_TASK_RESTORE_MODE_VM_RESTORED,
+		},
+	})
+	if err != nil {
+		return nil, fmt.Errorf("restore Kata sandbox %q: %w", sid, err)
+	}
+	if err := ValidateRestoreResult(reqContainers, resp); err != nil {
+		return nil, err
+	}
+	ids := make([]string, 0, len(tasks))
+	for _, task := range tasks {
+		if _, err := c.tasks.Create(ctx, sid, &taskapi.CreateTaskRequest{
+			ID: task.TaskID, Bundle: task.Bundle, Terminal: task.Terminal,
+			Stdin: task.Stdin, Stdout: task.Stdout, Stderr: task.Stderr,
+			Options: task.Options, Checkpoint: vmRestoredTaskCheckpoint,
+		}); err != nil {
+			return nil, fmt.Errorf("adopt VM-restored task %q: %w", task.TaskID, err)
+		}
+		ids = append(ids, task.TaskID)
+	}
+	if err := c.tasks.RequireCreated(ctx, sid, ids); err != nil {
+		return nil, err
+	}
+	st, err := c.Status(ctx, sid)
+	if err != nil {
+		return nil, fmt.Errorf("sandbox %q status after restore: %w", sid, err)
+	}
+	if st.GetState() != "SANDBOX_READY" {
+		return nil, fmt.Errorf("restored sandbox %q is in state %q, require SANDBOX_READY", sid, st.GetState())
+	}
+	return resp, nil
+}
+
+// StartRestored explicitly starts every CREATED task. Restore itself
+// must not re-run the OCI entrypoint.
+func (c *SandboxController) StartRestored(ctx context.Context, sid string, tasks []RestoreTask) error {
+	started := make([]string, 0, len(tasks))
+	for _, task := range tasks {
+		if _, err := c.tasks.Start(ctx, sid, task.TaskID); err != nil {
+			for _, id := range started {
+				_ = c.tasks.Kill(context.WithoutCancel(ctx), sid, id, 9, true)
+			}
+			return fmt.Errorf("start restored task %q: %w", task.TaskID, err)
+		}
+		started = append(started, task.TaskID)
+	}
+	return nil
+}
+
+func (c *SandboxController) shutdown(ctx context.Context, sid string) error {
+	inst, err := c.shims.Get(sid)
+	if err != nil {
+		return err
+	}
+	_, callErr := inst.Sandbox.ShutdownSandbox(ctx, &sandboxapi.ShutdownSandboxRequest{SandboxId: sid})
+	stopErr := c.shims.Stop(sid)
+	netErr := cleanupKataTaps(c.takeNetNS(sid))
+	if rmErr := os.RemoveAll(inst.Bundle); rmErr != nil {
+		return errors.Join(callErr, stopErr, netErr, rmErr)
+	}
+	return errors.Join(callErr, stopErr, netErr)
+}
+
+func (c *SandboxController) Shutdown(ctx context.Context, sid string) error {
+	return c.shutdown(ctx, sid)
+}
+
+func (c *SandboxController) rememberNetNS(sid, netns string) error {
+	state, err := inspectNetworkState(netns)
+	if err != nil {
+		return err
+	}
+	c.mu.Lock()
+	c.netns[sid] = state
+	c.mu.Unlock()
+	return nil
+}
+
+func (c *SandboxController) takeNetNS(sid string) networkState {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	netns := c.netns[sid]
+	delete(c.netns, sid)
+	return netns
+}
+
+var kataTapName = regexp.MustCompile(`^tap[0-9]+_kata$`)
+
+func inspectNetworkState(netns string) (networkState, error) {
+	state := networkState{path: netns, interfaces: map[string]bool{}}
+	if netns == "" {
+		return state, nil
+	}
+	out, err := exec.Command("nsenter", "--net="+netns, "--", "ip", "-o", "link", "show").CombinedOutput()
+	if err != nil {
+		return state, fmt.Errorf("inspect netns %q links: %w: %s", netns, err, out)
+	}
+	for _, line := range strings.Split(string(out), "\n") {
+		parts := strings.SplitN(line, ":", 3)
+		if len(parts) < 2 {
+			continue
+		}
+		name := strings.TrimSpace(strings.SplitN(parts[1], "@", 2)[0])
+		if name == "" || name == "lo" || strings.HasPrefix(name, "tunl") || kataTapName.MatchString(name) {
+			continue
+		}
+		qdisc, err := exec.Command("nsenter", "--net="+netns, "--", "tc", "qdisc", "show", "dev", name).CombinedOutput()
+		if err != nil {
+			return state, fmt.Errorf("inspect qdisc on %q: %w: %s", name, err, qdisc)
+		}
+		state.interfaces[name] = strings.Contains(string(qdisc), "qdisc ingress ")
+	}
+	if len(state.interfaces) != 1 {
+		return state, fmt.Errorf("netns %q has %d CNI interfaces, require exactly one", netns, len(state.interfaces))
+	}
+	return state, nil
+}
+
+// cleanupKataTaps removes only interfaces whose naming rule is defined by
+// runtime-rs NetworkPair (tap{index}_kata). CNI-owned interfaces are untouched.
+func cleanupKataTaps(state networkState) error {
+	if state.path == "" {
+		return nil
+	}
+	args := []string{"--net=" + state.path, "--", "ip", "-o", "link", "show"}
+	out, err := exec.Command("nsenter", args...).CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("list Kata interfaces in netns %q: %w: %s", state.path, err, out)
+	}
+	hasKataTap := false
+	for _, line := range strings.Split(string(out), "\n") {
+		parts := strings.SplitN(line, ":", 3)
+		if len(parts) < 2 {
+			continue
+		}
+		name := strings.TrimSpace(strings.SplitN(parts[1], "@", 2)[0])
+		if !kataTapName.MatchString(name) {
+			continue
+		}
+		hasKataTap = true
+	}
+	if !hasKataTap {
+		return nil
+	}
+	for name, hadIngress := range state.interfaces {
+		if hadIngress {
+			continue
+		}
+		deleteOut, err := exec.Command("nsenter", "--net="+state.path, "--", "tc", "qdisc", "delete", "dev", name, "ingress").CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("delete Kata ingress qdisc on %q: %w: %s", name, err, deleteOut)
+		}
+	}
+	for _, line := range strings.Split(string(out), "\n") {
+		parts := strings.SplitN(line, ":", 3)
+		if len(parts) < 2 {
+			continue
+		}
+		name := strings.TrimSpace(strings.SplitN(parts[1], "@", 2)[0])
+		if !kataTapName.MatchString(name) {
+			continue
+		}
+		deleteOut, err := exec.Command("nsenter", "--net="+state.path, "--", "ip", "link", "delete", "dev", name).CombinedOutput()
+		if err != nil {
+			return fmt.Errorf("delete Kata interface %q: %w: %s", name, err, deleteOut)
+		}
+	}
+	return nil
+}
+
+func requireSandboxOptions(options *anypb.Any) error {
+	if options == nil || options.TypeUrl != podSandboxConfigTypeURL || len(options.Value) == 0 {
+		return fmt.Errorf("sandbox options must be non-empty %q", podSandboxConfigTypeURL)
+	}
+	return nil
+}
+
+func checkpointContainers(inventory map[string]string) ([]*sandboxapi.CheckpointContainer, error) {
+	keys := make([]string, 0, len(inventory))
+	for key, id := range inventory {
+		if key == "" || !validID(id) {
+			return nil, fmt.Errorf("invalid checkpoint task %q=%q", key, id)
+		}
+		keys = append(keys, key)
+	}
+	sort.Strings(keys)
+	out := make([]*sandboxapi.CheckpointContainer, 0, len(keys))
+	for _, key := range keys {
+		out = append(out, &sandboxapi.CheckpointContainer{Name: key, Id: inventory[key]})
+	}
+	return out, nil
+}
+
+func restoreContainers(in []RestoreTask) ([]*sandboxapi.RestoreContainer, error) {
+	seenKeys, seenIDs := map[string]bool{}, map[string]bool{}
+	out := make([]*sandboxapi.RestoreContainer, 0, len(in))
+	for _, task := range in {
+		if task.CheckpointKey == "" || !validID(task.TaskID) || !filepath.IsAbs(task.Bundle) {
+			return nil, fmt.Errorf("invalid restore task key=%q id=%q bundle=%q", task.CheckpointKey, task.TaskID, task.Bundle)
+		}
+		if seenKeys[task.CheckpointKey] || seenIDs[task.TaskID] {
+			return nil, fmt.Errorf("duplicate restore task key=%q id=%q", task.CheckpointKey, task.TaskID)
+		}
+		seenKeys[task.CheckpointKey], seenIDs[task.TaskID] = true, true
+		if _, err := os.Stat(filepath.Join(task.Bundle, "config.json")); err != nil {
+			return nil, fmt.Errorf("restore task %q bundle: %w", task.TaskID, err)
+		}
+		out = append(out, &sandboxapi.RestoreContainer{
+			CheckpointKey: task.CheckpointKey, Id: task.TaskID, Name: task.CheckpointKey, BundlePath: task.Bundle,
+			Terminal: task.Terminal, Stdin: task.Stdin, Stdout: task.Stdout, Stderr: task.Stderr,
+			Config: task.Options,
+		})
+	}
+	return out, nil
+}
+
+func ValidateRestoreResult(want []*sandboxapi.RestoreContainer, got *sandboxapi.RestoreResponse) error {
+	if got == nil {
+		return errors.New("restore result is nil")
+	}
+	wantSet := map[string]bool{}
+	for _, container := range want {
+		wantSet[container.GetName()] = true
+	}
+	gotSet := map[string]bool{}
+	for _, container := range got.GetContainers() {
+		name := container.GetName()
+		if name == "" || gotSet[name] {
+			return fmt.Errorf("invalid or duplicate restored container %q", name)
+		}
+		if container.GetTaskRestoreMode() != sandboxapi.TaskRestoreMode_TASK_RESTORE_MODE_VM_RESTORED {
+			return fmt.Errorf("restored container %q did not select VM-restored task adoption", name)
+		}
+		if container.GetTaskCheckpointImage() != "" {
+			return fmt.Errorf("restored container %q returned an unexpected task checkpoint image", name)
+		}
+		gotSet[name] = true
+	}
+	if len(wantSet) != len(gotSet) {
+		return fmt.Errorf("restore returned %d containers, require %d", len(gotSet), len(wantSet))
+	}
+	for name := range wantSet {
+		if !gotSet[name] {
+			return fmt.Errorf("restore result is missing container %q", name)
+		}
+	}
+	return nil
+}
+
+func prepareEmptyDir(path string) error {
+	if !filepath.IsAbs(path) {
+		return errors.New("path must be absolute")
+	}
+	entries, err := os.ReadDir(path)
+	if errors.Is(err, os.ErrNotExist) {
+		return os.MkdirAll(path, 0o700)
+	}
+	if err != nil {
+		return err
+	}
+	if len(entries) != 0 {
+		return errors.New("checkpoint output directory is not empty")
+	}
+	return nil
+}
+
+func cloneMap(in map[string]string) map[string]string {
+	out := make(map[string]string, len(in))
+	for k, v := range in {
+		out[k] = v
+	}
+	return out
+}
diff --git a/internal/sandboxd/controller_test.go b/internal/sandboxd/controller_test.go
new file mode 100644
index 0000000000..86ad2e7c01
--- /dev/null
+++ b/internal/sandboxd/controller_test.go
@@ -0,0 +1,173 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"os"
+	"path/filepath"
+	"testing"
+
+	sandboxapi "github.com/agent-substrate/substrate/internal/sandboxd/sandboxapi"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func TestParseBootstrap(t *testing.T) {
+	got, err := parseBootstrap([]byte(`{"version":3,"protocol":"ttrpc","address":"unix:///run/containerd/s/x"}`))
+	if err != nil || got.Address != "unix:///run/containerd/s/x" {
+		t.Fatalf("parseBootstrap() = %#v, %v", got, err)
+	}
+	for _, bad := range []string{
+		`{"version":2,"protocol":"ttrpc","address":"unix:///x"}`,
+		`{"version":3,"protocol":"grpc","address":"unix:///x"}`,
+		`not-json`,
+	} {
+		if _, err := parseBootstrap([]byte(bad)); err == nil {
+			t.Errorf("parseBootstrap(%q) succeeded", bad)
+		}
+	}
+}
+
+func TestValidateRestoreResult(t *testing.T) {
+	want := []*sandboxapi.RestoreContainer{{Name: "app", CheckpointKey: "app", Id: "new-app"}}
+	good := &sandboxapi.RestoreResponse{
+		Containers: []*sandboxapi.RestoredContainer{{
+			Name:            "app",
+			TaskRestoreMode: sandboxapi.TaskRestoreMode_TASK_RESTORE_MODE_VM_RESTORED,
+		}},
+	}
+	if err := ValidateRestoreResult(want, good); err != nil {
+		t.Fatal(err)
+	}
+	good.Containers[0].Name = "wrong"
+	if err := ValidateRestoreResult(want, good); err == nil {
+		t.Fatal("mismatched container name accepted")
+	}
+	good.Containers[0].Name = "app"
+	good.Containers[0].TaskRestoreMode = sandboxapi.TaskRestoreMode_TASK_RESTORE_MODE_UNSPECIFIED
+	if err := ValidateRestoreResult(want, good); err == nil {
+		t.Fatal("unspecified task restore mode accepted")
+	}
+}
+
+func TestValidateCheckpoint(t *testing.T) {
+	dir := t.TempDir()
+	state := []byte("vm-state")
+	rootfs := []byte("rootfs")
+	if err := os.Mkdir(filepath.Join(dir, "storage"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.Mkdir(filepath.Join(dir, "vm"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "vm", "state"), state, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "storage", "rootfs-base.raw"), rootfs, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	manifest := `{
+  "format_version": 10,
+  "hypervisor": "qemu",
+  "sandbox_id": "source",
+  "tasks": [{"checkpoint_key":"app","task_id":"source-app"}],
+  "rootfs": [{"checkpoint_key":"app","file":"storage/rootfs-base.raw","format":"raw","device_id":"rootfs0","index":0,"driver_option":"blk","virt_path":"/dev/vda","is_direct":null,"discard_unmap":false,"aio":"iouring","queue_size":128,"num_queues":1,"logical_sector_size":0,"physical_sector_size":0,"serial_override":"","size":6,"sha256":"` + sum(rootfs) + `"}],
+  "block_volumes": [],
+  "network_macs": [],
+  "memory_hotplug_size": 1073741824,
+  "vcpu_hotplug_count": 1,
+  "vm_state": [{"file":"vm/state","size":8,"sha256":"` + sum(state) + `"}],
+  "runtime_fingerprint": "fingerprint"
+}`
+	if err := os.WriteFile(filepath.Join(dir, "manifest.json"), []byte(manifest), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateCheckpoint(dir); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(dir, "vm", "state"), []byte("corrupt!"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := ValidateCheckpoint(dir); err == nil {
+		t.Fatal("corrupt state accepted")
+	}
+}
+
+func sum(b []byte) string {
+	h := sha256.Sum256(b)
+	return hex.EncodeToString(h[:])
+}
+
+type startSandboxService struct {
+	sandboxapi.TTRPCSandboxService
+	request  *sandboxapi.StartSandboxRequest
+	response *sandboxapi.StartSandboxResponse
+	err      error
+}
+
+func (f *startSandboxService) StartSandbox(_ context.Context, req *sandboxapi.StartSandboxRequest) (*sandboxapi.StartSandboxResponse, error) {
+	f.request = req
+	return f.response, f.err
+}
+
+func TestSandboxControllerStart(t *testing.T) {
+	newController := func(service sandboxapi.TTRPCSandboxService) *SandboxController {
+		shims := &ShimManager{instances: map[string]*Instance{
+			"sandbox-1": {ID: "sandbox-1", Sandbox: service},
+		}}
+		return NewSandboxController(shims, NewTaskManager(shims))
+	}
+
+	t.Run("passes sandbox id and accepts complete response", func(t *testing.T) {
+		service := &startSandboxService{response: &sandboxapi.StartSandboxResponse{
+			Pid: 42, CreatedAt: timestamppb.Now(),
+		}}
+		if err := newController(service).Start(context.Background(), "sandbox-1"); err != nil {
+			t.Fatal(err)
+		}
+		if service.request == nil || service.request.GetSandboxId() != "sandbox-1" {
+			t.Fatalf("StartSandbox request = %+v", service.request)
+		}
+	})
+
+	for _, tc := range []struct {
+		name     string
+		response *sandboxapi.StartSandboxResponse
+	}{
+		{name: "missing pid", response: &sandboxapi.StartSandboxResponse{CreatedAt: timestamppb.Now()}},
+		{name: "missing creation time", response: &sandboxapi.StartSandboxResponse{Pid: 42}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			service := &startSandboxService{response: tc.response}
+			if err := newController(service).Start(context.Background(), "sandbox-1"); err == nil {
+				t.Fatal("Start accepted an incomplete response")
+			}
+		})
+	}
+
+	t.Run("preserves shim error", func(t *testing.T) {
+		shimErr := errors.New("shim start failed")
+		service := &startSandboxService{err: shimErr}
+		err := newController(service).Start(context.Background(), "sandbox-1")
+		if !errors.Is(err, shimErr) {
+			t.Fatalf("Start error = %v, want wrapped shim error", err)
+		}
+	})
+}
diff --git a/internal/sandboxd/dan.go b/internal/sandboxd/dan.go
new file mode 100644
index 0000000000..222fced66a
--- /dev/null
+++ b/internal/sandboxd/dan.go
@@ -0,0 +1,182 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net"
+	"os"
+	"path/filepath"
+)
+
+const DefaultDANConfigDir = "/run/kata-containers/dans"
+
+type HostTapDANConfig struct {
+	NetNSPath   string
+	TapName     string
+	GuestMAC    string
+	IPAddresses []string
+	MTU         uint64
+	Routes      []DANRoute
+}
+
+type DANRoute struct {
+	Destination string `json:"dest"`
+	Gateway     string `json:"gateway,omitempty"`
+	Source      string `json:"source,omitempty"`
+	Scope       uint32 `json:"scope,omitempty"`
+	Flags       uint32 `json:"flags,omitempty"`
+	MTU         uint32 `json:"mtu,omitempty"`
+}
+
+type danConfig struct {
+	NetNS   string      `json:"netns"`
+	Devices []danDevice `json:"devices"`
+}
+
+type danDevice struct {
+	Name        string         `json:"name"`
+	GuestMAC    string         `json:"guest_mac"`
+	Device      danHostTap     `json:"device"`
+	NetworkInfo danNetworkInfo `json:"network_info"`
+}
+
+type danHostTap struct {
+	Type      string `json:"type"`
+	TapName   string `json:"tap_name"`
+	QueueNum  uint32 `json:"queue_num,omitempty"`
+	QueueSize uint32 `json:"queue_size,omitempty"`
+}
+
+type danNetworkInfo struct {
+	Interface danInterface `json:"interface"`
+	Routes    []DANRoute   `json:"routes"`
+	Neighbors []any        `json:"neighbors"`
+}
+
+type danInterface struct {
+	IPAddresses []string `json:"ip_addresses"`
+	MTU         uint64   `json:"mtu"`
+	Type        string   `json:"ntype"`
+	Flags       uint32   `json:"flags"`
+}
+
+// WriteHostTapDANConfig atomically publishes the single-NIC host-tap schema
+// consumed by runtime-rs from <dan_conf>/<sandbox-id>.json.
+func WriteHostTapDANConfig(dir, sandboxID string, cfg HostTapDANConfig) (string, error) {
+	if !filepath.IsAbs(dir) || !validID(sandboxID) {
+		return "", errors.New("absolute DAN directory and valid sandbox id are required")
+	}
+	if err := validateHostTapDANConfig(cfg); err != nil {
+		return "", err
+	}
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return "", fmt.Errorf("create DAN directory: %w", err)
+	}
+	info, err := os.Lstat(dir)
+	if err != nil || !info.IsDir() {
+		return "", errors.New("DAN directory must be a directory, not a symlink")
+	}
+
+	document := danConfig{
+		NetNS: cfg.NetNSPath,
+		Devices: []danDevice{{
+			Name:     "eth0",
+			GuestMAC: cfg.GuestMAC,
+			Device:   danHostTap{Type: "host-tap", TapName: cfg.TapName},
+			NetworkInfo: danNetworkInfo{
+				Interface: danInterface{IPAddresses: append([]string(nil), cfg.IPAddresses...), MTU: cfg.MTU, Type: "tuntap"},
+				Routes:    append([]DANRoute(nil), cfg.Routes...), Neighbors: []any{},
+			},
+		}},
+	}
+	data, err := json.Marshal(document)
+	if err != nil {
+		return "", err
+	}
+	data = append(data, '\n')
+
+	tmp, err := os.CreateTemp(dir, "."+sandboxID+"-*.tmp")
+	if err != nil {
+		return "", fmt.Errorf("create temporary DAN config: %w", err)
+	}
+	tmpPath := tmp.Name()
+	defer os.Remove(tmpPath)
+	if err := tmp.Chmod(0o600); err != nil {
+		_ = tmp.Close()
+		return "", err
+	}
+	if _, err := tmp.Write(data); err != nil {
+		_ = tmp.Close()
+		return "", err
+	}
+	if err := tmp.Sync(); err != nil {
+		_ = tmp.Close()
+		return "", err
+	}
+	if err := tmp.Close(); err != nil {
+		return "", err
+	}
+	target := filepath.Join(dir, sandboxID+".json")
+	if err := os.Rename(tmpPath, target); err != nil {
+		return "", fmt.Errorf("publish DAN config: %w", err)
+	}
+	return target, nil
+}
+
+func RemoveDANConfig(dir, sandboxID string) error {
+	if !filepath.IsAbs(dir) || !validID(sandboxID) {
+		return errors.New("absolute DAN directory and valid sandbox id are required")
+	}
+	err := os.Remove(filepath.Join(dir, sandboxID+".json"))
+	if errors.Is(err, os.ErrNotExist) {
+		return nil
+	}
+	return err
+}
+
+func validateHostTapDANConfig(cfg HostTapDANConfig) error {
+	if !filepath.IsAbs(cfg.NetNSPath) || !kataTapName.MatchString(cfg.TapName) {
+		return errors.New("absolute netns path and Kata-owned tap name are required")
+	}
+	if _, err := net.ParseMAC(cfg.GuestMAC); err != nil {
+		return fmt.Errorf("invalid guest MAC: %w", err)
+	}
+	if len(cfg.IPAddresses) == 0 || cfg.MTU == 0 {
+		return errors.New("guest IP addresses and MTU are required")
+	}
+	for _, address := range cfg.IPAddresses {
+		if _, _, err := net.ParseCIDR(address); err != nil {
+			return fmt.Errorf("invalid guest address %q: %w", address, err)
+		}
+	}
+	for _, route := range cfg.Routes {
+		if route.Destination != "" {
+			if _, _, err := net.ParseCIDR(route.Destination); err != nil {
+				return fmt.Errorf("invalid route destination %q: %w", route.Destination, err)
+			}
+		}
+		for name, value := range map[string]string{"gateway": route.Gateway, "source": route.Source} {
+			if value != "" && net.ParseIP(value) == nil {
+				return fmt.Errorf("invalid route %s %q", name, value)
+			}
+		}
+	}
+	return nil
+}
diff --git a/internal/sandboxd/dan_test.go b/internal/sandboxd/dan_test.go
new file mode 100644
index 0000000000..80d5c96069
--- /dev/null
+++ b/internal/sandboxd/dan_test.go
@@ -0,0 +1,102 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestWriteHostTapDANConfig(t *testing.T) {
+	dir := t.TempDir()
+	path, err := WriteHostTapDANConfig(dir, "sandbox-1", HostTapDANConfig{
+		NetNSPath:   "/run/netns/ateom:test",
+		TapName:     "tap0_kata",
+		GuestMAC:    "02:a8:1e:00:00:02",
+		IPAddresses: []string{"169.254.17.2/30"},
+		MTU:         1500,
+		Routes:      []DANRoute{{Gateway: "169.254.17.1"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if path != filepath.Join(dir, "sandbox-1.json") {
+		t.Fatalf("path = %q", path)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if info.Mode().Perm() != 0o600 {
+		t.Fatalf("mode = %o, want 600", info.Mode().Perm())
+	}
+	data, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var got map[string]any
+	if err := json.Unmarshal(data, &got); err != nil {
+		t.Fatal(err)
+	}
+	devices, ok := got["devices"].([]any)
+	if !ok || len(devices) != 1 {
+		t.Fatalf("devices = %#v", got["devices"])
+	}
+	device := devices[0].(map[string]any)["device"].(map[string]any)
+	if device["type"] != "host-tap" || device["tap_name"] != "tap0_kata" {
+		t.Fatalf("device = %#v", device)
+	}
+	if err := RemoveDANConfig(dir, "sandbox-1"); err != nil {
+		t.Fatal(err)
+	}
+	if err := RemoveDANConfig(dir, "sandbox-1"); err != nil {
+		t.Fatal("remove must be idempotent:", err)
+	}
+}
+
+func TestWriteHostTapDANConfigRejectsInvalidOwnership(t *testing.T) {
+	base := HostTapDANConfig{
+		NetNSPath:   "/run/netns/ateom:test",
+		TapName:     "tap0_kata",
+		GuestMAC:    "02:a8:1e:00:00:02",
+		IPAddresses: []string{"169.254.17.2/30"},
+		MTU:         1500,
+	}
+	tests := []struct {
+		name   string
+		dir    string
+		id     string
+		mutate func(*HostTapDANConfig)
+	}{
+		{name: "relative directory", dir: "relative", id: "sandbox", mutate: func(*HostTapDANConfig) {}},
+		{name: "escaping id", dir: t.TempDir(), id: "../sandbox", mutate: func(*HostTapDANConfig) {}},
+		{name: "foreign tap", dir: t.TempDir(), id: "sandbox", mutate: func(c *HostTapDANConfig) { c.TapName = "eth0" }},
+		{name: "invalid mac", dir: t.TempDir(), id: "sandbox", mutate: func(c *HostTapDANConfig) { c.GuestMAC = "bad" }},
+		{name: "invalid cidr", dir: t.TempDir(), id: "sandbox", mutate: func(c *HostTapDANConfig) { c.IPAddresses = []string{"bad"} }},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			cfg := base
+			tc.mutate(&cfg)
+			if _, err := WriteHostTapDANConfig(tc.dir, tc.id, cfg); err == nil {
+				t.Fatal("invalid DAN config accepted")
+			}
+		})
+	}
+}
diff --git a/internal/sandboxd/manager.go b/internal/sandboxd/manager.go
new file mode 100644
index 0000000000..053998ba63
--- /dev/null
+++ b/internal/sandboxd/manager.go
@@ -0,0 +1,404 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+// Package sandboxd implements the small subset of containerd's shim manager,
+// sandbox controller and task manager required by ateom-kata.
+package sandboxd
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"log/slog"
+	"net"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"sync"
+	"syscall"
+	"time"
+
+	sandboxapi "github.com/agent-substrate/substrate/internal/sandboxd/sandboxapi"
+	taskapi "github.com/containerd/containerd/api/runtime/task/v3"
+	tasktypes "github.com/containerd/containerd/api/types/task"
+	"github.com/containerd/ttrpc"
+)
+
+const supportedShimVersion = 3
+
+type bootstrapResult struct {
+	Version  int    `json:"version"`
+	Address  string `json:"address"`
+	Protocol string `json:"protocol"`
+}
+
+// Instance is a running Kata shim and its services.
+type Instance struct {
+	ID       string
+	Bundle   string
+	PID      int
+	Endpoint string
+
+	client     *ttrpc.Client
+	Sandbox    sandboxapi.TTRPCSandboxService
+	Checkpoint sandboxapi.TTRPCCheckpointService
+	Task       taskapi.TTRPCTaskService
+}
+
+// ShimManager starts and tracks Kata shim v2 processes.
+type ShimManager struct {
+	binary    string
+	namespace string
+	address   string
+	root      string
+	kataConf  string
+
+	mu        sync.RWMutex
+	instances map[string]*Instance
+}
+
+type ShimManagerConfig struct {
+	Binary, Namespace, Address, Root, KataConfig string
+}
+
+func NewShimManager(cfg ShimManagerConfig) (*ShimManager, error) {
+	if !filepath.IsAbs(cfg.Binary) || !filepath.IsAbs(cfg.Root) {
+		return nil, errors.New("shim binary and root must be absolute paths")
+	}
+	if cfg.Namespace == "" {
+		cfg.Namespace = "sandboxd"
+	}
+	if cfg.Address == "" {
+		cfg.Address = "unix:///run/sandboxd/sandboxd.sock"
+	}
+	if err := os.MkdirAll(cfg.Root, 0o700); err != nil {
+		return nil, fmt.Errorf("create shim root: %w", err)
+	}
+	return &ShimManager{binary: cfg.Binary, namespace: cfg.Namespace, address: cfg.Address, root: cfg.Root, kataConf: cfg.KataConfig, instances: map[string]*Instance{}}, nil
+}
+
+func validID(id string) bool {
+	if id == "" || id == "." || id == ".." || len(id) > 128 {
+		return false
+	}
+	for _, r := range id {
+		if !(r == '-' || r == '_' || r == '.' || r >= '0' && r <= '9' || r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z') {
+			return false
+		}
+	}
+	return true
+}
+
+func (m *ShimManager) bundle(id string) (string, error) {
+	if !validID(id) {
+		return "", fmt.Errorf("invalid sandbox id %q", id)
+	}
+	return filepath.Join(m.root, id), nil
+}
+
+// Start creates the shim bundle and executes the containerd shim start
+// bootstrap protocol. Kata runtime-rs currently emits a JSON v3 result.
+func (m *ShimManager) Start(ctx context.Context, id string) (_ *Instance, retErr error) {
+	bundle, err := m.bundle(id)
+	if err != nil {
+		return nil, err
+	}
+	m.mu.RLock()
+	_, exists := m.instances[id]
+	m.mu.RUnlock()
+	if exists {
+		return nil, fmt.Errorf("shim %q already exists", id)
+	}
+	if err := os.MkdirAll(bundle, 0o700); err != nil {
+		return nil, fmt.Errorf("create shim bundle: %w", err)
+	}
+	if err := ensureSandboxSpec(bundle); err != nil {
+		return nil, err
+	}
+	// A previous sandboxd crash may leave Kata's deterministic shim socket
+	// behind. The shim delete bootstrap removes that endpoint before start.
+	cleanup := exec.Command(m.binary,
+		"-id", id, "-namespace", m.namespace, "-address", m.address,
+		"-bundle", bundle, "-publish-binary", "/bin/true", "delete")
+	cleanup.Dir = bundle
+	cleanup.Env = os.Environ()
+	if m.kataConf != "" {
+		cleanup.Env = append(cleanup.Env, "KATA_CONF_FILE="+m.kataConf)
+	}
+	_, _ = cleanup.CombinedOutput()
+	defer func() {
+		if retErr != nil {
+			_ = os.RemoveAll(bundle)
+		}
+	}()
+	logFile, err := os.OpenFile(filepath.Join(bundle, "log"), os.O_CREATE|os.O_APPEND|os.O_WRONLY, 0o600)
+	if err != nil {
+		return nil, fmt.Errorf("create shim log: %w", err)
+	}
+	_ = logFile.Close()
+
+	cmd := exec.CommandContext(ctx, m.binary,
+		"-id", id, "-namespace", m.namespace, "-address", m.address,
+		"-bundle", bundle, "-publish-binary", "/bin/true", "start")
+	cmd.Dir = bundle
+	cmd.Env = os.Environ()
+	if m.kataConf != "" {
+		cmd.Env = append(cmd.Env, "KATA_CONF_FILE="+m.kataConf)
+	}
+	out, err := cmd.CombinedOutput()
+	if err != nil {
+		return nil, fmt.Errorf("start Kata shim: %w: %s", err, strings.TrimSpace(string(out)))
+	}
+	boot, err := parseBootstrap(out)
+	if err != nil {
+		return nil, err
+	}
+	pidBytes, err := os.ReadFile(filepath.Join(bundle, "shim.pid"))
+	if err != nil {
+		return nil, fmt.Errorf("read shim.pid: %w", err)
+	}
+	pid, err := strconv.Atoi(strings.TrimSpace(string(pidBytes)))
+	if err != nil || pid <= 0 {
+		return nil, fmt.Errorf("invalid shim.pid %q", strings.TrimSpace(string(pidBytes)))
+	}
+	conn, err := net.DialTimeout("unix", strings.TrimPrefix(boot.Address, "unix://"), 10*time.Second)
+	if err != nil {
+		_ = syscall.Kill(pid, syscall.SIGKILL)
+		return nil, fmt.Errorf("dial shim %q: %w", boot.Address, err)
+	}
+	client := ttrpc.NewClient(conn)
+	inst := &Instance{ID: id, Bundle: bundle, PID: pid, Endpoint: boot.Address, client: client}
+	inst.Sandbox = sandboxapi.NewTTRPCSandboxClient(client)
+	inst.Checkpoint = sandboxapi.NewTTRPCCheckpointClient(client)
+	inst.Task = taskapi.NewTTRPCTaskClient(client)
+	if err := writeJSONAtomic(filepath.Join(bundle, "bootstrap.json"), boot); err != nil {
+		_ = client.Close()
+		return nil, err
+	}
+	m.mu.Lock()
+	m.instances[id] = inst
+	m.mu.Unlock()
+	go m.monitor(inst)
+	return inst, nil
+}
+
+func ensureSandboxSpec(bundle string) error {
+	path := filepath.Join(bundle, "config.json")
+	if _, err := os.Stat(path); err == nil {
+		return nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	// The sandbox service needs an OCI-shaped spec for bookkeeping, but no
+	// host process is executed from this bundle. Workload specs live in the
+	// task bundles prepared by atelet.
+	const spec = `{"ociVersion":"1.2.0","process":{"terminal":false,"user":{"uid":0,"gid":0},"args":["/pause"],"cwd":"/"},"root":{"path":"rootfs"},"linux":{"namespaces":[]}}`
+	if err := os.Mkdir(filepath.Join(bundle, "rootfs"), 0o700); err != nil && !errors.Is(err, os.ErrExist) {
+		return err
+	}
+	return os.WriteFile(path, []byte(spec), 0o600)
+}
+
+func parseBootstrap(out []byte) (*bootstrapResult, error) {
+	var boot bootstrapResult
+	if err := json.Unmarshal(out, &boot); err != nil {
+		return nil, fmt.Errorf("decode shim bootstrap: %w", err)
+	}
+	if boot.Version != supportedShimVersion {
+		return nil, fmt.Errorf("shim bootstrap version %d, require %d", boot.Version, supportedShimVersion)
+	}
+	if boot.Protocol != "ttrpc" || !strings.HasPrefix(boot.Address, "unix://") {
+		return nil, fmt.Errorf("unsupported shim endpoint %q+%q", boot.Protocol, boot.Address)
+	}
+	return &boot, nil
+}
+
+func writeJSONAtomic(path string, v any) error {
+	b, err := json.MarshalIndent(v, "", "  ")
+	if err != nil {
+		return err
+	}
+	tmp := path + ".tmp"
+	if err := os.WriteFile(tmp, b, 0o600); err != nil {
+		return err
+	}
+	return os.Rename(tmp, path)
+}
+
+func (m *ShimManager) Get(id string) (*Instance, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	inst := m.instances[id]
+	if inst == nil {
+		return nil, fmt.Errorf("shim %q not found", id)
+	}
+	return inst, nil
+}
+
+func (m *ShimManager) monitor(inst *Instance) {
+	t := time.NewTicker(time.Second)
+	defer t.Stop()
+	for range t.C {
+		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+		_, err := inst.Sandbox.PingSandbox(ctx, &sandboxapi.PingRequest{SandboxId: inst.ID})
+		cancel()
+		if err == nil {
+			continue
+		}
+		if syscall.Kill(inst.PID, 0) == nil {
+			continue // process alive, TTRPC may recover
+		}
+		_ = inst.client.Close()
+		m.mu.Lock()
+		if m.instances[inst.ID] == inst {
+			delete(m.instances, inst.ID)
+		}
+		m.mu.Unlock()
+		return
+	}
+}
+
+func (m *ShimManager) Remove(id string) {
+	m.mu.Lock()
+	inst := m.instances[id]
+	delete(m.instances, id)
+	m.mu.Unlock()
+	if inst != nil {
+		_ = inst.client.Close()
+	}
+}
+
+// Stop closes the client and ensures the exact shim process started for this
+// sandbox is gone. ShutdownSandbox normally asks the shim server to exit; the
+// signal fallback prevents a failed/partial CreateSandbox from leaking a shim.
+func (m *ShimManager) Stop(id string) error {
+	m.mu.Lock()
+	inst := m.instances[id]
+	delete(m.instances, id)
+	m.mu.Unlock()
+	if inst == nil {
+		return nil
+	}
+	slog.Info("Stopping Kata shim", "sandbox_id", id, "pid", inst.PID)
+	_ = inst.client.Close()
+	if socket := strings.TrimPrefix(inst.Endpoint, "unix://"); socket != inst.Endpoint {
+		_ = os.Remove(socket)
+	}
+	if processExited(inst.PID) {
+		slog.Info("Kata shim already exited", "sandbox_id", id, "pid", inst.PID)
+		return nil
+	}
+	if err := syscall.Kill(inst.PID, syscall.SIGTERM); err != nil && !errors.Is(err, syscall.ESRCH) {
+		return err
+	}
+	slog.Info("Sent SIGTERM to Kata shim", "sandbox_id", id, "pid", inst.PID)
+	deadline := time.Now().Add(5 * time.Second)
+	for time.Now().Before(deadline) {
+		if processExited(inst.PID) {
+			slog.Info("Kata shim exited after SIGTERM", "sandbox_id", id, "pid", inst.PID)
+			return nil
+		}
+		time.Sleep(50 * time.Millisecond)
+	}
+	if err := syscall.Kill(inst.PID, syscall.SIGKILL); err != nil && !errors.Is(err, syscall.ESRCH) {
+		return err
+	}
+	slog.Warn("Kata shim required SIGKILL", "sandbox_id", id, "pid", inst.PID)
+	return nil
+}
+
+// processExited recognizes and reaps an exited shim when ateom-kata is PID 1.
+// A zombie still answers kill(pid, 0), which would otherwise force every clean
+// shim shutdown down the SIGKILL fallback. If the shim is not our child,
+// Wait4 returns ECHILD and the original liveness probe remains authoritative.
+func processExited(pid int) bool {
+	var status syscall.WaitStatus
+	if waited, err := syscall.Wait4(pid, &status, syscall.WNOHANG, nil); err == nil && waited == pid {
+		return true
+	}
+	return syscall.Kill(pid, 0) != nil
+}
+
+// TaskManager is the Task v3 facade used for both cold create and restored
+// task adoption.
+type TaskManager struct{ shims *ShimManager }
+
+func NewTaskManager(shims *ShimManager) *TaskManager { return &TaskManager{shims: shims} }
+
+func (m *TaskManager) Create(ctx context.Context, sid string, req *taskapi.CreateTaskRequest) (*taskapi.CreateTaskResponse, error) {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Task.Create(ctx, req)
+}
+
+func (m *TaskManager) Start(ctx context.Context, sid, tid string) (*taskapi.StartResponse, error) {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Task.Start(ctx, &taskapi.StartRequest{ID: tid})
+}
+
+func (m *TaskManager) State(ctx context.Context, sid, tid string) (*taskapi.StateResponse, error) {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Task.State(ctx, &taskapi.StateRequest{ID: tid})
+}
+
+func (m *TaskManager) RequireCreated(ctx context.Context, sid string, tids []string) error {
+	for _, tid := range tids {
+		st, err := m.State(ctx, sid, tid)
+		if err != nil {
+			return fmt.Errorf("state restored task %q: %w", tid, err)
+		}
+		if st.GetStatus() != tasktypes.Status_CREATED {
+			return fmt.Errorf("restored task %q is %s, require CREATED", tid, st.GetStatus())
+		}
+	}
+	return nil
+}
+
+func (m *TaskManager) Wait(ctx context.Context, sid, tid string) (*taskapi.WaitResponse, error) {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Task.Wait(ctx, &taskapi.WaitRequest{ID: tid})
+}
+
+func (m *TaskManager) Kill(ctx context.Context, sid, tid string, signal uint32, all bool) error {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return err
+	}
+	_, err = inst.Task.Kill(ctx, &taskapi.KillRequest{ID: tid, Signal: signal, All: all})
+	return err
+}
+
+func (m *TaskManager) Delete(ctx context.Context, sid, tid string) (*taskapi.DeleteResponse, error) {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Task.Delete(ctx, &taskapi.DeleteRequest{ID: tid})
+}
diff --git a/internal/sandboxd/sandboxapi/SOURCE.md b/internal/sandboxd/sandboxapi/SOURCE.md
new file mode 100644
index 0000000000..a94c576199
--- /dev/null
+++ b/internal/sandboxd/sandboxapi/SOURCE.md
@@ -0,0 +1,16 @@
+# Protocol source
+
+The checked-in `sandbox.proto` is the authoritative source for this experimental
+protocol. It is based on containerd's Sandbox v1 API and adds the separate
+Checkpoint service required by the matching experimental Kata shim.
+
+The optional, separate Checkpoint service uses `CheckpointRequest` and
+`RestoreRequest`, including `TaskRestoreMode` negotiation. The public
+`github.com/containerd/containerd/api v1.12.0-beta.0` module does not contain
+this exact contract yet. Do not describe this directory as an upstream
+containerd API. Replace it with the released module when the contract is
+published.
+
+The Go package path is deliberately local to Substrate so this experimental
+contract cannot be mistaken for a released containerd API. Run
+`hack/update/codegen.sh` to regenerate both protobuf and ttrpc bindings.
diff --git a/internal/sandboxd/sandboxapi/sandbox.pb.go b/internal/sandboxd/sandboxapi/sandbox.pb.go
new file mode 100644
index 0000000000..f59d728969
--- /dev/null
+++ b/internal/sandboxd/sandboxapi/sandbox.pb.go
@@ -0,0 +1,1866 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11-devel
+// 	protoc        v4.25.3
+// source: sandbox.proto
+
+package sandbox
+
+import (
+	types "github.com/containerd/containerd/api/types"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type TaskRestoreMode int32
+
+const (
+	TaskRestoreMode_TASK_RESTORE_MODE_UNSPECIFIED TaskRestoreMode = 0
+	TaskRestoreMode_TASK_RESTORE_MODE_VM_RESTORED TaskRestoreMode = 1
+)
+
+// Enum value maps for TaskRestoreMode.
+var (
+	TaskRestoreMode_name = map[int32]string{
+		0: "TASK_RESTORE_MODE_UNSPECIFIED",
+		1: "TASK_RESTORE_MODE_VM_RESTORED",
+	}
+	TaskRestoreMode_value = map[string]int32{
+		"TASK_RESTORE_MODE_UNSPECIFIED": 0,
+		"TASK_RESTORE_MODE_VM_RESTORED": 1,
+	}
+)
+
+func (x TaskRestoreMode) Enum() *TaskRestoreMode {
+	p := new(TaskRestoreMode)
+	*p = x
+	return p
+}
+
+func (x TaskRestoreMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (TaskRestoreMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_sandbox_proto_enumTypes[0].Descriptor()
+}
+
+func (TaskRestoreMode) Type() protoreflect.EnumType {
+	return &file_sandbox_proto_enumTypes[0]
+}
+
+func (x TaskRestoreMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use TaskRestoreMode.Descriptor instead.
+func (TaskRestoreMode) EnumDescriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{0}
+}
+
+type CreateSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	BundlePath    string                 `protobuf:"bytes,2,opt,name=bundle_path,json=bundlePath,proto3" json:"bundle_path,omitempty"`
+	Rootfs        []*types.Mount         `protobuf:"bytes,3,rep,name=rootfs,proto3" json:"rootfs,omitempty"`
+	Options       *anypb.Any             `protobuf:"bytes,4,opt,name=options,proto3" json:"options,omitempty"`
+	NetnsPath     string                 `protobuf:"bytes,5,opt,name=netns_path,json=netnsPath,proto3" json:"netns_path,omitempty"`
+	Annotations   map[string]string      `protobuf:"bytes,6,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateSandboxRequest) Reset() {
+	*x = CreateSandboxRequest{}
+	mi := &file_sandbox_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSandboxRequest) ProtoMessage() {}
+
+func (x *CreateSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSandboxRequest.ProtoReflect.Descriptor instead.
+func (*CreateSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *CreateSandboxRequest) GetBundlePath() string {
+	if x != nil {
+		return x.BundlePath
+	}
+	return ""
+}
+
+func (x *CreateSandboxRequest) GetRootfs() []*types.Mount {
+	if x != nil {
+		return x.Rootfs
+	}
+	return nil
+}
+
+func (x *CreateSandboxRequest) GetOptions() *anypb.Any {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+func (x *CreateSandboxRequest) GetNetnsPath() string {
+	if x != nil {
+		return x.NetnsPath
+	}
+	return ""
+}
+
+func (x *CreateSandboxRequest) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+type CreateSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateSandboxResponse) Reset() {
+	*x = CreateSandboxResponse{}
+	mi := &file_sandbox_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateSandboxResponse) ProtoMessage() {}
+
+func (x *CreateSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateSandboxResponse.ProtoReflect.Descriptor instead.
+func (*CreateSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{1}
+}
+
+type StartSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StartSandboxRequest) Reset() {
+	*x = StartSandboxRequest{}
+	mi := &file_sandbox_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StartSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartSandboxRequest) ProtoMessage() {}
+
+func (x *StartSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartSandboxRequest.ProtoReflect.Descriptor instead.
+func (*StartSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *StartSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type StartSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Pid           uint32                 `protobuf:"varint,1,opt,name=pid,proto3" json:"pid,omitempty"`
+	CreatedAt     *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	Spec          *anypb.Any             `protobuf:"bytes,3,opt,name=spec,proto3" json:"spec,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StartSandboxResponse) Reset() {
+	*x = StartSandboxResponse{}
+	mi := &file_sandbox_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StartSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartSandboxResponse) ProtoMessage() {}
+
+func (x *StartSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartSandboxResponse.ProtoReflect.Descriptor instead.
+func (*StartSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *StartSandboxResponse) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+func (x *StartSandboxResponse) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *StartSandboxResponse) GetSpec() *anypb.Any {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+type PlatformRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PlatformRequest) Reset() {
+	*x = PlatformRequest{}
+	mi := &file_sandbox_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PlatformRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PlatformRequest) ProtoMessage() {}
+
+func (x *PlatformRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PlatformRequest.ProtoReflect.Descriptor instead.
+func (*PlatformRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *PlatformRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type PlatformResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Platform      *types.Platform        `protobuf:"bytes,1,opt,name=platform,proto3" json:"platform,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PlatformResponse) Reset() {
+	*x = PlatformResponse{}
+	mi := &file_sandbox_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PlatformResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PlatformResponse) ProtoMessage() {}
+
+func (x *PlatformResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PlatformResponse.ProtoReflect.Descriptor instead.
+func (*PlatformResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *PlatformResponse) GetPlatform() *types.Platform {
+	if x != nil {
+		return x.Platform
+	}
+	return nil
+}
+
+type StopSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	TimeoutSecs   uint32                 `protobuf:"varint,2,opt,name=timeout_secs,json=timeoutSecs,proto3" json:"timeout_secs,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StopSandboxRequest) Reset() {
+	*x = StopSandboxRequest{}
+	mi := &file_sandbox_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StopSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopSandboxRequest) ProtoMessage() {}
+
+func (x *StopSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopSandboxRequest.ProtoReflect.Descriptor instead.
+func (*StopSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *StopSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *StopSandboxRequest) GetTimeoutSecs() uint32 {
+	if x != nil {
+		return x.TimeoutSecs
+	}
+	return 0
+}
+
+type StopSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StopSandboxResponse) Reset() {
+	*x = StopSandboxResponse{}
+	mi := &file_sandbox_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StopSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopSandboxResponse) ProtoMessage() {}
+
+func (x *StopSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopSandboxResponse.ProtoReflect.Descriptor instead.
+func (*StopSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{7}
+}
+
+type UpdateSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	Resources     *anypb.Any             `protobuf:"bytes,2,opt,name=resources,proto3" json:"resources,omitempty"`
+	Annotations   map[string]string      `protobuf:"bytes,3,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateSandboxRequest) Reset() {
+	*x = UpdateSandboxRequest{}
+	mi := &file_sandbox_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateSandboxRequest) ProtoMessage() {}
+
+func (x *UpdateSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateSandboxRequest.ProtoReflect.Descriptor instead.
+func (*UpdateSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *UpdateSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *UpdateSandboxRequest) GetResources() *anypb.Any {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *UpdateSandboxRequest) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+type WaitSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WaitSandboxRequest) Reset() {
+	*x = WaitSandboxRequest{}
+	mi := &file_sandbox_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitSandboxRequest) ProtoMessage() {}
+
+func (x *WaitSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitSandboxRequest.ProtoReflect.Descriptor instead.
+func (*WaitSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *WaitSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type WaitSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ExitStatus    uint32                 `protobuf:"varint,1,opt,name=exit_status,json=exitStatus,proto3" json:"exit_status,omitempty"`
+	ExitedAt      *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=exited_at,json=exitedAt,proto3" json:"exited_at,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WaitSandboxResponse) Reset() {
+	*x = WaitSandboxResponse{}
+	mi := &file_sandbox_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WaitSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitSandboxResponse) ProtoMessage() {}
+
+func (x *WaitSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitSandboxResponse.ProtoReflect.Descriptor instead.
+func (*WaitSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *WaitSandboxResponse) GetExitStatus() uint32 {
+	if x != nil {
+		return x.ExitStatus
+	}
+	return 0
+}
+
+func (x *WaitSandboxResponse) GetExitedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExitedAt
+	}
+	return nil
+}
+
+type UpdateSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateSandboxResponse) Reset() {
+	*x = UpdateSandboxResponse{}
+	mi := &file_sandbox_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateSandboxResponse) ProtoMessage() {}
+
+func (x *UpdateSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateSandboxResponse.ProtoReflect.Descriptor instead.
+func (*UpdateSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{11}
+}
+
+type SandboxStatusRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	Verbose       bool                   `protobuf:"varint,2,opt,name=verbose,proto3" json:"verbose,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SandboxStatusRequest) Reset() {
+	*x = SandboxStatusRequest{}
+	mi := &file_sandbox_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SandboxStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SandboxStatusRequest) ProtoMessage() {}
+
+func (x *SandboxStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SandboxStatusRequest.ProtoReflect.Descriptor instead.
+func (*SandboxStatusRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *SandboxStatusRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *SandboxStatusRequest) GetVerbose() bool {
+	if x != nil {
+		return x.Verbose
+	}
+	return false
+}
+
+type SandboxStatusResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	Pid           uint32                 `protobuf:"varint,2,opt,name=pid,proto3" json:"pid,omitempty"`
+	State         string                 `protobuf:"bytes,3,opt,name=state,proto3" json:"state,omitempty"`
+	Info          map[string]string      `protobuf:"bytes,4,rep,name=info,proto3" json:"info,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	CreatedAt     *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	ExitedAt      *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=exited_at,json=exitedAt,proto3" json:"exited_at,omitempty"`
+	Extra         *anypb.Any             `protobuf:"bytes,7,opt,name=extra,proto3" json:"extra,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SandboxStatusResponse) Reset() {
+	*x = SandboxStatusResponse{}
+	mi := &file_sandbox_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SandboxStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SandboxStatusResponse) ProtoMessage() {}
+
+func (x *SandboxStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SandboxStatusResponse.ProtoReflect.Descriptor instead.
+func (*SandboxStatusResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *SandboxStatusResponse) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *SandboxStatusResponse) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+func (x *SandboxStatusResponse) GetState() string {
+	if x != nil {
+		return x.State
+	}
+	return ""
+}
+
+func (x *SandboxStatusResponse) GetInfo() map[string]string {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+func (x *SandboxStatusResponse) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *SandboxStatusResponse) GetExitedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExitedAt
+	}
+	return nil
+}
+
+func (x *SandboxStatusResponse) GetExtra() *anypb.Any {
+	if x != nil {
+		return x.Extra
+	}
+	return nil
+}
+
+type PingRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PingRequest) Reset() {
+	*x = PingRequest{}
+	mi := &file_sandbox_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PingRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PingRequest) ProtoMessage() {}
+
+func (x *PingRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PingRequest.ProtoReflect.Descriptor instead.
+func (*PingRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *PingRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type PingResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PingResponse) Reset() {
+	*x = PingResponse{}
+	mi := &file_sandbox_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PingResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PingResponse) ProtoMessage() {}
+
+func (x *PingResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PingResponse.ProtoReflect.Descriptor instead.
+func (*PingResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{15}
+}
+
+type ShutdownSandboxRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ShutdownSandboxRequest) Reset() {
+	*x = ShutdownSandboxRequest{}
+	mi := &file_sandbox_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ShutdownSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ShutdownSandboxRequest) ProtoMessage() {}
+
+func (x *ShutdownSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ShutdownSandboxRequest.ProtoReflect.Descriptor instead.
+func (*ShutdownSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *ShutdownSandboxRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type ShutdownSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ShutdownSandboxResponse) Reset() {
+	*x = ShutdownSandboxResponse{}
+	mi := &file_sandbox_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ShutdownSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ShutdownSandboxResponse) ProtoMessage() {}
+
+func (x *ShutdownSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ShutdownSandboxResponse.ProtoReflect.Descriptor instead.
+func (*ShutdownSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{17}
+}
+
+type SandboxMetricsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SandboxMetricsRequest) Reset() {
+	*x = SandboxMetricsRequest{}
+	mi := &file_sandbox_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SandboxMetricsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SandboxMetricsRequest) ProtoMessage() {}
+
+func (x *SandboxMetricsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SandboxMetricsRequest.ProtoReflect.Descriptor instead.
+func (*SandboxMetricsRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *SandboxMetricsRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+type SandboxMetricsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Metrics       *types.Metric          `protobuf:"bytes,1,opt,name=metrics,proto3" json:"metrics,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SandboxMetricsResponse) Reset() {
+	*x = SandboxMetricsResponse{}
+	mi := &file_sandbox_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SandboxMetricsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SandboxMetricsResponse) ProtoMessage() {}
+
+func (x *SandboxMetricsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SandboxMetricsResponse.ProtoReflect.Descriptor instead.
+func (*SandboxMetricsResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *SandboxMetricsResponse) GetMetrics() *types.Metric {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
+type CheckpointContainer struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Id            string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name          string                 `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Config        *anypb.Any             `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"`
+	Status        *anypb.Any             `protobuf:"bytes,4,opt,name=status,proto3" json:"status,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointContainer) Reset() {
+	*x = CheckpointContainer{}
+	mi := &file_sandbox_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointContainer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointContainer) ProtoMessage() {}
+
+func (x *CheckpointContainer) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointContainer.ProtoReflect.Descriptor instead.
+func (*CheckpointContainer) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *CheckpointContainer) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *CheckpointContainer) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *CheckpointContainer) GetConfig() *anypb.Any {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *CheckpointContainer) GetStatus() *anypb.Any {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+type CheckpointRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId     string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	OutputPath    string                 `protobuf:"bytes,2,opt,name=output_path,json=outputPath,proto3" json:"output_path,omitempty"`
+	SandboxConfig *anypb.Any             `protobuf:"bytes,3,opt,name=sandbox_config,json=sandboxConfig,proto3" json:"sandbox_config,omitempty"`
+	Containers    []*CheckpointContainer `protobuf:"bytes,4,rep,name=containers,proto3" json:"containers,omitempty"`
+	Options       map[string]string      `protobuf:"bytes,5,rep,name=options,proto3" json:"options,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointRequest) Reset() {
+	*x = CheckpointRequest{}
+	mi := &file_sandbox_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointRequest) ProtoMessage() {}
+
+func (x *CheckpointRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[21]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointRequest.ProtoReflect.Descriptor instead.
+func (*CheckpointRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *CheckpointRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *CheckpointRequest) GetOutputPath() string {
+	if x != nil {
+		return x.OutputPath
+	}
+	return ""
+}
+
+func (x *CheckpointRequest) GetSandboxConfig() *anypb.Any {
+	if x != nil {
+		return x.SandboxConfig
+	}
+	return nil
+}
+
+func (x *CheckpointRequest) GetContainers() []*CheckpointContainer {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+func (x *CheckpointRequest) GetOptions() map[string]string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+type CheckpointResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointResponse) Reset() {
+	*x = CheckpointResponse{}
+	mi := &file_sandbox_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointResponse) ProtoMessage() {}
+
+func (x *CheckpointResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[22]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointResponse.ProtoReflect.Descriptor instead.
+func (*CheckpointResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{22}
+}
+
+type RestoreContainer struct {
+	state  protoimpl.MessageState `protogen:"open.v1"`
+	Id     string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Name   string                 `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
+	Config *anypb.Any             `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"`
+	// checkpoint_key identifies this container in the checkpoint manifest.
+	// The shim uses it to match restore tasks to checkpoint artifacts.
+	CheckpointKey string `protobuf:"bytes,4,opt,name=checkpoint_key,json=checkpointKey,proto3" json:"checkpoint_key,omitempty"`
+	// Absolute path to the container bundle on the host.
+	BundlePath string `protobuf:"bytes,5,opt,name=bundle_path,json=bundlePath,proto3" json:"bundle_path,omitempty"`
+	// Whether the container has a terminal (TTY).
+	Terminal bool `protobuf:"varint,6,opt,name=terminal,proto3" json:"terminal,omitempty"`
+	// Stdio paths for the container.
+	Stdin         string `protobuf:"bytes,7,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	Stdout        string `protobuf:"bytes,8,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr        string `protobuf:"bytes,9,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RestoreContainer) Reset() {
+	*x = RestoreContainer{}
+	mi := &file_sandbox_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestoreContainer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestoreContainer) ProtoMessage() {}
+
+func (x *RestoreContainer) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestoreContainer.ProtoReflect.Descriptor instead.
+func (*RestoreContainer) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *RestoreContainer) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *RestoreContainer) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RestoreContainer) GetConfig() *anypb.Any {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *RestoreContainer) GetCheckpointKey() string {
+	if x != nil {
+		return x.CheckpointKey
+	}
+	return ""
+}
+
+func (x *RestoreContainer) GetBundlePath() string {
+	if x != nil {
+		return x.BundlePath
+	}
+	return ""
+}
+
+func (x *RestoreContainer) GetTerminal() bool {
+	if x != nil {
+		return x.Terminal
+	}
+	return false
+}
+
+func (x *RestoreContainer) GetStdin() string {
+	if x != nil {
+		return x.Stdin
+	}
+	return ""
+}
+
+func (x *RestoreContainer) GetStdout() string {
+	if x != nil {
+		return x.Stdout
+	}
+	return ""
+}
+
+func (x *RestoreContainer) GetStderr() string {
+	if x != nil {
+		return x.Stderr
+	}
+	return ""
+}
+
+type RestoreRequest struct {
+	state          protoimpl.MessageState `protogen:"open.v1"`
+	SandboxId      string                 `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	CheckpointPath string                 `protobuf:"bytes,2,opt,name=checkpoint_path,json=checkpointPath,proto3" json:"checkpoint_path,omitempty"`
+	SandboxConfig  *anypb.Any             `protobuf:"bytes,3,opt,name=sandbox_config,json=sandboxConfig,proto3" json:"sandbox_config,omitempty"`
+	Containers     []*RestoreContainer    `protobuf:"bytes,4,rep,name=containers,proto3" json:"containers,omitempty"`
+	Options        map[string]string      `protobuf:"bytes,5,rep,name=options,proto3" json:"options,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Path to the network namespace for the restored sandbox.
+	NetnsPath                string            `protobuf:"bytes,6,opt,name=netns_path,json=netnsPath,proto3" json:"netns_path,omitempty"`
+	AcceptedTaskRestoreModes []TaskRestoreMode `protobuf:"varint,7,rep,packed,name=accepted_task_restore_modes,json=acceptedTaskRestoreModes,proto3,enum=containerd.runtime.sandbox.v1.TaskRestoreMode" json:"accepted_task_restore_modes,omitempty"`
+	unknownFields            protoimpl.UnknownFields
+	sizeCache                protoimpl.SizeCache
+}
+
+func (x *RestoreRequest) Reset() {
+	*x = RestoreRequest{}
+	mi := &file_sandbox_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestoreRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestoreRequest) ProtoMessage() {}
+
+func (x *RestoreRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[24]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestoreRequest.ProtoReflect.Descriptor instead.
+func (*RestoreRequest) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *RestoreRequest) GetSandboxId() string {
+	if x != nil {
+		return x.SandboxId
+	}
+	return ""
+}
+
+func (x *RestoreRequest) GetCheckpointPath() string {
+	if x != nil {
+		return x.CheckpointPath
+	}
+	return ""
+}
+
+func (x *RestoreRequest) GetSandboxConfig() *anypb.Any {
+	if x != nil {
+		return x.SandboxConfig
+	}
+	return nil
+}
+
+func (x *RestoreRequest) GetContainers() []*RestoreContainer {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+func (x *RestoreRequest) GetOptions() map[string]string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+func (x *RestoreRequest) GetNetnsPath() string {
+	if x != nil {
+		return x.NetnsPath
+	}
+	return ""
+}
+
+func (x *RestoreRequest) GetAcceptedTaskRestoreModes() []TaskRestoreMode {
+	if x != nil {
+		return x.AcceptedTaskRestoreModes
+	}
+	return nil
+}
+
+type RestoredContainer struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	Name  string                 `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Ownership transfers from the controller to the caller when Restore
+	// succeeds. Empty when no containerd task checkpoint is required.
+	TaskCheckpointImage string          `protobuf:"bytes,2,opt,name=task_checkpoint_image,json=taskCheckpointImage,proto3" json:"task_checkpoint_image,omitempty"`
+	TaskRestoreMode     TaskRestoreMode `protobuf:"varint,3,opt,name=task_restore_mode,json=taskRestoreMode,proto3,enum=containerd.runtime.sandbox.v1.TaskRestoreMode" json:"task_restore_mode,omitempty"`
+	unknownFields       protoimpl.UnknownFields
+	sizeCache           protoimpl.SizeCache
+}
+
+func (x *RestoredContainer) Reset() {
+	*x = RestoredContainer{}
+	mi := &file_sandbox_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestoredContainer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestoredContainer) ProtoMessage() {}
+
+func (x *RestoredContainer) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestoredContainer.ProtoReflect.Descriptor instead.
+func (*RestoredContainer) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *RestoredContainer) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RestoredContainer) GetTaskCheckpointImage() string {
+	if x != nil {
+		return x.TaskCheckpointImage
+	}
+	return ""
+}
+
+func (x *RestoredContainer) GetTaskRestoreMode() TaskRestoreMode {
+	if x != nil {
+		return x.TaskRestoreMode
+	}
+	return TaskRestoreMode_TASK_RESTORE_MODE_UNSPECIFIED
+}
+
+type RestoreResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Containers    []*RestoredContainer   `protobuf:"bytes,1,rep,name=containers,proto3" json:"containers,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RestoreResponse) Reset() {
+	*x = RestoreResponse{}
+	mi := &file_sandbox_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestoreResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestoreResponse) ProtoMessage() {}
+
+func (x *RestoreResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_sandbox_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestoreResponse.ProtoReflect.Descriptor instead.
+func (*RestoreResponse) Descriptor() ([]byte, []int) {
+	return file_sandbox_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *RestoreResponse) GetContainers() []*RestoredContainer {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+var File_sandbox_proto protoreflect.FileDescriptor
+
+const file_sandbox_proto_rawDesc = "" +
+	"\n" +
+	"\rsandbox.proto\x12\x1dcontainerd.runtime.sandbox.v1\x1a\x19google/protobuf/any.proto\x1a\x1fgoogle/protobuf/timestamp.proto\x1a\x13types/metrics.proto\x1a\x11types/mount.proto\x1a\x14types/platform.proto\"\xfe\x02\n" +
+	"\x14CreateSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
+	"\vbundle_path\x18\x02 \x01(\tR\n" +
+	"bundlePath\x12/\n" +
+	"\x06rootfs\x18\x03 \x03(\v2\x17.containerd.types.MountR\x06rootfs\x12.\n" +
+	"\aoptions\x18\x04 \x01(\v2\x14.google.protobuf.AnyR\aoptions\x12\x1d\n" +
+	"\n" +
+	"netns_path\x18\x05 \x01(\tR\tnetnsPath\x12f\n" +
+	"\vannotations\x18\x06 \x03(\v2D.containerd.runtime.sandbox.v1.CreateSandboxRequest.AnnotationsEntryR\vannotations\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x17\n" +
+	"\x15CreateSandboxResponse\"4\n" +
+	"\x13StartSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x8d\x01\n" +
+	"\x14StartSandboxResponse\x12\x10\n" +
+	"\x03pid\x18\x01 \x01(\rR\x03pid\x129\n" +
+	"\n" +
+	"created_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x12(\n" +
+	"\x04spec\x18\x03 \x01(\v2\x14.google.protobuf.AnyR\x04spec\"0\n" +
+	"\x0fPlatformRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"J\n" +
+	"\x10PlatformResponse\x126\n" +
+	"\bplatform\x18\x01 \x01(\v2\x1a.containerd.types.PlatformR\bplatform\"V\n" +
+	"\x12StopSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12!\n" +
+	"\ftimeout_secs\x18\x02 \x01(\rR\vtimeoutSecs\"\x15\n" +
+	"\x13StopSandboxResponse\"\x91\x02\n" +
+	"\x14UpdateSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x122\n" +
+	"\tresources\x18\x02 \x01(\v2\x14.google.protobuf.AnyR\tresources\x12f\n" +
+	"\vannotations\x18\x03 \x03(\v2D.containerd.runtime.sandbox.v1.UpdateSandboxRequest.AnnotationsEntryR\vannotations\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"3\n" +
+	"\x12WaitSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"o\n" +
+	"\x13WaitSandboxResponse\x12\x1f\n" +
+	"\vexit_status\x18\x01 \x01(\rR\n" +
+	"exitStatus\x127\n" +
+	"\texited_at\x18\x02 \x01(\v2\x1a.google.protobuf.TimestampR\bexitedAt\"\x17\n" +
+	"\x15UpdateSandboxResponse\"O\n" +
+	"\x14SandboxStatusRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x18\n" +
+	"\averbose\x18\x02 \x01(\bR\averbose\"\x8b\x03\n" +
+	"\x15SandboxStatusResponse\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x10\n" +
+	"\x03pid\x18\x02 \x01(\rR\x03pid\x12\x14\n" +
+	"\x05state\x18\x03 \x01(\tR\x05state\x12R\n" +
+	"\x04info\x18\x04 \x03(\v2>.containerd.runtime.sandbox.v1.SandboxStatusResponse.InfoEntryR\x04info\x129\n" +
+	"\n" +
+	"created_at\x18\x05 \x01(\v2\x1a.google.protobuf.TimestampR\tcreatedAt\x127\n" +
+	"\texited_at\x18\x06 \x01(\v2\x1a.google.protobuf.TimestampR\bexitedAt\x12*\n" +
+	"\x05extra\x18\a \x01(\v2\x14.google.protobuf.AnyR\x05extra\x1a7\n" +
+	"\tInfoEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\",\n" +
+	"\vPingRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x0e\n" +
+	"\fPingResponse\"7\n" +
+	"\x16ShutdownSandboxRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"\x19\n" +
+	"\x17ShutdownSandboxResponse\"6\n" +
+	"\x15SandboxMetricsRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\"L\n" +
+	"\x16SandboxMetricsResponse\x122\n" +
+	"\ametrics\x18\x01 \x01(\v2\x18.containerd.types.MetricR\ametrics\"\x95\x01\n" +
+	"\x13CheckpointContainer\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name\x12,\n" +
+	"\x06config\x18\x03 \x01(\v2\x14.google.protobuf.AnyR\x06config\x12,\n" +
+	"\x06status\x18\x04 \x01(\v2\x14.google.protobuf.AnyR\x06status\"\xf9\x02\n" +
+	"\x11CheckpointRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12\x1f\n" +
+	"\voutput_path\x18\x02 \x01(\tR\n" +
+	"outputPath\x12;\n" +
+	"\x0esandbox_config\x18\x03 \x01(\v2\x14.google.protobuf.AnyR\rsandboxConfig\x12R\n" +
+	"\n" +
+	"containers\x18\x04 \x03(\v22.containerd.runtime.sandbox.v1.CheckpointContainerR\n" +
+	"containers\x12W\n" +
+	"\aoptions\x18\x05 \x03(\v2=.containerd.runtime.sandbox.v1.CheckpointRequest.OptionsEntryR\aoptions\x1a:\n" +
+	"\fOptionsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x14\n" +
+	"\x12CheckpointResponse\"\x8e\x02\n" +
+	"\x10RestoreContainer\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12\x12\n" +
+	"\x04name\x18\x02 \x01(\tR\x04name\x12,\n" +
+	"\x06config\x18\x03 \x01(\v2\x14.google.protobuf.AnyR\x06config\x12%\n" +
+	"\x0echeckpoint_key\x18\x04 \x01(\tR\rcheckpointKey\x12\x1f\n" +
+	"\vbundle_path\x18\x05 \x01(\tR\n" +
+	"bundlePath\x12\x1a\n" +
+	"\bterminal\x18\x06 \x01(\bR\bterminal\x12\x14\n" +
+	"\x05stdin\x18\a \x01(\tR\x05stdin\x12\x16\n" +
+	"\x06stdout\x18\b \x01(\tR\x06stdout\x12\x16\n" +
+	"\x06stderr\x18\t \x01(\tR\x06stderr\"\x86\x04\n" +
+	"\x0eRestoreRequest\x12\x1d\n" +
+	"\n" +
+	"sandbox_id\x18\x01 \x01(\tR\tsandboxId\x12'\n" +
+	"\x0fcheckpoint_path\x18\x02 \x01(\tR\x0echeckpointPath\x12;\n" +
+	"\x0esandbox_config\x18\x03 \x01(\v2\x14.google.protobuf.AnyR\rsandboxConfig\x12O\n" +
+	"\n" +
+	"containers\x18\x04 \x03(\v2/.containerd.runtime.sandbox.v1.RestoreContainerR\n" +
+	"containers\x12T\n" +
+	"\aoptions\x18\x05 \x03(\v2:.containerd.runtime.sandbox.v1.RestoreRequest.OptionsEntryR\aoptions\x12\x1d\n" +
+	"\n" +
+	"netns_path\x18\x06 \x01(\tR\tnetnsPath\x12m\n" +
+	"\x1baccepted_task_restore_modes\x18\a \x03(\x0e2..containerd.runtime.sandbox.v1.TaskRestoreModeR\x18acceptedTaskRestoreModes\x1a:\n" +
+	"\fOptionsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xb7\x01\n" +
+	"\x11RestoredContainer\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x122\n" +
+	"\x15task_checkpoint_image\x18\x02 \x01(\tR\x13taskCheckpointImage\x12Z\n" +
+	"\x11task_restore_mode\x18\x03 \x01(\x0e2..containerd.runtime.sandbox.v1.TaskRestoreModeR\x0ftaskRestoreMode\"c\n" +
+	"\x0fRestoreResponse\x12P\n" +
+	"\n" +
+	"containers\x18\x01 \x03(\v20.containerd.runtime.sandbox.v1.RestoredContainerR\n" +
+	"containers*W\n" +
+	"\x0fTaskRestoreMode\x12!\n" +
+	"\x1dTASK_RESTORE_MODE_UNSPECIFIED\x10\x00\x12!\n" +
+	"\x1dTASK_RESTORE_MODE_VM_RESTORED\x10\x012\xbd\b\n" +
+	"\aSandbox\x12z\n" +
+	"\rCreateSandbox\x123.containerd.runtime.sandbox.v1.CreateSandboxRequest\x1a4.containerd.runtime.sandbox.v1.CreateSandboxResponse\x12w\n" +
+	"\fStartSandbox\x122.containerd.runtime.sandbox.v1.StartSandboxRequest\x1a3.containerd.runtime.sandbox.v1.StartSandboxResponse\x12k\n" +
+	"\bPlatform\x12..containerd.runtime.sandbox.v1.PlatformRequest\x1a/.containerd.runtime.sandbox.v1.PlatformResponse\x12t\n" +
+	"\vStopSandbox\x121.containerd.runtime.sandbox.v1.StopSandboxRequest\x1a2.containerd.runtime.sandbox.v1.StopSandboxResponse\x12t\n" +
+	"\vWaitSandbox\x121.containerd.runtime.sandbox.v1.WaitSandboxRequest\x1a2.containerd.runtime.sandbox.v1.WaitSandboxResponse\x12z\n" +
+	"\rSandboxStatus\x123.containerd.runtime.sandbox.v1.SandboxStatusRequest\x1a4.containerd.runtime.sandbox.v1.SandboxStatusResponse\x12f\n" +
+	"\vPingSandbox\x12*.containerd.runtime.sandbox.v1.PingRequest\x1a+.containerd.runtime.sandbox.v1.PingResponse\x12\x80\x01\n" +
+	"\x0fShutdownSandbox\x125.containerd.runtime.sandbox.v1.ShutdownSandboxRequest\x1a6.containerd.runtime.sandbox.v1.ShutdownSandboxResponse\x12}\n" +
+	"\x0eSandboxMetrics\x124.containerd.runtime.sandbox.v1.SandboxMetricsRequest\x1a5.containerd.runtime.sandbox.v1.SandboxMetricsResponse2\xe9\x01\n" +
+	"\n" +
+	"Checkpoint\x12q\n" +
+	"\n" +
+	"Checkpoint\x120.containerd.runtime.sandbox.v1.CheckpointRequest\x1a1.containerd.runtime.sandbox.v1.CheckpointResponse\x12h\n" +
+	"\aRestore\x12-.containerd.runtime.sandbox.v1.RestoreRequest\x1a..containerd.runtime.sandbox.v1.RestoreResponseBKZIgithub.com/agent-substrate/substrate/internal/sandboxd/sandboxapi;sandboxb\x06proto3"
+
+var (
+	file_sandbox_proto_rawDescOnce sync.Once
+	file_sandbox_proto_rawDescData []byte
+)
+
+func file_sandbox_proto_rawDescGZIP() []byte {
+	file_sandbox_proto_rawDescOnce.Do(func() {
+		file_sandbox_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc)))
+	})
+	return file_sandbox_proto_rawDescData
+}
+
+var file_sandbox_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 32)
+var file_sandbox_proto_goTypes = []any{
+	(TaskRestoreMode)(0),            // 0: containerd.runtime.sandbox.v1.TaskRestoreMode
+	(*CreateSandboxRequest)(nil),    // 1: containerd.runtime.sandbox.v1.CreateSandboxRequest
+	(*CreateSandboxResponse)(nil),   // 2: containerd.runtime.sandbox.v1.CreateSandboxResponse
+	(*StartSandboxRequest)(nil),     // 3: containerd.runtime.sandbox.v1.StartSandboxRequest
+	(*StartSandboxResponse)(nil),    // 4: containerd.runtime.sandbox.v1.StartSandboxResponse
+	(*PlatformRequest)(nil),         // 5: containerd.runtime.sandbox.v1.PlatformRequest
+	(*PlatformResponse)(nil),        // 6: containerd.runtime.sandbox.v1.PlatformResponse
+	(*StopSandboxRequest)(nil),      // 7: containerd.runtime.sandbox.v1.StopSandboxRequest
+	(*StopSandboxResponse)(nil),     // 8: containerd.runtime.sandbox.v1.StopSandboxResponse
+	(*UpdateSandboxRequest)(nil),    // 9: containerd.runtime.sandbox.v1.UpdateSandboxRequest
+	(*WaitSandboxRequest)(nil),      // 10: containerd.runtime.sandbox.v1.WaitSandboxRequest
+	(*WaitSandboxResponse)(nil),     // 11: containerd.runtime.sandbox.v1.WaitSandboxResponse
+	(*UpdateSandboxResponse)(nil),   // 12: containerd.runtime.sandbox.v1.UpdateSandboxResponse
+	(*SandboxStatusRequest)(nil),    // 13: containerd.runtime.sandbox.v1.SandboxStatusRequest
+	(*SandboxStatusResponse)(nil),   // 14: containerd.runtime.sandbox.v1.SandboxStatusResponse
+	(*PingRequest)(nil),             // 15: containerd.runtime.sandbox.v1.PingRequest
+	(*PingResponse)(nil),            // 16: containerd.runtime.sandbox.v1.PingResponse
+	(*ShutdownSandboxRequest)(nil),  // 17: containerd.runtime.sandbox.v1.ShutdownSandboxRequest
+	(*ShutdownSandboxResponse)(nil), // 18: containerd.runtime.sandbox.v1.ShutdownSandboxResponse
+	(*SandboxMetricsRequest)(nil),   // 19: containerd.runtime.sandbox.v1.SandboxMetricsRequest
+	(*SandboxMetricsResponse)(nil),  // 20: containerd.runtime.sandbox.v1.SandboxMetricsResponse
+	(*CheckpointContainer)(nil),     // 21: containerd.runtime.sandbox.v1.CheckpointContainer
+	(*CheckpointRequest)(nil),       // 22: containerd.runtime.sandbox.v1.CheckpointRequest
+	(*CheckpointResponse)(nil),      // 23: containerd.runtime.sandbox.v1.CheckpointResponse
+	(*RestoreContainer)(nil),        // 24: containerd.runtime.sandbox.v1.RestoreContainer
+	(*RestoreRequest)(nil),          // 25: containerd.runtime.sandbox.v1.RestoreRequest
+	(*RestoredContainer)(nil),       // 26: containerd.runtime.sandbox.v1.RestoredContainer
+	(*RestoreResponse)(nil),         // 27: containerd.runtime.sandbox.v1.RestoreResponse
+	nil,                             // 28: containerd.runtime.sandbox.v1.CreateSandboxRequest.AnnotationsEntry
+	nil,                             // 29: containerd.runtime.sandbox.v1.UpdateSandboxRequest.AnnotationsEntry
+	nil,                             // 30: containerd.runtime.sandbox.v1.SandboxStatusResponse.InfoEntry
+	nil,                             // 31: containerd.runtime.sandbox.v1.CheckpointRequest.OptionsEntry
+	nil,                             // 32: containerd.runtime.sandbox.v1.RestoreRequest.OptionsEntry
+	(*types.Mount)(nil),             // 33: containerd.types.Mount
+	(*anypb.Any)(nil),               // 34: google.protobuf.Any
+	(*timestamppb.Timestamp)(nil),   // 35: google.protobuf.Timestamp
+	(*types.Platform)(nil),          // 36: containerd.types.Platform
+	(*types.Metric)(nil),            // 37: containerd.types.Metric
+}
+var file_sandbox_proto_depIdxs = []int32{
+	33, // 0: containerd.runtime.sandbox.v1.CreateSandboxRequest.rootfs:type_name -> containerd.types.Mount
+	34, // 1: containerd.runtime.sandbox.v1.CreateSandboxRequest.options:type_name -> google.protobuf.Any
+	28, // 2: containerd.runtime.sandbox.v1.CreateSandboxRequest.annotations:type_name -> containerd.runtime.sandbox.v1.CreateSandboxRequest.AnnotationsEntry
+	35, // 3: containerd.runtime.sandbox.v1.StartSandboxResponse.created_at:type_name -> google.protobuf.Timestamp
+	34, // 4: containerd.runtime.sandbox.v1.StartSandboxResponse.spec:type_name -> google.protobuf.Any
+	36, // 5: containerd.runtime.sandbox.v1.PlatformResponse.platform:type_name -> containerd.types.Platform
+	34, // 6: containerd.runtime.sandbox.v1.UpdateSandboxRequest.resources:type_name -> google.protobuf.Any
+	29, // 7: containerd.runtime.sandbox.v1.UpdateSandboxRequest.annotations:type_name -> containerd.runtime.sandbox.v1.UpdateSandboxRequest.AnnotationsEntry
+	35, // 8: containerd.runtime.sandbox.v1.WaitSandboxResponse.exited_at:type_name -> google.protobuf.Timestamp
+	30, // 9: containerd.runtime.sandbox.v1.SandboxStatusResponse.info:type_name -> containerd.runtime.sandbox.v1.SandboxStatusResponse.InfoEntry
+	35, // 10: containerd.runtime.sandbox.v1.SandboxStatusResponse.created_at:type_name -> google.protobuf.Timestamp
+	35, // 11: containerd.runtime.sandbox.v1.SandboxStatusResponse.exited_at:type_name -> google.protobuf.Timestamp
+	34, // 12: containerd.runtime.sandbox.v1.SandboxStatusResponse.extra:type_name -> google.protobuf.Any
+	37, // 13: containerd.runtime.sandbox.v1.SandboxMetricsResponse.metrics:type_name -> containerd.types.Metric
+	34, // 14: containerd.runtime.sandbox.v1.CheckpointContainer.config:type_name -> google.protobuf.Any
+	34, // 15: containerd.runtime.sandbox.v1.CheckpointContainer.status:type_name -> google.protobuf.Any
+	34, // 16: containerd.runtime.sandbox.v1.CheckpointRequest.sandbox_config:type_name -> google.protobuf.Any
+	21, // 17: containerd.runtime.sandbox.v1.CheckpointRequest.containers:type_name -> containerd.runtime.sandbox.v1.CheckpointContainer
+	31, // 18: containerd.runtime.sandbox.v1.CheckpointRequest.options:type_name -> containerd.runtime.sandbox.v1.CheckpointRequest.OptionsEntry
+	34, // 19: containerd.runtime.sandbox.v1.RestoreContainer.config:type_name -> google.protobuf.Any
+	34, // 20: containerd.runtime.sandbox.v1.RestoreRequest.sandbox_config:type_name -> google.protobuf.Any
+	24, // 21: containerd.runtime.sandbox.v1.RestoreRequest.containers:type_name -> containerd.runtime.sandbox.v1.RestoreContainer
+	32, // 22: containerd.runtime.sandbox.v1.RestoreRequest.options:type_name -> containerd.runtime.sandbox.v1.RestoreRequest.OptionsEntry
+	0,  // 23: containerd.runtime.sandbox.v1.RestoreRequest.accepted_task_restore_modes:type_name -> containerd.runtime.sandbox.v1.TaskRestoreMode
+	0,  // 24: containerd.runtime.sandbox.v1.RestoredContainer.task_restore_mode:type_name -> containerd.runtime.sandbox.v1.TaskRestoreMode
+	26, // 25: containerd.runtime.sandbox.v1.RestoreResponse.containers:type_name -> containerd.runtime.sandbox.v1.RestoredContainer
+	1,  // 26: containerd.runtime.sandbox.v1.Sandbox.CreateSandbox:input_type -> containerd.runtime.sandbox.v1.CreateSandboxRequest
+	3,  // 27: containerd.runtime.sandbox.v1.Sandbox.StartSandbox:input_type -> containerd.runtime.sandbox.v1.StartSandboxRequest
+	5,  // 28: containerd.runtime.sandbox.v1.Sandbox.Platform:input_type -> containerd.runtime.sandbox.v1.PlatformRequest
+	7,  // 29: containerd.runtime.sandbox.v1.Sandbox.StopSandbox:input_type -> containerd.runtime.sandbox.v1.StopSandboxRequest
+	10, // 30: containerd.runtime.sandbox.v1.Sandbox.WaitSandbox:input_type -> containerd.runtime.sandbox.v1.WaitSandboxRequest
+	13, // 31: containerd.runtime.sandbox.v1.Sandbox.SandboxStatus:input_type -> containerd.runtime.sandbox.v1.SandboxStatusRequest
+	15, // 32: containerd.runtime.sandbox.v1.Sandbox.PingSandbox:input_type -> containerd.runtime.sandbox.v1.PingRequest
+	17, // 33: containerd.runtime.sandbox.v1.Sandbox.ShutdownSandbox:input_type -> containerd.runtime.sandbox.v1.ShutdownSandboxRequest
+	19, // 34: containerd.runtime.sandbox.v1.Sandbox.SandboxMetrics:input_type -> containerd.runtime.sandbox.v1.SandboxMetricsRequest
+	22, // 35: containerd.runtime.sandbox.v1.Checkpoint.Checkpoint:input_type -> containerd.runtime.sandbox.v1.CheckpointRequest
+	25, // 36: containerd.runtime.sandbox.v1.Checkpoint.Restore:input_type -> containerd.runtime.sandbox.v1.RestoreRequest
+	2,  // 37: containerd.runtime.sandbox.v1.Sandbox.CreateSandbox:output_type -> containerd.runtime.sandbox.v1.CreateSandboxResponse
+	4,  // 38: containerd.runtime.sandbox.v1.Sandbox.StartSandbox:output_type -> containerd.runtime.sandbox.v1.StartSandboxResponse
+	6,  // 39: containerd.runtime.sandbox.v1.Sandbox.Platform:output_type -> containerd.runtime.sandbox.v1.PlatformResponse
+	8,  // 40: containerd.runtime.sandbox.v1.Sandbox.StopSandbox:output_type -> containerd.runtime.sandbox.v1.StopSandboxResponse
+	11, // 41: containerd.runtime.sandbox.v1.Sandbox.WaitSandbox:output_type -> containerd.runtime.sandbox.v1.WaitSandboxResponse
+	14, // 42: containerd.runtime.sandbox.v1.Sandbox.SandboxStatus:output_type -> containerd.runtime.sandbox.v1.SandboxStatusResponse
+	16, // 43: containerd.runtime.sandbox.v1.Sandbox.PingSandbox:output_type -> containerd.runtime.sandbox.v1.PingResponse
+	18, // 44: containerd.runtime.sandbox.v1.Sandbox.ShutdownSandbox:output_type -> containerd.runtime.sandbox.v1.ShutdownSandboxResponse
+	20, // 45: containerd.runtime.sandbox.v1.Sandbox.SandboxMetrics:output_type -> containerd.runtime.sandbox.v1.SandboxMetricsResponse
+	23, // 46: containerd.runtime.sandbox.v1.Checkpoint.Checkpoint:output_type -> containerd.runtime.sandbox.v1.CheckpointResponse
+	27, // 47: containerd.runtime.sandbox.v1.Checkpoint.Restore:output_type -> containerd.runtime.sandbox.v1.RestoreResponse
+	37, // [37:48] is the sub-list for method output_type
+	26, // [26:37] is the sub-list for method input_type
+	26, // [26:26] is the sub-list for extension type_name
+	26, // [26:26] is the sub-list for extension extendee
+	0,  // [0:26] is the sub-list for field type_name
+}
+
+func init() { file_sandbox_proto_init() }
+func file_sandbox_proto_init() {
+	if File_sandbox_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_sandbox_proto_rawDesc), len(file_sandbox_proto_rawDesc)),
+			NumEnums:      1,
+			NumMessages:   32,
+			NumExtensions: 0,
+			NumServices:   2,
+		},
+		GoTypes:           file_sandbox_proto_goTypes,
+		DependencyIndexes: file_sandbox_proto_depIdxs,
+		EnumInfos:         file_sandbox_proto_enumTypes,
+		MessageInfos:      file_sandbox_proto_msgTypes,
+	}.Build()
+	File_sandbox_proto = out.File
+	file_sandbox_proto_goTypes = nil
+	file_sandbox_proto_depIdxs = nil
+}
diff --git a/internal/sandboxd/sandboxapi/sandbox.proto b/internal/sandboxd/sandboxapi/sandbox.proto
new file mode 100644
index 0000000000..329695baeb
--- /dev/null
+++ b/internal/sandboxd/sandboxapi/sandbox.proto
@@ -0,0 +1,233 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.runtime.sandbox.v1;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+import "types/metrics.proto";
+import "types/mount.proto";
+import "types/platform.proto";
+
+option go_package = "github.com/agent-substrate/substrate/internal/sandboxd/sandboxapi;sandbox";
+
+// Sandbox is an optional interface that shim may implement to support sandboxes environments.
+// A typical example of sandbox is microVM or pause container - an entity that groups containers and/or
+// holds resources relevant for this group.
+service Sandbox {
+  // CreateSandbox will be called right after sandbox shim instance launched.
+  // It is a good place to initialize sandbox environment.
+  rpc CreateSandbox(CreateSandboxRequest) returns (CreateSandboxResponse);
+
+  // StartSandbox will start a previously created sandbox.
+  rpc StartSandbox(StartSandboxRequest) returns (StartSandboxResponse);
+
+  // Platform queries the platform the sandbox is going to run containers on.
+  // containerd will use this to generate a proper OCI spec.
+  rpc Platform(PlatformRequest) returns (PlatformResponse);
+
+  // StopSandbox will stop existing sandbox instance
+  rpc StopSandbox(StopSandboxRequest) returns (StopSandboxResponse);
+
+  // WaitSandbox blocks until sandbox exits.
+  rpc WaitSandbox(WaitSandboxRequest) returns (WaitSandboxResponse);
+
+  // SandboxStatus will return current status of the running sandbox instance
+  rpc SandboxStatus(SandboxStatusRequest) returns (SandboxStatusResponse);
+
+  // PingSandbox is a lightweight API call to check whether sandbox alive.
+  rpc PingSandbox(PingRequest) returns (PingResponse);
+
+  // ShutdownSandbox must shutdown shim instance.
+  rpc ShutdownSandbox(ShutdownSandboxRequest) returns (ShutdownSandboxResponse);
+
+  // SandboxMetrics retrieves metrics about a sandbox instance.
+  rpc SandboxMetrics(SandboxMetricsRequest) returns (SandboxMetricsResponse);
+}
+
+// Checkpoint is an optional sandbox-shim capability. It is a separate service
+// so existing Sandbox implementations do not need to implement checkpoint and
+// restore methods.
+service Checkpoint {
+  rpc Checkpoint(CheckpointRequest) returns (CheckpointResponse);
+  rpc Restore(RestoreRequest) returns (RestoreResponse);
+}
+
+message CreateSandboxRequest {
+  string sandbox_id = 1;
+  string bundle_path = 2;
+  repeated containerd.types.Mount rootfs = 3;
+  google.protobuf.Any options = 4;
+  string netns_path = 5;
+  map<string, string> annotations = 6;
+}
+
+message CreateSandboxResponse {}
+
+message StartSandboxRequest {
+  string sandbox_id = 1;
+}
+
+message StartSandboxResponse {
+  uint32 pid = 1;
+  google.protobuf.Timestamp created_at = 2;
+  google.protobuf.Any spec = 3;
+}
+
+message PlatformRequest {
+  string sandbox_id = 1;
+}
+
+message PlatformResponse {
+  containerd.types.Platform platform = 1;
+}
+
+message StopSandboxRequest {
+  string sandbox_id = 1;
+  uint32 timeout_secs = 2;
+}
+
+message StopSandboxResponse {}
+
+message UpdateSandboxRequest {
+  string sandbox_id = 1;
+  google.protobuf.Any resources = 2;
+  map<string, string> annotations = 3;
+}
+
+message WaitSandboxRequest {
+  string sandbox_id = 1;
+}
+
+message WaitSandboxResponse {
+  uint32 exit_status = 1;
+  google.protobuf.Timestamp exited_at = 2;
+}
+
+message UpdateSandboxResponse {}
+
+message SandboxStatusRequest {
+  string sandbox_id = 1;
+  bool verbose = 2;
+}
+
+message SandboxStatusResponse {
+  string sandbox_id = 1;
+  uint32 pid = 2;
+  string state = 3;
+  map<string, string> info = 4;
+  google.protobuf.Timestamp created_at = 5;
+  google.protobuf.Timestamp exited_at = 6;
+  google.protobuf.Any extra = 7;
+}
+
+message PingRequest {
+  string sandbox_id = 1;
+}
+
+message PingResponse {}
+
+message ShutdownSandboxRequest {
+  string sandbox_id = 1;
+}
+
+message ShutdownSandboxResponse {}
+
+message SandboxMetricsRequest {
+  string sandbox_id = 1;
+}
+
+message SandboxMetricsResponse {
+  containerd.types.Metric metrics = 1;
+}
+
+message CheckpointContainer {
+  string id = 1;
+  string name = 2;
+  google.protobuf.Any config = 3;
+  google.protobuf.Any status = 4;
+}
+
+message CheckpointRequest {
+  string sandbox_id = 1;
+  string output_path = 2;
+  google.protobuf.Any sandbox_config = 3;
+  repeated CheckpointContainer containers = 4;
+  map<string, string> options = 5;
+}
+
+message CheckpointResponse {}
+
+message RestoreContainer {
+  string id = 1;
+  string name = 2;
+  google.protobuf.Any config = 3;
+  // checkpoint_key identifies this container in the checkpoint manifest.
+  // The shim uses it to match restore tasks to checkpoint artifacts.
+  string checkpoint_key = 4;
+  // Absolute path to the container bundle on the host.
+  string bundle_path = 5;
+  // Whether the container has a terminal (TTY).
+  bool terminal = 6;
+  // Stdio paths for the container.
+  string stdin = 7;
+  string stdout = 8;
+  string stderr = 9;
+}
+
+enum TaskRestoreMode {
+  TASK_RESTORE_MODE_UNSPECIFIED = 0;
+  TASK_RESTORE_MODE_VM_RESTORED = 1;
+}
+
+message RestoreRequest {
+  string sandbox_id = 1;
+  string checkpoint_path = 2;
+  google.protobuf.Any sandbox_config = 3;
+  repeated RestoreContainer containers = 4;
+  map<string, string> options = 5;
+  // Path to the network namespace for the restored sandbox.
+  string netns_path = 6;
+  repeated TaskRestoreMode accepted_task_restore_modes = 7;
+}
+
+message RestoredContainer {
+  string name = 1;
+  // Ownership transfers from the controller to the caller when Restore
+  // succeeds. Empty when no containerd task checkpoint is required.
+  string task_checkpoint_image = 2;
+  TaskRestoreMode task_restore_mode = 3;
+}
+
+message RestoreResponse {
+  repeated RestoredContainer containers = 1;
+}
diff --git a/internal/sandboxd/sandboxapi/sandbox_ttrpc.pb.go b/internal/sandboxd/sandboxapi/sandbox_ttrpc.pb.go
new file mode 100644
index 0000000000..d1767ae566
--- /dev/null
+++ b/internal/sandboxd/sandboxapi/sandbox_ttrpc.pb.go
@@ -0,0 +1,238 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Code generated by protoc-gen-go-ttrpc. DO NOT EDIT.
+// source: sandbox.proto
+package sandbox
+
+import (
+	context "context"
+	ttrpc "github.com/containerd/ttrpc"
+)
+
+type TTRPCSandboxService interface {
+	CreateSandbox(context.Context, *CreateSandboxRequest) (*CreateSandboxResponse, error)
+	StartSandbox(context.Context, *StartSandboxRequest) (*StartSandboxResponse, error)
+	Platform(context.Context, *PlatformRequest) (*PlatformResponse, error)
+	StopSandbox(context.Context, *StopSandboxRequest) (*StopSandboxResponse, error)
+	WaitSandbox(context.Context, *WaitSandboxRequest) (*WaitSandboxResponse, error)
+	SandboxStatus(context.Context, *SandboxStatusRequest) (*SandboxStatusResponse, error)
+	PingSandbox(context.Context, *PingRequest) (*PingResponse, error)
+	ShutdownSandbox(context.Context, *ShutdownSandboxRequest) (*ShutdownSandboxResponse, error)
+	SandboxMetrics(context.Context, *SandboxMetricsRequest) (*SandboxMetricsResponse, error)
+}
+
+func RegisterTTRPCSandboxService(srv *ttrpc.Server, svc TTRPCSandboxService) {
+	srv.RegisterService("containerd.runtime.sandbox.v1.Sandbox", &ttrpc.ServiceDesc{
+		Methods: map[string]ttrpc.Method{
+			"CreateSandbox": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req CreateSandboxRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.CreateSandbox(ctx, &req)
+			},
+			"StartSandbox": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req StartSandboxRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.StartSandbox(ctx, &req)
+			},
+			"Platform": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req PlatformRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Platform(ctx, &req)
+			},
+			"StopSandbox": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req StopSandboxRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.StopSandbox(ctx, &req)
+			},
+			"WaitSandbox": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req WaitSandboxRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.WaitSandbox(ctx, &req)
+			},
+			"SandboxStatus": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req SandboxStatusRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.SandboxStatus(ctx, &req)
+			},
+			"PingSandbox": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req PingRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.PingSandbox(ctx, &req)
+			},
+			"ShutdownSandbox": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req ShutdownSandboxRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.ShutdownSandbox(ctx, &req)
+			},
+			"SandboxMetrics": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req SandboxMetricsRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.SandboxMetrics(ctx, &req)
+			},
+		},
+	})
+}
+
+type ttrpcsandboxClient struct {
+	client *ttrpc.Client
+}
+
+func NewTTRPCSandboxClient(client *ttrpc.Client) TTRPCSandboxService {
+	return &ttrpcsandboxClient{
+		client: client,
+	}
+}
+
+func (c *ttrpcsandboxClient) CreateSandbox(ctx context.Context, req *CreateSandboxRequest) (*CreateSandboxResponse, error) {
+	var resp CreateSandboxResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "CreateSandbox", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) StartSandbox(ctx context.Context, req *StartSandboxRequest) (*StartSandboxResponse, error) {
+	var resp StartSandboxResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "StartSandbox", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) Platform(ctx context.Context, req *PlatformRequest) (*PlatformResponse, error) {
+	var resp PlatformResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "Platform", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) StopSandbox(ctx context.Context, req *StopSandboxRequest) (*StopSandboxResponse, error) {
+	var resp StopSandboxResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "StopSandbox", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) WaitSandbox(ctx context.Context, req *WaitSandboxRequest) (*WaitSandboxResponse, error) {
+	var resp WaitSandboxResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "WaitSandbox", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) SandboxStatus(ctx context.Context, req *SandboxStatusRequest) (*SandboxStatusResponse, error) {
+	var resp SandboxStatusResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "SandboxStatus", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) PingSandbox(ctx context.Context, req *PingRequest) (*PingResponse, error) {
+	var resp PingResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "PingSandbox", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) ShutdownSandbox(ctx context.Context, req *ShutdownSandboxRequest) (*ShutdownSandboxResponse, error) {
+	var resp ShutdownSandboxResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "ShutdownSandbox", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpcsandboxClient) SandboxMetrics(ctx context.Context, req *SandboxMetricsRequest) (*SandboxMetricsResponse, error) {
+	var resp SandboxMetricsResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Sandbox", "SandboxMetrics", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+type TTRPCCheckpointService interface {
+	Checkpoint(context.Context, *CheckpointRequest) (*CheckpointResponse, error)
+	Restore(context.Context, *RestoreRequest) (*RestoreResponse, error)
+}
+
+func RegisterTTRPCCheckpointService(srv *ttrpc.Server, svc TTRPCCheckpointService) {
+	srv.RegisterService("containerd.runtime.sandbox.v1.Checkpoint", &ttrpc.ServiceDesc{
+		Methods: map[string]ttrpc.Method{
+			"Checkpoint": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req CheckpointRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Checkpoint(ctx, &req)
+			},
+			"Restore": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req RestoreRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Restore(ctx, &req)
+			},
+		},
+	})
+}
+
+type ttrpccheckpointClient struct {
+	client *ttrpc.Client
+}
+
+func NewTTRPCCheckpointClient(client *ttrpc.Client) TTRPCCheckpointService {
+	return &ttrpccheckpointClient{
+		client: client,
+	}
+}
+
+func (c *ttrpccheckpointClient) Checkpoint(ctx context.Context, req *CheckpointRequest) (*CheckpointResponse, error) {
+	var resp CheckpointResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Checkpoint", "Checkpoint", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpccheckpointClient) Restore(ctx context.Context, req *RestoreRequest) (*RestoreResponse, error) {
+	var resp RestoreResponse
+	if err := c.client.Call(ctx, "containerd.runtime.sandbox.v1.Checkpoint", "Restore", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
diff --git a/internal/sandboxd/server.go b/internal/sandboxd/server.go
new file mode 100644
index 0000000000..bd5088497c
--- /dev/null
+++ b/internal/sandboxd/server.go
@@ -0,0 +1,319 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io/fs"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	taskapi "github.com/containerd/containerd/api/runtime/task/v3"
+	containerdtypes "github.com/containerd/containerd/api/types"
+	tasktypes "github.com/containerd/containerd/api/types/task"
+	"github.com/google/uuid"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func ValidateOperationID(operationID string) error {
+	if len(operationID) == 0 || len(operationID) > 128 || strings.TrimSpace(operationID) != operationID {
+		return errors.New("operation ID must be a non-empty UUID of at most 128 bytes")
+	}
+	if _, err := uuid.Parse(operationID); err != nil {
+		return fmt.Errorf("operation ID must be a UUID: %w", err)
+	}
+	return nil
+}
+
+// Task is the subset of task configuration needed by the embedded Kata runtime.
+type Task struct {
+	CheckpointKey string
+	TaskID        string
+	Bundle        string
+	Terminal      bool
+	Stdin         string
+	Stdout        string
+	Stderr        string
+	RootfsFile    string
+	RootfsFSType  string
+	RootfsOptions []string
+}
+
+// Sandbox describes one Kata sandbox and its tasks.
+type Sandbox struct {
+	SandboxID        string
+	NetNSPath        string
+	PodSandboxConfig []byte
+	Annotations      map[string]string
+	Tasks            []*Task
+}
+
+// Runtime owns the Worker-Pod-local Kata lifecycle used by ateom-kata.
+type Runtime struct {
+	controller *SandboxController
+	tasks      *TaskManager
+}
+
+func NewRuntime(controller *SandboxController, tasks *TaskManager) *Runtime {
+	return &Runtime{controller: controller, tasks: tasks}
+}
+
+func (r *Runtime) Run(ctx context.Context, sb *Sandbox) (retErr error) {
+	sb, err := validateSandbox(sb)
+	if err != nil {
+		return invalid(err)
+	}
+	options := &anypb.Any{TypeUrl: podSandboxConfigTypeURL, Value: sb.PodSandboxConfig}
+	if err := r.controller.Create(ctx, sb.SandboxID, sb.NetNSPath, options, sb.Annotations); err != nil {
+		return err
+	}
+	defer func() {
+		if retErr != nil {
+			_ = r.controller.Shutdown(context.WithoutCancel(ctx), sb.SandboxID)
+		}
+	}()
+	if err := r.controller.Start(ctx, sb.SandboxID); err != nil {
+		return err
+	}
+	for _, task := range sb.Tasks {
+		create, err := createTaskRequest(task)
+		if err != nil {
+			return invalid(err)
+		}
+		if _, err := r.tasks.Create(ctx, sb.SandboxID, create); err != nil {
+			return fmt.Errorf("create task %q: %w", task.TaskID, err)
+		}
+		if _, err := r.tasks.Start(ctx, sb.SandboxID, task.TaskID); err != nil {
+			return fmt.Errorf("start task %q: %w", task.TaskID, err)
+		}
+	}
+	return nil
+}
+
+func (r *Runtime) Checkpoint(ctx context.Context, sandboxID, outputPath, operationID string, tasks map[string]string) error {
+	if !validID(sandboxID) || len(tasks) == 0 {
+		return invalid(errors.New("sandbox id and task inventory are required"))
+	}
+	if err := ValidateOperationID(operationID); err != nil {
+		return invalid(err)
+	}
+	return r.controller.Checkpoint(ctx, sandboxID, outputPath, operationID, tasks)
+}
+
+func (r *Runtime) Restore(ctx context.Context, sb *Sandbox, checkpointPath, operationID string) error {
+	sb, err := validateSandbox(sb)
+	if err != nil {
+		return invalid(err)
+	}
+	if err := ValidateOperationID(operationID); err != nil {
+		return invalid(err)
+	}
+	tasks := make([]RestoreTask, 0, len(sb.Tasks))
+	for _, task := range sb.Tasks {
+		tasks = append(tasks, RestoreTask{
+			CheckpointKey: task.CheckpointKey, TaskID: task.TaskID, Bundle: task.Bundle,
+			Terminal: task.Terminal, Stdin: task.Stdin, Stdout: task.Stdout, Stderr: task.Stderr,
+		})
+	}
+	options := &anypb.Any{TypeUrl: podSandboxConfigTypeURL, Value: sb.PodSandboxConfig}
+	_, err = r.controller.Restore(ctx, sb.SandboxID, checkpointPath, sb.NetNSPath, operationID, options, tasks)
+	if err != nil {
+		return err
+	}
+	if err := r.controller.StartRestored(ctx, sb.SandboxID, tasks); err != nil {
+		_ = r.controller.Shutdown(context.WithoutCancel(ctx), sb.SandboxID)
+		return err
+	}
+	return nil
+}
+
+func (r *Runtime) State(ctx context.Context, sandboxID, taskID string) (*taskapi.StateResponse, error) {
+	return r.tasks.State(ctx, sandboxID, taskID)
+}
+
+func (r *Runtime) Wait(ctx context.Context, sandboxID, taskID string) (*taskapi.WaitResponse, error) {
+	return r.tasks.Wait(ctx, sandboxID, taskID)
+}
+
+func (r *Runtime) Kill(ctx context.Context, sandboxID, taskID string, signal uint32, all bool) error {
+	return r.tasks.Kill(ctx, sandboxID, taskID, signal, all)
+}
+
+// Drain asks every workload process to exit cleanly. The caller owns the
+// timeout and follows with Delete, which supplies the SIGKILL fallback.
+func (r *Runtime) Drain(ctx context.Context, sb *Sandbox) error {
+	for _, task := range sb.Tasks {
+		if err := r.tasks.Kill(ctx, sb.SandboxID, task.TaskID, uint32(syscall.SIGTERM), true); err != nil {
+			return fmt.Errorf("signal task %q during drain: %w", task.TaskID, err)
+		}
+	}
+	for _, task := range sb.Tasks {
+		if _, err := r.tasks.Wait(ctx, sb.SandboxID, task.TaskID); err != nil {
+			return fmt.Errorf("wait task %q during drain: %w", task.TaskID, err)
+		}
+	}
+	return nil
+}
+
+func (r *Runtime) Delete(ctx context.Context, sandboxID string, taskIDs []string) error {
+	for i := len(taskIDs) - 1; i >= 0; i-- {
+		taskID := taskIDs[i]
+		state, err := r.tasks.State(ctx, sandboxID, taskID)
+		if err != nil {
+			return fmt.Errorf("state task %q before delete: %w", taskID, err)
+		}
+		if state.GetStatus() == tasktypes.Status_RUNNING || state.GetStatus() == tasktypes.Status_PAUSED {
+			if err := r.tasks.Kill(ctx, sandboxID, taskID, 9, true); err != nil {
+				return fmt.Errorf("kill task %q before delete: %w", taskID, err)
+			}
+			if _, err := r.tasks.Wait(ctx, sandboxID, taskID); err != nil {
+				return fmt.Errorf("wait task %q before delete: %w", taskID, err)
+			}
+		}
+		if _, err := r.tasks.Delete(ctx, sandboxID, taskID); err != nil {
+			return fmt.Errorf("delete task %q: %w", taskID, err)
+		}
+	}
+	return r.controller.Shutdown(ctx, sandboxID)
+}
+
+func validateSandbox(sb *Sandbox) (*Sandbox, error) {
+	if sb == nil || !validID(sb.SandboxID) || sb.NetNSPath == "" || len(sb.PodSandboxConfig) == 0 || len(sb.Tasks) == 0 {
+		return nil, errors.New("sandbox id, netns, PodSandboxConfig and tasks are required")
+	}
+	for _, task := range sb.Tasks {
+		if task == nil {
+			return nil, errors.New("sandbox task is required")
+		}
+	}
+	return sb, nil
+}
+
+func createTaskRequest(task *Task) (*taskapi.CreateTaskRequest, error) {
+	if task == nil || !validID(task.TaskID) || !filepath.IsAbs(task.Bundle) || !filepath.IsAbs(task.RootfsFile) || task.RootfsFSType == "" {
+		return nil, errors.New("task id, absolute bundle/rootfs and rootfs fs type are required")
+	}
+	if _, err := os.Stat(filepath.Join(task.Bundle, "config.json")); err != nil {
+		return nil, fmt.Errorf("task bundle: %w", err)
+	}
+	if err := prepareRootfsFile(task.Bundle, task.RootfsFile); err != nil {
+		return nil, err
+	}
+	options := append([]string(nil), task.RootfsOptions...)
+	hasLoop := false
+	for _, option := range options {
+		hasLoop = hasLoop || option == "loop"
+	}
+	if !hasLoop {
+		options = append(options, "loop")
+	}
+	return &taskapi.CreateTaskRequest{
+		ID: task.TaskID, Bundle: task.Bundle, Terminal: task.Terminal,
+		Stdin: task.Stdin, Stdout: task.Stdout, Stderr: task.Stderr,
+		Rootfs: []*containerdtypes.Mount{{Type: task.RootfsFSType, Source: task.RootfsFile, Options: options}},
+	}, nil
+}
+
+func prepareRootfsFile(bundle, output string) error {
+	if info, err := os.Lstat(output); err == nil {
+		if !info.Mode().IsRegular() {
+			return errors.New("rootfs_file must be a regular file")
+		}
+		return nil
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return err
+	}
+	source := filepath.Join(bundle, "rootfs")
+	if info, err := os.Stat(source); err != nil || !info.IsDir() {
+		return errors.New("bundle rootfs directory is missing")
+	}
+	if err := os.MkdirAll(filepath.Dir(output), 0o700); err != nil {
+		return err
+	}
+	size, err := managedRootfsSize(source)
+	if err != nil {
+		return err
+	}
+	tmp := output + ".partial"
+	_ = os.Remove(tmp)
+	file, err := os.OpenFile(tmp, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0o600)
+	if err != nil {
+		return err
+	}
+	if err := file.Truncate(size); err != nil {
+		_ = file.Close()
+		_ = os.Remove(tmp)
+		return err
+	}
+	if err := file.Close(); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	cmd := exec.Command("mkfs.ext4", "-q", "-F", "-d", source, tmp)
+	if out, err := cmd.CombinedOutput(); err != nil {
+		_ = os.Remove(tmp)
+		return fmt.Errorf("mkfs.ext4 rootfs: %w: %s", err, out)
+	}
+	if err := os.Rename(tmp, output); err != nil {
+		_ = os.Remove(tmp)
+		return err
+	}
+	return nil
+}
+
+func managedRootfsSize(root string) (int64, error) {
+	const (
+		minimum = int64(512 << 20)
+		reserve = int64(128 << 20)
+		align   = int64(1 << 20)
+	)
+	var content int64
+	err := filepath.WalkDir(root, func(path string, entry fs.DirEntry, err error) error {
+		if err != nil {
+			return err
+		}
+		if !entry.Type().IsRegular() {
+			return nil
+		}
+		info, err := entry.Info()
+		if err != nil {
+			return err
+		}
+		if info.Size() > 0 && content > (int64(^uint64(0)>>1)-info.Size()) {
+			return errors.New("rootfs size overflow")
+		}
+		content += info.Size()
+		return nil
+	})
+	if err != nil {
+		return 0, fmt.Errorf("measure bundle rootfs: %w", err)
+	}
+	size := content + content/2 + reserve
+	if size < minimum {
+		size = minimum
+	}
+	return (size + align - 1) / align * align, nil
+}
+
+func invalid(err error) error { return status.Error(codes.InvalidArgument, err.Error()) }
diff --git a/internal/sandboxd/server_test.go b/internal/sandboxd/server_test.go
new file mode 100644
index 0000000000..9344aba68b
--- /dev/null
+++ b/internal/sandboxd/server_test.go
@@ -0,0 +1,76 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCreateTaskRequestBuildsManagedRootfs(t *testing.T) {
+	bundle := t.TempDir()
+	if err := os.Mkdir(filepath.Join(bundle, "rootfs"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(bundle, "rootfs", "counter"), []byte("7\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(bundle, "config.json"), []byte(`{}`), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	rootfs := filepath.Join(bundle, "rootfs.raw")
+	req, err := createTaskRequest(&Task{TaskID: "task", Bundle: bundle, RootfsFile: rootfs, RootfsFSType: "ext4"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(req.GetRootfs()) != 1 || req.GetRootfs()[0].GetSource() != rootfs {
+		t.Fatalf("rootfs = %+v", req.GetRootfs())
+	}
+	foundLoop := false
+	for _, option := range req.GetRootfs()[0].GetOptions() {
+		foundLoop = foundLoop || option == "loop"
+	}
+	if !foundLoop {
+		t.Fatal("managed block rootfs lacks loop option")
+	}
+	if info, err := os.Stat(rootfs); err != nil || info.Size() != 512<<20 {
+		t.Fatalf("rootfs file: info=%v err=%v", info, err)
+	}
+}
+
+func TestManagedRootfsSizeGrowsWithContent(t *testing.T) {
+	root := t.TempDir()
+	f, err := os.Create(filepath.Join(root, "large"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Truncate(400 << 20); err != nil {
+		_ = f.Close()
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+	size, err := managedRootfsSize(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if size <= 512<<20 || size%(1<<20) != 0 {
+		t.Fatalf("managedRootfsSize() = %d", size)
+	}
+}
diff --git a/internal/sandboxd/stats.go b/internal/sandboxd/stats.go
new file mode 100644
index 0000000000..bf1dad28bf
--- /dev/null
+++ b/internal/sandboxd/stats.go
@@ -0,0 +1,91 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	statsv1 "github.com/containerd/cgroups/v3/cgroup1/stats"
+	statsv2 "github.com/containerd/cgroups/v3/cgroup2/stats"
+	taskapi "github.com/containerd/containerd/api/runtime/task/v3"
+)
+
+type TaskStats struct {
+	MemoryCurrentBytes    uint64
+	MemoryPeakBytes       uint64
+	MemoryWorkingSetBytes uint64
+	CPUUsageUsec          uint64
+}
+
+func (m *TaskManager) Stats(ctx context.Context, sid, tid string) (*taskapi.StatsResponse, error) {
+	inst, err := m.shims.Get(sid)
+	if err != nil {
+		return nil, err
+	}
+	return inst.Task.Stats(ctx, &taskapi.StatsRequest{ID: tid})
+}
+
+func (r *Runtime) Stats(ctx context.Context, sb *Sandbox) (*TaskStats, error) {
+	total := &TaskStats{}
+	for _, task := range sb.Tasks {
+		resp, err := r.tasks.Stats(ctx, sb.SandboxID, task.TaskID)
+		if err != nil {
+			return nil, fmt.Errorf("stats task %q: %w", task.TaskID, err)
+		}
+		if err := addTaskStats(total, resp); err != nil {
+			return nil, fmt.Errorf("decode stats task %q: %w", task.TaskID, err)
+		}
+	}
+	return total, nil
+}
+
+func addTaskStats(total *TaskStats, resp *taskapi.StatsResponse) error {
+	any := resp.GetStats()
+	if any == nil {
+		return fmt.Errorf("task returned no stats")
+	}
+	switch {
+	case strings.Contains(any.GetTypeUrl(), "cgroups.v2"):
+		var metrics statsv2.Metrics
+		if err := any.UnmarshalTo(&metrics); err != nil {
+			return err
+		}
+		current := metrics.GetMemory().GetUsage()
+		inactive := metrics.GetMemory().GetInactiveFile()
+		total.MemoryCurrentBytes += current
+		total.MemoryPeakBytes += metrics.GetMemory().GetMaxUsage()
+		total.MemoryWorkingSetBytes += current - min(current, inactive)
+		total.CPUUsageUsec += metrics.GetCPU().GetUsageUsec()
+		return nil
+	case strings.Contains(any.GetTypeUrl(), "cgroups.v1"):
+		var metrics statsv1.Metrics
+		if err := any.UnmarshalTo(&metrics); err != nil {
+			return err
+		}
+		current := metrics.GetMemory().GetUsage().GetUsage()
+		inactive := metrics.GetMemory().GetTotalInactiveFile()
+		total.MemoryCurrentBytes += current
+		total.MemoryPeakBytes += metrics.GetMemory().GetUsage().GetMax()
+		total.MemoryWorkingSetBytes += current - min(current, inactive)
+		total.CPUUsageUsec += metrics.GetCPU().GetUsage().GetTotal() / 1000
+		return nil
+	default:
+		return fmt.Errorf("unsupported task stats type %q", any.GetTypeUrl())
+	}
+}
diff --git a/internal/sandboxd/stats_test.go b/internal/sandboxd/stats_test.go
new file mode 100644
index 0000000000..06c3dcc9b8
--- /dev/null
+++ b/internal/sandboxd/stats_test.go
@@ -0,0 +1,63 @@
+// Copyright 2026 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//go:build linux
+
+package sandboxd
+
+import (
+	"testing"
+
+	statsv1 "github.com/containerd/cgroups/v3/cgroup1/stats"
+	statsv2 "github.com/containerd/cgroups/v3/cgroup2/stats"
+	taskapi "github.com/containerd/containerd/api/runtime/task/v3"
+	"google.golang.org/protobuf/types/known/anypb"
+)
+
+func TestAddTaskStatsV2(t *testing.T) {
+	payload, err := anypb.New(&statsv2.Metrics{
+		CPU:    &statsv2.CPUStat{UsageUsec: 25},
+		Memory: &statsv2.MemoryStat{Usage: 100, MaxUsage: 120, InactiveFile: 30},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := &TaskStats{}
+	if err := addTaskStats(got, &taskapi.StatsResponse{Stats: payload}); err != nil {
+		t.Fatal(err)
+	}
+	if *got != (TaskStats{MemoryCurrentBytes: 100, MemoryPeakBytes: 120, MemoryWorkingSetBytes: 70, CPUUsageUsec: 25}) {
+		t.Fatalf("stats = %+v", got)
+	}
+}
+
+func TestAddTaskStatsV1(t *testing.T) {
+	payload, err := anypb.New(&statsv1.Metrics{
+		CPU: &statsv1.CPUStat{Usage: &statsv1.CPUUsage{Total: 25000}},
+		Memory: &statsv1.MemoryStat{
+			Usage:             &statsv1.MemoryEntry{Usage: 100, Max: 120},
+			TotalInactiveFile: 30,
+		},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got := &TaskStats{}
+	if err := addTaskStats(got, &taskapi.StatsResponse{Stats: payload}); err != nil {
+		t.Fatal(err)
+	}
+	if *got != (TaskStats{MemoryCurrentBytes: 100, MemoryPeakBytes: 120, MemoryWorkingSetBytes: 70, CPUUsageUsec: 25}) {
+		t.Fatalf("stats = %+v", got)
+	}
+}
diff --git a/manifests/ate-install/atelet.yaml b/manifests/ate-install/atelet.yaml
index b07e03fc59..9c5e726f2e 100644
--- a/manifests/ate-install/atelet.yaml
+++ b/manifests/ate-install/atelet.yaml
@@ -243,6 +243,9 @@ spec:
         - name: host-dev
           mountPath: /host/dev
           readOnly: true
+        - name: kata-assets
+          mountPath: /opt/ateom-kata
+          readOnly: true
       volumes:
       - name: run-ateom
         hostPath:
@@ -269,6 +272,12 @@ spec:
         hostPath:
           path: /dev
           type: Directory
+      # ateom-kata SandboxConfig assets are immutable node-local bundles. Keep
+      # them read-only inside atelet, which validates and stages those assets.
+      - name: kata-assets
+        hostPath:
+          path: /opt/ateom-kata
+          type: Directory
       # Identity for mutual TLS with the ate-apiserver. atelet is not behind a
       # Service, so it uses a podidentity (SPIFFE) cert rather than a servicedns
       # serving cert (which requires DNS SANs it would not have); the
diff --git a/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml b/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml
index 583edd5926..0ab5120ce9 100644
--- a/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml
+++ b/manifests/ate-install/generated/ate.dev_sandboxconfigs.yaml
@@ -128,6 +128,7 @@ spec:
                 enum:
                 - gvisor
                 - microvm
+                - kata
                 type: string
             required:
             - pauseImage
diff --git a/manifests/ate-install/generated/ate.dev_workerpools.yaml b/manifests/ate-install/generated/ate.dev_workerpools.yaml
index 0841a19513..52620850d2 100644
--- a/manifests/ate-install/generated/ate.dev_workerpools.yaml
+++ b/manifests/ate-install/generated/ate.dev_workerpools.yaml
@@ -86,6 +86,7 @@ spec:
                 enum:
                 - gvisor
                 - microvm
+                - kata
                 type: string
               template:
                 description: Template holds optional metadata, scheduling, and resource
diff --git a/pkg/api/v1alpha1/sandboxconfig_types.go b/pkg/api/v1alpha1/sandboxconfig_types.go
index b63634f63b..e3f1fee930 100644
--- a/pkg/api/v1alpha1/sandboxconfig_types.go
+++ b/pkg/api/v1alpha1/sandboxconfig_types.go
@@ -28,6 +28,8 @@ const (
 	// SandboxClassMicroVM is the micro-VM runtime (cmd/ateom-microvm); needs
 	// /dev/kvm and vhost devices.
 	SandboxClassMicroVM SandboxClass = "microvm"
+	// SandboxClassKata is the Kata runtime-rs shim-v2 backend.
+	SandboxClassKata SandboxClass = "kata"
 )
 
 // AssetFile is one content-addressed file that atelet fetches for a sandbox
@@ -56,7 +58,7 @@ type SandboxConfigSpec struct {
 	// sandbox_config.sandbox_class.
 	//
 	// +required
-	// +kubebuilder:validation:Enum=gvisor;microvm
+	// +kubebuilder:validation:Enum=gvisor;microvm;kata
 	// +kubebuilder:default=gvisor
 	SandboxClass SandboxClass `json:"sandboxClass"`
 
diff --git a/pkg/api/v1alpha1/workerpool_types.go b/pkg/api/v1alpha1/workerpool_types.go
index 3382662b6d..3af1411b0a 100644
--- a/pkg/api/v1alpha1/workerpool_types.go
+++ b/pkg/api/v1alpha1/workerpool_types.go
@@ -102,7 +102,7 @@ type WorkerPoolSpec struct {
 	// See Also: TODOs in ActorTemplate SandboxClass
 	//
 	// +optional
-	// +kubebuilder:validation:Enum=gvisor;microvm
+	// +kubebuilder:validation:Enum=gvisor;microvm;kata
 	// +kubebuilder:default=gvisor
 	SandboxClass SandboxClass `json:"sandboxClass,omitempty"`
 }
diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go
index 967f06922e..11b61d7059 100644
--- a/pkg/proto/ateapipb/ateapi.pb.go
+++ b/pkg/proto/ateapipb/ateapi.pb.go
@@ -216,7 +216,8 @@ type SandboxClass int32
 const (
 	SandboxClass_SANDBOX_CLASS_UNSPECIFIED SandboxClass = 0
 	SandboxClass_SANDBOX_CLASS_GVISOR      SandboxClass = 1
-	SandboxClass_SANDBOX_CLASS_MICROVM     SandboxClass = 2 // Keep this in sync with SandboxConfig.sandbox_class's maximum.
+	SandboxClass_SANDBOX_CLASS_MICROVM     SandboxClass = 2
+	SandboxClass_SANDBOX_CLASS_KATA        SandboxClass = 3 // Keep this in sync with SandboxConfig.sandbox_class's maximum.
 )
 
 // Enum value maps for SandboxClass.
@@ -225,11 +226,13 @@ var (
 		0: "SANDBOX_CLASS_UNSPECIFIED",
 		1: "SANDBOX_CLASS_GVISOR",
 		2: "SANDBOX_CLASS_MICROVM",
+		3: "SANDBOX_CLASS_KATA",
 	}
 	SandboxClass_value = map[string]int32{
 		"SANDBOX_CLASS_UNSPECIFIED": 0,
 		"SANDBOX_CLASS_GVISOR":      1,
 		"SANDBOX_CLASS_MICROVM":     2,
+		"SANDBOX_CLASS_KATA":        3,
 	}
 )
 
@@ -2387,7 +2390,7 @@ type SandboxConfig struct {
 	//
 	// +k8s:required
 	// +k8s:minimum=1
-	// +k8s:maximum=2 # keep this in sync with the SandboxClass enum
+	// +k8s:maximum=3 # keep this in sync with the SandboxClass enum
 	SandboxClass SandboxClass `protobuf:"varint,1,opt,name=sandbox_class,json=sandboxClass,proto3,enum=ateapi.SandboxClass" json:"sandbox_class,omitempty"`
 	// config_name names the cluster-scoped SandboxConfig Kubernetes object
 	// supplying the sandbox binaries. Required; must match sandbox_class.
@@ -7215,11 +7218,12 @@ const file_ateapi_proto_rawDesc = "" +
 	"\x13ACTOR_STATE_PAUSING\x10\x05\x12\x16\n" +
 	"\x12ACTOR_STATE_PAUSED\x10\x06\x12\x17\n" +
 	"\x13ACTOR_STATE_CRASHED\x10\a\x12\x18\n" +
-	"\x14ACTOR_STATE_DELETING\x10\b*b\n" +
+	"\x14ACTOR_STATE_DELETING\x10\b*z\n" +
 	"\fSandboxClass\x12\x1d\n" +
 	"\x19SANDBOX_CLASS_UNSPECIFIED\x10\x00\x12\x18\n" +
 	"\x14SANDBOX_CLASS_GVISOR\x10\x01\x12\x19\n" +
-	"\x15SANDBOX_CLASS_MICROVM\x10\x02*d\n" +
+	"\x15SANDBOX_CLASS_MICROVM\x10\x02\x12\x16\n" +
+	"\x12SANDBOX_CLASS_KATA\x10\x03*d\n" +
 	"\fResumeSource\x12\x1d\n" +
 	"\x19RESUME_SOURCE_UNSPECIFIED\x10\x00\x12\x1b\n" +
 	"\x17RESUME_SOURCE_COLD_BOOT\x10\x01\x12\x18\n" +
diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto
index 0022537716..4ad391bc4e 100644
--- a/pkg/proto/ateapipb/ateapi.proto
+++ b/pkg/proto/ateapipb/ateapi.proto
@@ -735,6 +735,7 @@ enum SandboxClass {
   SANDBOX_CLASS_UNSPECIFIED = 0;
   SANDBOX_CLASS_GVISOR = 1;
   SANDBOX_CLASS_MICROVM = 2;
+  SANDBOX_CLASS_KATA = 3;
   // Keep this in sync with SandboxConfig.sandbox_class's maximum.
 }
 
@@ -831,7 +832,7 @@ message SandboxConfig {
   //
   // +k8s:required
   // +k8s:minimum=1
-  // +k8s:maximum=2 # keep this in sync with the SandboxClass enum
+  // +k8s:maximum=3 # keep this in sync with the SandboxClass enum
   SandboxClass sandbox_class = 1;
 
   // config_name names the cluster-scoped SandboxConfig Kubernetes object
diff --git a/vendor/github.com/containerd/cgroups/v3/LICENSE b/vendor/github.com/containerd/cgroups/v3/LICENSE
new file mode 100644
index 0000000000..261eeb9e9f
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/doc.go b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/doc.go
new file mode 100644
index 0000000000..e51e12f800
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/doc.go
@@ -0,0 +1,17 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package stats
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.pb.go b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.pb.go
new file mode 100644
index 0000000000..75206889ba
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.pb.go
@@ -0,0 +1,1959 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        v3.21.5
+// source: github.com/containerd/cgroups/cgroup1/stats/metrics.proto
+
+package stats
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Metrics struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Hugetlb          []*HugetlbStat    `protobuf:"bytes,1,rep,name=hugetlb,proto3" json:"hugetlb,omitempty"`
+	Pids             *PidsStat         `protobuf:"bytes,2,opt,name=pids,proto3" json:"pids,omitempty"`
+	CPU              *CPUStat          `protobuf:"bytes,3,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	Memory           *MemoryStat       `protobuf:"bytes,4,opt,name=memory,proto3" json:"memory,omitempty"`
+	Blkio            *BlkIOStat        `protobuf:"bytes,5,opt,name=blkio,proto3" json:"blkio,omitempty"`
+	Rdma             *RdmaStat         `protobuf:"bytes,6,opt,name=rdma,proto3" json:"rdma,omitempty"`
+	Network          []*NetworkStat    `protobuf:"bytes,7,rep,name=network,proto3" json:"network,omitempty"`
+	CgroupStats      *CgroupStats      `protobuf:"bytes,8,opt,name=cgroup_stats,json=cgroupStats,proto3" json:"cgroup_stats,omitempty"`
+	MemoryOomControl *MemoryOomControl `protobuf:"bytes,9,opt,name=memory_oom_control,json=memoryOomControl,proto3" json:"memory_oom_control,omitempty"`
+}
+
+func (x *Metrics) Reset() {
+	*x = Metrics{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metrics) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metrics) ProtoMessage() {}
+
+func (x *Metrics) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metrics.ProtoReflect.Descriptor instead.
+func (*Metrics) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Metrics) GetHugetlb() []*HugetlbStat {
+	if x != nil {
+		return x.Hugetlb
+	}
+	return nil
+}
+
+func (x *Metrics) GetPids() *PidsStat {
+	if x != nil {
+		return x.Pids
+	}
+	return nil
+}
+
+func (x *Metrics) GetCPU() *CPUStat {
+	if x != nil {
+		return x.CPU
+	}
+	return nil
+}
+
+func (x *Metrics) GetMemory() *MemoryStat {
+	if x != nil {
+		return x.Memory
+	}
+	return nil
+}
+
+func (x *Metrics) GetBlkio() *BlkIOStat {
+	if x != nil {
+		return x.Blkio
+	}
+	return nil
+}
+
+func (x *Metrics) GetRdma() *RdmaStat {
+	if x != nil {
+		return x.Rdma
+	}
+	return nil
+}
+
+func (x *Metrics) GetNetwork() []*NetworkStat {
+	if x != nil {
+		return x.Network
+	}
+	return nil
+}
+
+func (x *Metrics) GetCgroupStats() *CgroupStats {
+	if x != nil {
+		return x.CgroupStats
+	}
+	return nil
+}
+
+func (x *Metrics) GetMemoryOomControl() *MemoryOomControl {
+	if x != nil {
+		return x.MemoryOomControl
+	}
+	return nil
+}
+
+type HugetlbStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Usage    uint64 `protobuf:"varint,1,opt,name=usage,proto3" json:"usage,omitempty"`
+	Max      uint64 `protobuf:"varint,2,opt,name=max,proto3" json:"max,omitempty"`
+	Failcnt  uint64 `protobuf:"varint,3,opt,name=failcnt,proto3" json:"failcnt,omitempty"`
+	Pagesize string `protobuf:"bytes,4,opt,name=pagesize,proto3" json:"pagesize,omitempty"`
+}
+
+func (x *HugetlbStat) Reset() {
+	*x = HugetlbStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HugetlbStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HugetlbStat) ProtoMessage() {}
+
+func (x *HugetlbStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HugetlbStat.ProtoReflect.Descriptor instead.
+func (*HugetlbStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *HugetlbStat) GetUsage() uint64 {
+	if x != nil {
+		return x.Usage
+	}
+	return 0
+}
+
+func (x *HugetlbStat) GetMax() uint64 {
+	if x != nil {
+		return x.Max
+	}
+	return 0
+}
+
+func (x *HugetlbStat) GetFailcnt() uint64 {
+	if x != nil {
+		return x.Failcnt
+	}
+	return 0
+}
+
+func (x *HugetlbStat) GetPagesize() string {
+	if x != nil {
+		return x.Pagesize
+	}
+	return ""
+}
+
+type PidsStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Current uint64 `protobuf:"varint,1,opt,name=current,proto3" json:"current,omitempty"`
+	Limit   uint64 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
+}
+
+func (x *PidsStat) Reset() {
+	*x = PidsStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PidsStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PidsStat) ProtoMessage() {}
+
+func (x *PidsStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PidsStat.ProtoReflect.Descriptor instead.
+func (*PidsStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *PidsStat) GetCurrent() uint64 {
+	if x != nil {
+		return x.Current
+	}
+	return 0
+}
+
+func (x *PidsStat) GetLimit() uint64 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+type CPUStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Usage      *CPUUsage `protobuf:"bytes,1,opt,name=usage,proto3" json:"usage,omitempty"`
+	Throttling *Throttle `protobuf:"bytes,2,opt,name=throttling,proto3" json:"throttling,omitempty"`
+}
+
+func (x *CPUStat) Reset() {
+	*x = CPUStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CPUStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CPUStat) ProtoMessage() {}
+
+func (x *CPUStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CPUStat.ProtoReflect.Descriptor instead.
+func (*CPUStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *CPUStat) GetUsage() *CPUUsage {
+	if x != nil {
+		return x.Usage
+	}
+	return nil
+}
+
+func (x *CPUStat) GetThrottling() *Throttle {
+	if x != nil {
+		return x.Throttling
+	}
+	return nil
+}
+
+type CPUUsage struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// values in nanoseconds
+	Total  uint64   `protobuf:"varint,1,opt,name=total,proto3" json:"total,omitempty"`
+	Kernel uint64   `protobuf:"varint,2,opt,name=kernel,proto3" json:"kernel,omitempty"`
+	User   uint64   `protobuf:"varint,3,opt,name=user,proto3" json:"user,omitempty"`
+	PerCPU []uint64 `protobuf:"varint,4,rep,packed,name=per_cpu,json=perCpu,proto3" json:"per_cpu,omitempty"`
+}
+
+func (x *CPUUsage) Reset() {
+	*x = CPUUsage{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CPUUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CPUUsage) ProtoMessage() {}
+
+func (x *CPUUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CPUUsage.ProtoReflect.Descriptor instead.
+func (*CPUUsage) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CPUUsage) GetTotal() uint64 {
+	if x != nil {
+		return x.Total
+	}
+	return 0
+}
+
+func (x *CPUUsage) GetKernel() uint64 {
+	if x != nil {
+		return x.Kernel
+	}
+	return 0
+}
+
+func (x *CPUUsage) GetUser() uint64 {
+	if x != nil {
+		return x.User
+	}
+	return 0
+}
+
+func (x *CPUUsage) GetPerCPU() []uint64 {
+	if x != nil {
+		return x.PerCPU
+	}
+	return nil
+}
+
+type Throttle struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Periods          uint64 `protobuf:"varint,1,opt,name=periods,proto3" json:"periods,omitempty"`
+	ThrottledPeriods uint64 `protobuf:"varint,2,opt,name=throttled_periods,json=throttledPeriods,proto3" json:"throttled_periods,omitempty"`
+	ThrottledTime    uint64 `protobuf:"varint,3,opt,name=throttled_time,json=throttledTime,proto3" json:"throttled_time,omitempty"`
+}
+
+func (x *Throttle) Reset() {
+	*x = Throttle{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Throttle) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Throttle) ProtoMessage() {}
+
+func (x *Throttle) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Throttle.ProtoReflect.Descriptor instead.
+func (*Throttle) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *Throttle) GetPeriods() uint64 {
+	if x != nil {
+		return x.Periods
+	}
+	return 0
+}
+
+func (x *Throttle) GetThrottledPeriods() uint64 {
+	if x != nil {
+		return x.ThrottledPeriods
+	}
+	return 0
+}
+
+func (x *Throttle) GetThrottledTime() uint64 {
+	if x != nil {
+		return x.ThrottledTime
+	}
+	return 0
+}
+
+type MemoryStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Cache                   uint64       `protobuf:"varint,1,opt,name=cache,proto3" json:"cache,omitempty"`
+	RSS                     uint64       `protobuf:"varint,2,opt,name=rss,proto3" json:"rss,omitempty"`
+	RSSHuge                 uint64       `protobuf:"varint,3,opt,name=rss_huge,json=rssHuge,proto3" json:"rss_huge,omitempty"`
+	MappedFile              uint64       `protobuf:"varint,4,opt,name=mapped_file,json=mappedFile,proto3" json:"mapped_file,omitempty"`
+	Dirty                   uint64       `protobuf:"varint,5,opt,name=dirty,proto3" json:"dirty,omitempty"`
+	Writeback               uint64       `protobuf:"varint,6,opt,name=writeback,proto3" json:"writeback,omitempty"`
+	PgPgIn                  uint64       `protobuf:"varint,7,opt,name=pg_pg_in,json=pgPgIn,proto3" json:"pg_pg_in,omitempty"`
+	PgPgOut                 uint64       `protobuf:"varint,8,opt,name=pg_pg_out,json=pgPgOut,proto3" json:"pg_pg_out,omitempty"`
+	PgFault                 uint64       `protobuf:"varint,9,opt,name=pg_fault,json=pgFault,proto3" json:"pg_fault,omitempty"`
+	PgMajFault              uint64       `protobuf:"varint,10,opt,name=pg_maj_fault,json=pgMajFault,proto3" json:"pg_maj_fault,omitempty"`
+	InactiveAnon            uint64       `protobuf:"varint,11,opt,name=inactive_anon,json=inactiveAnon,proto3" json:"inactive_anon,omitempty"`
+	ActiveAnon              uint64       `protobuf:"varint,12,opt,name=active_anon,json=activeAnon,proto3" json:"active_anon,omitempty"`
+	InactiveFile            uint64       `protobuf:"varint,13,opt,name=inactive_file,json=inactiveFile,proto3" json:"inactive_file,omitempty"`
+	ActiveFile              uint64       `protobuf:"varint,14,opt,name=active_file,json=activeFile,proto3" json:"active_file,omitempty"`
+	Unevictable             uint64       `protobuf:"varint,15,opt,name=unevictable,proto3" json:"unevictable,omitempty"`
+	HierarchicalMemoryLimit uint64       `protobuf:"varint,16,opt,name=hierarchical_memory_limit,json=hierarchicalMemoryLimit,proto3" json:"hierarchical_memory_limit,omitempty"`
+	HierarchicalSwapLimit   uint64       `protobuf:"varint,17,opt,name=hierarchical_swap_limit,json=hierarchicalSwapLimit,proto3" json:"hierarchical_swap_limit,omitempty"`
+	TotalCache              uint64       `protobuf:"varint,18,opt,name=total_cache,json=totalCache,proto3" json:"total_cache,omitempty"`
+	TotalRSS                uint64       `protobuf:"varint,19,opt,name=total_rss,json=totalRss,proto3" json:"total_rss,omitempty"`
+	TotalRSSHuge            uint64       `protobuf:"varint,20,opt,name=total_rss_huge,json=totalRssHuge,proto3" json:"total_rss_huge,omitempty"`
+	TotalMappedFile         uint64       `protobuf:"varint,21,opt,name=total_mapped_file,json=totalMappedFile,proto3" json:"total_mapped_file,omitempty"`
+	TotalDirty              uint64       `protobuf:"varint,22,opt,name=total_dirty,json=totalDirty,proto3" json:"total_dirty,omitempty"`
+	TotalWriteback          uint64       `protobuf:"varint,23,opt,name=total_writeback,json=totalWriteback,proto3" json:"total_writeback,omitempty"`
+	TotalPgPgIn             uint64       `protobuf:"varint,24,opt,name=total_pg_pg_in,json=totalPgPgIn,proto3" json:"total_pg_pg_in,omitempty"`
+	TotalPgPgOut            uint64       `protobuf:"varint,25,opt,name=total_pg_pg_out,json=totalPgPgOut,proto3" json:"total_pg_pg_out,omitempty"`
+	TotalPgFault            uint64       `protobuf:"varint,26,opt,name=total_pg_fault,json=totalPgFault,proto3" json:"total_pg_fault,omitempty"`
+	TotalPgMajFault         uint64       `protobuf:"varint,27,opt,name=total_pg_maj_fault,json=totalPgMajFault,proto3" json:"total_pg_maj_fault,omitempty"`
+	TotalInactiveAnon       uint64       `protobuf:"varint,28,opt,name=total_inactive_anon,json=totalInactiveAnon,proto3" json:"total_inactive_anon,omitempty"`
+	TotalActiveAnon         uint64       `protobuf:"varint,29,opt,name=total_active_anon,json=totalActiveAnon,proto3" json:"total_active_anon,omitempty"`
+	TotalInactiveFile       uint64       `protobuf:"varint,30,opt,name=total_inactive_file,json=totalInactiveFile,proto3" json:"total_inactive_file,omitempty"`
+	TotalActiveFile         uint64       `protobuf:"varint,31,opt,name=total_active_file,json=totalActiveFile,proto3" json:"total_active_file,omitempty"`
+	TotalUnevictable        uint64       `protobuf:"varint,32,opt,name=total_unevictable,json=totalUnevictable,proto3" json:"total_unevictable,omitempty"`
+	Usage                   *MemoryEntry `protobuf:"bytes,33,opt,name=usage,proto3" json:"usage,omitempty"`
+	Swap                    *MemoryEntry `protobuf:"bytes,34,opt,name=swap,proto3" json:"swap,omitempty"`
+	Kernel                  *MemoryEntry `protobuf:"bytes,35,opt,name=kernel,proto3" json:"kernel,omitempty"`
+	KernelTCP               *MemoryEntry `protobuf:"bytes,36,opt,name=kernel_tcp,json=kernelTcp,proto3" json:"kernel_tcp,omitempty"`
+}
+
+func (x *MemoryStat) Reset() {
+	*x = MemoryStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MemoryStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoryStat) ProtoMessage() {}
+
+func (x *MemoryStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoryStat.ProtoReflect.Descriptor instead.
+func (*MemoryStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *MemoryStat) GetCache() uint64 {
+	if x != nil {
+		return x.Cache
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetRSS() uint64 {
+	if x != nil {
+		return x.RSS
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetRSSHuge() uint64 {
+	if x != nil {
+		return x.RSSHuge
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetMappedFile() uint64 {
+	if x != nil {
+		return x.MappedFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetDirty() uint64 {
+	if x != nil {
+		return x.Dirty
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetWriteback() uint64 {
+	if x != nil {
+		return x.Writeback
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgPgIn() uint64 {
+	if x != nil {
+		return x.PgPgIn
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgPgOut() uint64 {
+	if x != nil {
+		return x.PgPgOut
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgFault() uint64 {
+	if x != nil {
+		return x.PgFault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgMajFault() uint64 {
+	if x != nil {
+		return x.PgMajFault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetInactiveAnon() uint64 {
+	if x != nil {
+		return x.InactiveAnon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetActiveAnon() uint64 {
+	if x != nil {
+		return x.ActiveAnon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetInactiveFile() uint64 {
+	if x != nil {
+		return x.InactiveFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetActiveFile() uint64 {
+	if x != nil {
+		return x.ActiveFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetUnevictable() uint64 {
+	if x != nil {
+		return x.Unevictable
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetHierarchicalMemoryLimit() uint64 {
+	if x != nil {
+		return x.HierarchicalMemoryLimit
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetHierarchicalSwapLimit() uint64 {
+	if x != nil {
+		return x.HierarchicalSwapLimit
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalCache() uint64 {
+	if x != nil {
+		return x.TotalCache
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalRSS() uint64 {
+	if x != nil {
+		return x.TotalRSS
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalRSSHuge() uint64 {
+	if x != nil {
+		return x.TotalRSSHuge
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalMappedFile() uint64 {
+	if x != nil {
+		return x.TotalMappedFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalDirty() uint64 {
+	if x != nil {
+		return x.TotalDirty
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalWriteback() uint64 {
+	if x != nil {
+		return x.TotalWriteback
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalPgPgIn() uint64 {
+	if x != nil {
+		return x.TotalPgPgIn
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalPgPgOut() uint64 {
+	if x != nil {
+		return x.TotalPgPgOut
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalPgFault() uint64 {
+	if x != nil {
+		return x.TotalPgFault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalPgMajFault() uint64 {
+	if x != nil {
+		return x.TotalPgMajFault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalInactiveAnon() uint64 {
+	if x != nil {
+		return x.TotalInactiveAnon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalActiveAnon() uint64 {
+	if x != nil {
+		return x.TotalActiveAnon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalInactiveFile() uint64 {
+	if x != nil {
+		return x.TotalInactiveFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalActiveFile() uint64 {
+	if x != nil {
+		return x.TotalActiveFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetTotalUnevictable() uint64 {
+	if x != nil {
+		return x.TotalUnevictable
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetUsage() *MemoryEntry {
+	if x != nil {
+		return x.Usage
+	}
+	return nil
+}
+
+func (x *MemoryStat) GetSwap() *MemoryEntry {
+	if x != nil {
+		return x.Swap
+	}
+	return nil
+}
+
+func (x *MemoryStat) GetKernel() *MemoryEntry {
+	if x != nil {
+		return x.Kernel
+	}
+	return nil
+}
+
+func (x *MemoryStat) GetKernelTCP() *MemoryEntry {
+	if x != nil {
+		return x.KernelTCP
+	}
+	return nil
+}
+
+type MemoryEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Limit   uint64 `protobuf:"varint,1,opt,name=limit,proto3" json:"limit,omitempty"`
+	Usage   uint64 `protobuf:"varint,2,opt,name=usage,proto3" json:"usage,omitempty"`
+	Max     uint64 `protobuf:"varint,3,opt,name=max,proto3" json:"max,omitempty"`
+	Failcnt uint64 `protobuf:"varint,4,opt,name=failcnt,proto3" json:"failcnt,omitempty"`
+}
+
+func (x *MemoryEntry) Reset() {
+	*x = MemoryEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MemoryEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoryEntry) ProtoMessage() {}
+
+func (x *MemoryEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoryEntry.ProtoReflect.Descriptor instead.
+func (*MemoryEntry) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *MemoryEntry) GetLimit() uint64 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+func (x *MemoryEntry) GetUsage() uint64 {
+	if x != nil {
+		return x.Usage
+	}
+	return 0
+}
+
+func (x *MemoryEntry) GetMax() uint64 {
+	if x != nil {
+		return x.Max
+	}
+	return 0
+}
+
+func (x *MemoryEntry) GetFailcnt() uint64 {
+	if x != nil {
+		return x.Failcnt
+	}
+	return 0
+}
+
+type MemoryOomControl struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	OomKillDisable uint64 `protobuf:"varint,1,opt,name=oom_kill_disable,json=oomKillDisable,proto3" json:"oom_kill_disable,omitempty"`
+	UnderOom       uint64 `protobuf:"varint,2,opt,name=under_oom,json=underOom,proto3" json:"under_oom,omitempty"`
+	OomKill        uint64 `protobuf:"varint,3,opt,name=oom_kill,json=oomKill,proto3" json:"oom_kill,omitempty"`
+}
+
+func (x *MemoryOomControl) Reset() {
+	*x = MemoryOomControl{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MemoryOomControl) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoryOomControl) ProtoMessage() {}
+
+func (x *MemoryOomControl) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoryOomControl.ProtoReflect.Descriptor instead.
+func (*MemoryOomControl) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *MemoryOomControl) GetOomKillDisable() uint64 {
+	if x != nil {
+		return x.OomKillDisable
+	}
+	return 0
+}
+
+func (x *MemoryOomControl) GetUnderOom() uint64 {
+	if x != nil {
+		return x.UnderOom
+	}
+	return 0
+}
+
+func (x *MemoryOomControl) GetOomKill() uint64 {
+	if x != nil {
+		return x.OomKill
+	}
+	return 0
+}
+
+type BlkIOStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IoServiceBytesRecursive []*BlkIOEntry `protobuf:"bytes,1,rep,name=io_service_bytes_recursive,json=ioServiceBytesRecursive,proto3" json:"io_service_bytes_recursive,omitempty"`
+	IoServicedRecursive     []*BlkIOEntry `protobuf:"bytes,2,rep,name=io_serviced_recursive,json=ioServicedRecursive,proto3" json:"io_serviced_recursive,omitempty"`
+	IoQueuedRecursive       []*BlkIOEntry `protobuf:"bytes,3,rep,name=io_queued_recursive,json=ioQueuedRecursive,proto3" json:"io_queued_recursive,omitempty"`
+	IoServiceTimeRecursive  []*BlkIOEntry `protobuf:"bytes,4,rep,name=io_service_time_recursive,json=ioServiceTimeRecursive,proto3" json:"io_service_time_recursive,omitempty"`
+	IoWaitTimeRecursive     []*BlkIOEntry `protobuf:"bytes,5,rep,name=io_wait_time_recursive,json=ioWaitTimeRecursive,proto3" json:"io_wait_time_recursive,omitempty"`
+	IoMergedRecursive       []*BlkIOEntry `protobuf:"bytes,6,rep,name=io_merged_recursive,json=ioMergedRecursive,proto3" json:"io_merged_recursive,omitempty"`
+	IoTimeRecursive         []*BlkIOEntry `protobuf:"bytes,7,rep,name=io_time_recursive,json=ioTimeRecursive,proto3" json:"io_time_recursive,omitempty"`
+	SectorsRecursive        []*BlkIOEntry `protobuf:"bytes,8,rep,name=sectors_recursive,json=sectorsRecursive,proto3" json:"sectors_recursive,omitempty"`
+}
+
+func (x *BlkIOStat) Reset() {
+	*x = BlkIOStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BlkIOStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BlkIOStat) ProtoMessage() {}
+
+func (x *BlkIOStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BlkIOStat.ProtoReflect.Descriptor instead.
+func (*BlkIOStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *BlkIOStat) GetIoServiceBytesRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoServiceBytesRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetIoServicedRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoServicedRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetIoQueuedRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoQueuedRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetIoServiceTimeRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoServiceTimeRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetIoWaitTimeRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoWaitTimeRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetIoMergedRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoMergedRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetIoTimeRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.IoTimeRecursive
+	}
+	return nil
+}
+
+func (x *BlkIOStat) GetSectorsRecursive() []*BlkIOEntry {
+	if x != nil {
+		return x.SectorsRecursive
+	}
+	return nil
+}
+
+type BlkIOEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Op     string `protobuf:"bytes,1,opt,name=op,proto3" json:"op,omitempty"`
+	Device string `protobuf:"bytes,2,opt,name=device,proto3" json:"device,omitempty"`
+	Major  uint64 `protobuf:"varint,3,opt,name=major,proto3" json:"major,omitempty"`
+	Minor  uint64 `protobuf:"varint,4,opt,name=minor,proto3" json:"minor,omitempty"`
+	Value  uint64 `protobuf:"varint,5,opt,name=value,proto3" json:"value,omitempty"`
+}
+
+func (x *BlkIOEntry) Reset() {
+	*x = BlkIOEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *BlkIOEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*BlkIOEntry) ProtoMessage() {}
+
+func (x *BlkIOEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use BlkIOEntry.ProtoReflect.Descriptor instead.
+func (*BlkIOEntry) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *BlkIOEntry) GetOp() string {
+	if x != nil {
+		return x.Op
+	}
+	return ""
+}
+
+func (x *BlkIOEntry) GetDevice() string {
+	if x != nil {
+		return x.Device
+	}
+	return ""
+}
+
+func (x *BlkIOEntry) GetMajor() uint64 {
+	if x != nil {
+		return x.Major
+	}
+	return 0
+}
+
+func (x *BlkIOEntry) GetMinor() uint64 {
+	if x != nil {
+		return x.Minor
+	}
+	return 0
+}
+
+func (x *BlkIOEntry) GetValue() uint64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+type RdmaStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Current []*RdmaEntry `protobuf:"bytes,1,rep,name=current,proto3" json:"current,omitempty"`
+	Limit   []*RdmaEntry `protobuf:"bytes,2,rep,name=limit,proto3" json:"limit,omitempty"`
+}
+
+func (x *RdmaStat) Reset() {
+	*x = RdmaStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RdmaStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RdmaStat) ProtoMessage() {}
+
+func (x *RdmaStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RdmaStat.ProtoReflect.Descriptor instead.
+func (*RdmaStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *RdmaStat) GetCurrent() []*RdmaEntry {
+	if x != nil {
+		return x.Current
+	}
+	return nil
+}
+
+func (x *RdmaStat) GetLimit() []*RdmaEntry {
+	if x != nil {
+		return x.Limit
+	}
+	return nil
+}
+
+type RdmaEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Device     string `protobuf:"bytes,1,opt,name=device,proto3" json:"device,omitempty"`
+	HcaHandles uint32 `protobuf:"varint,2,opt,name=hca_handles,json=hcaHandles,proto3" json:"hca_handles,omitempty"`
+	HcaObjects uint32 `protobuf:"varint,3,opt,name=hca_objects,json=hcaObjects,proto3" json:"hca_objects,omitempty"`
+}
+
+func (x *RdmaEntry) Reset() {
+	*x = RdmaEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RdmaEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RdmaEntry) ProtoMessage() {}
+
+func (x *RdmaEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RdmaEntry.ProtoReflect.Descriptor instead.
+func (*RdmaEntry) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *RdmaEntry) GetDevice() string {
+	if x != nil {
+		return x.Device
+	}
+	return ""
+}
+
+func (x *RdmaEntry) GetHcaHandles() uint32 {
+	if x != nil {
+		return x.HcaHandles
+	}
+	return 0
+}
+
+func (x *RdmaEntry) GetHcaObjects() uint32 {
+	if x != nil {
+		return x.HcaObjects
+	}
+	return 0
+}
+
+type NetworkStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name      string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	RxBytes   uint64 `protobuf:"varint,2,opt,name=rx_bytes,json=rxBytes,proto3" json:"rx_bytes,omitempty"`
+	RxPackets uint64 `protobuf:"varint,3,opt,name=rx_packets,json=rxPackets,proto3" json:"rx_packets,omitempty"`
+	RxErrors  uint64 `protobuf:"varint,4,opt,name=rx_errors,json=rxErrors,proto3" json:"rx_errors,omitempty"`
+	RxDropped uint64 `protobuf:"varint,5,opt,name=rx_dropped,json=rxDropped,proto3" json:"rx_dropped,omitempty"`
+	TxBytes   uint64 `protobuf:"varint,6,opt,name=tx_bytes,json=txBytes,proto3" json:"tx_bytes,omitempty"`
+	TxPackets uint64 `protobuf:"varint,7,opt,name=tx_packets,json=txPackets,proto3" json:"tx_packets,omitempty"`
+	TxErrors  uint64 `protobuf:"varint,8,opt,name=tx_errors,json=txErrors,proto3" json:"tx_errors,omitempty"`
+	TxDropped uint64 `protobuf:"varint,9,opt,name=tx_dropped,json=txDropped,proto3" json:"tx_dropped,omitempty"`
+}
+
+func (x *NetworkStat) Reset() {
+	*x = NetworkStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *NetworkStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkStat) ProtoMessage() {}
+
+func (x *NetworkStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkStat.ProtoReflect.Descriptor instead.
+func (*NetworkStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *NetworkStat) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *NetworkStat) GetRxBytes() uint64 {
+	if x != nil {
+		return x.RxBytes
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetRxPackets() uint64 {
+	if x != nil {
+		return x.RxPackets
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetRxErrors() uint64 {
+	if x != nil {
+		return x.RxErrors
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetRxDropped() uint64 {
+	if x != nil {
+		return x.RxDropped
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetTxBytes() uint64 {
+	if x != nil {
+		return x.TxBytes
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetTxPackets() uint64 {
+	if x != nil {
+		return x.TxPackets
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetTxErrors() uint64 {
+	if x != nil {
+		return x.TxErrors
+	}
+	return 0
+}
+
+func (x *NetworkStat) GetTxDropped() uint64 {
+	if x != nil {
+		return x.TxDropped
+	}
+	return 0
+}
+
+// CgroupStats exports per-cgroup statistics.
+type CgroupStats struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// number of tasks sleeping
+	NrSleeping uint64 `protobuf:"varint,1,opt,name=nr_sleeping,json=nrSleeping,proto3" json:"nr_sleeping,omitempty"`
+	// number of tasks running
+	NrRunning uint64 `protobuf:"varint,2,opt,name=nr_running,json=nrRunning,proto3" json:"nr_running,omitempty"`
+	// number of tasks in stopped state
+	NrStopped uint64 `protobuf:"varint,3,opt,name=nr_stopped,json=nrStopped,proto3" json:"nr_stopped,omitempty"`
+	// number of tasks in uninterruptible state
+	NrUninterruptible uint64 `protobuf:"varint,4,opt,name=nr_uninterruptible,json=nrUninterruptible,proto3" json:"nr_uninterruptible,omitempty"`
+	// number of tasks waiting on IO
+	NrIoWait uint64 `protobuf:"varint,5,opt,name=nr_io_wait,json=nrIoWait,proto3" json:"nr_io_wait,omitempty"`
+}
+
+func (x *CgroupStats) Reset() {
+	*x = CgroupStats{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CgroupStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CgroupStats) ProtoMessage() {}
+
+func (x *CgroupStats) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CgroupStats.ProtoReflect.Descriptor instead.
+func (*CgroupStats) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *CgroupStats) GetNrSleeping() uint64 {
+	if x != nil {
+		return x.NrSleeping
+	}
+	return 0
+}
+
+func (x *CgroupStats) GetNrRunning() uint64 {
+	if x != nil {
+		return x.NrRunning
+	}
+	return 0
+}
+
+func (x *CgroupStats) GetNrStopped() uint64 {
+	if x != nil {
+		return x.NrStopped
+	}
+	return 0
+}
+
+func (x *CgroupStats) GetNrUninterruptible() uint64 {
+	if x != nil {
+		return x.NrUninterruptible
+	}
+	return 0
+}
+
+func (x *CgroupStats) GetNrIoWait() uint64 {
+	if x != nil {
+		return x.NrIoWait
+	}
+	return 0
+}
+
+var File_github_com_containerd_cgroups_cgroup1_stats_metrics_proto protoreflect.FileDescriptor
+
+var file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDesc = []byte{
+	0x0a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2f,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x31, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x73, 0x2f, 0x6d, 0x65,
+	0x74, 0x72, 0x69, 0x63, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x18, 0x69, 0x6f, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x2e, 0x76, 0x31, 0x22, 0xcd, 0x04, 0x0a, 0x07, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x73, 0x12, 0x3f, 0x0a, 0x07, 0x68, 0x75, 0x67, 0x65, 0x74, 0x6c, 0x62, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x48, 0x75,
+	0x67, 0x65, 0x74, 0x6c, 0x62, 0x53, 0x74, 0x61, 0x74, 0x52, 0x07, 0x68, 0x75, 0x67, 0x65, 0x74,
+	0x6c, 0x62, 0x12, 0x36, 0x0a, 0x04, 0x70, 0x69, 0x64, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x50, 0x69, 0x64, 0x73,
+	0x53, 0x74, 0x61, 0x74, 0x52, 0x04, 0x70, 0x69, 0x64, 0x73, 0x12, 0x33, 0x0a, 0x03, 0x63, 0x70,
+	0x75, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x43, 0x50, 0x55, 0x53, 0x74, 0x61, 0x74, 0x52, 0x03, 0x63, 0x70, 0x75, 0x12,
+	0x3c, 0x0a, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72,
+	0x79, 0x53, 0x74, 0x61, 0x74, 0x52, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x12, 0x39, 0x0a,
+	0x05, 0x62, 0x6c, 0x6b, 0x69, 0x6f, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x69,
+	0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72,
+	0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x53, 0x74, 0x61,
+	0x74, 0x52, 0x05, 0x62, 0x6c, 0x6b, 0x69, 0x6f, 0x12, 0x36, 0x0a, 0x04, 0x72, 0x64, 0x6d, 0x61,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76,
+	0x31, 0x2e, 0x52, 0x64, 0x6d, 0x61, 0x53, 0x74, 0x61, 0x74, 0x52, 0x04, 0x72, 0x64, 0x6d, 0x61,
+	0x12, 0x3f, 0x0a, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x18, 0x07, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4e, 0x65, 0x74,
+	0x77, 0x6f, 0x72, 0x6b, 0x53, 0x74, 0x61, 0x74, 0x52, 0x07, 0x6e, 0x65, 0x74, 0x77, 0x6f, 0x72,
+	0x6b, 0x12, 0x48, 0x0a, 0x0c, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x5f, 0x73, 0x74, 0x61, 0x74,
+	0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x43, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x0b,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x58, 0x0a, 0x12, 0x6d,
+	0x65, 0x6d, 0x6f, 0x72, 0x79, 0x5f, 0x6f, 0x6f, 0x6d, 0x5f, 0x63, 0x6f, 0x6e, 0x74, 0x72, 0x6f,
+	0x6c, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2a, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x4f, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74,
+	0x72, 0x6f, 0x6c, 0x52, 0x10, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x4f, 0x6f, 0x6d, 0x43, 0x6f,
+	0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x22, 0x6b, 0x0a, 0x0b, 0x48, 0x75, 0x67, 0x65, 0x74, 0x6c, 0x62,
+	0x53, 0x74, 0x61, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61,
+	0x78, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x6d, 0x61, 0x78, 0x12, 0x18, 0x0a, 0x07,
+	0x66, 0x61, 0x69, 0x6c, 0x63, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x66,
+	0x61, 0x69, 0x6c, 0x63, 0x6e, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x67, 0x65, 0x73, 0x69,
+	0x7a, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x67, 0x65, 0x73, 0x69,
+	0x7a, 0x65, 0x22, 0x3a, 0x0a, 0x08, 0x50, 0x69, 0x64, 0x73, 0x53, 0x74, 0x61, 0x74, 0x12, 0x18,
+	0x0a, 0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69,
+	0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x22, 0x87,
+	0x01, 0x0a, 0x07, 0x43, 0x50, 0x55, 0x53, 0x74, 0x61, 0x74, 0x12, 0x38, 0x0a, 0x05, 0x75, 0x73,
+	0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x2e, 0x76, 0x31, 0x2e, 0x43, 0x50, 0x55, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x05, 0x75,
+	0x73, 0x61, 0x67, 0x65, 0x12, 0x42, 0x0a, 0x0a, 0x74, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x69,
+	0x6e, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x54, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x52, 0x0a, 0x74, 0x68,
+	0x72, 0x6f, 0x74, 0x74, 0x6c, 0x69, 0x6e, 0x67, 0x22, 0x65, 0x0a, 0x08, 0x43, 0x50, 0x55, 0x55,
+	0x73, 0x61, 0x67, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x6b, 0x65,
+	0x72, 0x6e, 0x65, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x6b, 0x65, 0x72, 0x6e,
+	0x65, 0x6c, 0x12, 0x12, 0x0a, 0x04, 0x75, 0x73, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x04, 0x75, 0x73, 0x65, 0x72, 0x12, 0x17, 0x0a, 0x07, 0x70, 0x65, 0x72, 0x5f, 0x63, 0x70,
+	0x75, 0x18, 0x04, 0x20, 0x03, 0x28, 0x04, 0x52, 0x06, 0x70, 0x65, 0x72, 0x43, 0x70, 0x75, 0x22,
+	0x78, 0x0a, 0x08, 0x54, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70,
+	0x65, 0x72, 0x69, 0x6f, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x70, 0x65,
+	0x72, 0x69, 0x6f, 0x64, 0x73, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c,
+	0x65, 0x64, 0x5f, 0x70, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x10, 0x74, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x64, 0x50, 0x65, 0x72, 0x69, 0x6f,
+	0x64, 0x73, 0x12, 0x25, 0x0a, 0x0e, 0x74, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x64, 0x5f,
+	0x74, 0x69, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0d, 0x74, 0x68, 0x72, 0x6f,
+	0x74, 0x74, 0x6c, 0x65, 0x64, 0x54, 0x69, 0x6d, 0x65, 0x22, 0x94, 0x0b, 0x0a, 0x0a, 0x4d, 0x65,
+	0x6d, 0x6f, 0x72, 0x79, 0x53, 0x74, 0x61, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x63, 0x61, 0x63, 0x68,
+	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x63, 0x61, 0x63, 0x68, 0x65, 0x12, 0x10,
+	0x0a, 0x03, 0x72, 0x73, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x72, 0x73, 0x73,
+	0x12, 0x19, 0x0a, 0x08, 0x72, 0x73, 0x73, 0x5f, 0x68, 0x75, 0x67, 0x65, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x07, 0x72, 0x73, 0x73, 0x48, 0x75, 0x67, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x6d,
+	0x61, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x0a, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x14, 0x0a, 0x05,
+	0x64, 0x69, 0x72, 0x74, 0x79, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x64, 0x69, 0x72,
+	0x74, 0x79, 0x12, 0x1c, 0x0a, 0x09, 0x77, 0x72, 0x69, 0x74, 0x65, 0x62, 0x61, 0x63, 0x6b, 0x18,
+	0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x77, 0x72, 0x69, 0x74, 0x65, 0x62, 0x61, 0x63, 0x6b,
+	0x12, 0x18, 0x0a, 0x08, 0x70, 0x67, 0x5f, 0x70, 0x67, 0x5f, 0x69, 0x6e, 0x18, 0x07, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x06, 0x70, 0x67, 0x50, 0x67, 0x49, 0x6e, 0x12, 0x1a, 0x0a, 0x09, 0x70, 0x67,
+	0x5f, 0x70, 0x67, 0x5f, 0x6f, 0x75, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x70,
+	0x67, 0x50, 0x67, 0x4f, 0x75, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x70, 0x67, 0x5f, 0x66, 0x61, 0x75,
+	0x6c, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x70, 0x67, 0x46, 0x61, 0x75, 0x6c,
+	0x74, 0x12, 0x20, 0x0a, 0x0c, 0x70, 0x67, 0x5f, 0x6d, 0x61, 0x6a, 0x5f, 0x66, 0x61, 0x75, 0x6c,
+	0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x70, 0x67, 0x4d, 0x61, 0x6a, 0x46, 0x61,
+	0x75, 0x6c, 0x74, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f,
+	0x61, 0x6e, 0x6f, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x69, 0x6e, 0x61, 0x63,
+	0x74, 0x69, 0x76, 0x65, 0x41, 0x6e, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x5f, 0x61, 0x6e, 0x6f, 0x6e, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x61,
+	0x63, 0x74, 0x69, 0x76, 0x65, 0x41, 0x6e, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x61,
+	0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x0c, 0x69, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1f,
+	0x0a, 0x0b, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x0e, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x0a, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12,
+	0x20, 0x0a, 0x0b, 0x75, 0x6e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x0f,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x75, 0x6e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x61, 0x62, 0x6c,
+	0x65, 0x12, 0x3a, 0x0a, 0x19, 0x68, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x69, 0x63, 0x61,
+	0x6c, 0x5f, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x10,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x17, 0x68, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x69, 0x63,
+	0x61, 0x6c, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x36, 0x0a,
+	0x17, 0x68, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x69, 0x63, 0x61, 0x6c, 0x5f, 0x73, 0x77,
+	0x61, 0x70, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x11, 0x20, 0x01, 0x28, 0x04, 0x52, 0x15,
+	0x68, 0x69, 0x65, 0x72, 0x61, 0x72, 0x63, 0x68, 0x69, 0x63, 0x61, 0x6c, 0x53, 0x77, 0x61, 0x70,
+	0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x63,
+	0x61, 0x63, 0x68, 0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x74, 0x6f, 0x74, 0x61,
+	0x6c, 0x43, 0x61, 0x63, 0x68, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f,
+	0x72, 0x73, 0x73, 0x18, 0x13, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x74, 0x6f, 0x74, 0x61, 0x6c,
+	0x52, 0x73, 0x73, 0x12, 0x24, 0x0a, 0x0e, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x72, 0x73, 0x73,
+	0x5f, 0x68, 0x75, 0x67, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x74, 0x6f, 0x74,
+	0x61, 0x6c, 0x52, 0x73, 0x73, 0x48, 0x75, 0x67, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x74, 0x6f, 0x74,
+	0x61, 0x6c, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x15,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x0f, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x4d, 0x61, 0x70, 0x70, 0x65,
+	0x64, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x64,
+	0x69, 0x72, 0x74, 0x79, 0x18, 0x16, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x74, 0x6f, 0x74, 0x61,
+	0x6c, 0x44, 0x69, 0x72, 0x74, 0x79, 0x12, 0x27, 0x0a, 0x0f, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f,
+	0x77, 0x72, 0x69, 0x74, 0x65, 0x62, 0x61, 0x63, 0x6b, 0x18, 0x17, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x0e, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x57, 0x72, 0x69, 0x74, 0x65, 0x62, 0x61, 0x63, 0x6b, 0x12,
+	0x23, 0x0a, 0x0e, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x70, 0x67, 0x5f, 0x70, 0x67, 0x5f, 0x69,
+	0x6e, 0x18, 0x18, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x50, 0x67,
+	0x50, 0x67, 0x49, 0x6e, 0x12, 0x25, 0x0a, 0x0f, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x70, 0x67,
+	0x5f, 0x70, 0x67, 0x5f, 0x6f, 0x75, 0x74, 0x18, 0x19, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x74,
+	0x6f, 0x74, 0x61, 0x6c, 0x50, 0x67, 0x50, 0x67, 0x4f, 0x75, 0x74, 0x12, 0x24, 0x0a, 0x0e, 0x74,
+	0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x70, 0x67, 0x5f, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x1a, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x0c, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x50, 0x67, 0x46, 0x61, 0x75, 0x6c,
+	0x74, 0x12, 0x2b, 0x0a, 0x12, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x70, 0x67, 0x5f, 0x6d, 0x61,
+	0x6a, 0x5f, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0f, 0x74,
+	0x6f, 0x74, 0x61, 0x6c, 0x50, 0x67, 0x4d, 0x61, 0x6a, 0x46, 0x61, 0x75, 0x6c, 0x74, 0x12, 0x2e,
+	0x0a, 0x13, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x69, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65,
+	0x5f, 0x61, 0x6e, 0x6f, 0x6e, 0x18, 0x1c, 0x20, 0x01, 0x28, 0x04, 0x52, 0x11, 0x74, 0x6f, 0x74,
+	0x61, 0x6c, 0x49, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x41, 0x6e, 0x6f, 0x6e, 0x12, 0x2a,
+	0x0a, 0x11, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x61,
+	0x6e, 0x6f, 0x6e, 0x18, 0x1d, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0f, 0x74, 0x6f, 0x74, 0x61, 0x6c,
+	0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x41, 0x6e, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x13, 0x74, 0x6f,
+	0x74, 0x61, 0x6c, 0x5f, 0x69, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x66, 0x69, 0x6c,
+	0x65, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x04, 0x52, 0x11, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x49, 0x6e,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x2a, 0x0a, 0x11, 0x74, 0x6f,
+	0x74, 0x61, 0x6c, 0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18,
+	0x1f, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0f, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x41, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x2b, 0x0a, 0x11, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x5f,
+	0x75, 0x6e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x20, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x10, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x55, 0x6e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x61,
+	0x62, 0x6c, 0x65, 0x12, 0x3b, 0x0a, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x21, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65,
+	0x6d, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65,
+	0x12, 0x39, 0x0a, 0x04, 0x73, 0x77, 0x61, 0x70, 0x18, 0x22, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25,
+	0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x04, 0x73, 0x77, 0x61, 0x70, 0x12, 0x3d, 0x0a, 0x06, 0x6b,
+	0x65, 0x72, 0x6e, 0x65, 0x6c, 0x18, 0x23, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x52, 0x06, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x12, 0x44, 0x0a, 0x0a, 0x6b, 0x65,
+	0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x74, 0x63, 0x70, 0x18, 0x24, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x25,
+	0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x09, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x54, 0x63, 0x70,
+	0x22, 0x65, 0x0a, 0x0b, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05,
+	0x6c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6d,
+	0x61, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x6d, 0x61, 0x78, 0x12, 0x18, 0x0a,
+	0x07, 0x66, 0x61, 0x69, 0x6c, 0x63, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07,
+	0x66, 0x61, 0x69, 0x6c, 0x63, 0x6e, 0x74, 0x22, 0x74, 0x0a, 0x10, 0x4d, 0x65, 0x6d, 0x6f, 0x72,
+	0x79, 0x4f, 0x6f, 0x6d, 0x43, 0x6f, 0x6e, 0x74, 0x72, 0x6f, 0x6c, 0x12, 0x28, 0x0a, 0x10, 0x6f,
+	0x6f, 0x6d, 0x5f, 0x6b, 0x69, 0x6c, 0x6c, 0x5f, 0x64, 0x69, 0x73, 0x61, 0x62, 0x6c, 0x65, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0e, 0x6f, 0x6f, 0x6d, 0x4b, 0x69, 0x6c, 0x6c, 0x44, 0x69,
+	0x73, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x5f, 0x6f,
+	0x6f, 0x6d, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x75, 0x6e, 0x64, 0x65, 0x72, 0x4f,
+	0x6f, 0x6d, 0x12, 0x19, 0x0a, 0x08, 0x6f, 0x6f, 0x6d, 0x5f, 0x6b, 0x69, 0x6c, 0x6c, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x6f, 0x6f, 0x6d, 0x4b, 0x69, 0x6c, 0x6c, 0x22, 0xd5, 0x05,
+	0x0a, 0x09, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x53, 0x74, 0x61, 0x74, 0x12, 0x61, 0x0a, 0x1a, 0x69,
+	0x6f, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x5f,
+	0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x17, 0x69, 0x6f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x42, 0x79, 0x74, 0x65, 0x73, 0x52, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x12, 0x58,
+	0x0a, 0x15, 0x69, 0x6f, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x64, 0x5f, 0x72, 0x65,
+	0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x13, 0x69, 0x6f, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x64, 0x52,
+	0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x12, 0x54, 0x0a, 0x13, 0x69, 0x6f, 0x5f, 0x71,
+	0x75, 0x65, 0x75, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18,
+	0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31,
+	0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x11, 0x69, 0x6f, 0x51,
+	0x75, 0x65, 0x75, 0x65, 0x64, 0x52, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x12, 0x5f,
+	0x0a, 0x19, 0x69, 0x6f, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x74, 0x69, 0x6d,
+	0x65, 0x5f, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x04, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x24, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b,
+	0x49, 0x4f, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x16, 0x69, 0x6f, 0x53, 0x65, 0x72, 0x76, 0x69,
+	0x63, 0x65, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x12,
+	0x59, 0x0a, 0x16, 0x69, 0x6f, 0x5f, 0x77, 0x61, 0x69, 0x74, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x5f,
+	0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x24, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x13, 0x69, 0x6f, 0x57, 0x61, 0x69, 0x74, 0x54, 0x69, 0x6d,
+	0x65, 0x52, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x12, 0x54, 0x0a, 0x13, 0x69, 0x6f,
+	0x5f, 0x6d, 0x65, 0x72, 0x67, 0x65, 0x64, 0x5f, 0x72, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76,
+	0x65, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e,
+	0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x11, 0x69,
+	0x6f, 0x4d, 0x65, 0x72, 0x67, 0x65, 0x64, 0x52, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65,
+	0x12, 0x50, 0x0a, 0x11, 0x69, 0x6f, 0x5f, 0x74, 0x69, 0x6d, 0x65, 0x5f, 0x72, 0x65, 0x63, 0x75,
+	0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e, 0x69, 0x6f,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x0f, 0x69, 0x6f, 0x54, 0x69, 0x6d, 0x65, 0x52, 0x65, 0x63, 0x75, 0x72, 0x73, 0x69,
+	0x76, 0x65, 0x12, 0x51, 0x0a, 0x11, 0x73, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x5f, 0x72, 0x65,
+	0x63, 0x75, 0x72, 0x73, 0x69, 0x76, 0x65, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x24, 0x2e,
+	0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67,
+	0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x52, 0x10, 0x73, 0x65, 0x63, 0x74, 0x6f, 0x72, 0x73, 0x52, 0x65, 0x63, 0x75,
+	0x72, 0x73, 0x69, 0x76, 0x65, 0x22, 0x76, 0x0a, 0x0a, 0x42, 0x6c, 0x6b, 0x49, 0x4f, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x6f, 0x70, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x6d,
+	0x61, 0x6a, 0x6f, 0x72, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x6d, 0x61, 0x6a, 0x6f,
+	0x72, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x69, 0x6e, 0x6f, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x05, 0x6d, 0x69, 0x6e, 0x6f, 0x72, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x22, 0x84, 0x01,
+	0x0a, 0x08, 0x52, 0x64, 0x6d, 0x61, 0x53, 0x74, 0x61, 0x74, 0x12, 0x3d, 0x0a, 0x07, 0x63, 0x75,
+	0x72, 0x72, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x69, 0x6f,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f,
+	0x75, 0x70, 0x73, 0x2e, 0x76, 0x31, 0x2e, 0x52, 0x64, 0x6d, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x52, 0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x12, 0x39, 0x0a, 0x05, 0x6c, 0x69, 0x6d,
+	0x69, 0x74, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73,
+	0x2e, 0x76, 0x31, 0x2e, 0x52, 0x64, 0x6d, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x6c,
+	0x69, 0x6d, 0x69, 0x74, 0x22, 0x65, 0x0a, 0x09, 0x52, 0x64, 0x6d, 0x61, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x64, 0x65, 0x76, 0x69, 0x63, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x63, 0x61,
+	0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a,
+	0x68, 0x63, 0x61, 0x48, 0x61, 0x6e, 0x64, 0x6c, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x63,
+	0x61, 0x5f, 0x6f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x0a, 0x68, 0x63, 0x61, 0x4f, 0x62, 0x6a, 0x65, 0x63, 0x74, 0x73, 0x22, 0x8d, 0x02, 0x0a, 0x0b,
+	0x4e, 0x65, 0x74, 0x77, 0x6f, 0x72, 0x6b, 0x53, 0x74, 0x61, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12,
+	0x19, 0x0a, 0x08, 0x72, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x07, 0x72, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78,
+	0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09,
+	0x72, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12, 0x1b, 0x0a, 0x09, 0x72, 0x78, 0x5f,
+	0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x72, 0x78,
+	0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x12, 0x1d, 0x0a, 0x0a, 0x72, 0x78, 0x5f, 0x64, 0x72, 0x6f,
+	0x70, 0x70, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x72, 0x78, 0x44, 0x72,
+	0x6f, 0x70, 0x70, 0x65, 0x64, 0x12, 0x19, 0x0a, 0x08, 0x74, 0x78, 0x5f, 0x62, 0x79, 0x74, 0x65,
+	0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x74, 0x78, 0x42, 0x79, 0x74, 0x65, 0x73,
+	0x12, 0x1d, 0x0a, 0x0a, 0x74, 0x78, 0x5f, 0x70, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x74, 0x78, 0x50, 0x61, 0x63, 0x6b, 0x65, 0x74, 0x73, 0x12,
+	0x1b, 0x0a, 0x09, 0x74, 0x78, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x18, 0x08, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x08, 0x74, 0x78, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x12, 0x1d, 0x0a, 0x0a,
+	0x74, 0x78, 0x5f, 0x64, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x09, 0x74, 0x78, 0x44, 0x72, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x22, 0xb9, 0x01, 0x0a, 0x0b,
+	0x43, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x6e,
+	0x72, 0x5f, 0x73, 0x6c, 0x65, 0x65, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x0a, 0x6e, 0x72, 0x53, 0x6c, 0x65, 0x65, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x1d, 0x0a, 0x0a,
+	0x6e, 0x72, 0x5f, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x09, 0x6e, 0x72, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x12, 0x1d, 0x0a, 0x0a, 0x6e,
+	0x72, 0x5f, 0x73, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x6e, 0x72, 0x53, 0x74, 0x6f, 0x70, 0x70, 0x65, 0x64, 0x12, 0x2d, 0x0a, 0x12, 0x6e, 0x72,
+	0x5f, 0x75, 0x6e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x72, 0x75, 0x70, 0x74, 0x69, 0x62, 0x6c, 0x65,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x11, 0x6e, 0x72, 0x55, 0x6e, 0x69, 0x6e, 0x74, 0x65,
+	0x72, 0x72, 0x75, 0x70, 0x74, 0x69, 0x62, 0x6c, 0x65, 0x12, 0x1c, 0x0a, 0x0a, 0x6e, 0x72, 0x5f,
+	0x69, 0x6f, 0x5f, 0x77, 0x61, 0x69, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x6e,
+	0x72, 0x49, 0x6f, 0x57, 0x61, 0x69, 0x74, 0x42, 0x2d, 0x5a, 0x2b, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x31,
+	0x2f, 0x73, 0x74, 0x61, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescOnce sync.Once
+	file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescData = file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDesc
+)
+
+func file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescGZIP() []byte {
+	file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescOnce.Do(func() {
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescData = protoimpl.X.CompressGZIP(file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescData)
+	})
+	return file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDescData
+}
+
+var file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes = make([]protoimpl.MessageInfo, 15)
+var file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_goTypes = []interface{}{
+	(*Metrics)(nil),          // 0: io.containerd.cgroups.v1.Metrics
+	(*HugetlbStat)(nil),      // 1: io.containerd.cgroups.v1.HugetlbStat
+	(*PidsStat)(nil),         // 2: io.containerd.cgroups.v1.PidsStat
+	(*CPUStat)(nil),          // 3: io.containerd.cgroups.v1.CPUStat
+	(*CPUUsage)(nil),         // 4: io.containerd.cgroups.v1.CPUUsage
+	(*Throttle)(nil),         // 5: io.containerd.cgroups.v1.Throttle
+	(*MemoryStat)(nil),       // 6: io.containerd.cgroups.v1.MemoryStat
+	(*MemoryEntry)(nil),      // 7: io.containerd.cgroups.v1.MemoryEntry
+	(*MemoryOomControl)(nil), // 8: io.containerd.cgroups.v1.MemoryOomControl
+	(*BlkIOStat)(nil),        // 9: io.containerd.cgroups.v1.BlkIOStat
+	(*BlkIOEntry)(nil),       // 10: io.containerd.cgroups.v1.BlkIOEntry
+	(*RdmaStat)(nil),         // 11: io.containerd.cgroups.v1.RdmaStat
+	(*RdmaEntry)(nil),        // 12: io.containerd.cgroups.v1.RdmaEntry
+	(*NetworkStat)(nil),      // 13: io.containerd.cgroups.v1.NetworkStat
+	(*CgroupStats)(nil),      // 14: io.containerd.cgroups.v1.CgroupStats
+}
+var file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_depIdxs = []int32{
+	1,  // 0: io.containerd.cgroups.v1.Metrics.hugetlb:type_name -> io.containerd.cgroups.v1.HugetlbStat
+	2,  // 1: io.containerd.cgroups.v1.Metrics.pids:type_name -> io.containerd.cgroups.v1.PidsStat
+	3,  // 2: io.containerd.cgroups.v1.Metrics.cpu:type_name -> io.containerd.cgroups.v1.CPUStat
+	6,  // 3: io.containerd.cgroups.v1.Metrics.memory:type_name -> io.containerd.cgroups.v1.MemoryStat
+	9,  // 4: io.containerd.cgroups.v1.Metrics.blkio:type_name -> io.containerd.cgroups.v1.BlkIOStat
+	11, // 5: io.containerd.cgroups.v1.Metrics.rdma:type_name -> io.containerd.cgroups.v1.RdmaStat
+	13, // 6: io.containerd.cgroups.v1.Metrics.network:type_name -> io.containerd.cgroups.v1.NetworkStat
+	14, // 7: io.containerd.cgroups.v1.Metrics.cgroup_stats:type_name -> io.containerd.cgroups.v1.CgroupStats
+	8,  // 8: io.containerd.cgroups.v1.Metrics.memory_oom_control:type_name -> io.containerd.cgroups.v1.MemoryOomControl
+	4,  // 9: io.containerd.cgroups.v1.CPUStat.usage:type_name -> io.containerd.cgroups.v1.CPUUsage
+	5,  // 10: io.containerd.cgroups.v1.CPUStat.throttling:type_name -> io.containerd.cgroups.v1.Throttle
+	7,  // 11: io.containerd.cgroups.v1.MemoryStat.usage:type_name -> io.containerd.cgroups.v1.MemoryEntry
+	7,  // 12: io.containerd.cgroups.v1.MemoryStat.swap:type_name -> io.containerd.cgroups.v1.MemoryEntry
+	7,  // 13: io.containerd.cgroups.v1.MemoryStat.kernel:type_name -> io.containerd.cgroups.v1.MemoryEntry
+	7,  // 14: io.containerd.cgroups.v1.MemoryStat.kernel_tcp:type_name -> io.containerd.cgroups.v1.MemoryEntry
+	10, // 15: io.containerd.cgroups.v1.BlkIOStat.io_service_bytes_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 16: io.containerd.cgroups.v1.BlkIOStat.io_serviced_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 17: io.containerd.cgroups.v1.BlkIOStat.io_queued_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 18: io.containerd.cgroups.v1.BlkIOStat.io_service_time_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 19: io.containerd.cgroups.v1.BlkIOStat.io_wait_time_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 20: io.containerd.cgroups.v1.BlkIOStat.io_merged_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 21: io.containerd.cgroups.v1.BlkIOStat.io_time_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	10, // 22: io.containerd.cgroups.v1.BlkIOStat.sectors_recursive:type_name -> io.containerd.cgroups.v1.BlkIOEntry
+	12, // 23: io.containerd.cgroups.v1.RdmaStat.current:type_name -> io.containerd.cgroups.v1.RdmaEntry
+	12, // 24: io.containerd.cgroups.v1.RdmaStat.limit:type_name -> io.containerd.cgroups.v1.RdmaEntry
+	25, // [25:25] is the sub-list for method output_type
+	25, // [25:25] is the sub-list for method input_type
+	25, // [25:25] is the sub-list for extension type_name
+	25, // [25:25] is the sub-list for extension extendee
+	0,  // [0:25] is the sub-list for field type_name
+}
+
+func init() { file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_init() }
+func file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_init() {
+	if File_github_com_containerd_cgroups_cgroup1_stats_metrics_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metrics); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HugetlbStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PidsStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CPUStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CPUUsage); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Throttle); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MemoryStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MemoryEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MemoryOomControl); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BlkIOStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*BlkIOEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RdmaStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RdmaEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*NetworkStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CgroupStats); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   15,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_goTypes,
+		DependencyIndexes: file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_depIdxs,
+		MessageInfos:      file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_msgTypes,
+	}.Build()
+	File_github_com_containerd_cgroups_cgroup1_stats_metrics_proto = out.File
+	file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_rawDesc = nil
+	file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_goTypes = nil
+	file_github_com_containerd_cgroups_cgroup1_stats_metrics_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.pb.txt b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.pb.txt
new file mode 100644
index 0000000000..7e4313ea58
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.pb.txt
@@ -0,0 +1,771 @@
+file {
+  name: "github.com/containerd/cgroups/cgroup1/stats/metrics.proto"
+  package: "io.containerd.cgroups.v1"
+  message_type {
+    name: "Metrics"
+    field {
+      name: "hugetlb"
+      number: 1
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.HugetlbStat"
+      json_name: "hugetlb"
+    }
+    field {
+      name: "pids"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.PidsStat"
+      json_name: "pids"
+    }
+    field {
+      name: "cpu"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.CPUStat"
+      json_name: "cpu"
+    }
+    field {
+      name: "memory"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.MemoryStat"
+      json_name: "memory"
+    }
+    field {
+      name: "blkio"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOStat"
+      json_name: "blkio"
+    }
+    field {
+      name: "rdma"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.RdmaStat"
+      json_name: "rdma"
+    }
+    field {
+      name: "network"
+      number: 7
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.NetworkStat"
+      json_name: "network"
+    }
+    field {
+      name: "cgroup_stats"
+      number: 8
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.CgroupStats"
+      json_name: "cgroupStats"
+    }
+    field {
+      name: "memory_oom_control"
+      number: 9
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.MemoryOomControl"
+      json_name: "memoryOomControl"
+    }
+  }
+  message_type {
+    name: "HugetlbStat"
+    field {
+      name: "usage"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "usage"
+    }
+    field {
+      name: "max"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "max"
+    }
+    field {
+      name: "failcnt"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "failcnt"
+    }
+    field {
+      name: "pagesize"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "pagesize"
+    }
+  }
+  message_type {
+    name: "PidsStat"
+    field {
+      name: "current"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "current"
+    }
+    field {
+      name: "limit"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "limit"
+    }
+  }
+  message_type {
+    name: "CPUStat"
+    field {
+      name: "usage"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.CPUUsage"
+      json_name: "usage"
+    }
+    field {
+      name: "throttling"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.Throttle"
+      json_name: "throttling"
+    }
+  }
+  message_type {
+    name: "CPUUsage"
+    field {
+      name: "total"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "total"
+    }
+    field {
+      name: "kernel"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "kernel"
+    }
+    field {
+      name: "user"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "user"
+    }
+    field {
+      name: "per_cpu"
+      number: 4
+      label: LABEL_REPEATED
+      type: TYPE_UINT64
+      json_name: "perCpu"
+    }
+  }
+  message_type {
+    name: "Throttle"
+    field {
+      name: "periods"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "periods"
+    }
+    field {
+      name: "throttled_periods"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "throttledPeriods"
+    }
+    field {
+      name: "throttled_time"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "throttledTime"
+    }
+  }
+  message_type {
+    name: "MemoryStat"
+    field {
+      name: "cache"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "cache"
+    }
+    field {
+      name: "rss"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rss"
+    }
+    field {
+      name: "rss_huge"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rssHuge"
+    }
+    field {
+      name: "mapped_file"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "mappedFile"
+    }
+    field {
+      name: "dirty"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "dirty"
+    }
+    field {
+      name: "writeback"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "writeback"
+    }
+    field {
+      name: "pg_pg_in"
+      number: 7
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgPgIn"
+    }
+    field {
+      name: "pg_pg_out"
+      number: 8
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgPgOut"
+    }
+    field {
+      name: "pg_fault"
+      number: 9
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgFault"
+    }
+    field {
+      name: "pg_maj_fault"
+      number: 10
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgMajFault"
+    }
+    field {
+      name: "inactive_anon"
+      number: 11
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "inactiveAnon"
+    }
+    field {
+      name: "active_anon"
+      number: 12
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "activeAnon"
+    }
+    field {
+      name: "inactive_file"
+      number: 13
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "inactiveFile"
+    }
+    field {
+      name: "active_file"
+      number: 14
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "activeFile"
+    }
+    field {
+      name: "unevictable"
+      number: 15
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "unevictable"
+    }
+    field {
+      name: "hierarchical_memory_limit"
+      number: 16
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "hierarchicalMemoryLimit"
+    }
+    field {
+      name: "hierarchical_swap_limit"
+      number: 17
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "hierarchicalSwapLimit"
+    }
+    field {
+      name: "total_cache"
+      number: 18
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalCache"
+    }
+    field {
+      name: "total_rss"
+      number: 19
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalRss"
+    }
+    field {
+      name: "total_rss_huge"
+      number: 20
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalRssHuge"
+    }
+    field {
+      name: "total_mapped_file"
+      number: 21
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalMappedFile"
+    }
+    field {
+      name: "total_dirty"
+      number: 22
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalDirty"
+    }
+    field {
+      name: "total_writeback"
+      number: 23
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalWriteback"
+    }
+    field {
+      name: "total_pg_pg_in"
+      number: 24
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalPgPgIn"
+    }
+    field {
+      name: "total_pg_pg_out"
+      number: 25
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalPgPgOut"
+    }
+    field {
+      name: "total_pg_fault"
+      number: 26
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalPgFault"
+    }
+    field {
+      name: "total_pg_maj_fault"
+      number: 27
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalPgMajFault"
+    }
+    field {
+      name: "total_inactive_anon"
+      number: 28
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalInactiveAnon"
+    }
+    field {
+      name: "total_active_anon"
+      number: 29
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalActiveAnon"
+    }
+    field {
+      name: "total_inactive_file"
+      number: 30
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalInactiveFile"
+    }
+    field {
+      name: "total_active_file"
+      number: 31
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalActiveFile"
+    }
+    field {
+      name: "total_unevictable"
+      number: 32
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "totalUnevictable"
+    }
+    field {
+      name: "usage"
+      number: 33
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.MemoryEntry"
+      json_name: "usage"
+    }
+    field {
+      name: "swap"
+      number: 34
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.MemoryEntry"
+      json_name: "swap"
+    }
+    field {
+      name: "kernel"
+      number: 35
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.MemoryEntry"
+      json_name: "kernel"
+    }
+    field {
+      name: "kernel_tcp"
+      number: 36
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.MemoryEntry"
+      json_name: "kernelTcp"
+    }
+  }
+  message_type {
+    name: "MemoryEntry"
+    field {
+      name: "limit"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "limit"
+    }
+    field {
+      name: "usage"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "usage"
+    }
+    field {
+      name: "max"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "max"
+    }
+    field {
+      name: "failcnt"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "failcnt"
+    }
+  }
+  message_type {
+    name: "MemoryOomControl"
+    field {
+      name: "oom_kill_disable"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "oomKillDisable"
+    }
+    field {
+      name: "under_oom"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "underOom"
+    }
+    field {
+      name: "oom_kill"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "oomKill"
+    }
+  }
+  message_type {
+    name: "BlkIOStat"
+    field {
+      name: "io_service_bytes_recursive"
+      number: 1
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioServiceBytesRecursive"
+    }
+    field {
+      name: "io_serviced_recursive"
+      number: 2
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioServicedRecursive"
+    }
+    field {
+      name: "io_queued_recursive"
+      number: 3
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioQueuedRecursive"
+    }
+    field {
+      name: "io_service_time_recursive"
+      number: 4
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioServiceTimeRecursive"
+    }
+    field {
+      name: "io_wait_time_recursive"
+      number: 5
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioWaitTimeRecursive"
+    }
+    field {
+      name: "io_merged_recursive"
+      number: 6
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioMergedRecursive"
+    }
+    field {
+      name: "io_time_recursive"
+      number: 7
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "ioTimeRecursive"
+    }
+    field {
+      name: "sectors_recursive"
+      number: 8
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.BlkIOEntry"
+      json_name: "sectorsRecursive"
+    }
+  }
+  message_type {
+    name: "BlkIOEntry"
+    field {
+      name: "op"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "op"
+    }
+    field {
+      name: "device"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "device"
+    }
+    field {
+      name: "major"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "major"
+    }
+    field {
+      name: "minor"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "minor"
+    }
+    field {
+      name: "value"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "value"
+    }
+  }
+  message_type {
+    name: "RdmaStat"
+    field {
+      name: "current"
+      number: 1
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.RdmaEntry"
+      json_name: "current"
+    }
+    field {
+      name: "limit"
+      number: 2
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v1.RdmaEntry"
+      json_name: "limit"
+    }
+  }
+  message_type {
+    name: "RdmaEntry"
+    field {
+      name: "device"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "device"
+    }
+    field {
+      name: "hca_handles"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT32
+      json_name: "hcaHandles"
+    }
+    field {
+      name: "hca_objects"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT32
+      json_name: "hcaObjects"
+    }
+  }
+  message_type {
+    name: "NetworkStat"
+    field {
+      name: "name"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "name"
+    }
+    field {
+      name: "rx_bytes"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rxBytes"
+    }
+    field {
+      name: "rx_packets"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rxPackets"
+    }
+    field {
+      name: "rx_errors"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rxErrors"
+    }
+    field {
+      name: "rx_dropped"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rxDropped"
+    }
+    field {
+      name: "tx_bytes"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "txBytes"
+    }
+    field {
+      name: "tx_packets"
+      number: 7
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "txPackets"
+    }
+    field {
+      name: "tx_errors"
+      number: 8
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "txErrors"
+    }
+    field {
+      name: "tx_dropped"
+      number: 9
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "txDropped"
+    }
+  }
+  message_type {
+    name: "CgroupStats"
+    field {
+      name: "nr_sleeping"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrSleeping"
+    }
+    field {
+      name: "nr_running"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrRunning"
+    }
+    field {
+      name: "nr_stopped"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrStopped"
+    }
+    field {
+      name: "nr_uninterruptible"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrUninterruptible"
+    }
+    field {
+      name: "nr_io_wait"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrIoWait"
+    }
+  }
+  options {
+    go_package: "github.com/containerd/cgroups/cgroup1/stats"
+  }
+  syntax: "proto3"
+}
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.proto b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.proto
new file mode 100644
index 0000000000..e6e4444b1b
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup1/stats/metrics.proto
@@ -0,0 +1,158 @@
+syntax = "proto3";
+
+package io.containerd.cgroups.v1;
+
+option go_package = "github.com/containerd/cgroups/cgroup1/stats";
+
+message Metrics {
+	repeated HugetlbStat hugetlb = 1;
+	PidsStat pids = 2;
+	CPUStat cpu = 3;
+	MemoryStat memory = 4;
+	BlkIOStat blkio = 5;
+	RdmaStat rdma = 6;
+	repeated NetworkStat network = 7;
+	CgroupStats cgroup_stats = 8;
+	MemoryOomControl memory_oom_control = 9;
+}
+
+message HugetlbStat {
+	uint64 usage = 1;
+	uint64 max = 2;
+	uint64 failcnt = 3;
+	string pagesize = 4;
+}
+
+message PidsStat {
+	uint64 current = 1;
+	uint64 limit = 2;
+}
+
+message CPUStat {
+	CPUUsage usage = 1;
+	Throttle throttling = 2;
+}
+
+message CPUUsage {
+	// values in nanoseconds
+	uint64 total = 1;
+	uint64 kernel = 2;
+	uint64 user = 3;
+	repeated uint64 per_cpu = 4;
+
+}
+
+message Throttle {
+	uint64 periods = 1;
+	uint64 throttled_periods = 2;
+	uint64 throttled_time = 3;
+}
+
+message MemoryStat {
+	uint64 cache = 1;
+	uint64 rss = 2;
+	uint64 rss_huge = 3;
+	uint64 mapped_file = 4;
+	uint64 dirty = 5;
+	uint64 writeback = 6;
+	uint64 pg_pg_in = 7;
+	uint64 pg_pg_out = 8;
+	uint64 pg_fault = 9;
+	uint64 pg_maj_fault = 10;
+	uint64 inactive_anon = 11;
+	uint64 active_anon = 12;
+	uint64 inactive_file = 13;
+	uint64 active_file = 14;
+	uint64 unevictable = 15;
+	uint64 hierarchical_memory_limit = 16;
+	uint64 hierarchical_swap_limit = 17;
+	uint64 total_cache = 18;
+	uint64 total_rss = 19;
+	uint64 total_rss_huge = 20;
+	uint64 total_mapped_file = 21;
+	uint64 total_dirty = 22;
+	uint64 total_writeback = 23;
+	uint64 total_pg_pg_in = 24;
+	uint64 total_pg_pg_out = 25;
+	uint64 total_pg_fault = 26;
+	uint64 total_pg_maj_fault = 27;
+	uint64 total_inactive_anon = 28;
+	uint64 total_active_anon = 29;
+	uint64 total_inactive_file = 30;
+	uint64 total_active_file = 31;
+	uint64 total_unevictable = 32;
+	MemoryEntry usage = 33;
+	MemoryEntry swap = 34;
+	MemoryEntry kernel = 35;
+	MemoryEntry kernel_tcp = 36;
+
+}
+
+message MemoryEntry {
+	uint64 limit = 1;
+	uint64 usage = 2;
+	uint64 max = 3;
+	uint64 failcnt = 4;
+}
+
+message MemoryOomControl {
+	uint64 oom_kill_disable = 1;
+	uint64 under_oom = 2;
+	uint64 oom_kill = 3;
+}
+
+message BlkIOStat {
+	repeated BlkIOEntry io_service_bytes_recursive = 1;
+	repeated BlkIOEntry io_serviced_recursive = 2;
+	repeated BlkIOEntry io_queued_recursive = 3;
+	repeated BlkIOEntry io_service_time_recursive = 4;
+	repeated BlkIOEntry io_wait_time_recursive = 5;
+	repeated BlkIOEntry io_merged_recursive = 6;
+	repeated BlkIOEntry io_time_recursive = 7;
+	repeated BlkIOEntry sectors_recursive = 8;
+}
+
+message BlkIOEntry {
+	string op = 1;
+	string device = 2;
+	uint64 major = 3;
+	uint64 minor = 4;
+	uint64 value = 5;
+}
+
+message RdmaStat {
+	repeated RdmaEntry current = 1;
+	repeated RdmaEntry limit = 2;
+}
+
+message RdmaEntry {
+	string device = 1;
+	uint32 hca_handles = 2;
+	uint32 hca_objects = 3;
+}
+
+message NetworkStat {
+	string name = 1;
+	uint64 rx_bytes = 2;
+	uint64 rx_packets = 3;
+	uint64 rx_errors  = 4;
+	uint64 rx_dropped = 5;
+	uint64 tx_bytes = 6;
+	uint64 tx_packets = 7;
+	uint64 tx_errors = 8;
+	uint64 tx_dropped = 9;
+}
+
+// CgroupStats exports per-cgroup statistics.
+message CgroupStats {
+	// number of tasks sleeping
+	uint64 nr_sleeping = 1;
+	// number of tasks running
+	uint64 nr_running = 2;
+	// number of tasks in stopped state
+	uint64 nr_stopped = 3;
+	// number of tasks in uninterruptible state
+	uint64 nr_uninterruptible = 4;
+	// number of tasks waiting on IO
+	uint64 nr_io_wait = 5;
+}
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/doc.go b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/doc.go
new file mode 100644
index 0000000000..e51e12f800
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/doc.go
@@ -0,0 +1,17 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package stats
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.pb.go b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.pb.go
new file mode 100644
index 0000000000..3d53c224ce
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.pb.go
@@ -0,0 +1,1558 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        v3.21.5
+// source: github.com/containerd/cgroups/cgroup2/stats/metrics.proto
+
+package stats
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Metrics struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pids         *PidsStat      `protobuf:"bytes,1,opt,name=pids,proto3" json:"pids,omitempty"`
+	CPU          *CPUStat       `protobuf:"bytes,2,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	Memory       *MemoryStat    `protobuf:"bytes,4,opt,name=memory,proto3" json:"memory,omitempty"`
+	Rdma         *RdmaStat      `protobuf:"bytes,5,opt,name=rdma,proto3" json:"rdma,omitempty"`
+	Io           *IOStat        `protobuf:"bytes,6,opt,name=io,proto3" json:"io,omitempty"`
+	Hugetlb      []*HugeTlbStat `protobuf:"bytes,7,rep,name=hugetlb,proto3" json:"hugetlb,omitempty"`
+	MemoryEvents *MemoryEvents  `protobuf:"bytes,8,opt,name=memory_events,json=memoryEvents,proto3" json:"memory_events,omitempty"`
+}
+
+func (x *Metrics) Reset() {
+	*x = Metrics{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metrics) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metrics) ProtoMessage() {}
+
+func (x *Metrics) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metrics.ProtoReflect.Descriptor instead.
+func (*Metrics) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Metrics) GetPids() *PidsStat {
+	if x != nil {
+		return x.Pids
+	}
+	return nil
+}
+
+func (x *Metrics) GetCPU() *CPUStat {
+	if x != nil {
+		return x.CPU
+	}
+	return nil
+}
+
+func (x *Metrics) GetMemory() *MemoryStat {
+	if x != nil {
+		return x.Memory
+	}
+	return nil
+}
+
+func (x *Metrics) GetRdma() *RdmaStat {
+	if x != nil {
+		return x.Rdma
+	}
+	return nil
+}
+
+func (x *Metrics) GetIo() *IOStat {
+	if x != nil {
+		return x.Io
+	}
+	return nil
+}
+
+func (x *Metrics) GetHugetlb() []*HugeTlbStat {
+	if x != nil {
+		return x.Hugetlb
+	}
+	return nil
+}
+
+func (x *Metrics) GetMemoryEvents() *MemoryEvents {
+	if x != nil {
+		return x.MemoryEvents
+	}
+	return nil
+}
+
+type PSIData struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Avg10  float64 `protobuf:"fixed64,1,opt,name=avg10,proto3" json:"avg10,omitempty"`
+	Avg60  float64 `protobuf:"fixed64,2,opt,name=avg60,proto3" json:"avg60,omitempty"`
+	Avg300 float64 `protobuf:"fixed64,3,opt,name=avg300,proto3" json:"avg300,omitempty"`
+	Total  uint64  `protobuf:"varint,4,opt,name=total,proto3" json:"total,omitempty"`
+}
+
+func (x *PSIData) Reset() {
+	*x = PSIData{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PSIData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PSIData) ProtoMessage() {}
+
+func (x *PSIData) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PSIData.ProtoReflect.Descriptor instead.
+func (*PSIData) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *PSIData) GetAvg10() float64 {
+	if x != nil {
+		return x.Avg10
+	}
+	return 0
+}
+
+func (x *PSIData) GetAvg60() float64 {
+	if x != nil {
+		return x.Avg60
+	}
+	return 0
+}
+
+func (x *PSIData) GetAvg300() float64 {
+	if x != nil {
+		return x.Avg300
+	}
+	return 0
+}
+
+func (x *PSIData) GetTotal() uint64 {
+	if x != nil {
+		return x.Total
+	}
+	return 0
+}
+
+type PSIStats struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Some *PSIData `protobuf:"bytes,1,opt,name=some,proto3" json:"some,omitempty"`
+	Full *PSIData `protobuf:"bytes,2,opt,name=full,proto3" json:"full,omitempty"`
+}
+
+func (x *PSIStats) Reset() {
+	*x = PSIStats{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PSIStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PSIStats) ProtoMessage() {}
+
+func (x *PSIStats) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PSIStats.ProtoReflect.Descriptor instead.
+func (*PSIStats) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *PSIStats) GetSome() *PSIData {
+	if x != nil {
+		return x.Some
+	}
+	return nil
+}
+
+func (x *PSIStats) GetFull() *PSIData {
+	if x != nil {
+		return x.Full
+	}
+	return nil
+}
+
+type PidsStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Current uint64 `protobuf:"varint,1,opt,name=current,proto3" json:"current,omitempty"`
+	Limit   uint64 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
+}
+
+func (x *PidsStat) Reset() {
+	*x = PidsStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PidsStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PidsStat) ProtoMessage() {}
+
+func (x *PidsStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PidsStat.ProtoReflect.Descriptor instead.
+func (*PidsStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *PidsStat) GetCurrent() uint64 {
+	if x != nil {
+		return x.Current
+	}
+	return 0
+}
+
+func (x *PidsStat) GetLimit() uint64 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+type CPUStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	UsageUsec     uint64    `protobuf:"varint,1,opt,name=usage_usec,json=usageUsec,proto3" json:"usage_usec,omitempty"`
+	UserUsec      uint64    `protobuf:"varint,2,opt,name=user_usec,json=userUsec,proto3" json:"user_usec,omitempty"`
+	SystemUsec    uint64    `protobuf:"varint,3,opt,name=system_usec,json=systemUsec,proto3" json:"system_usec,omitempty"`
+	NrPeriods     uint64    `protobuf:"varint,4,opt,name=nr_periods,json=nrPeriods,proto3" json:"nr_periods,omitempty"`
+	NrThrottled   uint64    `protobuf:"varint,5,opt,name=nr_throttled,json=nrThrottled,proto3" json:"nr_throttled,omitempty"`
+	ThrottledUsec uint64    `protobuf:"varint,6,opt,name=throttled_usec,json=throttledUsec,proto3" json:"throttled_usec,omitempty"`
+	PSI           *PSIStats `protobuf:"bytes,7,opt,name=psi,proto3" json:"psi,omitempty"`
+}
+
+func (x *CPUStat) Reset() {
+	*x = CPUStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CPUStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CPUStat) ProtoMessage() {}
+
+func (x *CPUStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CPUStat.ProtoReflect.Descriptor instead.
+func (*CPUStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *CPUStat) GetUsageUsec() uint64 {
+	if x != nil {
+		return x.UsageUsec
+	}
+	return 0
+}
+
+func (x *CPUStat) GetUserUsec() uint64 {
+	if x != nil {
+		return x.UserUsec
+	}
+	return 0
+}
+
+func (x *CPUStat) GetSystemUsec() uint64 {
+	if x != nil {
+		return x.SystemUsec
+	}
+	return 0
+}
+
+func (x *CPUStat) GetNrPeriods() uint64 {
+	if x != nil {
+		return x.NrPeriods
+	}
+	return 0
+}
+
+func (x *CPUStat) GetNrThrottled() uint64 {
+	if x != nil {
+		return x.NrThrottled
+	}
+	return 0
+}
+
+func (x *CPUStat) GetThrottledUsec() uint64 {
+	if x != nil {
+		return x.ThrottledUsec
+	}
+	return 0
+}
+
+func (x *CPUStat) GetPSI() *PSIStats {
+	if x != nil {
+		return x.PSI
+	}
+	return nil
+}
+
+type MemoryStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Anon                  uint64    `protobuf:"varint,1,opt,name=anon,proto3" json:"anon,omitempty"`
+	File                  uint64    `protobuf:"varint,2,opt,name=file,proto3" json:"file,omitempty"`
+	KernelStack           uint64    `protobuf:"varint,3,opt,name=kernel_stack,json=kernelStack,proto3" json:"kernel_stack,omitempty"`
+	Slab                  uint64    `protobuf:"varint,4,opt,name=slab,proto3" json:"slab,omitempty"`
+	Sock                  uint64    `protobuf:"varint,5,opt,name=sock,proto3" json:"sock,omitempty"`
+	Shmem                 uint64    `protobuf:"varint,6,opt,name=shmem,proto3" json:"shmem,omitempty"`
+	FileMapped            uint64    `protobuf:"varint,7,opt,name=file_mapped,json=fileMapped,proto3" json:"file_mapped,omitempty"`
+	FileDirty             uint64    `protobuf:"varint,8,opt,name=file_dirty,json=fileDirty,proto3" json:"file_dirty,omitempty"`
+	FileWriteback         uint64    `protobuf:"varint,9,opt,name=file_writeback,json=fileWriteback,proto3" json:"file_writeback,omitempty"`
+	AnonThp               uint64    `protobuf:"varint,10,opt,name=anon_thp,json=anonThp,proto3" json:"anon_thp,omitempty"`
+	InactiveAnon          uint64    `protobuf:"varint,11,opt,name=inactive_anon,json=inactiveAnon,proto3" json:"inactive_anon,omitempty"`
+	ActiveAnon            uint64    `protobuf:"varint,12,opt,name=active_anon,json=activeAnon,proto3" json:"active_anon,omitempty"`
+	InactiveFile          uint64    `protobuf:"varint,13,opt,name=inactive_file,json=inactiveFile,proto3" json:"inactive_file,omitempty"`
+	ActiveFile            uint64    `protobuf:"varint,14,opt,name=active_file,json=activeFile,proto3" json:"active_file,omitempty"`
+	Unevictable           uint64    `protobuf:"varint,15,opt,name=unevictable,proto3" json:"unevictable,omitempty"`
+	SlabReclaimable       uint64    `protobuf:"varint,16,opt,name=slab_reclaimable,json=slabReclaimable,proto3" json:"slab_reclaimable,omitempty"`
+	SlabUnreclaimable     uint64    `protobuf:"varint,17,opt,name=slab_unreclaimable,json=slabUnreclaimable,proto3" json:"slab_unreclaimable,omitempty"`
+	Pgfault               uint64    `protobuf:"varint,18,opt,name=pgfault,proto3" json:"pgfault,omitempty"`
+	Pgmajfault            uint64    `protobuf:"varint,19,opt,name=pgmajfault,proto3" json:"pgmajfault,omitempty"`
+	WorkingsetRefault     uint64    `protobuf:"varint,20,opt,name=workingset_refault,json=workingsetRefault,proto3" json:"workingset_refault,omitempty"`
+	WorkingsetActivate    uint64    `protobuf:"varint,21,opt,name=workingset_activate,json=workingsetActivate,proto3" json:"workingset_activate,omitempty"`
+	WorkingsetNodereclaim uint64    `protobuf:"varint,22,opt,name=workingset_nodereclaim,json=workingsetNodereclaim,proto3" json:"workingset_nodereclaim,omitempty"`
+	Pgrefill              uint64    `protobuf:"varint,23,opt,name=pgrefill,proto3" json:"pgrefill,omitempty"`
+	Pgscan                uint64    `protobuf:"varint,24,opt,name=pgscan,proto3" json:"pgscan,omitempty"`
+	Pgsteal               uint64    `protobuf:"varint,25,opt,name=pgsteal,proto3" json:"pgsteal,omitempty"`
+	Pgactivate            uint64    `protobuf:"varint,26,opt,name=pgactivate,proto3" json:"pgactivate,omitempty"`
+	Pgdeactivate          uint64    `protobuf:"varint,27,opt,name=pgdeactivate,proto3" json:"pgdeactivate,omitempty"`
+	Pglazyfree            uint64    `protobuf:"varint,28,opt,name=pglazyfree,proto3" json:"pglazyfree,omitempty"`
+	Pglazyfreed           uint64    `protobuf:"varint,29,opt,name=pglazyfreed,proto3" json:"pglazyfreed,omitempty"`
+	ThpFaultAlloc         uint64    `protobuf:"varint,30,opt,name=thp_fault_alloc,json=thpFaultAlloc,proto3" json:"thp_fault_alloc,omitempty"`
+	ThpCollapseAlloc      uint64    `protobuf:"varint,31,opt,name=thp_collapse_alloc,json=thpCollapseAlloc,proto3" json:"thp_collapse_alloc,omitempty"`
+	Usage                 uint64    `protobuf:"varint,32,opt,name=usage,proto3" json:"usage,omitempty"`
+	UsageLimit            uint64    `protobuf:"varint,33,opt,name=usage_limit,json=usageLimit,proto3" json:"usage_limit,omitempty"`
+	SwapUsage             uint64    `protobuf:"varint,34,opt,name=swap_usage,json=swapUsage,proto3" json:"swap_usage,omitempty"`
+	SwapLimit             uint64    `protobuf:"varint,35,opt,name=swap_limit,json=swapLimit,proto3" json:"swap_limit,omitempty"`
+	MaxUsage              uint64    `protobuf:"varint,36,opt,name=max_usage,json=maxUsage,proto3" json:"max_usage,omitempty"`
+	SwapMaxUsage          uint64    `protobuf:"varint,37,opt,name=swap_max_usage,json=swapMaxUsage,proto3" json:"swap_max_usage,omitempty"`
+	PSI                   *PSIStats `protobuf:"bytes,38,opt,name=psi,proto3" json:"psi,omitempty"`
+}
+
+func (x *MemoryStat) Reset() {
+	*x = MemoryStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MemoryStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoryStat) ProtoMessage() {}
+
+func (x *MemoryStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoryStat.ProtoReflect.Descriptor instead.
+func (*MemoryStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *MemoryStat) GetAnon() uint64 {
+	if x != nil {
+		return x.Anon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetFile() uint64 {
+	if x != nil {
+		return x.File
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetKernelStack() uint64 {
+	if x != nil {
+		return x.KernelStack
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSlab() uint64 {
+	if x != nil {
+		return x.Slab
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSock() uint64 {
+	if x != nil {
+		return x.Sock
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetShmem() uint64 {
+	if x != nil {
+		return x.Shmem
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetFileMapped() uint64 {
+	if x != nil {
+		return x.FileMapped
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetFileDirty() uint64 {
+	if x != nil {
+		return x.FileDirty
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetFileWriteback() uint64 {
+	if x != nil {
+		return x.FileWriteback
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetAnonThp() uint64 {
+	if x != nil {
+		return x.AnonThp
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetInactiveAnon() uint64 {
+	if x != nil {
+		return x.InactiveAnon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetActiveAnon() uint64 {
+	if x != nil {
+		return x.ActiveAnon
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetInactiveFile() uint64 {
+	if x != nil {
+		return x.InactiveFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetActiveFile() uint64 {
+	if x != nil {
+		return x.ActiveFile
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetUnevictable() uint64 {
+	if x != nil {
+		return x.Unevictable
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSlabReclaimable() uint64 {
+	if x != nil {
+		return x.SlabReclaimable
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSlabUnreclaimable() uint64 {
+	if x != nil {
+		return x.SlabUnreclaimable
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgfault() uint64 {
+	if x != nil {
+		return x.Pgfault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgmajfault() uint64 {
+	if x != nil {
+		return x.Pgmajfault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetWorkingsetRefault() uint64 {
+	if x != nil {
+		return x.WorkingsetRefault
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetWorkingsetActivate() uint64 {
+	if x != nil {
+		return x.WorkingsetActivate
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetWorkingsetNodereclaim() uint64 {
+	if x != nil {
+		return x.WorkingsetNodereclaim
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgrefill() uint64 {
+	if x != nil {
+		return x.Pgrefill
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgscan() uint64 {
+	if x != nil {
+		return x.Pgscan
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgsteal() uint64 {
+	if x != nil {
+		return x.Pgsteal
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgactivate() uint64 {
+	if x != nil {
+		return x.Pgactivate
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPgdeactivate() uint64 {
+	if x != nil {
+		return x.Pgdeactivate
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPglazyfree() uint64 {
+	if x != nil {
+		return x.Pglazyfree
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPglazyfreed() uint64 {
+	if x != nil {
+		return x.Pglazyfreed
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetThpFaultAlloc() uint64 {
+	if x != nil {
+		return x.ThpFaultAlloc
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetThpCollapseAlloc() uint64 {
+	if x != nil {
+		return x.ThpCollapseAlloc
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetUsage() uint64 {
+	if x != nil {
+		return x.Usage
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetUsageLimit() uint64 {
+	if x != nil {
+		return x.UsageLimit
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSwapUsage() uint64 {
+	if x != nil {
+		return x.SwapUsage
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSwapLimit() uint64 {
+	if x != nil {
+		return x.SwapLimit
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetMaxUsage() uint64 {
+	if x != nil {
+		return x.MaxUsage
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetSwapMaxUsage() uint64 {
+	if x != nil {
+		return x.SwapMaxUsage
+	}
+	return 0
+}
+
+func (x *MemoryStat) GetPSI() *PSIStats {
+	if x != nil {
+		return x.PSI
+	}
+	return nil
+}
+
+type MemoryEvents struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Low     uint64 `protobuf:"varint,1,opt,name=low,proto3" json:"low,omitempty"`
+	High    uint64 `protobuf:"varint,2,opt,name=high,proto3" json:"high,omitempty"`
+	Max     uint64 `protobuf:"varint,3,opt,name=max,proto3" json:"max,omitempty"`
+	Oom     uint64 `protobuf:"varint,4,opt,name=oom,proto3" json:"oom,omitempty"`
+	OomKill uint64 `protobuf:"varint,5,opt,name=oom_kill,json=oomKill,proto3" json:"oom_kill,omitempty"`
+}
+
+func (x *MemoryEvents) Reset() {
+	*x = MemoryEvents{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *MemoryEvents) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoryEvents) ProtoMessage() {}
+
+func (x *MemoryEvents) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoryEvents.ProtoReflect.Descriptor instead.
+func (*MemoryEvents) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *MemoryEvents) GetLow() uint64 {
+	if x != nil {
+		return x.Low
+	}
+	return 0
+}
+
+func (x *MemoryEvents) GetHigh() uint64 {
+	if x != nil {
+		return x.High
+	}
+	return 0
+}
+
+func (x *MemoryEvents) GetMax() uint64 {
+	if x != nil {
+		return x.Max
+	}
+	return 0
+}
+
+func (x *MemoryEvents) GetOom() uint64 {
+	if x != nil {
+		return x.Oom
+	}
+	return 0
+}
+
+func (x *MemoryEvents) GetOomKill() uint64 {
+	if x != nil {
+		return x.OomKill
+	}
+	return 0
+}
+
+type RdmaStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Current []*RdmaEntry `protobuf:"bytes,1,rep,name=current,proto3" json:"current,omitempty"`
+	Limit   []*RdmaEntry `protobuf:"bytes,2,rep,name=limit,proto3" json:"limit,omitempty"`
+}
+
+func (x *RdmaStat) Reset() {
+	*x = RdmaStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RdmaStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RdmaStat) ProtoMessage() {}
+
+func (x *RdmaStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RdmaStat.ProtoReflect.Descriptor instead.
+func (*RdmaStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *RdmaStat) GetCurrent() []*RdmaEntry {
+	if x != nil {
+		return x.Current
+	}
+	return nil
+}
+
+func (x *RdmaStat) GetLimit() []*RdmaEntry {
+	if x != nil {
+		return x.Limit
+	}
+	return nil
+}
+
+type RdmaEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Device     string `protobuf:"bytes,1,opt,name=device,proto3" json:"device,omitempty"`
+	HcaHandles uint32 `protobuf:"varint,2,opt,name=hca_handles,json=hcaHandles,proto3" json:"hca_handles,omitempty"`
+	HcaObjects uint32 `protobuf:"varint,3,opt,name=hca_objects,json=hcaObjects,proto3" json:"hca_objects,omitempty"`
+}
+
+func (x *RdmaEntry) Reset() {
+	*x = RdmaEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RdmaEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RdmaEntry) ProtoMessage() {}
+
+func (x *RdmaEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RdmaEntry.ProtoReflect.Descriptor instead.
+func (*RdmaEntry) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *RdmaEntry) GetDevice() string {
+	if x != nil {
+		return x.Device
+	}
+	return ""
+}
+
+func (x *RdmaEntry) GetHcaHandles() uint32 {
+	if x != nil {
+		return x.HcaHandles
+	}
+	return 0
+}
+
+func (x *RdmaEntry) GetHcaObjects() uint32 {
+	if x != nil {
+		return x.HcaObjects
+	}
+	return 0
+}
+
+type IOStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Usage []*IOEntry `protobuf:"bytes,1,rep,name=usage,proto3" json:"usage,omitempty"`
+	PSI   *PSIStats  `protobuf:"bytes,2,opt,name=psi,proto3" json:"psi,omitempty"`
+}
+
+func (x *IOStat) Reset() {
+	*x = IOStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IOStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IOStat) ProtoMessage() {}
+
+func (x *IOStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IOStat.ProtoReflect.Descriptor instead.
+func (*IOStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *IOStat) GetUsage() []*IOEntry {
+	if x != nil {
+		return x.Usage
+	}
+	return nil
+}
+
+func (x *IOStat) GetPSI() *PSIStats {
+	if x != nil {
+		return x.PSI
+	}
+	return nil
+}
+
+type IOEntry struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Major  uint64 `protobuf:"varint,1,opt,name=major,proto3" json:"major,omitempty"`
+	Minor  uint64 `protobuf:"varint,2,opt,name=minor,proto3" json:"minor,omitempty"`
+	Rbytes uint64 `protobuf:"varint,3,opt,name=rbytes,proto3" json:"rbytes,omitempty"`
+	Wbytes uint64 `protobuf:"varint,4,opt,name=wbytes,proto3" json:"wbytes,omitempty"`
+	Rios   uint64 `protobuf:"varint,5,opt,name=rios,proto3" json:"rios,omitempty"`
+	Wios   uint64 `protobuf:"varint,6,opt,name=wios,proto3" json:"wios,omitempty"`
+}
+
+func (x *IOEntry) Reset() {
+	*x = IOEntry{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IOEntry) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IOEntry) ProtoMessage() {}
+
+func (x *IOEntry) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IOEntry.ProtoReflect.Descriptor instead.
+func (*IOEntry) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *IOEntry) GetMajor() uint64 {
+	if x != nil {
+		return x.Major
+	}
+	return 0
+}
+
+func (x *IOEntry) GetMinor() uint64 {
+	if x != nil {
+		return x.Minor
+	}
+	return 0
+}
+
+func (x *IOEntry) GetRbytes() uint64 {
+	if x != nil {
+		return x.Rbytes
+	}
+	return 0
+}
+
+func (x *IOEntry) GetWbytes() uint64 {
+	if x != nil {
+		return x.Wbytes
+	}
+	return 0
+}
+
+func (x *IOEntry) GetRios() uint64 {
+	if x != nil {
+		return x.Rios
+	}
+	return 0
+}
+
+func (x *IOEntry) GetWios() uint64 {
+	if x != nil {
+		return x.Wios
+	}
+	return 0
+}
+
+type HugeTlbStat struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Current  uint64 `protobuf:"varint,1,opt,name=current,proto3" json:"current,omitempty"`
+	Max      uint64 `protobuf:"varint,2,opt,name=max,proto3" json:"max,omitempty"`
+	Pagesize string `protobuf:"bytes,3,opt,name=pagesize,proto3" json:"pagesize,omitempty"`
+}
+
+func (x *HugeTlbStat) Reset() {
+	*x = HugeTlbStat{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *HugeTlbStat) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HugeTlbStat) ProtoMessage() {}
+
+func (x *HugeTlbStat) ProtoReflect() protoreflect.Message {
+	mi := &file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HugeTlbStat.ProtoReflect.Descriptor instead.
+func (*HugeTlbStat) Descriptor() ([]byte, []int) {
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *HugeTlbStat) GetCurrent() uint64 {
+	if x != nil {
+		return x.Current
+	}
+	return 0
+}
+
+func (x *HugeTlbStat) GetMax() uint64 {
+	if x != nil {
+		return x.Max
+	}
+	return 0
+}
+
+func (x *HugeTlbStat) GetPagesize() string {
+	if x != nil {
+		return x.Pagesize
+	}
+	return ""
+}
+
+var File_github_com_containerd_cgroups_cgroup2_stats_metrics_proto protoreflect.FileDescriptor
+
+var file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDesc = []byte{
+	0x0a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2f,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x32, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x73, 0x2f, 0x6d, 0x65,
+	0x74, 0x72, 0x69, 0x63, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x18, 0x69, 0x6f, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x2e, 0x76, 0x32, 0x22, 0xac, 0x03, 0x0a, 0x07, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63,
+	0x73, 0x12, 0x36, 0x0a, 0x04, 0x70, 0x69, 0x64, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x69, 0x64, 0x73, 0x53,
+	0x74, 0x61, 0x74, 0x52, 0x04, 0x70, 0x69, 0x64, 0x73, 0x12, 0x33, 0x0a, 0x03, 0x63, 0x70, 0x75,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76,
+	0x32, 0x2e, 0x43, 0x50, 0x55, 0x53, 0x74, 0x61, 0x74, 0x52, 0x03, 0x63, 0x70, 0x75, 0x12, 0x3c,
+	0x0a, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x24,
+	0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79,
+	0x53, 0x74, 0x61, 0x74, 0x52, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x12, 0x36, 0x0a, 0x04,
+	0x72, 0x64, 0x6d, 0x61, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x64, 0x6d, 0x61, 0x53, 0x74, 0x61, 0x74, 0x52, 0x04,
+	0x72, 0x64, 0x6d, 0x61, 0x12, 0x30, 0x0a, 0x02, 0x69, 0x6f, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x20, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x49, 0x4f, 0x53, 0x74,
+	0x61, 0x74, 0x52, 0x02, 0x69, 0x6f, 0x12, 0x3f, 0x0a, 0x07, 0x68, 0x75, 0x67, 0x65, 0x74, 0x6c,
+	0x62, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e,
+	0x76, 0x32, 0x2e, 0x48, 0x75, 0x67, 0x65, 0x54, 0x6c, 0x62, 0x53, 0x74, 0x61, 0x74, 0x52, 0x07,
+	0x68, 0x75, 0x67, 0x65, 0x74, 0x6c, 0x62, 0x12, 0x4b, 0x0a, 0x0d, 0x6d, 0x65, 0x6d, 0x6f, 0x72,
+	0x79, 0x5f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x08, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x26,
+	0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79,
+	0x45, 0x76, 0x65, 0x6e, 0x74, 0x73, 0x52, 0x0c, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x45, 0x76,
+	0x65, 0x6e, 0x74, 0x73, 0x22, 0x63, 0x0a, 0x07, 0x50, 0x53, 0x49, 0x44, 0x61, 0x74, 0x61, 0x12,
+	0x14, 0x0a, 0x05, 0x61, 0x76, 0x67, 0x31, 0x30, 0x18, 0x01, 0x20, 0x01, 0x28, 0x01, 0x52, 0x05,
+	0x61, 0x76, 0x67, 0x31, 0x30, 0x12, 0x14, 0x0a, 0x05, 0x61, 0x76, 0x67, 0x36, 0x30, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x01, 0x52, 0x05, 0x61, 0x76, 0x67, 0x36, 0x30, 0x12, 0x16, 0x0a, 0x06, 0x61,
+	0x76, 0x67, 0x33, 0x30, 0x30, 0x18, 0x03, 0x20, 0x01, 0x28, 0x01, 0x52, 0x06, 0x61, 0x76, 0x67,
+	0x33, 0x30, 0x30, 0x12, 0x14, 0x0a, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x05, 0x74, 0x6f, 0x74, 0x61, 0x6c, 0x22, 0x78, 0x0a, 0x08, 0x50, 0x53, 0x49,
+	0x53, 0x74, 0x61, 0x74, 0x73, 0x12, 0x35, 0x0a, 0x04, 0x73, 0x6f, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x50,
+	0x53, 0x49, 0x44, 0x61, 0x74, 0x61, 0x52, 0x04, 0x73, 0x6f, 0x6d, 0x65, 0x12, 0x35, 0x0a, 0x04,
+	0x66, 0x75, 0x6c, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x69, 0x6f, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75,
+	0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x53, 0x49, 0x44, 0x61, 0x74, 0x61, 0x52, 0x04, 0x66,
+	0x75, 0x6c, 0x6c, 0x22, 0x3a, 0x0a, 0x08, 0x50, 0x69, 0x64, 0x73, 0x53, 0x74, 0x61, 0x74, 0x12,
+	0x18, 0x0a, 0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x12, 0x14, 0x0a, 0x05, 0x6c, 0x69, 0x6d,
+	0x69, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x22,
+	0x85, 0x02, 0x0a, 0x07, 0x43, 0x50, 0x55, 0x53, 0x74, 0x61, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x75,
+	0x73, 0x61, 0x67, 0x65, 0x5f, 0x75, 0x73, 0x65, 0x63, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x75, 0x73, 0x61, 0x67, 0x65, 0x55, 0x73, 0x65, 0x63, 0x12, 0x1b, 0x0a, 0x09, 0x75, 0x73,
+	0x65, 0x72, 0x5f, 0x75, 0x73, 0x65, 0x63, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x75,
+	0x73, 0x65, 0x72, 0x55, 0x73, 0x65, 0x63, 0x12, 0x1f, 0x0a, 0x0b, 0x73, 0x79, 0x73, 0x74, 0x65,
+	0x6d, 0x5f, 0x75, 0x73, 0x65, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x73, 0x79,
+	0x73, 0x74, 0x65, 0x6d, 0x55, 0x73, 0x65, 0x63, 0x12, 0x1d, 0x0a, 0x0a, 0x6e, 0x72, 0x5f, 0x70,
+	0x65, 0x72, 0x69, 0x6f, 0x64, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x6e, 0x72,
+	0x50, 0x65, 0x72, 0x69, 0x6f, 0x64, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6e, 0x72, 0x5f, 0x74, 0x68,
+	0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x6e,
+	0x72, 0x54, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x64, 0x12, 0x25, 0x0a, 0x0e, 0x74, 0x68,
+	0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x64, 0x5f, 0x75, 0x73, 0x65, 0x63, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x0d, 0x74, 0x68, 0x72, 0x6f, 0x74, 0x74, 0x6c, 0x65, 0x64, 0x55, 0x73, 0x65,
+	0x63, 0x12, 0x34, 0x0a, 0x03, 0x70, 0x73, 0x69, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22,
+	0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x53, 0x49, 0x53, 0x74, 0x61,
+	0x74, 0x73, 0x52, 0x03, 0x70, 0x73, 0x69, 0x22, 0x88, 0x0a, 0x0a, 0x0a, 0x4d, 0x65, 0x6d, 0x6f,
+	0x72, 0x79, 0x53, 0x74, 0x61, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x61, 0x6e, 0x6f, 0x6e, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x61, 0x6e, 0x6f, 0x6e, 0x12, 0x12, 0x0a, 0x04, 0x66, 0x69,
+	0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x66, 0x69, 0x6c, 0x65, 0x12, 0x21,
+	0x0a, 0x0c, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x5f, 0x73, 0x74, 0x61, 0x63, 0x6b, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x0b, 0x6b, 0x65, 0x72, 0x6e, 0x65, 0x6c, 0x53, 0x74, 0x61, 0x63,
+	0x6b, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x6c, 0x61, 0x62, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x04, 0x73, 0x6c, 0x61, 0x62, 0x12, 0x12, 0x0a, 0x04, 0x73, 0x6f, 0x63, 0x6b, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x04, 0x73, 0x6f, 0x63, 0x6b, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x68, 0x6d,
+	0x65, 0x6d, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x73, 0x68, 0x6d, 0x65, 0x6d, 0x12,
+	0x1f, 0x0a, 0x0b, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x65, 0x64, 0x18, 0x07,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x66, 0x69, 0x6c, 0x65, 0x4d, 0x61, 0x70, 0x70, 0x65, 0x64,
+	0x12, 0x1d, 0x0a, 0x0a, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x64, 0x69, 0x72, 0x74, 0x79, 0x18, 0x08,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x09, 0x66, 0x69, 0x6c, 0x65, 0x44, 0x69, 0x72, 0x74, 0x79, 0x12,
+	0x25, 0x0a, 0x0e, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x77, 0x72, 0x69, 0x74, 0x65, 0x62, 0x61, 0x63,
+	0x6b, 0x18, 0x09, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0d, 0x66, 0x69, 0x6c, 0x65, 0x57, 0x72, 0x69,
+	0x74, 0x65, 0x62, 0x61, 0x63, 0x6b, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x6e, 0x6f, 0x6e, 0x5f, 0x74,
+	0x68, 0x70, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x61, 0x6e, 0x6f, 0x6e, 0x54, 0x68,
+	0x70, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x61, 0x6e,
+	0x6f, 0x6e, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c, 0x69, 0x6e, 0x61, 0x63, 0x74, 0x69,
+	0x76, 0x65, 0x41, 0x6e, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65,
+	0x5f, 0x61, 0x6e, 0x6f, 0x6e, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x61, 0x63, 0x74,
+	0x69, 0x76, 0x65, 0x41, 0x6e, 0x6f, 0x6e, 0x12, 0x23, 0x0a, 0x0d, 0x69, 0x6e, 0x61, 0x63, 0x74,
+	0x69, 0x76, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c,
+	0x69, 0x6e, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x1f, 0x0a, 0x0b,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x18, 0x0e, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x0a, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x12, 0x20, 0x0a,
+	0x0b, 0x75, 0x6e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x18, 0x0f, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x0b, 0x75, 0x6e, 0x65, 0x76, 0x69, 0x63, 0x74, 0x61, 0x62, 0x6c, 0x65, 0x12,
+	0x29, 0x0a, 0x10, 0x73, 0x6c, 0x61, 0x62, 0x5f, 0x72, 0x65, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x61,
+	0x62, 0x6c, 0x65, 0x18, 0x10, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0f, 0x73, 0x6c, 0x61, 0x62, 0x52,
+	0x65, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x2d, 0x0a, 0x12, 0x73, 0x6c,
+	0x61, 0x62, 0x5f, 0x75, 0x6e, 0x72, 0x65, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x61, 0x62, 0x6c, 0x65,
+	0x18, 0x11, 0x20, 0x01, 0x28, 0x04, 0x52, 0x11, 0x73, 0x6c, 0x61, 0x62, 0x55, 0x6e, 0x72, 0x65,
+	0x63, 0x6c, 0x61, 0x69, 0x6d, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x67, 0x66,
+	0x61, 0x75, 0x6c, 0x74, 0x18, 0x12, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07, 0x70, 0x67, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x67, 0x6d, 0x61, 0x6a, 0x66, 0x61, 0x75, 0x6c,
+	0x74, 0x18, 0x13, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x70, 0x67, 0x6d, 0x61, 0x6a, 0x66, 0x61,
+	0x75, 0x6c, 0x74, 0x12, 0x2d, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x73, 0x65,
+	0x74, 0x5f, 0x72, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x18, 0x14, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x11, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x73, 0x65, 0x74, 0x52, 0x65, 0x66, 0x61, 0x75,
+	0x6c, 0x74, 0x12, 0x2f, 0x0a, 0x13, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x73, 0x65, 0x74,
+	0x5f, 0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x15, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x12, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x73, 0x65, 0x74, 0x41, 0x63, 0x74, 0x69, 0x76,
+	0x61, 0x74, 0x65, 0x12, 0x35, 0x0a, 0x16, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x73, 0x65,
+	0x74, 0x5f, 0x6e, 0x6f, 0x64, 0x65, 0x72, 0x65, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x18, 0x16, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x15, 0x77, 0x6f, 0x72, 0x6b, 0x69, 0x6e, 0x67, 0x73, 0x65, 0x74, 0x4e,
+	0x6f, 0x64, 0x65, 0x72, 0x65, 0x63, 0x6c, 0x61, 0x69, 0x6d, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x67,
+	0x72, 0x65, 0x66, 0x69, 0x6c, 0x6c, 0x18, 0x17, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x70, 0x67,
+	0x72, 0x65, 0x66, 0x69, 0x6c, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x67, 0x73, 0x63, 0x61, 0x6e,
+	0x18, 0x18, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x70, 0x67, 0x73, 0x63, 0x61, 0x6e, 0x12, 0x18,
+	0x0a, 0x07, 0x70, 0x67, 0x73, 0x74, 0x65, 0x61, 0x6c, 0x18, 0x19, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x07, 0x70, 0x67, 0x73, 0x74, 0x65, 0x61, 0x6c, 0x12, 0x1e, 0x0a, 0x0a, 0x70, 0x67, 0x61, 0x63,
+	0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x1a, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0a, 0x70, 0x67,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x22, 0x0a, 0x0c, 0x70, 0x67, 0x64, 0x65,
+	0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x18, 0x1b, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c,
+	0x70, 0x67, 0x64, 0x65, 0x61, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x65, 0x12, 0x1e, 0x0a, 0x0a,
+	0x70, 0x67, 0x6c, 0x61, 0x7a, 0x79, 0x66, 0x72, 0x65, 0x65, 0x18, 0x1c, 0x20, 0x01, 0x28, 0x04,
+	0x52, 0x0a, 0x70, 0x67, 0x6c, 0x61, 0x7a, 0x79, 0x66, 0x72, 0x65, 0x65, 0x12, 0x20, 0x0a, 0x0b,
+	0x70, 0x67, 0x6c, 0x61, 0x7a, 0x79, 0x66, 0x72, 0x65, 0x65, 0x64, 0x18, 0x1d, 0x20, 0x01, 0x28,
+	0x04, 0x52, 0x0b, 0x70, 0x67, 0x6c, 0x61, 0x7a, 0x79, 0x66, 0x72, 0x65, 0x65, 0x64, 0x12, 0x26,
+	0x0a, 0x0f, 0x74, 0x68, 0x70, 0x5f, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x61, 0x6c, 0x6c, 0x6f,
+	0x63, 0x18, 0x1e, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0d, 0x74, 0x68, 0x70, 0x46, 0x61, 0x75, 0x6c,
+	0x74, 0x41, 0x6c, 0x6c, 0x6f, 0x63, 0x12, 0x2c, 0x0a, 0x12, 0x74, 0x68, 0x70, 0x5f, 0x63, 0x6f,
+	0x6c, 0x6c, 0x61, 0x70, 0x73, 0x65, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x63, 0x18, 0x1f, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x10, 0x74, 0x68, 0x70, 0x43, 0x6f, 0x6c, 0x6c, 0x61, 0x70, 0x73, 0x65, 0x41,
+	0x6c, 0x6c, 0x6f, 0x63, 0x12, 0x14, 0x0a, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x20, 0x20,
+	0x01, 0x28, 0x04, 0x52, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x75, 0x73,
+	0x61, 0x67, 0x65, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x21, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x0a, 0x75, 0x73, 0x61, 0x67, 0x65, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x73,
+	0x77, 0x61, 0x70, 0x5f, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x22, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x09, 0x73, 0x77, 0x61, 0x70, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1d, 0x0a, 0x0a, 0x73, 0x77,
+	0x61, 0x70, 0x5f, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x23, 0x20, 0x01, 0x28, 0x04, 0x52, 0x09,
+	0x73, 0x77, 0x61, 0x70, 0x4c, 0x69, 0x6d, 0x69, 0x74, 0x12, 0x1b, 0x0a, 0x09, 0x6d, 0x61, 0x78,
+	0x5f, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x24, 0x20, 0x01, 0x28, 0x04, 0x52, 0x08, 0x6d, 0x61,
+	0x78, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x24, 0x0a, 0x0e, 0x73, 0x77, 0x61, 0x70, 0x5f, 0x6d,
+	0x61, 0x78, 0x5f, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x25, 0x20, 0x01, 0x28, 0x04, 0x52, 0x0c,
+	0x73, 0x77, 0x61, 0x70, 0x4d, 0x61, 0x78, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x34, 0x0a, 0x03,
+	0x70, 0x73, 0x69, 0x18, 0x26, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70,
+	0x73, 0x2e, 0x76, 0x32, 0x2e, 0x50, 0x53, 0x49, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x03, 0x70,
+	0x73, 0x69, 0x22, 0x73, 0x0a, 0x0c, 0x4d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x45, 0x76, 0x65, 0x6e,
+	0x74, 0x73, 0x12, 0x10, 0x0a, 0x03, 0x6c, 0x6f, 0x77, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x03, 0x6c, 0x6f, 0x77, 0x12, 0x12, 0x0a, 0x04, 0x68, 0x69, 0x67, 0x68, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x04, 0x52, 0x04, 0x68, 0x69, 0x67, 0x68, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x78, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x6d, 0x61, 0x78, 0x12, 0x10, 0x0a, 0x03, 0x6f, 0x6f,
+	0x6d, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x6f, 0x6f, 0x6d, 0x12, 0x19, 0x0a, 0x08,
+	0x6f, 0x6f, 0x6d, 0x5f, 0x6b, 0x69, 0x6c, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07,
+	0x6f, 0x6f, 0x6d, 0x4b, 0x69, 0x6c, 0x6c, 0x22, 0x84, 0x01, 0x0a, 0x08, 0x52, 0x64, 0x6d, 0x61,
+	0x53, 0x74, 0x61, 0x74, 0x12, 0x3d, 0x0a, 0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x23, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32,
+	0x2e, 0x52, 0x64, 0x6d, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x07, 0x63, 0x75, 0x72, 0x72,
+	0x65, 0x6e, 0x74, 0x12, 0x39, 0x0a, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x23, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x52, 0x64,
+	0x6d, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x05, 0x6c, 0x69, 0x6d, 0x69, 0x74, 0x22, 0x65,
+	0x0a, 0x09, 0x52, 0x64, 0x6d, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x16, 0x0a, 0x06, 0x64,
+	0x65, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x65, 0x76,
+	0x69, 0x63, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x63, 0x61, 0x5f, 0x68, 0x61, 0x6e, 0x64, 0x6c,
+	0x65, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x68, 0x63, 0x61, 0x48, 0x61, 0x6e,
+	0x64, 0x6c, 0x65, 0x73, 0x12, 0x1f, 0x0a, 0x0b, 0x68, 0x63, 0x61, 0x5f, 0x6f, 0x62, 0x6a, 0x65,
+	0x63, 0x74, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x68, 0x63, 0x61, 0x4f, 0x62,
+	0x6a, 0x65, 0x63, 0x74, 0x73, 0x22, 0x77, 0x0a, 0x06, 0x49, 0x4f, 0x53, 0x74, 0x61, 0x74, 0x12,
+	0x37, 0x0a, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21,
+	0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32, 0x2e, 0x49, 0x4f, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x52, 0x05, 0x75, 0x73, 0x61, 0x67, 0x65, 0x12, 0x34, 0x0a, 0x03, 0x70, 0x73, 0x69, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x22, 0x2e, 0x69, 0x6f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2e, 0x76, 0x32,
+	0x2e, 0x50, 0x53, 0x49, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x03, 0x70, 0x73, 0x69, 0x22, 0x8d,
+	0x01, 0x0a, 0x07, 0x49, 0x4f, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x6d, 0x61,
+	0x6a, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x05, 0x6d, 0x61, 0x6a, 0x6f, 0x72,
+	0x12, 0x14, 0x0a, 0x05, 0x6d, 0x69, 0x6e, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x04, 0x52,
+	0x05, 0x6d, 0x69, 0x6e, 0x6f, 0x72, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x62, 0x79, 0x74, 0x65, 0x73,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06, 0x72, 0x62, 0x79, 0x74, 0x65, 0x73, 0x12, 0x16,
+	0x0a, 0x06, 0x77, 0x62, 0x79, 0x74, 0x65, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x04, 0x52, 0x06,
+	0x77, 0x62, 0x79, 0x74, 0x65, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x72, 0x69, 0x6f, 0x73, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x72, 0x69, 0x6f, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x77, 0x69,
+	0x6f, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x04, 0x52, 0x04, 0x77, 0x69, 0x6f, 0x73, 0x22, 0x55,
+	0x0a, 0x0b, 0x48, 0x75, 0x67, 0x65, 0x54, 0x6c, 0x62, 0x53, 0x74, 0x61, 0x74, 0x12, 0x18, 0x0a,
+	0x07, 0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x04, 0x52, 0x07,
+	0x63, 0x75, 0x72, 0x72, 0x65, 0x6e, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6d, 0x61, 0x78, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x04, 0x52, 0x03, 0x6d, 0x61, 0x78, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x61, 0x67,
+	0x65, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x61, 0x67,
+	0x65, 0x73, 0x69, 0x7a, 0x65, 0x42, 0x2d, 0x5a, 0x2b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63,
+	0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x2f, 0x63, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x32, 0x2f, 0x73,
+	0x74, 0x61, 0x74, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescOnce sync.Once
+	file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescData = file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDesc
+)
+
+func file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescGZIP() []byte {
+	file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescOnce.Do(func() {
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescData = protoimpl.X.CompressGZIP(file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescData)
+	})
+	return file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDescData
+}
+
+var file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes = make([]protoimpl.MessageInfo, 12)
+var file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_goTypes = []interface{}{
+	(*Metrics)(nil),      // 0: io.containerd.cgroups.v2.Metrics
+	(*PSIData)(nil),      // 1: io.containerd.cgroups.v2.PSIData
+	(*PSIStats)(nil),     // 2: io.containerd.cgroups.v2.PSIStats
+	(*PidsStat)(nil),     // 3: io.containerd.cgroups.v2.PidsStat
+	(*CPUStat)(nil),      // 4: io.containerd.cgroups.v2.CPUStat
+	(*MemoryStat)(nil),   // 5: io.containerd.cgroups.v2.MemoryStat
+	(*MemoryEvents)(nil), // 6: io.containerd.cgroups.v2.MemoryEvents
+	(*RdmaStat)(nil),     // 7: io.containerd.cgroups.v2.RdmaStat
+	(*RdmaEntry)(nil),    // 8: io.containerd.cgroups.v2.RdmaEntry
+	(*IOStat)(nil),       // 9: io.containerd.cgroups.v2.IOStat
+	(*IOEntry)(nil),      // 10: io.containerd.cgroups.v2.IOEntry
+	(*HugeTlbStat)(nil),  // 11: io.containerd.cgroups.v2.HugeTlbStat
+}
+var file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_depIdxs = []int32{
+	3,  // 0: io.containerd.cgroups.v2.Metrics.pids:type_name -> io.containerd.cgroups.v2.PidsStat
+	4,  // 1: io.containerd.cgroups.v2.Metrics.cpu:type_name -> io.containerd.cgroups.v2.CPUStat
+	5,  // 2: io.containerd.cgroups.v2.Metrics.memory:type_name -> io.containerd.cgroups.v2.MemoryStat
+	7,  // 3: io.containerd.cgroups.v2.Metrics.rdma:type_name -> io.containerd.cgroups.v2.RdmaStat
+	9,  // 4: io.containerd.cgroups.v2.Metrics.io:type_name -> io.containerd.cgroups.v2.IOStat
+	11, // 5: io.containerd.cgroups.v2.Metrics.hugetlb:type_name -> io.containerd.cgroups.v2.HugeTlbStat
+	6,  // 6: io.containerd.cgroups.v2.Metrics.memory_events:type_name -> io.containerd.cgroups.v2.MemoryEvents
+	1,  // 7: io.containerd.cgroups.v2.PSIStats.some:type_name -> io.containerd.cgroups.v2.PSIData
+	1,  // 8: io.containerd.cgroups.v2.PSIStats.full:type_name -> io.containerd.cgroups.v2.PSIData
+	2,  // 9: io.containerd.cgroups.v2.CPUStat.psi:type_name -> io.containerd.cgroups.v2.PSIStats
+	2,  // 10: io.containerd.cgroups.v2.MemoryStat.psi:type_name -> io.containerd.cgroups.v2.PSIStats
+	8,  // 11: io.containerd.cgroups.v2.RdmaStat.current:type_name -> io.containerd.cgroups.v2.RdmaEntry
+	8,  // 12: io.containerd.cgroups.v2.RdmaStat.limit:type_name -> io.containerd.cgroups.v2.RdmaEntry
+	10, // 13: io.containerd.cgroups.v2.IOStat.usage:type_name -> io.containerd.cgroups.v2.IOEntry
+	2,  // 14: io.containerd.cgroups.v2.IOStat.psi:type_name -> io.containerd.cgroups.v2.PSIStats
+	15, // [15:15] is the sub-list for method output_type
+	15, // [15:15] is the sub-list for method input_type
+	15, // [15:15] is the sub-list for extension type_name
+	15, // [15:15] is the sub-list for extension extendee
+	0,  // [0:15] is the sub-list for field type_name
+}
+
+func init() { file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_init() }
+func file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_init() {
+	if File_github_com_containerd_cgroups_cgroup2_stats_metrics_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metrics); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PSIData); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PSIStats); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PidsStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CPUStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MemoryStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*MemoryEvents); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RdmaStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RdmaEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*IOStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*IOEntry); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*HugeTlbStat); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   12,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_goTypes,
+		DependencyIndexes: file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_depIdxs,
+		MessageInfos:      file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_msgTypes,
+	}.Build()
+	File_github_com_containerd_cgroups_cgroup2_stats_metrics_proto = out.File
+	file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_rawDesc = nil
+	file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_goTypes = nil
+	file_github_com_containerd_cgroups_cgroup2_stats_metrics_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.pb.txt b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.pb.txt
new file mode 100644
index 0000000000..26f5ba5de7
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.pb.txt
@@ -0,0 +1,626 @@
+file {
+  name: "github.com/containerd/cgroups/cgroup2/stats/metrics.proto"
+  package: "io.containerd.cgroups.v2"
+  message_type {
+    name: "Metrics"
+    field {
+      name: "pids"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.PidsStat"
+      json_name: "pids"
+    }
+    field {
+      name: "cpu"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.CPUStat"
+      json_name: "cpu"
+    }
+    field {
+      name: "memory"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.MemoryStat"
+      json_name: "memory"
+    }
+    field {
+      name: "rdma"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.RdmaStat"
+      json_name: "rdma"
+    }
+    field {
+      name: "io"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.IOStat"
+      json_name: "io"
+    }
+    field {
+      name: "hugetlb"
+      number: 7
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.HugeTlbStat"
+      json_name: "hugetlb"
+    }
+    field {
+      name: "memory_events"
+      number: 8
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.MemoryEvents"
+      json_name: "memoryEvents"
+    }
+  }
+  message_type {
+    name: "PSIData"
+    field {
+      name: "avg10"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_DOUBLE
+      json_name: "avg10"
+    }
+    field {
+      name: "avg60"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_DOUBLE
+      json_name: "avg60"
+    }
+    field {
+      name: "avg300"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_DOUBLE
+      json_name: "avg300"
+    }
+    field {
+      name: "total"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "total"
+    }
+  }
+  message_type {
+    name: "PSIStats"
+    field {
+      name: "some"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.PSIData"
+      json_name: "some"
+    }
+    field {
+      name: "full"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.PSIData"
+      json_name: "full"
+    }
+  }
+  message_type {
+    name: "PidsStat"
+    field {
+      name: "current"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "current"
+    }
+    field {
+      name: "limit"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "limit"
+    }
+  }
+  message_type {
+    name: "CPUStat"
+    field {
+      name: "usage_usec"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "usageUsec"
+    }
+    field {
+      name: "user_usec"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "userUsec"
+    }
+    field {
+      name: "system_usec"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "systemUsec"
+    }
+    field {
+      name: "nr_periods"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrPeriods"
+    }
+    field {
+      name: "nr_throttled"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "nrThrottled"
+    }
+    field {
+      name: "throttled_usec"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "throttledUsec"
+    }
+    field {
+      name: "psi"
+      number: 7
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.PSIStats"
+      json_name: "psi"
+    }
+  }
+  message_type {
+    name: "MemoryStat"
+    field {
+      name: "anon"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "anon"
+    }
+    field {
+      name: "file"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "file"
+    }
+    field {
+      name: "kernel_stack"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "kernelStack"
+    }
+    field {
+      name: "slab"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "slab"
+    }
+    field {
+      name: "sock"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "sock"
+    }
+    field {
+      name: "shmem"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "shmem"
+    }
+    field {
+      name: "file_mapped"
+      number: 7
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "fileMapped"
+    }
+    field {
+      name: "file_dirty"
+      number: 8
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "fileDirty"
+    }
+    field {
+      name: "file_writeback"
+      number: 9
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "fileWriteback"
+    }
+    field {
+      name: "anon_thp"
+      number: 10
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "anonThp"
+    }
+    field {
+      name: "inactive_anon"
+      number: 11
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "inactiveAnon"
+    }
+    field {
+      name: "active_anon"
+      number: 12
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "activeAnon"
+    }
+    field {
+      name: "inactive_file"
+      number: 13
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "inactiveFile"
+    }
+    field {
+      name: "active_file"
+      number: 14
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "activeFile"
+    }
+    field {
+      name: "unevictable"
+      number: 15
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "unevictable"
+    }
+    field {
+      name: "slab_reclaimable"
+      number: 16
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "slabReclaimable"
+    }
+    field {
+      name: "slab_unreclaimable"
+      number: 17
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "slabUnreclaimable"
+    }
+    field {
+      name: "pgfault"
+      number: 18
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgfault"
+    }
+    field {
+      name: "pgmajfault"
+      number: 19
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgmajfault"
+    }
+    field {
+      name: "workingset_refault"
+      number: 20
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "workingsetRefault"
+    }
+    field {
+      name: "workingset_activate"
+      number: 21
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "workingsetActivate"
+    }
+    field {
+      name: "workingset_nodereclaim"
+      number: 22
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "workingsetNodereclaim"
+    }
+    field {
+      name: "pgrefill"
+      number: 23
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgrefill"
+    }
+    field {
+      name: "pgscan"
+      number: 24
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgscan"
+    }
+    field {
+      name: "pgsteal"
+      number: 25
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgsteal"
+    }
+    field {
+      name: "pgactivate"
+      number: 26
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgactivate"
+    }
+    field {
+      name: "pgdeactivate"
+      number: 27
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pgdeactivate"
+    }
+    field {
+      name: "pglazyfree"
+      number: 28
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pglazyfree"
+    }
+    field {
+      name: "pglazyfreed"
+      number: 29
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "pglazyfreed"
+    }
+    field {
+      name: "thp_fault_alloc"
+      number: 30
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "thpFaultAlloc"
+    }
+    field {
+      name: "thp_collapse_alloc"
+      number: 31
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "thpCollapseAlloc"
+    }
+    field {
+      name: "usage"
+      number: 32
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "usage"
+    }
+    field {
+      name: "usage_limit"
+      number: 33
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "usageLimit"
+    }
+    field {
+      name: "swap_usage"
+      number: 34
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "swapUsage"
+    }
+    field {
+      name: "swap_limit"
+      number: 35
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "swapLimit"
+    }
+    field {
+      name: "max_usage"
+      number: 36
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "maxUsage"
+    }
+    field {
+      name: "swap_max_usage"
+      number: 37
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "swapMaxUsage"
+    }
+    field {
+      name: "psi"
+      number: 38
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.PSIStats"
+      json_name: "psi"
+    }
+  }
+  message_type {
+    name: "MemoryEvents"
+    field {
+      name: "low"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "low"
+    }
+    field {
+      name: "high"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "high"
+    }
+    field {
+      name: "max"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "max"
+    }
+    field {
+      name: "oom"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "oom"
+    }
+    field {
+      name: "oom_kill"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "oomKill"
+    }
+  }
+  message_type {
+    name: "RdmaStat"
+    field {
+      name: "current"
+      number: 1
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.RdmaEntry"
+      json_name: "current"
+    }
+    field {
+      name: "limit"
+      number: 2
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.RdmaEntry"
+      json_name: "limit"
+    }
+  }
+  message_type {
+    name: "RdmaEntry"
+    field {
+      name: "device"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "device"
+    }
+    field {
+      name: "hca_handles"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT32
+      json_name: "hcaHandles"
+    }
+    field {
+      name: "hca_objects"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT32
+      json_name: "hcaObjects"
+    }
+  }
+  message_type {
+    name: "IOStat"
+    field {
+      name: "usage"
+      number: 1
+      label: LABEL_REPEATED
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.IOEntry"
+      json_name: "usage"
+    }
+    field {
+      name: "psi"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_MESSAGE
+      type_name: ".io.containerd.cgroups.v2.PSIStats"
+      json_name: "psi"
+    }
+  }
+  message_type {
+    name: "IOEntry"
+    field {
+      name: "major"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "major"
+    }
+    field {
+      name: "minor"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "minor"
+    }
+    field {
+      name: "rbytes"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rbytes"
+    }
+    field {
+      name: "wbytes"
+      number: 4
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "wbytes"
+    }
+    field {
+      name: "rios"
+      number: 5
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "rios"
+    }
+    field {
+      name: "wios"
+      number: 6
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "wios"
+    }
+  }
+  message_type {
+    name: "HugeTlbStat"
+    field {
+      name: "current"
+      number: 1
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "current"
+    }
+    field {
+      name: "max"
+      number: 2
+      label: LABEL_OPTIONAL
+      type: TYPE_UINT64
+      json_name: "max"
+    }
+    field {
+      name: "pagesize"
+      number: 3
+      label: LABEL_OPTIONAL
+      type: TYPE_STRING
+      json_name: "pagesize"
+    }
+  }
+  options {
+    go_package: "github.com/containerd/cgroups/cgroup2/stats"
+  }
+  syntax: "proto3"
+}
diff --git a/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.proto b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.proto
new file mode 100644
index 0000000000..a4eae7a4e1
--- /dev/null
+++ b/vendor/github.com/containerd/cgroups/v3/cgroup2/stats/metrics.proto
@@ -0,0 +1,122 @@
+syntax = "proto3";
+
+package io.containerd.cgroups.v2;
+
+option go_package = "github.com/containerd/cgroups/cgroup2/stats";
+
+message Metrics {
+	PidsStat pids = 1;
+	CPUStat cpu = 2;
+	MemoryStat memory = 4;
+	RdmaStat rdma = 5;
+	IOStat io = 6;
+	repeated HugeTlbStat hugetlb = 7;
+	MemoryEvents memory_events = 8;
+}
+
+message PSIData {
+	double avg10 = 1;
+	double avg60 = 2;
+	double avg300 = 3;
+	uint64 total = 4;
+}
+
+message PSIStats {
+	PSIData some = 1;
+	PSIData full = 2;
+}
+
+message PidsStat {
+	uint64 current = 1;
+	uint64 limit = 2;
+}
+
+message CPUStat {
+	uint64 usage_usec  = 1;
+	uint64 user_usec = 2;
+	uint64 system_usec = 3;
+	uint64 nr_periods = 4;
+	uint64 nr_throttled = 5;
+	uint64 throttled_usec = 6;
+	PSIStats psi = 7;
+}
+
+message MemoryStat {
+	uint64 anon = 1;
+	uint64 file = 2;
+	uint64 kernel_stack = 3;
+	uint64 slab = 4;
+	uint64 sock = 5;
+	uint64 shmem = 6;
+	uint64 file_mapped = 7;
+	uint64 file_dirty = 8;
+	uint64 file_writeback = 9;
+	uint64 anon_thp = 10;
+	uint64 inactive_anon = 11;
+	uint64 active_anon = 12;
+	uint64 inactive_file = 13;
+	uint64 active_file = 14;
+	uint64 unevictable = 15;
+	uint64 slab_reclaimable = 16;
+	uint64 slab_unreclaimable = 17;
+	uint64 pgfault = 18;
+	uint64 pgmajfault = 19;
+	uint64 workingset_refault = 20;
+	uint64 workingset_activate = 21;
+	uint64 workingset_nodereclaim = 22;
+	uint64 pgrefill = 23;
+	uint64 pgscan = 24;
+	uint64 pgsteal = 25;
+	uint64 pgactivate = 26;
+	uint64 pgdeactivate = 27;
+	uint64 pglazyfree = 28;
+	uint64 pglazyfreed = 29;
+	uint64 thp_fault_alloc = 30;
+	uint64 thp_collapse_alloc = 31;
+	uint64 usage = 32;
+	uint64 usage_limit = 33;
+	uint64 swap_usage = 34;
+	uint64 swap_limit = 35;
+	uint64 max_usage = 36;
+	uint64 swap_max_usage = 37;
+	PSIStats psi = 38;
+}
+
+message MemoryEvents {
+	uint64 low = 1;
+	uint64 high = 2;
+	uint64 max = 3;
+	uint64 oom = 4;
+	uint64 oom_kill = 5;
+}
+
+message RdmaStat {
+	repeated RdmaEntry current = 1;
+	repeated RdmaEntry limit = 2;
+}
+
+message RdmaEntry {
+	string device = 1;
+	uint32 hca_handles = 2;
+	uint32 hca_objects = 3;
+}
+
+message IOStat {
+	repeated IOEntry usage = 1;
+	PSIStats psi = 2;
+}
+
+message IOEntry {
+	uint64 major = 1;
+	uint64 minor = 2;
+	uint64 rbytes = 3;
+	uint64 wbytes = 4;
+	uint64 rios = 5;
+	uint64 wios = 6;
+}
+
+message HugeTlbStat {
+	uint64 current = 1;
+	uint64 max = 2;
+	string pagesize = 3;
+}
diff --git a/vendor/github.com/containerd/containerd/api/LICENSE b/vendor/github.com/containerd/containerd/api/LICENSE
new file mode 100644
index 0000000000..584149b6ee
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/containerd/containerd/api/runtime/task/v3/doc.go b/vendor/github.com/containerd/containerd/api/runtime/task/v3/doc.go
new file mode 100644
index 0000000000..f933dd8d41
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/runtime/task/v3/doc.go
@@ -0,0 +1,17 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package task
diff --git a/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim.pb.go b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim.pb.go
new file mode 100644
index 0000000000..588b41c6a9
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim.pb.go
@@ -0,0 +1,2331 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: runtime/task/v3/shim.proto
+
+package task
+
+import (
+	types "github.com/containerd/containerd/api/types"
+	task "github.com/containerd/containerd/api/types/task"
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type CreateTaskRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID               string         `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Bundle           string         `protobuf:"bytes,2,opt,name=bundle,proto3" json:"bundle,omitempty"`
+	Rootfs           []*types.Mount `protobuf:"bytes,3,rep,name=rootfs,proto3" json:"rootfs,omitempty"`
+	Terminal         bool           `protobuf:"varint,4,opt,name=terminal,proto3" json:"terminal,omitempty"`
+	Stdin            string         `protobuf:"bytes,5,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	Stdout           string         `protobuf:"bytes,6,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr           string         `protobuf:"bytes,7,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	Checkpoint       string         `protobuf:"bytes,8,opt,name=checkpoint,proto3" json:"checkpoint,omitempty"`
+	ParentCheckpoint string         `protobuf:"bytes,9,opt,name=parent_checkpoint,json=parentCheckpoint,proto3" json:"parent_checkpoint,omitempty"`
+	Options          *anypb.Any     `protobuf:"bytes,10,opt,name=options,proto3" json:"options,omitempty"`
+}
+
+func (x *CreateTaskRequest) Reset() {
+	*x = CreateTaskRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateTaskRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateTaskRequest) ProtoMessage() {}
+
+func (x *CreateTaskRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateTaskRequest.ProtoReflect.Descriptor instead.
+func (*CreateTaskRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *CreateTaskRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetBundle() string {
+	if x != nil {
+		return x.Bundle
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetRootfs() []*types.Mount {
+	if x != nil {
+		return x.Rootfs
+	}
+	return nil
+}
+
+func (x *CreateTaskRequest) GetTerminal() bool {
+	if x != nil {
+		return x.Terminal
+	}
+	return false
+}
+
+func (x *CreateTaskRequest) GetStdin() string {
+	if x != nil {
+		return x.Stdin
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetStdout() string {
+	if x != nil {
+		return x.Stdout
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetStderr() string {
+	if x != nil {
+		return x.Stderr
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetCheckpoint() string {
+	if x != nil {
+		return x.Checkpoint
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetParentCheckpoint() string {
+	if x != nil {
+		return x.ParentCheckpoint
+	}
+	return ""
+}
+
+func (x *CreateTaskRequest) GetOptions() *anypb.Any {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+type CreateTaskResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pid uint32 `protobuf:"varint,1,opt,name=pid,proto3" json:"pid,omitempty"`
+}
+
+func (x *CreateTaskResponse) Reset() {
+	*x = CreateTaskResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CreateTaskResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateTaskResponse) ProtoMessage() {}
+
+func (x *CreateTaskResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateTaskResponse.ProtoReflect.Descriptor instead.
+func (*CreateTaskResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *CreateTaskResponse) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+type DeleteRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+}
+
+func (x *DeleteRequest) Reset() {
+	*x = DeleteRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteRequest) ProtoMessage() {}
+
+func (x *DeleteRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteRequest.ProtoReflect.Descriptor instead.
+func (*DeleteRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *DeleteRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *DeleteRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+type DeleteResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pid        uint32                 `protobuf:"varint,1,opt,name=pid,proto3" json:"pid,omitempty"`
+	ExitStatus uint32                 `protobuf:"varint,2,opt,name=exit_status,json=exitStatus,proto3" json:"exit_status,omitempty"`
+	ExitedAt   *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=exited_at,json=exitedAt,proto3" json:"exited_at,omitempty"`
+}
+
+func (x *DeleteResponse) Reset() {
+	*x = DeleteResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *DeleteResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DeleteResponse) ProtoMessage() {}
+
+func (x *DeleteResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DeleteResponse.ProtoReflect.Descriptor instead.
+func (*DeleteResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *DeleteResponse) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+func (x *DeleteResponse) GetExitStatus() uint32 {
+	if x != nil {
+		return x.ExitStatus
+	}
+	return 0
+}
+
+func (x *DeleteResponse) GetExitedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExitedAt
+	}
+	return nil
+}
+
+type ExecProcessRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID       string     `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID   string     `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+	Terminal bool       `protobuf:"varint,3,opt,name=terminal,proto3" json:"terminal,omitempty"`
+	Stdin    string     `protobuf:"bytes,4,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	Stdout   string     `protobuf:"bytes,5,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr   string     `protobuf:"bytes,6,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	Spec     *anypb.Any `protobuf:"bytes,7,opt,name=spec,proto3" json:"spec,omitempty"`
+}
+
+func (x *ExecProcessRequest) Reset() {
+	*x = ExecProcessRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[4]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExecProcessRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecProcessRequest) ProtoMessage() {}
+
+func (x *ExecProcessRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[4]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecProcessRequest.ProtoReflect.Descriptor instead.
+func (*ExecProcessRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *ExecProcessRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *ExecProcessRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+func (x *ExecProcessRequest) GetTerminal() bool {
+	if x != nil {
+		return x.Terminal
+	}
+	return false
+}
+
+func (x *ExecProcessRequest) GetStdin() string {
+	if x != nil {
+		return x.Stdin
+	}
+	return ""
+}
+
+func (x *ExecProcessRequest) GetStdout() string {
+	if x != nil {
+		return x.Stdout
+	}
+	return ""
+}
+
+func (x *ExecProcessRequest) GetStderr() string {
+	if x != nil {
+		return x.Stderr
+	}
+	return ""
+}
+
+func (x *ExecProcessRequest) GetSpec() *anypb.Any {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+type ExecProcessResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *ExecProcessResponse) Reset() {
+	*x = ExecProcessResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[5]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ExecProcessResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecProcessResponse) ProtoMessage() {}
+
+func (x *ExecProcessResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[5]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecProcessResponse.ProtoReflect.Descriptor instead.
+func (*ExecProcessResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{5}
+}
+
+type ResizePtyRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+	Width  uint32 `protobuf:"varint,3,opt,name=width,proto3" json:"width,omitempty"`
+	Height uint32 `protobuf:"varint,4,opt,name=height,proto3" json:"height,omitempty"`
+}
+
+func (x *ResizePtyRequest) Reset() {
+	*x = ResizePtyRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[6]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResizePtyRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResizePtyRequest) ProtoMessage() {}
+
+func (x *ResizePtyRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[6]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResizePtyRequest.ProtoReflect.Descriptor instead.
+func (*ResizePtyRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *ResizePtyRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *ResizePtyRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+func (x *ResizePtyRequest) GetWidth() uint32 {
+	if x != nil {
+		return x.Width
+	}
+	return 0
+}
+
+func (x *ResizePtyRequest) GetHeight() uint32 {
+	if x != nil {
+		return x.Height
+	}
+	return 0
+}
+
+type StateRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+}
+
+func (x *StateRequest) Reset() {
+	*x = StateRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[7]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StateRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StateRequest) ProtoMessage() {}
+
+func (x *StateRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[7]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StateRequest.ProtoReflect.Descriptor instead.
+func (*StateRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *StateRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *StateRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+type StateResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID         string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Bundle     string                 `protobuf:"bytes,2,opt,name=bundle,proto3" json:"bundle,omitempty"`
+	Pid        uint32                 `protobuf:"varint,3,opt,name=pid,proto3" json:"pid,omitempty"`
+	Status     task.Status            `protobuf:"varint,4,opt,name=status,proto3,enum=containerd.v1.types.Status" json:"status,omitempty"`
+	Stdin      string                 `protobuf:"bytes,5,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	Stdout     string                 `protobuf:"bytes,6,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr     string                 `protobuf:"bytes,7,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	Terminal   bool                   `protobuf:"varint,8,opt,name=terminal,proto3" json:"terminal,omitempty"`
+	ExitStatus uint32                 `protobuf:"varint,9,opt,name=exit_status,json=exitStatus,proto3" json:"exit_status,omitempty"`
+	ExitedAt   *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=exited_at,json=exitedAt,proto3" json:"exited_at,omitempty"`
+	ExecID     string                 `protobuf:"bytes,11,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+}
+
+func (x *StateResponse) Reset() {
+	*x = StateResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[8]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StateResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StateResponse) ProtoMessage() {}
+
+func (x *StateResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[8]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StateResponse.ProtoReflect.Descriptor instead.
+func (*StateResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *StateResponse) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *StateResponse) GetBundle() string {
+	if x != nil {
+		return x.Bundle
+	}
+	return ""
+}
+
+func (x *StateResponse) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+func (x *StateResponse) GetStatus() task.Status {
+	if x != nil {
+		return x.Status
+	}
+	return task.Status(0)
+}
+
+func (x *StateResponse) GetStdin() string {
+	if x != nil {
+		return x.Stdin
+	}
+	return ""
+}
+
+func (x *StateResponse) GetStdout() string {
+	if x != nil {
+		return x.Stdout
+	}
+	return ""
+}
+
+func (x *StateResponse) GetStderr() string {
+	if x != nil {
+		return x.Stderr
+	}
+	return ""
+}
+
+func (x *StateResponse) GetTerminal() bool {
+	if x != nil {
+		return x.Terminal
+	}
+	return false
+}
+
+func (x *StateResponse) GetExitStatus() uint32 {
+	if x != nil {
+		return x.ExitStatus
+	}
+	return 0
+}
+
+func (x *StateResponse) GetExitedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExitedAt
+	}
+	return nil
+}
+
+func (x *StateResponse) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+type KillRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+	Signal uint32 `protobuf:"varint,3,opt,name=signal,proto3" json:"signal,omitempty"`
+	All    bool   `protobuf:"varint,4,opt,name=all,proto3" json:"all,omitempty"`
+}
+
+func (x *KillRequest) Reset() {
+	*x = KillRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[9]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *KillRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KillRequest) ProtoMessage() {}
+
+func (x *KillRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[9]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KillRequest.ProtoReflect.Descriptor instead.
+func (*KillRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *KillRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *KillRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+func (x *KillRequest) GetSignal() uint32 {
+	if x != nil {
+		return x.Signal
+	}
+	return 0
+}
+
+func (x *KillRequest) GetAll() bool {
+	if x != nil {
+		return x.All
+	}
+	return false
+}
+
+type CloseIORequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+	Stdin  bool   `protobuf:"varint,3,opt,name=stdin,proto3" json:"stdin,omitempty"`
+}
+
+func (x *CloseIORequest) Reset() {
+	*x = CloseIORequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[10]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CloseIORequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CloseIORequest) ProtoMessage() {}
+
+func (x *CloseIORequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[10]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CloseIORequest.ProtoReflect.Descriptor instead.
+func (*CloseIORequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *CloseIORequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *CloseIORequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+func (x *CloseIORequest) GetStdin() bool {
+	if x != nil {
+		return x.Stdin
+	}
+	return false
+}
+
+type PidsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *PidsRequest) Reset() {
+	*x = PidsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[11]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PidsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PidsRequest) ProtoMessage() {}
+
+func (x *PidsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[11]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PidsRequest.ProtoReflect.Descriptor instead.
+func (*PidsRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *PidsRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+type PidsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Processes []*task.ProcessInfo `protobuf:"bytes,1,rep,name=processes,proto3" json:"processes,omitempty"`
+}
+
+func (x *PidsResponse) Reset() {
+	*x = PidsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[12]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PidsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PidsResponse) ProtoMessage() {}
+
+func (x *PidsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[12]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PidsResponse.ProtoReflect.Descriptor instead.
+func (*PidsResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *PidsResponse) GetProcesses() []*task.ProcessInfo {
+	if x != nil {
+		return x.Processes
+	}
+	return nil
+}
+
+type CheckpointTaskRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID      string     `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Path    string     `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
+	Options *anypb.Any `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+}
+
+func (x *CheckpointTaskRequest) Reset() {
+	*x = CheckpointTaskRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[13]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckpointTaskRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointTaskRequest) ProtoMessage() {}
+
+func (x *CheckpointTaskRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[13]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointTaskRequest.ProtoReflect.Descriptor instead.
+func (*CheckpointTaskRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *CheckpointTaskRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *CheckpointTaskRequest) GetPath() string {
+	if x != nil {
+		return x.Path
+	}
+	return ""
+}
+
+func (x *CheckpointTaskRequest) GetOptions() *anypb.Any {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+type UpdateTaskRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID          string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Resources   *anypb.Any        `protobuf:"bytes,2,opt,name=resources,proto3" json:"resources,omitempty"`
+	Annotations map[string]string `protobuf:"bytes,3,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *UpdateTaskRequest) Reset() {
+	*x = UpdateTaskRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[14]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UpdateTaskRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateTaskRequest) ProtoMessage() {}
+
+func (x *UpdateTaskRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[14]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateTaskRequest.ProtoReflect.Descriptor instead.
+func (*UpdateTaskRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *UpdateTaskRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *UpdateTaskRequest) GetResources() *anypb.Any {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *UpdateTaskRequest) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+type StartRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+}
+
+func (x *StartRequest) Reset() {
+	*x = StartRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[15]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StartRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartRequest) ProtoMessage() {}
+
+func (x *StartRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[15]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartRequest.ProtoReflect.Descriptor instead.
+func (*StartRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *StartRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *StartRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+type StartResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Pid uint32 `protobuf:"varint,1,opt,name=pid,proto3" json:"pid,omitempty"`
+}
+
+func (x *StartResponse) Reset() {
+	*x = StartResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[16]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StartResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartResponse) ProtoMessage() {}
+
+func (x *StartResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[16]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartResponse.ProtoReflect.Descriptor instead.
+func (*StartResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *StartResponse) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+type WaitRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID     string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	ExecID string `protobuf:"bytes,2,opt,name=exec_id,json=execId,proto3" json:"exec_id,omitempty"`
+}
+
+func (x *WaitRequest) Reset() {
+	*x = WaitRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WaitRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitRequest) ProtoMessage() {}
+
+func (x *WaitRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitRequest.ProtoReflect.Descriptor instead.
+func (*WaitRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *WaitRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *WaitRequest) GetExecID() string {
+	if x != nil {
+		return x.ExecID
+	}
+	return ""
+}
+
+type WaitResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ExitStatus uint32                 `protobuf:"varint,1,opt,name=exit_status,json=exitStatus,proto3" json:"exit_status,omitempty"`
+	ExitedAt   *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=exited_at,json=exitedAt,proto3" json:"exited_at,omitempty"`
+}
+
+func (x *WaitResponse) Reset() {
+	*x = WaitResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WaitResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WaitResponse) ProtoMessage() {}
+
+func (x *WaitResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WaitResponse.ProtoReflect.Descriptor instead.
+func (*WaitResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *WaitResponse) GetExitStatus() uint32 {
+	if x != nil {
+		return x.ExitStatus
+	}
+	return 0
+}
+
+func (x *WaitResponse) GetExitedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExitedAt
+	}
+	return nil
+}
+
+type StatsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *StatsRequest) Reset() {
+	*x = StatsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StatsRequest) ProtoMessage() {}
+
+func (x *StatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StatsRequest.ProtoReflect.Descriptor instead.
+func (*StatsRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *StatsRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+type StatsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Stats *anypb.Any `protobuf:"bytes,1,opt,name=stats,proto3" json:"stats,omitempty"`
+}
+
+func (x *StatsResponse) Reset() {
+	*x = StatsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *StatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StatsResponse) ProtoMessage() {}
+
+func (x *StatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StatsResponse.ProtoReflect.Descriptor instead.
+func (*StatsResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *StatsResponse) GetStats() *anypb.Any {
+	if x != nil {
+		return x.Stats
+	}
+	return nil
+}
+
+type ConnectRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *ConnectRequest) Reset() {
+	*x = ConnectRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnectRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnectRequest) ProtoMessage() {}
+
+func (x *ConnectRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnectRequest.ProtoReflect.Descriptor instead.
+func (*ConnectRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *ConnectRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+type ConnectResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ShimPid uint32 `protobuf:"varint,1,opt,name=shim_pid,json=shimPid,proto3" json:"shim_pid,omitempty"`
+	TaskPid uint32 `protobuf:"varint,2,opt,name=task_pid,json=taskPid,proto3" json:"task_pid,omitempty"`
+	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
+}
+
+func (x *ConnectResponse) Reset() {
+	*x = ConnectResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ConnectResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ConnectResponse) ProtoMessage() {}
+
+func (x *ConnectResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ConnectResponse.ProtoReflect.Descriptor instead.
+func (*ConnectResponse) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *ConnectResponse) GetShimPid() uint32 {
+	if x != nil {
+		return x.ShimPid
+	}
+	return 0
+}
+
+func (x *ConnectResponse) GetTaskPid() uint32 {
+	if x != nil {
+		return x.TaskPid
+	}
+	return 0
+}
+
+func (x *ConnectResponse) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+type ShutdownRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID  string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Now bool   `protobuf:"varint,2,opt,name=now,proto3" json:"now,omitempty"`
+}
+
+func (x *ShutdownRequest) Reset() {
+	*x = ShutdownRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[23]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ShutdownRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ShutdownRequest) ProtoMessage() {}
+
+func (x *ShutdownRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[23]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ShutdownRequest.ProtoReflect.Descriptor instead.
+func (*ShutdownRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *ShutdownRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *ShutdownRequest) GetNow() bool {
+	if x != nil {
+		return x.Now
+	}
+	return false
+}
+
+type PauseRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *PauseRequest) Reset() {
+	*x = PauseRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[24]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *PauseRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PauseRequest) ProtoMessage() {}
+
+func (x *PauseRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[24]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PauseRequest.ProtoReflect.Descriptor instead.
+func (*PauseRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *PauseRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+type ResumeRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ID string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+}
+
+func (x *ResumeRequest) Reset() {
+	*x = ResumeRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_runtime_task_v3_shim_proto_msgTypes[25]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ResumeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ResumeRequest) ProtoMessage() {}
+
+func (x *ResumeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_runtime_task_v3_shim_proto_msgTypes[25]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ResumeRequest.ProtoReflect.Descriptor instead.
+func (*ResumeRequest) Descriptor() ([]byte, []int) {
+	return file_runtime_task_v3_shim_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *ResumeRequest) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+var File_runtime_task_v3_shim_proto protoreflect.FileDescriptor
+
+var file_runtime_task_v3_shim_proto_rawDesc = []byte{
+	0x0a, 0x1a, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x2f, 0x74, 0x61, 0x73, 0x6b, 0x2f, 0x76,
+	0x33, 0x2f, 0x73, 0x68, 0x69, 0x6d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x12, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33,
+	0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1b, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x65, 0x6d, 0x70,
+	0x74, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74,
+	0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x11, 0x74, 0x79, 0x70, 0x65, 0x73,
+	0x2f, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x15, 0x74, 0x79,
+	0x70, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x73, 0x6b, 0x2f, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0xcb, 0x02, 0x0a, 0x11, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61,
+	0x73, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75, 0x6e,
+	0x64, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x6e, 0x64, 0x6c,
+	0x65, 0x12, 0x2f, 0x0a, 0x06, 0x72, 0x6f, 0x6f, 0x74, 0x66, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x17, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74,
+	0x79, 0x70, 0x65, 0x73, 0x2e, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x06, 0x72, 0x6f, 0x6f, 0x74,
+	0x66, 0x73, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x12, 0x14,
+	0x0a, 0x05, 0x73, 0x74, 0x64, 0x69, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73,
+	0x74, 0x64, 0x69, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74,
+	0x64, 0x65, 0x72, 0x72, 0x12, 0x1e, 0x0a, 0x0a, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69,
+	0x6e, 0x74, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x63, 0x68, 0x65, 0x63, 0x6b, 0x70,
+	0x6f, 0x69, 0x6e, 0x74, 0x12, 0x2b, 0x0a, 0x11, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x5f, 0x63,
+	0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x10, 0x70, 0x61, 0x72, 0x65, 0x6e, 0x74, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e,
+	0x74, 0x12, 0x2e, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x0a, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x22, 0x26, 0x0a, 0x12, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x73, 0x6b, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x70, 0x69, 0x64, 0x22, 0x38, 0x0a, 0x0d, 0x44, 0x65, 0x6c,
+	0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x78,
+	0x65, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x78, 0x65,
+	0x63, 0x49, 0x64, 0x22, 0x7c, 0x0a, 0x0e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x0d, 0x52, 0x03, 0x70, 0x69, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x69, 0x74, 0x5f,
+	0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x65, 0x78,
+	0x69, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x37, 0x0a, 0x09, 0x65, 0x78, 0x69, 0x74,
+	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, 0x65, 0x78, 0x69, 0x74, 0x65, 0x64, 0x41,
+	0x74, 0x22, 0xc9, 0x01, 0x0a, 0x12, 0x45, 0x78, 0x65, 0x63, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73,
+	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x78, 0x65, 0x63,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x78, 0x65, 0x63, 0x49,
+	0x64, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x08, 0x52, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x12, 0x14, 0x0a,
+	0x05, 0x73, 0x74, 0x64, 0x69, 0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x74,
+	0x64, 0x69, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x73,
+	0x74, 0x64, 0x65, 0x72, 0x72, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x64,
+	0x65, 0x72, 0x72, 0x12, 0x28, 0x0a, 0x04, 0x73, 0x70, 0x65, 0x63, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x04, 0x73, 0x70, 0x65, 0x63, 0x22, 0x15, 0x0a,
+	0x13, 0x45, 0x78, 0x65, 0x63, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x69, 0x0a, 0x10, 0x52, 0x65, 0x73, 0x69, 0x7a, 0x65, 0x50, 0x74,
+	0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x78, 0x65, 0x63,
+	0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x78, 0x65, 0x63, 0x49,
+	0x64, 0x12, 0x14, 0x0a, 0x05, 0x77, 0x69, 0x64, 0x74, 0x68, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x05, 0x77, 0x69, 0x64, 0x74, 0x68, 0x12, 0x16, 0x0a, 0x06, 0x68, 0x65, 0x69, 0x67, 0x68,
+	0x74, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x68, 0x65, 0x69, 0x67, 0x68, 0x74, 0x22,
+	0x37, 0x0a, 0x0c, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
+	0x17, 0x0a, 0x07, 0x65, 0x78, 0x65, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x06, 0x65, 0x78, 0x65, 0x63, 0x49, 0x64, 0x22, 0xd3, 0x02, 0x0a, 0x0d, 0x53, 0x74, 0x61,
+	0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x62, 0x75,
+	0x6e, 0x64, 0x6c, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x62, 0x75, 0x6e, 0x64,
+	0x6c, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x03, 0x70, 0x69, 0x64, 0x12, 0x33, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x76, 0x31, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x64,
+	0x69, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x74, 0x64, 0x69, 0x6e, 0x12,
+	0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x65, 0x72,
+	0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x12,
+	0x1a, 0x0a, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x18, 0x08, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c, 0x12, 0x1f, 0x0a, 0x0b, 0x65,
+	0x78, 0x69, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0d,
+	0x52, 0x0a, 0x65, 0x78, 0x69, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x37, 0x0a, 0x09,
+	0x65, 0x78, 0x69, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, 0x65, 0x78, 0x69,
+	0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x78, 0x65, 0x63, 0x5f, 0x69, 0x64,
+	0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x78, 0x65, 0x63, 0x49, 0x64, 0x22, 0x60,
+	0x0a, 0x0b, 0x4b, 0x69, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17, 0x0a,
+	0x07, 0x65, 0x78, 0x65, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06,
+	0x65, 0x78, 0x65, 0x63, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x06, 0x73, 0x69, 0x67, 0x6e, 0x61, 0x6c, 0x12, 0x10,
+	0x0a, 0x03, 0x61, 0x6c, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x08, 0x52, 0x03, 0x61, 0x6c, 0x6c,
+	0x22, 0x4f, 0x0a, 0x0e, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x49, 0x4f, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x78, 0x65, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x65, 0x78, 0x65, 0x63, 0x49, 0x64, 0x12, 0x14, 0x0a, 0x05, 0x73,
+	0x74, 0x64, 0x69, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x05, 0x73, 0x74, 0x64, 0x69,
+	0x6e, 0x22, 0x1d, 0x0a, 0x0b, 0x50, 0x69, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64,
+	0x22, 0x4e, 0x0a, 0x0c, 0x50, 0x69, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x3e, 0x0a, 0x09, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x73, 0x18, 0x01, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2e, 0x76, 0x31, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x50, 0x72, 0x6f, 0x63, 0x65, 0x73,
+	0x73, 0x49, 0x6e, 0x66, 0x6f, 0x52, 0x09, 0x70, 0x72, 0x6f, 0x63, 0x65, 0x73, 0x73, 0x65, 0x73,
+	0x22, 0x6b, 0x0a, 0x15, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x54, 0x61,
+	0x73, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x61, 0x74,
+	0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x70, 0x61, 0x74, 0x68, 0x12, 0x2e, 0x0a,
+	0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x41, 0x6e, 0x79, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0xf1, 0x01,
+	0x0a, 0x11, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x61, 0x73, 0x6b, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x02, 0x69, 0x64, 0x12, 0x32, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x09, 0x72, 0x65,
+	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x58, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x36, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76,
+	0x33, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x61, 0x73, 0x6b, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x2e, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x1a, 0x3e, 0x0a, 0x10, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
+	0x01, 0x22, 0x37, 0x0a, 0x0c, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
+	0x64, 0x12, 0x17, 0x0a, 0x07, 0x65, 0x78, 0x65, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x06, 0x65, 0x78, 0x65, 0x63, 0x49, 0x64, 0x22, 0x21, 0x0a, 0x0d, 0x53, 0x74,
+	0x61, 0x72, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x70,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x70, 0x69, 0x64, 0x22, 0x36, 0x0a,
+	0x0b, 0x57, 0x61, 0x69, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x17, 0x0a, 0x07,
+	0x65, 0x78, 0x65, 0x63, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x65,
+	0x78, 0x65, 0x63, 0x49, 0x64, 0x22, 0x68, 0x0a, 0x0c, 0x57, 0x61, 0x69, 0x74, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x73, 0x74,
+	0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x65, 0x78, 0x69, 0x74,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x37, 0x0a, 0x09, 0x65, 0x78, 0x69, 0x74, 0x65, 0x64,
+	0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65,
+	0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x08, 0x65, 0x78, 0x69, 0x74, 0x65, 0x64, 0x41, 0x74, 0x22,
+	0x1e, 0x0a, 0x0c, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
+	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22,
+	0x3b, 0x0a, 0x0d, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x12, 0x2a, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x73, 0x22, 0x20, 0x0a, 0x0e,
+	0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x61,
+	0x0a, 0x0f, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x19, 0x0a, 0x08, 0x73, 0x68, 0x69, 0x6d, 0x5f, 0x70, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0d, 0x52, 0x07, 0x73, 0x68, 0x69, 0x6d, 0x50, 0x69, 0x64, 0x12, 0x19, 0x0a, 0x08,
+	0x74, 0x61, 0x73, 0x6b, 0x5f, 0x70, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x07,
+	0x74, 0x61, 0x73, 0x6b, 0x50, 0x69, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x22, 0x33, 0x0a, 0x0f, 0x53, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x6e, 0x6f, 0x77, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x03, 0x6e, 0x6f, 0x77, 0x22, 0x1e, 0x0a, 0x0c, 0x50, 0x61, 0x75, 0x73, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x1f, 0x0a, 0x0d, 0x52, 0x65, 0x73, 0x75, 0x6d, 0x65,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x32, 0x8a, 0x0a, 0x0a, 0x04, 0x54, 0x61, 0x73, 0x6b,
+	0x12, 0x4c, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x20, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x53,
+	0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33,
+	0x2e, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x57,
+	0x0a, 0x06, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x12, 0x25, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x72,
+	0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x73, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x26, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73,
+	0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x54, 0x61, 0x73, 0x6b, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4c, 0x0a, 0x05, 0x53, 0x74, 0x61, 0x72, 0x74,
+	0x12, 0x20, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61,
+	0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x21, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x74, 0x61, 0x72, 0x74, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4f, 0x0a, 0x06, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x12,
+	0x21, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73,
+	0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x22, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x44, 0x65, 0x6c, 0x65, 0x74, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x49, 0x0a, 0x04, 0x50, 0x69, 0x64, 0x73, 0x12, 0x1f,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b,
+	0x2e, 0x76, 0x33, 0x2e, 0x50, 0x69, 0x64, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x20, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73,
+	0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x50, 0x69, 0x64, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x12, 0x41, 0x0a, 0x05, 0x50, 0x61, 0x75, 0x73, 0x65, 0x12, 0x20, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e,
+	0x50, 0x61, 0x75, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x12, 0x43, 0x0a, 0x06, 0x52, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x12, 0x21,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b,
+	0x2e, 0x76, 0x33, 0x2e, 0x52, 0x65, 0x73, 0x75, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x4f, 0x0a, 0x0a, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x29, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x68, 0x65,
+	0x63, 0x6b, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x54, 0x61, 0x73, 0x6b, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x3f, 0x0a, 0x04, 0x4b, 0x69,
+	0x6c, 0x6c, 0x12, 0x1f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x4b, 0x69, 0x6c, 0x6c, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x46, 0x0a, 0x04, 0x45,
+	0x78, 0x65, 0x63, 0x12, 0x26, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x45, 0x78, 0x65, 0x63, 0x50, 0x72, 0x6f,
+	0x63, 0x65, 0x73, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x12, 0x49, 0x0a, 0x09, 0x52, 0x65, 0x73, 0x69, 0x7a, 0x65, 0x50, 0x74, 0x79,
+	0x12, 0x24, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61,
+	0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x52, 0x65, 0x73, 0x69, 0x7a, 0x65, 0x50, 0x74, 0x79, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x45,
+	0x0a, 0x07, 0x43, 0x6c, 0x6f, 0x73, 0x65, 0x49, 0x4f, 0x12, 0x22, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x43,
+	0x6c, 0x6f, 0x73, 0x65, 0x49, 0x4f, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x47, 0x0a, 0x06, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x12,
+	0x25, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73,
+	0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65, 0x54, 0x61, 0x73, 0x6b, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x12, 0x49,
+	0x0a, 0x04, 0x57, 0x61, 0x69, 0x74, 0x12, 0x1f, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x57, 0x61, 0x69, 0x74,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x57, 0x61, 0x69,
+	0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x4c, 0x0a, 0x05, 0x53, 0x74, 0x61,
+	0x74, 0x73, 0x12, 0x20, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x74, 0x61, 0x74, 0x73, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x52, 0x0a, 0x07, 0x43, 0x6f, 0x6e, 0x6e, 0x65,
+	0x63, 0x74, 0x12, 0x22, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63, 0x74, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x23, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x43, 0x6f, 0x6e, 0x6e,
+	0x65, 0x63, 0x74, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x47, 0x0a, 0x08, 0x53,
+	0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x12, 0x23, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x61, 0x73, 0x6b, 0x2e, 0x76, 0x33, 0x2e, 0x53, 0x68, 0x75,
+	0x74, 0x64, 0x6f, 0x77, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45,
+	0x6d, 0x70, 0x74, 0x79, 0x42, 0x3b, 0x5a, 0x39, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x72, 0x75, 0x6e,
+	0x74, 0x69, 0x6d, 0x65, 0x2f, 0x74, 0x61, 0x73, 0x6b, 0x2f, 0x76, 0x33, 0x3b, 0x74, 0x61, 0x73,
+	0x6b, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_runtime_task_v3_shim_proto_rawDescOnce sync.Once
+	file_runtime_task_v3_shim_proto_rawDescData = file_runtime_task_v3_shim_proto_rawDesc
+)
+
+func file_runtime_task_v3_shim_proto_rawDescGZIP() []byte {
+	file_runtime_task_v3_shim_proto_rawDescOnce.Do(func() {
+		file_runtime_task_v3_shim_proto_rawDescData = protoimpl.X.CompressGZIP(file_runtime_task_v3_shim_proto_rawDescData)
+	})
+	return file_runtime_task_v3_shim_proto_rawDescData
+}
+
+var file_runtime_task_v3_shim_proto_msgTypes = make([]protoimpl.MessageInfo, 27)
+var file_runtime_task_v3_shim_proto_goTypes = []interface{}{
+	(*CreateTaskRequest)(nil),     // 0: containerd.task.v3.CreateTaskRequest
+	(*CreateTaskResponse)(nil),    // 1: containerd.task.v3.CreateTaskResponse
+	(*DeleteRequest)(nil),         // 2: containerd.task.v3.DeleteRequest
+	(*DeleteResponse)(nil),        // 3: containerd.task.v3.DeleteResponse
+	(*ExecProcessRequest)(nil),    // 4: containerd.task.v3.ExecProcessRequest
+	(*ExecProcessResponse)(nil),   // 5: containerd.task.v3.ExecProcessResponse
+	(*ResizePtyRequest)(nil),      // 6: containerd.task.v3.ResizePtyRequest
+	(*StateRequest)(nil),          // 7: containerd.task.v3.StateRequest
+	(*StateResponse)(nil),         // 8: containerd.task.v3.StateResponse
+	(*KillRequest)(nil),           // 9: containerd.task.v3.KillRequest
+	(*CloseIORequest)(nil),        // 10: containerd.task.v3.CloseIORequest
+	(*PidsRequest)(nil),           // 11: containerd.task.v3.PidsRequest
+	(*PidsResponse)(nil),          // 12: containerd.task.v3.PidsResponse
+	(*CheckpointTaskRequest)(nil), // 13: containerd.task.v3.CheckpointTaskRequest
+	(*UpdateTaskRequest)(nil),     // 14: containerd.task.v3.UpdateTaskRequest
+	(*StartRequest)(nil),          // 15: containerd.task.v3.StartRequest
+	(*StartResponse)(nil),         // 16: containerd.task.v3.StartResponse
+	(*WaitRequest)(nil),           // 17: containerd.task.v3.WaitRequest
+	(*WaitResponse)(nil),          // 18: containerd.task.v3.WaitResponse
+	(*StatsRequest)(nil),          // 19: containerd.task.v3.StatsRequest
+	(*StatsResponse)(nil),         // 20: containerd.task.v3.StatsResponse
+	(*ConnectRequest)(nil),        // 21: containerd.task.v3.ConnectRequest
+	(*ConnectResponse)(nil),       // 22: containerd.task.v3.ConnectResponse
+	(*ShutdownRequest)(nil),       // 23: containerd.task.v3.ShutdownRequest
+	(*PauseRequest)(nil),          // 24: containerd.task.v3.PauseRequest
+	(*ResumeRequest)(nil),         // 25: containerd.task.v3.ResumeRequest
+	nil,                           // 26: containerd.task.v3.UpdateTaskRequest.AnnotationsEntry
+	(*types.Mount)(nil),           // 27: containerd.types.Mount
+	(*anypb.Any)(nil),             // 28: google.protobuf.Any
+	(*timestamppb.Timestamp)(nil), // 29: google.protobuf.Timestamp
+	(task.Status)(0),              // 30: containerd.v1.types.Status
+	(*task.ProcessInfo)(nil),      // 31: containerd.v1.types.ProcessInfo
+	(*emptypb.Empty)(nil),         // 32: google.protobuf.Empty
+}
+var file_runtime_task_v3_shim_proto_depIdxs = []int32{
+	27, // 0: containerd.task.v3.CreateTaskRequest.rootfs:type_name -> containerd.types.Mount
+	28, // 1: containerd.task.v3.CreateTaskRequest.options:type_name -> google.protobuf.Any
+	29, // 2: containerd.task.v3.DeleteResponse.exited_at:type_name -> google.protobuf.Timestamp
+	28, // 3: containerd.task.v3.ExecProcessRequest.spec:type_name -> google.protobuf.Any
+	30, // 4: containerd.task.v3.StateResponse.status:type_name -> containerd.v1.types.Status
+	29, // 5: containerd.task.v3.StateResponse.exited_at:type_name -> google.protobuf.Timestamp
+	31, // 6: containerd.task.v3.PidsResponse.processes:type_name -> containerd.v1.types.ProcessInfo
+	28, // 7: containerd.task.v3.CheckpointTaskRequest.options:type_name -> google.protobuf.Any
+	28, // 8: containerd.task.v3.UpdateTaskRequest.resources:type_name -> google.protobuf.Any
+	26, // 9: containerd.task.v3.UpdateTaskRequest.annotations:type_name -> containerd.task.v3.UpdateTaskRequest.AnnotationsEntry
+	29, // 10: containerd.task.v3.WaitResponse.exited_at:type_name -> google.protobuf.Timestamp
+	28, // 11: containerd.task.v3.StatsResponse.stats:type_name -> google.protobuf.Any
+	7,  // 12: containerd.task.v3.Task.State:input_type -> containerd.task.v3.StateRequest
+	0,  // 13: containerd.task.v3.Task.Create:input_type -> containerd.task.v3.CreateTaskRequest
+	15, // 14: containerd.task.v3.Task.Start:input_type -> containerd.task.v3.StartRequest
+	2,  // 15: containerd.task.v3.Task.Delete:input_type -> containerd.task.v3.DeleteRequest
+	11, // 16: containerd.task.v3.Task.Pids:input_type -> containerd.task.v3.PidsRequest
+	24, // 17: containerd.task.v3.Task.Pause:input_type -> containerd.task.v3.PauseRequest
+	25, // 18: containerd.task.v3.Task.Resume:input_type -> containerd.task.v3.ResumeRequest
+	13, // 19: containerd.task.v3.Task.Checkpoint:input_type -> containerd.task.v3.CheckpointTaskRequest
+	9,  // 20: containerd.task.v3.Task.Kill:input_type -> containerd.task.v3.KillRequest
+	4,  // 21: containerd.task.v3.Task.Exec:input_type -> containerd.task.v3.ExecProcessRequest
+	6,  // 22: containerd.task.v3.Task.ResizePty:input_type -> containerd.task.v3.ResizePtyRequest
+	10, // 23: containerd.task.v3.Task.CloseIO:input_type -> containerd.task.v3.CloseIORequest
+	14, // 24: containerd.task.v3.Task.Update:input_type -> containerd.task.v3.UpdateTaskRequest
+	17, // 25: containerd.task.v3.Task.Wait:input_type -> containerd.task.v3.WaitRequest
+	19, // 26: containerd.task.v3.Task.Stats:input_type -> containerd.task.v3.StatsRequest
+	21, // 27: containerd.task.v3.Task.Connect:input_type -> containerd.task.v3.ConnectRequest
+	23, // 28: containerd.task.v3.Task.Shutdown:input_type -> containerd.task.v3.ShutdownRequest
+	8,  // 29: containerd.task.v3.Task.State:output_type -> containerd.task.v3.StateResponse
+	1,  // 30: containerd.task.v3.Task.Create:output_type -> containerd.task.v3.CreateTaskResponse
+	16, // 31: containerd.task.v3.Task.Start:output_type -> containerd.task.v3.StartResponse
+	3,  // 32: containerd.task.v3.Task.Delete:output_type -> containerd.task.v3.DeleteResponse
+	12, // 33: containerd.task.v3.Task.Pids:output_type -> containerd.task.v3.PidsResponse
+	32, // 34: containerd.task.v3.Task.Pause:output_type -> google.protobuf.Empty
+	32, // 35: containerd.task.v3.Task.Resume:output_type -> google.protobuf.Empty
+	32, // 36: containerd.task.v3.Task.Checkpoint:output_type -> google.protobuf.Empty
+	32, // 37: containerd.task.v3.Task.Kill:output_type -> google.protobuf.Empty
+	32, // 38: containerd.task.v3.Task.Exec:output_type -> google.protobuf.Empty
+	32, // 39: containerd.task.v3.Task.ResizePty:output_type -> google.protobuf.Empty
+	32, // 40: containerd.task.v3.Task.CloseIO:output_type -> google.protobuf.Empty
+	32, // 41: containerd.task.v3.Task.Update:output_type -> google.protobuf.Empty
+	18, // 42: containerd.task.v3.Task.Wait:output_type -> containerd.task.v3.WaitResponse
+	20, // 43: containerd.task.v3.Task.Stats:output_type -> containerd.task.v3.StatsResponse
+	22, // 44: containerd.task.v3.Task.Connect:output_type -> containerd.task.v3.ConnectResponse
+	32, // 45: containerd.task.v3.Task.Shutdown:output_type -> google.protobuf.Empty
+	29, // [29:46] is the sub-list for method output_type
+	12, // [12:29] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
+}
+
+func init() { file_runtime_task_v3_shim_proto_init() }
+func file_runtime_task_v3_shim_proto_init() {
+	if File_runtime_task_v3_shim_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_runtime_task_v3_shim_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateTaskRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CreateTaskResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*DeleteResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExecProcessRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ExecProcessResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResizePtyRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StateRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StateResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*KillRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CloseIORequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PidsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PidsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckpointTaskRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UpdateTaskRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StartRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StartResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WaitRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*WaitResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StatsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*StatsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnectRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ConnectResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[23].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ShutdownRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[24].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*PauseRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_runtime_task_v3_shim_proto_msgTypes[25].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ResumeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_runtime_task_v3_shim_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   27,
+			NumExtensions: 0,
+			NumServices:   1,
+		},
+		GoTypes:           file_runtime_task_v3_shim_proto_goTypes,
+		DependencyIndexes: file_runtime_task_v3_shim_proto_depIdxs,
+		MessageInfos:      file_runtime_task_v3_shim_proto_msgTypes,
+	}.Build()
+	File_runtime_task_v3_shim_proto = out.File
+	file_runtime_task_v3_shim_proto_rawDesc = nil
+	file_runtime_task_v3_shim_proto_goTypes = nil
+	file_runtime_task_v3_shim_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim.proto b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim.proto
new file mode 100644
index 0000000000..2dffd52db8
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim.proto
@@ -0,0 +1,200 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.task.v3;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/empty.proto";
+import "google/protobuf/timestamp.proto";
+import "types/mount.proto";
+import "types/task/task.proto";
+
+option go_package = "github.com/containerd/containerd/api/runtime/task/v3;task";
+
+// Shim service is launched for each container and is responsible for owning the IO
+// for the container and its additional processes.  The shim is also the parent of
+// each container and allows reattaching to the IO and receiving the exit status
+// for the container processes.
+service Task {
+  rpc State(StateRequest) returns (StateResponse);
+  rpc Create(CreateTaskRequest) returns (CreateTaskResponse);
+  rpc Start(StartRequest) returns (StartResponse);
+  rpc Delete(DeleteRequest) returns (DeleteResponse);
+  rpc Pids(PidsRequest) returns (PidsResponse);
+  rpc Pause(PauseRequest) returns (google.protobuf.Empty);
+  rpc Resume(ResumeRequest) returns (google.protobuf.Empty);
+  rpc Checkpoint(CheckpointTaskRequest) returns (google.protobuf.Empty);
+  rpc Kill(KillRequest) returns (google.protobuf.Empty);
+  rpc Exec(ExecProcessRequest) returns (google.protobuf.Empty);
+  rpc ResizePty(ResizePtyRequest) returns (google.protobuf.Empty);
+  rpc CloseIO(CloseIORequest) returns (google.protobuf.Empty);
+  rpc Update(UpdateTaskRequest) returns (google.protobuf.Empty);
+  rpc Wait(WaitRequest) returns (WaitResponse);
+  rpc Stats(StatsRequest) returns (StatsResponse);
+  rpc Connect(ConnectRequest) returns (ConnectResponse);
+  rpc Shutdown(ShutdownRequest) returns (google.protobuf.Empty);
+}
+
+message CreateTaskRequest {
+  string id = 1;
+  string bundle = 2;
+  repeated containerd.types.Mount rootfs = 3;
+  bool terminal = 4;
+  string stdin = 5;
+  string stdout = 6;
+  string stderr = 7;
+  string checkpoint = 8;
+  string parent_checkpoint = 9;
+  google.protobuf.Any options = 10;
+}
+
+message CreateTaskResponse {
+  uint32 pid = 1;
+}
+
+message DeleteRequest {
+  string id = 1;
+  string exec_id = 2;
+}
+
+message DeleteResponse {
+  uint32 pid = 1;
+  uint32 exit_status = 2;
+  google.protobuf.Timestamp exited_at = 3;
+}
+
+message ExecProcessRequest {
+  string id = 1;
+  string exec_id = 2;
+  bool terminal = 3;
+  string stdin = 4;
+  string stdout = 5;
+  string stderr = 6;
+  google.protobuf.Any spec = 7;
+}
+
+message ExecProcessResponse {}
+
+message ResizePtyRequest {
+  string id = 1;
+  string exec_id = 2;
+  uint32 width = 3;
+  uint32 height = 4;
+}
+
+message StateRequest {
+  string id = 1;
+  string exec_id = 2;
+}
+
+message StateResponse {
+  string id = 1;
+  string bundle = 2;
+  uint32 pid = 3;
+  containerd.v1.types.Status status = 4;
+  string stdin = 5;
+  string stdout = 6;
+  string stderr = 7;
+  bool terminal = 8;
+  uint32 exit_status = 9;
+  google.protobuf.Timestamp exited_at = 10;
+  string exec_id = 11;
+}
+
+message KillRequest {
+  string id = 1;
+  string exec_id = 2;
+  uint32 signal = 3;
+  bool all = 4;
+}
+
+message CloseIORequest {
+  string id = 1;
+  string exec_id = 2;
+  bool stdin = 3;
+}
+
+message PidsRequest {
+  string id = 1;
+}
+
+message PidsResponse {
+  repeated containerd.v1.types.ProcessInfo processes = 1;
+}
+
+message CheckpointTaskRequest {
+  string id = 1;
+  string path = 2;
+  google.protobuf.Any options = 3;
+}
+
+message UpdateTaskRequest {
+  string id = 1;
+  google.protobuf.Any resources = 2;
+  map<string, string> annotations = 3;
+}
+
+message StartRequest {
+  string id = 1;
+  string exec_id = 2;
+}
+
+message StartResponse {
+  uint32 pid = 1;
+}
+
+message WaitRequest {
+  string id = 1;
+  string exec_id = 2;
+}
+
+message WaitResponse {
+  uint32 exit_status = 1;
+  google.protobuf.Timestamp exited_at = 2;
+}
+
+message StatsRequest {
+  string id = 1;
+}
+
+message StatsResponse {
+  google.protobuf.Any stats = 1;
+}
+
+message ConnectRequest {
+  string id = 1;
+}
+
+message ConnectResponse {
+  uint32 shim_pid = 1;
+  uint32 task_pid = 2;
+  string version = 3;
+}
+
+message ShutdownRequest {
+  string id = 1;
+  bool now = 2;
+}
+
+message PauseRequest {
+  string id = 1;
+}
+
+message ResumeRequest {
+  string id = 1;
+}
diff --git a/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim_grpc.pb.go b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim_grpc.pb.go
new file mode 100644
index 0000000000..c3d45cf835
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim_grpc.pb.go
@@ -0,0 +1,684 @@
+//go:build !no_grpc
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.2.0
+// - protoc             (unknown)
+// source: runtime/task/v3/shim.proto
+
+package task
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.32.0 or later.
+const _ = grpc.SupportPackageIsVersion7
+
+// TaskClient is the client API for Task service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+type TaskClient interface {
+	State(ctx context.Context, in *StateRequest, opts ...grpc.CallOption) (*StateResponse, error)
+	Create(ctx context.Context, in *CreateTaskRequest, opts ...grpc.CallOption) (*CreateTaskResponse, error)
+	Start(ctx context.Context, in *StartRequest, opts ...grpc.CallOption) (*StartResponse, error)
+	Delete(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error)
+	Pids(ctx context.Context, in *PidsRequest, opts ...grpc.CallOption) (*PidsResponse, error)
+	Pause(ctx context.Context, in *PauseRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Resume(ctx context.Context, in *ResumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Checkpoint(ctx context.Context, in *CheckpointTaskRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Kill(ctx context.Context, in *KillRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Exec(ctx context.Context, in *ExecProcessRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	ResizePty(ctx context.Context, in *ResizePtyRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	CloseIO(ctx context.Context, in *CloseIORequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Update(ctx context.Context, in *UpdateTaskRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	Wait(ctx context.Context, in *WaitRequest, opts ...grpc.CallOption) (*WaitResponse, error)
+	Stats(ctx context.Context, in *StatsRequest, opts ...grpc.CallOption) (*StatsResponse, error)
+	Connect(ctx context.Context, in *ConnectRequest, opts ...grpc.CallOption) (*ConnectResponse, error)
+	Shutdown(ctx context.Context, in *ShutdownRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+}
+
+type taskClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewTaskClient(cc grpc.ClientConnInterface) TaskClient {
+	return &taskClient{cc}
+}
+
+func (c *taskClient) State(ctx context.Context, in *StateRequest, opts ...grpc.CallOption) (*StateResponse, error) {
+	out := new(StateResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/State", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Create(ctx context.Context, in *CreateTaskRequest, opts ...grpc.CallOption) (*CreateTaskResponse, error) {
+	out := new(CreateTaskResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Create", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Start(ctx context.Context, in *StartRequest, opts ...grpc.CallOption) (*StartResponse, error) {
+	out := new(StartResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Start", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Delete(ctx context.Context, in *DeleteRequest, opts ...grpc.CallOption) (*DeleteResponse, error) {
+	out := new(DeleteResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Delete", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Pids(ctx context.Context, in *PidsRequest, opts ...grpc.CallOption) (*PidsResponse, error) {
+	out := new(PidsResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Pids", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Pause(ctx context.Context, in *PauseRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Pause", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Resume(ctx context.Context, in *ResumeRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Resume", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Checkpoint(ctx context.Context, in *CheckpointTaskRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Checkpoint", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Kill(ctx context.Context, in *KillRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Kill", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Exec(ctx context.Context, in *ExecProcessRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Exec", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) ResizePty(ctx context.Context, in *ResizePtyRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/ResizePty", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) CloseIO(ctx context.Context, in *CloseIORequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/CloseIO", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Update(ctx context.Context, in *UpdateTaskRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Update", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Wait(ctx context.Context, in *WaitRequest, opts ...grpc.CallOption) (*WaitResponse, error) {
+	out := new(WaitResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Wait", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Stats(ctx context.Context, in *StatsRequest, opts ...grpc.CallOption) (*StatsResponse, error) {
+	out := new(StatsResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Stats", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Connect(ctx context.Context, in *ConnectRequest, opts ...grpc.CallOption) (*ConnectResponse, error) {
+	out := new(ConnectResponse)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Connect", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *taskClient) Shutdown(ctx context.Context, in *ShutdownRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, "/containerd.task.v3.Task/Shutdown", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// TaskServer is the server API for Task service.
+// All implementations must embed UnimplementedTaskServer
+// for forward compatibility
+type TaskServer interface {
+	State(context.Context, *StateRequest) (*StateResponse, error)
+	Create(context.Context, *CreateTaskRequest) (*CreateTaskResponse, error)
+	Start(context.Context, *StartRequest) (*StartResponse, error)
+	Delete(context.Context, *DeleteRequest) (*DeleteResponse, error)
+	Pids(context.Context, *PidsRequest) (*PidsResponse, error)
+	Pause(context.Context, *PauseRequest) (*emptypb.Empty, error)
+	Resume(context.Context, *ResumeRequest) (*emptypb.Empty, error)
+	Checkpoint(context.Context, *CheckpointTaskRequest) (*emptypb.Empty, error)
+	Kill(context.Context, *KillRequest) (*emptypb.Empty, error)
+	Exec(context.Context, *ExecProcessRequest) (*emptypb.Empty, error)
+	ResizePty(context.Context, *ResizePtyRequest) (*emptypb.Empty, error)
+	CloseIO(context.Context, *CloseIORequest) (*emptypb.Empty, error)
+	Update(context.Context, *UpdateTaskRequest) (*emptypb.Empty, error)
+	Wait(context.Context, *WaitRequest) (*WaitResponse, error)
+	Stats(context.Context, *StatsRequest) (*StatsResponse, error)
+	Connect(context.Context, *ConnectRequest) (*ConnectResponse, error)
+	Shutdown(context.Context, *ShutdownRequest) (*emptypb.Empty, error)
+	mustEmbedUnimplementedTaskServer()
+}
+
+// UnimplementedTaskServer must be embedded to have forward compatible implementations.
+type UnimplementedTaskServer struct {
+}
+
+func (UnimplementedTaskServer) State(context.Context, *StateRequest) (*StateResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method State not implemented")
+}
+func (UnimplementedTaskServer) Create(context.Context, *CreateTaskRequest) (*CreateTaskResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Create not implemented")
+}
+func (UnimplementedTaskServer) Start(context.Context, *StartRequest) (*StartResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Start not implemented")
+}
+func (UnimplementedTaskServer) Delete(context.Context, *DeleteRequest) (*DeleteResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Delete not implemented")
+}
+func (UnimplementedTaskServer) Pids(context.Context, *PidsRequest) (*PidsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Pids not implemented")
+}
+func (UnimplementedTaskServer) Pause(context.Context, *PauseRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Pause not implemented")
+}
+func (UnimplementedTaskServer) Resume(context.Context, *ResumeRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Resume not implemented")
+}
+func (UnimplementedTaskServer) Checkpoint(context.Context, *CheckpointTaskRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Checkpoint not implemented")
+}
+func (UnimplementedTaskServer) Kill(context.Context, *KillRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Kill not implemented")
+}
+func (UnimplementedTaskServer) Exec(context.Context, *ExecProcessRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Exec not implemented")
+}
+func (UnimplementedTaskServer) ResizePty(context.Context, *ResizePtyRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method ResizePty not implemented")
+}
+func (UnimplementedTaskServer) CloseIO(context.Context, *CloseIORequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CloseIO not implemented")
+}
+func (UnimplementedTaskServer) Update(context.Context, *UpdateTaskRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Update not implemented")
+}
+func (UnimplementedTaskServer) Wait(context.Context, *WaitRequest) (*WaitResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Wait not implemented")
+}
+func (UnimplementedTaskServer) Stats(context.Context, *StatsRequest) (*StatsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Stats not implemented")
+}
+func (UnimplementedTaskServer) Connect(context.Context, *ConnectRequest) (*ConnectResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Connect not implemented")
+}
+func (UnimplementedTaskServer) Shutdown(context.Context, *ShutdownRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method Shutdown not implemented")
+}
+func (UnimplementedTaskServer) mustEmbedUnimplementedTaskServer() {}
+
+// UnsafeTaskServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to TaskServer will
+// result in compilation errors.
+type UnsafeTaskServer interface {
+	mustEmbedUnimplementedTaskServer()
+}
+
+func RegisterTaskServer(s grpc.ServiceRegistrar, srv TaskServer) {
+	s.RegisterService(&Task_ServiceDesc, srv)
+}
+
+func _Task_State_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StateRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).State(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/State",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).State(ctx, req.(*StateRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Create_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateTaskRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Create(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Create",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Create(ctx, req.(*CreateTaskRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Start_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StartRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Start(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Start",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Start(ctx, req.(*StartRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Delete_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(DeleteRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Delete(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Delete",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Delete(ctx, req.(*DeleteRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Pids_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PidsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Pids(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Pids",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Pids(ctx, req.(*PidsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Pause_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PauseRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Pause(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Pause",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Pause(ctx, req.(*PauseRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Resume_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResumeRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Resume(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Resume",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Resume(ctx, req.(*ResumeRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Checkpoint_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckpointTaskRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Checkpoint(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Checkpoint",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Checkpoint(ctx, req.(*CheckpointTaskRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Kill_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(KillRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Kill(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Kill",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Kill(ctx, req.(*KillRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Exec_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExecProcessRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Exec(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Exec",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Exec(ctx, req.(*ExecProcessRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_ResizePty_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ResizePtyRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).ResizePty(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/ResizePty",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).ResizePty(ctx, req.(*ResizePtyRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_CloseIO_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CloseIORequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).CloseIO(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/CloseIO",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).CloseIO(ctx, req.(*CloseIORequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Update_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateTaskRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Update(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Update",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Update(ctx, req.(*UpdateTaskRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Wait_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(WaitRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Wait(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Wait",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Wait(ctx, req.(*WaitRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Stats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StatsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Stats(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Stats",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Stats(ctx, req.(*StatsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Connect_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ConnectRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Connect(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Connect",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Connect(ctx, req.(*ConnectRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _Task_Shutdown_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ShutdownRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(TaskServer).Shutdown(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.task.v3.Task/Shutdown",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(TaskServer).Shutdown(ctx, req.(*ShutdownRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// Task_ServiceDesc is the grpc.ServiceDesc for Task service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var Task_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "containerd.task.v3.Task",
+	HandlerType: (*TaskServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "State",
+			Handler:    _Task_State_Handler,
+		},
+		{
+			MethodName: "Create",
+			Handler:    _Task_Create_Handler,
+		},
+		{
+			MethodName: "Start",
+			Handler:    _Task_Start_Handler,
+		},
+		{
+			MethodName: "Delete",
+			Handler:    _Task_Delete_Handler,
+		},
+		{
+			MethodName: "Pids",
+			Handler:    _Task_Pids_Handler,
+		},
+		{
+			MethodName: "Pause",
+			Handler:    _Task_Pause_Handler,
+		},
+		{
+			MethodName: "Resume",
+			Handler:    _Task_Resume_Handler,
+		},
+		{
+			MethodName: "Checkpoint",
+			Handler:    _Task_Checkpoint_Handler,
+		},
+		{
+			MethodName: "Kill",
+			Handler:    _Task_Kill_Handler,
+		},
+		{
+			MethodName: "Exec",
+			Handler:    _Task_Exec_Handler,
+		},
+		{
+			MethodName: "ResizePty",
+			Handler:    _Task_ResizePty_Handler,
+		},
+		{
+			MethodName: "CloseIO",
+			Handler:    _Task_CloseIO_Handler,
+		},
+		{
+			MethodName: "Update",
+			Handler:    _Task_Update_Handler,
+		},
+		{
+			MethodName: "Wait",
+			Handler:    _Task_Wait_Handler,
+		},
+		{
+			MethodName: "Stats",
+			Handler:    _Task_Stats_Handler,
+		},
+		{
+			MethodName: "Connect",
+			Handler:    _Task_Connect_Handler,
+		},
+		{
+			MethodName: "Shutdown",
+			Handler:    _Task_Shutdown_Handler,
+		},
+	},
+	Streams:  []grpc.StreamDesc{},
+	Metadata: "runtime/task/v3/shim.proto",
+}
diff --git a/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim_ttrpc.pb.go b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim_ttrpc.pb.go
new file mode 100644
index 0000000000..d06e0fba85
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/runtime/task/v3/shim_ttrpc.pb.go
@@ -0,0 +1,301 @@
+// Code generated by protoc-gen-go-ttrpc. DO NOT EDIT.
+// source: runtime/task/v3/shim.proto
+package task
+
+import (
+	context "context"
+	ttrpc "github.com/containerd/ttrpc"
+	emptypb "google.golang.org/protobuf/types/known/emptypb"
+)
+
+type TTRPCTaskService interface {
+	State(context.Context, *StateRequest) (*StateResponse, error)
+	Create(context.Context, *CreateTaskRequest) (*CreateTaskResponse, error)
+	Start(context.Context, *StartRequest) (*StartResponse, error)
+	Delete(context.Context, *DeleteRequest) (*DeleteResponse, error)
+	Pids(context.Context, *PidsRequest) (*PidsResponse, error)
+	Pause(context.Context, *PauseRequest) (*emptypb.Empty, error)
+	Resume(context.Context, *ResumeRequest) (*emptypb.Empty, error)
+	Checkpoint(context.Context, *CheckpointTaskRequest) (*emptypb.Empty, error)
+	Kill(context.Context, *KillRequest) (*emptypb.Empty, error)
+	Exec(context.Context, *ExecProcessRequest) (*emptypb.Empty, error)
+	ResizePty(context.Context, *ResizePtyRequest) (*emptypb.Empty, error)
+	CloseIO(context.Context, *CloseIORequest) (*emptypb.Empty, error)
+	Update(context.Context, *UpdateTaskRequest) (*emptypb.Empty, error)
+	Wait(context.Context, *WaitRequest) (*WaitResponse, error)
+	Stats(context.Context, *StatsRequest) (*StatsResponse, error)
+	Connect(context.Context, *ConnectRequest) (*ConnectResponse, error)
+	Shutdown(context.Context, *ShutdownRequest) (*emptypb.Empty, error)
+}
+
+func RegisterTTRPCTaskService(srv *ttrpc.Server, svc TTRPCTaskService) {
+	srv.RegisterService("containerd.task.v3.Task", &ttrpc.ServiceDesc{
+		Methods: map[string]ttrpc.Method{
+			"State": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req StateRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.State(ctx, &req)
+			},
+			"Create": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req CreateTaskRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Create(ctx, &req)
+			},
+			"Start": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req StartRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Start(ctx, &req)
+			},
+			"Delete": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req DeleteRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Delete(ctx, &req)
+			},
+			"Pids": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req PidsRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Pids(ctx, &req)
+			},
+			"Pause": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req PauseRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Pause(ctx, &req)
+			},
+			"Resume": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req ResumeRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Resume(ctx, &req)
+			},
+			"Checkpoint": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req CheckpointTaskRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Checkpoint(ctx, &req)
+			},
+			"Kill": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req KillRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Kill(ctx, &req)
+			},
+			"Exec": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req ExecProcessRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Exec(ctx, &req)
+			},
+			"ResizePty": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req ResizePtyRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.ResizePty(ctx, &req)
+			},
+			"CloseIO": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req CloseIORequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.CloseIO(ctx, &req)
+			},
+			"Update": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req UpdateTaskRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Update(ctx, &req)
+			},
+			"Wait": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req WaitRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Wait(ctx, &req)
+			},
+			"Stats": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req StatsRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Stats(ctx, &req)
+			},
+			"Connect": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req ConnectRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Connect(ctx, &req)
+			},
+			"Shutdown": func(ctx context.Context, unmarshal func(interface{}) error) (interface{}, error) {
+				var req ShutdownRequest
+				if err := unmarshal(&req); err != nil {
+					return nil, err
+				}
+				return svc.Shutdown(ctx, &req)
+			},
+		},
+	})
+}
+
+type ttrpctaskClient struct {
+	client *ttrpc.Client
+}
+
+func NewTTRPCTaskClient(client *ttrpc.Client) TTRPCTaskService {
+	return &ttrpctaskClient{
+		client: client,
+	}
+}
+
+func (c *ttrpctaskClient) State(ctx context.Context, req *StateRequest) (*StateResponse, error) {
+	var resp StateResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "State", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Create(ctx context.Context, req *CreateTaskRequest) (*CreateTaskResponse, error) {
+	var resp CreateTaskResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Create", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Start(ctx context.Context, req *StartRequest) (*StartResponse, error) {
+	var resp StartResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Start", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Delete(ctx context.Context, req *DeleteRequest) (*DeleteResponse, error) {
+	var resp DeleteResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Delete", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Pids(ctx context.Context, req *PidsRequest) (*PidsResponse, error) {
+	var resp PidsResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Pids", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Pause(ctx context.Context, req *PauseRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Pause", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Resume(ctx context.Context, req *ResumeRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Resume", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Checkpoint(ctx context.Context, req *CheckpointTaskRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Checkpoint", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Kill(ctx context.Context, req *KillRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Kill", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Exec(ctx context.Context, req *ExecProcessRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Exec", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) ResizePty(ctx context.Context, req *ResizePtyRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "ResizePty", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) CloseIO(ctx context.Context, req *CloseIORequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "CloseIO", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Update(ctx context.Context, req *UpdateTaskRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Update", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Wait(ctx context.Context, req *WaitRequest) (*WaitResponse, error) {
+	var resp WaitResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Wait", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Stats(ctx context.Context, req *StatsRequest) (*StatsResponse, error) {
+	var resp StatsResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Stats", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Connect(ctx context.Context, req *ConnectRequest) (*ConnectResponse, error) {
+	var resp ConnectResponse
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Connect", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
+
+func (c *ttrpctaskClient) Shutdown(ctx context.Context, req *ShutdownRequest) (*emptypb.Empty, error) {
+	var resp emptypb.Empty
+	if err := c.client.Call(ctx, "containerd.task.v3.Task", "Shutdown", req, &resp); err != nil {
+		return nil, err
+	}
+	return &resp, nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/descriptor.pb.go b/vendor/github.com/containerd/containerd/api/types/descriptor.pb.go
new file mode 100644
index 0000000000..ebc43750dd
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/descriptor.pb.go
@@ -0,0 +1,204 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/descriptor.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Descriptor describes a blob in a content store.
+//
+// This descriptor can be used to reference content from an
+// oci descriptor found in a manifest.
+// See https://godoc.org/github.com/opencontainers/image-spec/specs-go/v1#Descriptor
+type Descriptor struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	MediaType   string            `protobuf:"bytes,1,opt,name=media_type,json=mediaType,proto3" json:"media_type,omitempty"`
+	Digest      string            `protobuf:"bytes,2,opt,name=digest,proto3" json:"digest,omitempty"`
+	Size        int64             `protobuf:"varint,3,opt,name=size,proto3" json:"size,omitempty"`
+	Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *Descriptor) Reset() {
+	*x = Descriptor{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_descriptor_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Descriptor) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Descriptor) ProtoMessage() {}
+
+func (x *Descriptor) ProtoReflect() protoreflect.Message {
+	mi := &file_types_descriptor_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Descriptor.ProtoReflect.Descriptor instead.
+func (*Descriptor) Descriptor() ([]byte, []int) {
+	return file_types_descriptor_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Descriptor) GetMediaType() string {
+	if x != nil {
+		return x.MediaType
+	}
+	return ""
+}
+
+func (x *Descriptor) GetDigest() string {
+	if x != nil {
+		return x.Digest
+	}
+	return ""
+}
+
+func (x *Descriptor) GetSize() int64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+func (x *Descriptor) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+var File_types_descriptor_proto protoreflect.FileDescriptor
+
+var file_types_descriptor_proto_rawDesc = []byte{
+	0x0a, 0x16, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74,
+	0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
+	0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x22, 0xe8, 0x01, 0x0a, 0x0a, 0x44,
+	0x65, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x12, 0x1d, 0x0a, 0x0a, 0x6d, 0x65, 0x64,
+	0x69, 0x61, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6d,
+	0x65, 0x64, 0x69, 0x61, 0x54, 0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x64, 0x69, 0x67, 0x65,
+	0x73, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74,
+	0x12, 0x12, 0x0a, 0x04, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x04,
+	0x73, 0x69, 0x7a, 0x65, 0x12, 0x4f, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x44, 0x65, 0x73,
+	0x63, 0x72, 0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69,
+	0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x3e, 0x0a, 0x10, 0x41, 0x6e, 0x6e, 0x6f, 0x74, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79,
+	0x70, 0x65, 0x73, 0x3b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_types_descriptor_proto_rawDescOnce sync.Once
+	file_types_descriptor_proto_rawDescData = file_types_descriptor_proto_rawDesc
+)
+
+func file_types_descriptor_proto_rawDescGZIP() []byte {
+	file_types_descriptor_proto_rawDescOnce.Do(func() {
+		file_types_descriptor_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_descriptor_proto_rawDescData)
+	})
+	return file_types_descriptor_proto_rawDescData
+}
+
+var file_types_descriptor_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_types_descriptor_proto_goTypes = []interface{}{
+	(*Descriptor)(nil), // 0: containerd.types.Descriptor
+	nil,                // 1: containerd.types.Descriptor.AnnotationsEntry
+}
+var file_types_descriptor_proto_depIdxs = []int32{
+	1, // 0: containerd.types.Descriptor.annotations:type_name -> containerd.types.Descriptor.AnnotationsEntry
+	1, // [1:1] is the sub-list for method output_type
+	1, // [1:1] is the sub-list for method input_type
+	1, // [1:1] is the sub-list for extension type_name
+	1, // [1:1] is the sub-list for extension extendee
+	0, // [0:1] is the sub-list for field type_name
+}
+
+func init() { file_types_descriptor_proto_init() }
+func file_types_descriptor_proto_init() {
+	if File_types_descriptor_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_descriptor_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Descriptor); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_descriptor_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_descriptor_proto_goTypes,
+		DependencyIndexes: file_types_descriptor_proto_depIdxs,
+		MessageInfos:      file_types_descriptor_proto_msgTypes,
+	}.Build()
+	File_types_descriptor_proto = out.File
+	file_types_descriptor_proto_rawDesc = nil
+	file_types_descriptor_proto_goTypes = nil
+	file_types_descriptor_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/descriptor.proto b/vendor/github.com/containerd/containerd/api/types/descriptor.proto
new file mode 100644
index 0000000000..9baadad196
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/descriptor.proto
@@ -0,0 +1,33 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+// Descriptor describes a blob in a content store.
+//
+// This descriptor can be used to reference content from an
+// oci descriptor found in a manifest.
+// See https://godoc.org/github.com/opencontainers/image-spec/specs-go/v1#Descriptor
+message Descriptor {
+  string media_type = 1;
+  string digest = 2;
+  int64 size = 3;
+  map<string, string> annotations = 5;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/doc.go b/vendor/github.com/containerd/containerd/api/types/doc.go
new file mode 100644
index 0000000000..475b465ed4
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/doc.go
@@ -0,0 +1,17 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package types
diff --git a/vendor/github.com/containerd/containerd/api/types/event.pb.go b/vendor/github.com/containerd/containerd/api/types/event.pb.go
new file mode 100644
index 0000000000..a1984674d9
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/event.pb.go
@@ -0,0 +1,205 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/event.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Envelope struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Timestamp *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	Namespace string                 `protobuf:"bytes,2,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	Topic     string                 `protobuf:"bytes,3,opt,name=topic,proto3" json:"topic,omitempty"`
+	Event     *anypb.Any             `protobuf:"bytes,4,opt,name=event,proto3" json:"event,omitempty"`
+}
+
+func (x *Envelope) Reset() {
+	*x = Envelope{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_event_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Envelope) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Envelope) ProtoMessage() {}
+
+func (x *Envelope) ProtoReflect() protoreflect.Message {
+	mi := &file_types_event_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Envelope.ProtoReflect.Descriptor instead.
+func (*Envelope) Descriptor() ([]byte, []int) {
+	return file_types_event_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Envelope) GetTimestamp() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Timestamp
+	}
+	return nil
+}
+
+func (x *Envelope) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *Envelope) GetTopic() string {
+	if x != nil {
+		return x.Topic
+	}
+	return ""
+}
+
+func (x *Envelope) GetEvent() *anypb.Any {
+	if x != nil {
+		return x.Event
+	}
+	return nil
+}
+
+var File_types_event_proto protoreflect.FileDescriptor
+
+var file_types_event_proto_rawDesc = []byte{
+	0x0a, 0x11, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x1a, 0x15, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61,
+	0x74, 0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xaa, 0x01, 0x0a, 0x08, 0x45, 0x6e, 0x76,
+	0x65, 0x6c, 0x6f, 0x70, 0x65, 0x12, 0x38, 0x0a, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12,
+	0x1c, 0x0a, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x09, 0x6e, 0x61, 0x6d, 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x12, 0x14, 0x0a,
+	0x05, 0x74, 0x6f, 0x70, 0x69, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f,
+	0x70, 0x69, 0x63, 0x12, 0x2a, 0x0a, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x18, 0x04, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x65, 0x76, 0x65, 0x6e, 0x74, 0x3a,
+	0x04, 0x80, 0xb9, 0x1f, 0x01, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79,
+	0x70, 0x65, 0x73, 0x3b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x33,
+}
+
+var (
+	file_types_event_proto_rawDescOnce sync.Once
+	file_types_event_proto_rawDescData = file_types_event_proto_rawDesc
+)
+
+func file_types_event_proto_rawDescGZIP() []byte {
+	file_types_event_proto_rawDescOnce.Do(func() {
+		file_types_event_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_event_proto_rawDescData)
+	})
+	return file_types_event_proto_rawDescData
+}
+
+var file_types_event_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_types_event_proto_goTypes = []interface{}{
+	(*Envelope)(nil),              // 0: containerd.types.Envelope
+	(*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp
+	(*anypb.Any)(nil),             // 2: google.protobuf.Any
+}
+var file_types_event_proto_depIdxs = []int32{
+	1, // 0: containerd.types.Envelope.timestamp:type_name -> google.protobuf.Timestamp
+	2, // 1: containerd.types.Envelope.event:type_name -> google.protobuf.Any
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_types_event_proto_init() }
+func file_types_event_proto_init() {
+	if File_types_event_proto != nil {
+		return
+	}
+	file_types_fieldpath_proto_init()
+	if !protoimpl.UnsafeEnabled {
+		file_types_event_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Envelope); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_event_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_event_proto_goTypes,
+		DependencyIndexes: file_types_event_proto_depIdxs,
+		MessageInfos:      file_types_event_proto_msgTypes,
+	}.Build()
+	File_types_event_proto = out.File
+	file_types_event_proto_rawDesc = nil
+	file_types_event_proto_goTypes = nil
+	file_types_event_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/event.proto b/vendor/github.com/containerd/containerd/api/types/event.proto
new file mode 100644
index 0000000000..0b9c3fb937
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/event.proto
@@ -0,0 +1,33 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+import "types/fieldpath.proto";
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+message Envelope {
+  option (containerd.types.fieldpath) = true;
+  google.protobuf.Timestamp timestamp = 1;
+  string namespace = 2;
+  string topic = 3;
+  google.protobuf.Any event = 4;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/fieldpath.pb.go b/vendor/github.com/containerd/containerd/api/types/fieldpath.pb.go
new file mode 100644
index 0000000000..64172a51ed
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/fieldpath.pb.go
@@ -0,0 +1,142 @@
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/fieldpath.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	descriptorpb "google.golang.org/protobuf/types/descriptorpb"
+	reflect "reflect"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+var file_types_fieldpath_proto_extTypes = []protoimpl.ExtensionInfo{
+	{
+		ExtendedType:  (*descriptorpb.FileOptions)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         63300,
+		Name:          "containerd.types.fieldpath_all",
+		Tag:           "varint,63300,opt,name=fieldpath_all",
+		Filename:      "types/fieldpath.proto",
+	},
+	{
+		ExtendedType:  (*descriptorpb.MessageOptions)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         64400,
+		Name:          "containerd.types.fieldpath",
+		Tag:           "varint,64400,opt,name=fieldpath",
+		Filename:      "types/fieldpath.proto",
+	},
+}
+
+// Extension fields to descriptorpb.FileOptions.
+var (
+	// optional bool fieldpath_all = 63300;
+	E_FieldpathAll = &file_types_fieldpath_proto_extTypes[0]
+)
+
+// Extension fields to descriptorpb.MessageOptions.
+var (
+	// optional bool fieldpath = 64400;
+	E_Fieldpath = &file_types_fieldpath_proto_extTypes[1]
+)
+
+var File_types_fieldpath_proto protoreflect.FileDescriptor
+
+var file_types_fieldpath_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74,
+	0x68, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x20, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x64, 0x65, 0x73, 0x63, 0x72,
+	0x69, 0x70, 0x74, 0x6f, 0x72, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x3a, 0x46, 0x0a, 0x0d, 0x66,
+	0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x5f, 0x61, 0x6c, 0x6c, 0x12, 0x1c, 0x2e, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46,
+	0x69, 0x6c, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xc4, 0xee, 0x03, 0x20, 0x01,
+	0x28, 0x08, 0x52, 0x0c, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68, 0x41, 0x6c, 0x6c,
+	0x88, 0x01, 0x01, 0x3a, 0x42, 0x0a, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x70, 0x61, 0x74, 0x68,
+	0x12, 0x1f, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x4d, 0x65, 0x73, 0x73, 0x61, 0x67, 0x65, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x73, 0x18, 0x90, 0xf7, 0x03, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09, 0x66, 0x69, 0x65, 0x6c, 0x64,
+	0x70, 0x61, 0x74, 0x68, 0x88, 0x01, 0x01, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75,
+	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x3b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x33,
+}
+
+var file_types_fieldpath_proto_goTypes = []interface{}{
+	(*descriptorpb.FileOptions)(nil),    // 0: google.protobuf.FileOptions
+	(*descriptorpb.MessageOptions)(nil), // 1: google.protobuf.MessageOptions
+}
+var file_types_fieldpath_proto_depIdxs = []int32{
+	0, // 0: containerd.types.fieldpath_all:extendee -> google.protobuf.FileOptions
+	1, // 1: containerd.types.fieldpath:extendee -> google.protobuf.MessageOptions
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	0, // [0:2] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_types_fieldpath_proto_init() }
+func file_types_fieldpath_proto_init() {
+	if File_types_fieldpath_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_fieldpath_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   0,
+			NumExtensions: 2,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_fieldpath_proto_goTypes,
+		DependencyIndexes: file_types_fieldpath_proto_depIdxs,
+		ExtensionInfos:    file_types_fieldpath_proto_extTypes,
+	}.Build()
+	File_types_fieldpath_proto = out.File
+	file_types_fieldpath_proto_rawDesc = nil
+	file_types_fieldpath_proto_goTypes = nil
+	file_types_fieldpath_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/fieldpath.proto b/vendor/github.com/containerd/containerd/api/types/fieldpath.proto
new file mode 100644
index 0000000000..bb5591da5e
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/fieldpath.proto
@@ -0,0 +1,42 @@
+// Protocol Buffers for Go with Gadgets
+//
+// Copyright (c) 2013, The GoGo Authors. All rights reserved.
+// http://github.com/gogo/protobuf
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+syntax = "proto3";
+package containerd.types;
+
+import "google/protobuf/descriptor.proto";
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+extend google.protobuf.FileOptions {
+  optional bool fieldpath_all = 63300;
+}
+
+extend google.protobuf.MessageOptions {
+  optional bool fieldpath = 64400;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/introspection.pb.go b/vendor/github.com/containerd/containerd/api/types/introspection.pb.go
new file mode 100644
index 0000000000..b5f8044731
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/introspection.pb.go
@@ -0,0 +1,373 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/introspection.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type RuntimeRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	RuntimePath string `protobuf:"bytes,1,opt,name=runtime_path,json=runtimePath,proto3" json:"runtime_path,omitempty"`
+	// Options correspond to CreateTaskRequest.options.
+	// This is needed to pass the runc binary path, etc.
+	Options *anypb.Any `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
+}
+
+func (x *RuntimeRequest) Reset() {
+	*x = RuntimeRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_introspection_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RuntimeRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeRequest) ProtoMessage() {}
+
+func (x *RuntimeRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_types_introspection_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeRequest.ProtoReflect.Descriptor instead.
+func (*RuntimeRequest) Descriptor() ([]byte, []int) {
+	return file_types_introspection_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *RuntimeRequest) GetRuntimePath() string {
+	if x != nil {
+		return x.RuntimePath
+	}
+	return ""
+}
+
+func (x *RuntimeRequest) GetOptions() *anypb.Any {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+type RuntimeVersion struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Version  string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	Revision string `protobuf:"bytes,2,opt,name=revision,proto3" json:"revision,omitempty"`
+}
+
+func (x *RuntimeVersion) Reset() {
+	*x = RuntimeVersion{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_introspection_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RuntimeVersion) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeVersion) ProtoMessage() {}
+
+func (x *RuntimeVersion) ProtoReflect() protoreflect.Message {
+	mi := &file_types_introspection_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeVersion.ProtoReflect.Descriptor instead.
+func (*RuntimeVersion) Descriptor() ([]byte, []int) {
+	return file_types_introspection_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *RuntimeVersion) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *RuntimeVersion) GetRevision() string {
+	if x != nil {
+		return x.Revision
+	}
+	return ""
+}
+
+type RuntimeInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name    string          `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Version *RuntimeVersion `protobuf:"bytes,2,opt,name=version,proto3" json:"version,omitempty"`
+	// Options correspond to RuntimeInfoRequest.Options (contains runc binary path, etc.)
+	Options *anypb.Any `protobuf:"bytes,3,opt,name=options,proto3" json:"options,omitempty"`
+	// OCI-compatible runtimes should use https://github.com/opencontainers/runtime-spec/blob/main/features.md
+	Features *anypb.Any `protobuf:"bytes,4,opt,name=features,proto3" json:"features,omitempty"`
+	// Annotations of the shim. Irrelevant to features.Annotations.
+	Annotations map[string]string `protobuf:"bytes,5,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *RuntimeInfo) Reset() {
+	*x = RuntimeInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_introspection_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RuntimeInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeInfo) ProtoMessage() {}
+
+func (x *RuntimeInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_types_introspection_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeInfo.ProtoReflect.Descriptor instead.
+func (*RuntimeInfo) Descriptor() ([]byte, []int) {
+	return file_types_introspection_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *RuntimeInfo) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RuntimeInfo) GetVersion() *RuntimeVersion {
+	if x != nil {
+		return x.Version
+	}
+	return nil
+}
+
+func (x *RuntimeInfo) GetOptions() *anypb.Any {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+func (x *RuntimeInfo) GetFeatures() *anypb.Any {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
+func (x *RuntimeInfo) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+var File_types_introspection_proto protoreflect.FileDescriptor
+
+var file_types_introspection_proto_rawDesc = []byte{
+	0x0a, 0x19, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x69, 0x6e, 0x74, 0x72, 0x6f, 0x73, 0x70, 0x65,
+	0x63, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x19, 0x67,
+	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61,
+	0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x63, 0x0a, 0x0e, 0x52, 0x75, 0x6e, 0x74,
+	0x69, 0x6d, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x21, 0x0a, 0x0c, 0x72, 0x75,
+	0x6e, 0x74, 0x69, 0x6d, 0x65, 0x5f, 0x70, 0x61, 0x74, 0x68, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0b, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x50, 0x61, 0x74, 0x68, 0x12, 0x2e, 0x0a,
+	0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x41, 0x6e, 0x79, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x46, 0x0a,
+	0x0e, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12,
+	0x18, 0x0a, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x07, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x65, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x22, 0xd1, 0x02, 0x0a, 0x0b, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d,
+	0x65, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x3a, 0x0a, 0x07, 0x76, 0x65, 0x72,
+	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x52, 0x75,
+	0x6e, 0x74, 0x69, 0x6d, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x52, 0x07, 0x76, 0x65,
+	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x2e, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x07, 0x6f, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x30, 0x0a, 0x08, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65,
+	0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x08, 0x66,
+	0x65, 0x61, 0x74, 0x75, 0x72, 0x65, 0x73, 0x12, 0x50, 0x0a, 0x0b, 0x61, 0x6e, 0x6e, 0x6f, 0x74,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e,
+	0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x49, 0x6e, 0x66, 0x6f, 0x2e, 0x41, 0x6e, 0x6e, 0x6f,
+	0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0b, 0x61, 0x6e,
+	0x6e, 0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x1a, 0x3e, 0x0a, 0x10, 0x41, 0x6e, 0x6e,
+	0x6f, 0x74, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70,
+	0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x3b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_introspection_proto_rawDescOnce sync.Once
+	file_types_introspection_proto_rawDescData = file_types_introspection_proto_rawDesc
+)
+
+func file_types_introspection_proto_rawDescGZIP() []byte {
+	file_types_introspection_proto_rawDescOnce.Do(func() {
+		file_types_introspection_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_introspection_proto_rawDescData)
+	})
+	return file_types_introspection_proto_rawDescData
+}
+
+var file_types_introspection_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_types_introspection_proto_goTypes = []interface{}{
+	(*RuntimeRequest)(nil), // 0: containerd.types.RuntimeRequest
+	(*RuntimeVersion)(nil), // 1: containerd.types.RuntimeVersion
+	(*RuntimeInfo)(nil),    // 2: containerd.types.RuntimeInfo
+	nil,                    // 3: containerd.types.RuntimeInfo.AnnotationsEntry
+	(*anypb.Any)(nil),      // 4: google.protobuf.Any
+}
+var file_types_introspection_proto_depIdxs = []int32{
+	4, // 0: containerd.types.RuntimeRequest.options:type_name -> google.protobuf.Any
+	1, // 1: containerd.types.RuntimeInfo.version:type_name -> containerd.types.RuntimeVersion
+	4, // 2: containerd.types.RuntimeInfo.options:type_name -> google.protobuf.Any
+	4, // 3: containerd.types.RuntimeInfo.features:type_name -> google.protobuf.Any
+	3, // 4: containerd.types.RuntimeInfo.annotations:type_name -> containerd.types.RuntimeInfo.AnnotationsEntry
+	5, // [5:5] is the sub-list for method output_type
+	5, // [5:5] is the sub-list for method input_type
+	5, // [5:5] is the sub-list for extension type_name
+	5, // [5:5] is the sub-list for extension extendee
+	0, // [0:5] is the sub-list for field type_name
+}
+
+func init() { file_types_introspection_proto_init() }
+func file_types_introspection_proto_init() {
+	if File_types_introspection_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_introspection_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RuntimeRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_introspection_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RuntimeVersion); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_introspection_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*RuntimeInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_introspection_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_introspection_proto_goTypes,
+		DependencyIndexes: file_types_introspection_proto_depIdxs,
+		MessageInfos:      file_types_introspection_proto_msgTypes,
+	}.Build()
+	File_types_introspection_proto = out.File
+	file_types_introspection_proto_rawDesc = nil
+	file_types_introspection_proto_goTypes = nil
+	file_types_introspection_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/introspection.proto b/vendor/github.com/containerd/containerd/api/types/introspection.proto
new file mode 100644
index 0000000000..5ce83bfe0c
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/introspection.proto
@@ -0,0 +1,46 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+import "google/protobuf/any.proto";
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+message RuntimeRequest {
+  string runtime_path = 1;
+  // Options correspond to CreateTaskRequest.options.
+  // This is needed to pass the runc binary path, etc.
+  google.protobuf.Any options = 2;
+}
+
+message RuntimeVersion {
+  string version = 1;
+  string revision = 2;
+}
+
+message RuntimeInfo {
+  string name = 1;
+  RuntimeVersion version = 2;
+  // Options correspond to RuntimeInfoRequest.Options (contains runc binary path, etc.)
+  google.protobuf.Any options = 3;
+  // OCI-compatible runtimes should use https://github.com/opencontainers/runtime-spec/blob/main/features.md
+  google.protobuf.Any features = 4;
+  // Annotations of the shim. Irrelevant to features.Annotations.
+  map<string, string> annotations = 5;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/metrics.pb.go b/vendor/github.com/containerd/containerd/api/types/metrics.pb.go
new file mode 100644
index 0000000000..1cd6a7548c
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/metrics.pb.go
@@ -0,0 +1,191 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/metrics.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Metric struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Timestamp *timestamppb.Timestamp `protobuf:"bytes,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	ID        string                 `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Data      *anypb.Any             `protobuf:"bytes,3,opt,name=data,proto3" json:"data,omitempty"`
+}
+
+func (x *Metric) Reset() {
+	*x = Metric{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_metrics_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Metric) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metric) ProtoMessage() {}
+
+func (x *Metric) ProtoReflect() protoreflect.Message {
+	mi := &file_types_metrics_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metric.ProtoReflect.Descriptor instead.
+func (*Metric) Descriptor() ([]byte, []int) {
+	return file_types_metrics_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Metric) GetTimestamp() *timestamppb.Timestamp {
+	if x != nil {
+		return x.Timestamp
+	}
+	return nil
+}
+
+func (x *Metric) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *Metric) GetData() *anypb.Any {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+var File_types_metrics_proto protoreflect.FileDescriptor
+
+var file_types_metrics_proto_rawDesc = []byte{
+	0x0a, 0x13, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x6d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x73, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0x7c, 0x0a, 0x06, 0x4d, 0x65, 0x74, 0x72, 0x69, 0x63, 0x12, 0x38, 0x0a,
+	0x09, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x74, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x28, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x04, 0x64, 0x61, 0x74,
+	0x61, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x3b,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_metrics_proto_rawDescOnce sync.Once
+	file_types_metrics_proto_rawDescData = file_types_metrics_proto_rawDesc
+)
+
+func file_types_metrics_proto_rawDescGZIP() []byte {
+	file_types_metrics_proto_rawDescOnce.Do(func() {
+		file_types_metrics_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_metrics_proto_rawDescData)
+	})
+	return file_types_metrics_proto_rawDescData
+}
+
+var file_types_metrics_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_types_metrics_proto_goTypes = []interface{}{
+	(*Metric)(nil),                // 0: containerd.types.Metric
+	(*timestamppb.Timestamp)(nil), // 1: google.protobuf.Timestamp
+	(*anypb.Any)(nil),             // 2: google.protobuf.Any
+}
+var file_types_metrics_proto_depIdxs = []int32{
+	1, // 0: containerd.types.Metric.timestamp:type_name -> google.protobuf.Timestamp
+	2, // 1: containerd.types.Metric.data:type_name -> google.protobuf.Any
+	2, // [2:2] is the sub-list for method output_type
+	2, // [2:2] is the sub-list for method input_type
+	2, // [2:2] is the sub-list for extension type_name
+	2, // [2:2] is the sub-list for extension extendee
+	0, // [0:2] is the sub-list for field type_name
+}
+
+func init() { file_types_metrics_proto_init() }
+func file_types_metrics_proto_init() {
+	if File_types_metrics_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_metrics_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Metric); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_metrics_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_metrics_proto_goTypes,
+		DependencyIndexes: file_types_metrics_proto_depIdxs,
+		MessageInfos:      file_types_metrics_proto_msgTypes,
+	}.Build()
+	File_types_metrics_proto = out.File
+	file_types_metrics_proto_rawDesc = nil
+	file_types_metrics_proto_goTypes = nil
+	file_types_metrics_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/metrics.proto b/vendor/github.com/containerd/containerd/api/types/metrics.proto
new file mode 100644
index 0000000000..d1a7d49cc3
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/metrics.proto
@@ -0,0 +1,30 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+message Metric {
+  google.protobuf.Timestamp timestamp = 1;
+  string id = 2;
+  google.protobuf.Any data = 3;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/mount.pb.go b/vendor/github.com/containerd/containerd/api/types/mount.pb.go
new file mode 100644
index 0000000000..5191270feb
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/mount.pb.go
@@ -0,0 +1,414 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/mount.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Mount describes mounts for a container.
+//
+// This type is the lingua franca of ContainerD. All services provide mounts
+// to be used with the container at creation time.
+//
+// The Mount type follows the structure of the mount syscall, including a type,
+// source, target and options.
+type Mount struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Type defines the nature of the mount.
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Source specifies the name of the mount. Depending on mount type, this
+	// may be a volume name or a host path, or even ignored.
+	Source string `protobuf:"bytes,2,opt,name=source,proto3" json:"source,omitempty"`
+	// Target path in container
+	Target string `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
+	// Options specifies zero or more fstab style mount options.
+	Options []string `protobuf:"bytes,4,rep,name=options,proto3" json:"options,omitempty"`
+}
+
+func (x *Mount) Reset() {
+	*x = Mount{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_mount_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Mount) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Mount) ProtoMessage() {}
+
+func (x *Mount) ProtoReflect() protoreflect.Message {
+	mi := &file_types_mount_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Mount.ProtoReflect.Descriptor instead.
+func (*Mount) Descriptor() ([]byte, []int) {
+	return file_types_mount_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Mount) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *Mount) GetSource() string {
+	if x != nil {
+		return x.Source
+	}
+	return ""
+}
+
+func (x *Mount) GetTarget() string {
+	if x != nil {
+		return x.Target
+	}
+	return ""
+}
+
+func (x *Mount) GetOptions() []string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+type ActiveMount struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Mount      *Mount                 `protobuf:"bytes,1,opt,name=mount,proto3" json:"mount,omitempty"`
+	MountedAt  *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=mounted_at,json=mountedAt,proto3" json:"mounted_at,omitempty"`
+	MountPoint string                 `protobuf:"bytes,3,opt,name=mount_point,json=mountPoint,proto3" json:"mount_point,omitempty"`
+	Data       map[string]string      `protobuf:"bytes,4,rep,name=data,proto3" json:"data,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *ActiveMount) Reset() {
+	*x = ActiveMount{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_mount_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ActiveMount) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActiveMount) ProtoMessage() {}
+
+func (x *ActiveMount) ProtoReflect() protoreflect.Message {
+	mi := &file_types_mount_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActiveMount.ProtoReflect.Descriptor instead.
+func (*ActiveMount) Descriptor() ([]byte, []int) {
+	return file_types_mount_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ActiveMount) GetMount() *Mount {
+	if x != nil {
+		return x.Mount
+	}
+	return nil
+}
+
+func (x *ActiveMount) GetMountedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.MountedAt
+	}
+	return nil
+}
+
+func (x *ActiveMount) GetMountPoint() string {
+	if x != nil {
+		return x.MountPoint
+	}
+	return ""
+}
+
+func (x *ActiveMount) GetData() map[string]string {
+	if x != nil {
+		return x.Data
+	}
+	return nil
+}
+
+type ActivationInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name   string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Active []*ActiveMount    `protobuf:"bytes,2,rep,name=active,proto3" json:"active,omitempty"`
+	System []*Mount          `protobuf:"bytes,3,rep,name=system,proto3" json:"system,omitempty"`
+	Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+}
+
+func (x *ActivationInfo) Reset() {
+	*x = ActivationInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_mount_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ActivationInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ActivationInfo) ProtoMessage() {}
+
+func (x *ActivationInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_types_mount_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ActivationInfo.ProtoReflect.Descriptor instead.
+func (*ActivationInfo) Descriptor() ([]byte, []int) {
+	return file_types_mount_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *ActivationInfo) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ActivationInfo) GetActive() []*ActiveMount {
+	if x != nil {
+		return x.Active
+	}
+	return nil
+}
+
+func (x *ActivationInfo) GetSystem() []*Mount {
+	if x != nil {
+		return x.System
+	}
+	return nil
+}
+
+func (x *ActivationInfo) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+var File_types_mount_proto protoreflect.FileDescriptor
+
+var file_types_mount_proto_rawDesc = []byte{
+	0x0a, 0x11, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e,
+	0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0x65, 0x0a, 0x05, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x12,
+	0x12, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74,
+	0x79, 0x70, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x74,
+	0x61, 0x72, 0x67, 0x65, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x74, 0x61, 0x72,
+	0x67, 0x65, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x04,
+	0x20, 0x03, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x22, 0x8e, 0x02,
+	0x0a, 0x0b, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x2d, 0x0a,
+	0x05, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e,
+	0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x05, 0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x12, 0x39, 0x0a, 0x0a,
+	0x6d, 0x6f, 0x75, 0x6e, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x6d, 0x6f,
+	0x75, 0x6e, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x6d, 0x6f, 0x75, 0x6e, 0x74,
+	0x5f, 0x70, 0x6f, 0x69, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6d, 0x6f,
+	0x75, 0x6e, 0x74, 0x50, 0x6f, 0x69, 0x6e, 0x74, 0x12, 0x3b, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x27, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65,
+	0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x04, 0x64, 0x61, 0x74, 0x61, 0x1a, 0x37, 0x0a, 0x09, 0x44, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x8d,
+	0x02, 0x0a, 0x0e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66,
+	0x6f, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x35, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x18,
+	0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x65, 0x4d,
+	0x6f, 0x75, 0x6e, 0x74, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x76, 0x65, 0x12, 0x2f, 0x0a, 0x06,
+	0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x63,
+	0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e,
+	0x4d, 0x6f, 0x75, 0x6e, 0x74, 0x52, 0x06, 0x73, 0x79, 0x73, 0x74, 0x65, 0x6d, 0x12, 0x44, 0x0a,
+	0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e,
+	0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73,
+	0x2e, 0x41, 0x63, 0x74, 0x69, 0x76, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x6e, 0x66, 0x6f, 0x2e,
+	0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x6c, 0x61, 0x62,
+	0x65, 0x6c, 0x73, 0x1a, 0x39, 0x0a, 0x0b, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x32,
+	0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x3b, 0x74, 0x79, 0x70,
+	0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_mount_proto_rawDescOnce sync.Once
+	file_types_mount_proto_rawDescData = file_types_mount_proto_rawDesc
+)
+
+func file_types_mount_proto_rawDescGZIP() []byte {
+	file_types_mount_proto_rawDescOnce.Do(func() {
+		file_types_mount_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_mount_proto_rawDescData)
+	})
+	return file_types_mount_proto_rawDescData
+}
+
+var file_types_mount_proto_msgTypes = make([]protoimpl.MessageInfo, 5)
+var file_types_mount_proto_goTypes = []interface{}{
+	(*Mount)(nil),                 // 0: containerd.types.Mount
+	(*ActiveMount)(nil),           // 1: containerd.types.ActiveMount
+	(*ActivationInfo)(nil),        // 2: containerd.types.ActivationInfo
+	nil,                           // 3: containerd.types.ActiveMount.DataEntry
+	nil,                           // 4: containerd.types.ActivationInfo.LabelsEntry
+	(*timestamppb.Timestamp)(nil), // 5: google.protobuf.Timestamp
+}
+var file_types_mount_proto_depIdxs = []int32{
+	0, // 0: containerd.types.ActiveMount.mount:type_name -> containerd.types.Mount
+	5, // 1: containerd.types.ActiveMount.mounted_at:type_name -> google.protobuf.Timestamp
+	3, // 2: containerd.types.ActiveMount.data:type_name -> containerd.types.ActiveMount.DataEntry
+	1, // 3: containerd.types.ActivationInfo.active:type_name -> containerd.types.ActiveMount
+	0, // 4: containerd.types.ActivationInfo.system:type_name -> containerd.types.Mount
+	4, // 5: containerd.types.ActivationInfo.labels:type_name -> containerd.types.ActivationInfo.LabelsEntry
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
+}
+
+func init() { file_types_mount_proto_init() }
+func file_types_mount_proto_init() {
+	if File_types_mount_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_mount_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Mount); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_mount_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ActiveMount); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_mount_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ActivationInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_mount_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   5,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_mount_proto_goTypes,
+		DependencyIndexes: file_types_mount_proto_depIdxs,
+		MessageInfos:      file_types_mount_proto_msgTypes,
+	}.Build()
+	File_types_mount_proto = out.File
+	file_types_mount_proto_rawDesc = nil
+	file_types_mount_proto_goTypes = nil
+	file_types_mount_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/mount.proto b/vendor/github.com/containerd/containerd/api/types/mount.proto
new file mode 100644
index 0000000000..05fd4532bc
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/mount.proto
@@ -0,0 +1,65 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+// Mount describes mounts for a container.
+//
+// This type is the lingua franca of ContainerD. All services provide mounts
+// to be used with the container at creation time.
+//
+// The Mount type follows the structure of the mount syscall, including a type,
+// source, target and options.
+message Mount {
+  // Type defines the nature of the mount.
+  string type = 1;
+
+  // Source specifies the name of the mount. Depending on mount type, this
+  // may be a volume name or a host path, or even ignored.
+  string source = 2;
+
+  // Target path in container
+  string target = 3;
+
+  // Options specifies zero or more fstab style mount options.
+  repeated string options = 4;
+}
+
+message ActiveMount {
+  Mount mount = 1;
+
+  google.protobuf.Timestamp mounted_at = 2;
+
+  string mount_point = 3;
+
+  map<string, string> data = 4;
+}
+
+message ActivationInfo {
+  string name = 1;
+
+  repeated ActiveMount active = 2;
+
+  repeated Mount system = 3;
+
+  map<string, string> labels = 4;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/platform.pb.go b/vendor/github.com/containerd/containerd/api/types/platform.pb.go
new file mode 100644
index 0000000000..947b520dba
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/platform.pb.go
@@ -0,0 +1,201 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/platform.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Platform follows the structure of the OCI platform specification, from
+// descriptors.
+type Platform struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	OS           string   `protobuf:"bytes,1,opt,name=os,proto3" json:"os,omitempty"`
+	Architecture string   `protobuf:"bytes,2,opt,name=architecture,proto3" json:"architecture,omitempty"`
+	Variant      string   `protobuf:"bytes,3,opt,name=variant,proto3" json:"variant,omitempty"`
+	OSVersion    string   `protobuf:"bytes,4,opt,name=os_version,json=osVersion,proto3" json:"os_version,omitempty"`
+	OSFeatures   []string `protobuf:"bytes,5,rep,name=os_features,json=osFeatures,proto3" json:"os_features,omitempty"`
+}
+
+func (x *Platform) Reset() {
+	*x = Platform{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_platform_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Platform) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Platform) ProtoMessage() {}
+
+func (x *Platform) ProtoReflect() protoreflect.Message {
+	mi := &file_types_platform_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Platform.ProtoReflect.Descriptor instead.
+func (*Platform) Descriptor() ([]byte, []int) {
+	return file_types_platform_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Platform) GetOS() string {
+	if x != nil {
+		return x.OS
+	}
+	return ""
+}
+
+func (x *Platform) GetArchitecture() string {
+	if x != nil {
+		return x.Architecture
+	}
+	return ""
+}
+
+func (x *Platform) GetVariant() string {
+	if x != nil {
+		return x.Variant
+	}
+	return ""
+}
+
+func (x *Platform) GetOsVersion() string {
+	if x != nil {
+		return x.OSVersion
+	}
+	return ""
+}
+
+func (x *Platform) GetOsFeatures() []string {
+	if x != nil {
+		return x.OSFeatures
+	}
+	return nil
+}
+
+var File_types_platform_proto protoreflect.FileDescriptor
+
+var file_types_platform_proto_rawDesc = []byte{
+	0x0a, 0x14, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x22, 0x98, 0x01, 0x0a, 0x08, 0x50, 0x6c, 0x61,
+	0x74, 0x66, 0x6f, 0x72, 0x6d, 0x12, 0x0e, 0x0a, 0x02, 0x6f, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x02, 0x6f, 0x73, 0x12, 0x22, 0x0a, 0x0c, 0x61, 0x72, 0x63, 0x68, 0x69, 0x74, 0x65,
+	0x63, 0x74, 0x75, 0x72, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x61, 0x72, 0x63,
+	0x68, 0x69, 0x74, 0x65, 0x63, 0x74, 0x75, 0x72, 0x65, 0x12, 0x18, 0x0a, 0x07, 0x76, 0x61, 0x72,
+	0x69, 0x61, 0x6e, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x76, 0x61, 0x72, 0x69,
+	0x61, 0x6e, 0x74, 0x12, 0x1d, 0x0a, 0x0a, 0x6f, 0x73, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f,
+	0x6e, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x6f, 0x73, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6f, 0x73, 0x5f, 0x66, 0x65, 0x61, 0x74, 0x75, 0x72, 0x65,
+	0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x09, 0x52, 0x0a, 0x6f, 0x73, 0x46, 0x65, 0x61, 0x74, 0x75,
+	0x72, 0x65, 0x73, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e,
+	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65,
+	0x73, 0x3b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_platform_proto_rawDescOnce sync.Once
+	file_types_platform_proto_rawDescData = file_types_platform_proto_rawDesc
+)
+
+func file_types_platform_proto_rawDescGZIP() []byte {
+	file_types_platform_proto_rawDescOnce.Do(func() {
+		file_types_platform_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_platform_proto_rawDescData)
+	})
+	return file_types_platform_proto_rawDescData
+}
+
+var file_types_platform_proto_msgTypes = make([]protoimpl.MessageInfo, 1)
+var file_types_platform_proto_goTypes = []interface{}{
+	(*Platform)(nil), // 0: containerd.types.Platform
+}
+var file_types_platform_proto_depIdxs = []int32{
+	0, // [0:0] is the sub-list for method output_type
+	0, // [0:0] is the sub-list for method input_type
+	0, // [0:0] is the sub-list for extension type_name
+	0, // [0:0] is the sub-list for extension extendee
+	0, // [0:0] is the sub-list for field type_name
+}
+
+func init() { file_types_platform_proto_init() }
+func file_types_platform_proto_init() {
+	if File_types_platform_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_platform_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Platform); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_platform_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   1,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_platform_proto_goTypes,
+		DependencyIndexes: file_types_platform_proto_depIdxs,
+		MessageInfos:      file_types_platform_proto_msgTypes,
+	}.Build()
+	File_types_platform_proto = out.File
+	file_types_platform_proto_rawDesc = nil
+	file_types_platform_proto_goTypes = nil
+	file_types_platform_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/platform.proto b/vendor/github.com/containerd/containerd/api/types/platform.proto
new file mode 100644
index 0000000000..33ed85301c
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/platform.proto
@@ -0,0 +1,31 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+// Platform follows the structure of the OCI platform specification, from
+// descriptors.
+message Platform {
+  string os = 1;
+  string architecture = 2;
+  string variant = 3;
+  string os_version = 4;
+  repeated string os_features = 5;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/platform_helpers.go b/vendor/github.com/containerd/containerd/api/types/platform_helpers.go
new file mode 100644
index 0000000000..ba1fec5778
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/platform_helpers.go
@@ -0,0 +1,51 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package types
+
+import oci "github.com/opencontainers/image-spec/specs-go/v1"
+
+// OCIPlatformToProto converts from a slice of OCI [specs.Platform] to a
+// slice of the protobuf definition [Platform].
+func OCIPlatformToProto(platforms []oci.Platform) []*Platform {
+	ap := make([]*Platform, len(platforms))
+	for i := range platforms {
+		ap[i] = &Platform{
+			OS:           platforms[i].OS,
+			OSVersion:    platforms[i].OSVersion,
+			Architecture: platforms[i].Architecture,
+			Variant:      platforms[i].Variant,
+			OSFeatures:   platforms[i].OSFeatures,
+		}
+	}
+	return ap
+}
+
+// OCIPlatformFromProto converts a slice of the protobuf definition [Platform]
+// to a slice of OCI [specs.Platform].
+func OCIPlatformFromProto(platforms []*Platform) []oci.Platform {
+	op := make([]oci.Platform, len(platforms))
+	for i := range platforms {
+		op[i] = oci.Platform{
+			OS:           platforms[i].OS,
+			OSVersion:    platforms[i].OSVersion,
+			Architecture: platforms[i].Architecture,
+			Variant:      platforms[i].Variant,
+			OSFeatures:   platforms[i].OSFeatures,
+		}
+	}
+	return op
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/sandbox.pb.go b/vendor/github.com/containerd/containerd/api/types/sandbox.pb.go
new file mode 100644
index 0000000000..eb84c7be69
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/sandbox.pb.go
@@ -0,0 +1,354 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/sandbox.proto
+
+package types
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+// Sandbox represents a sandbox metadata object that keeps all info required by controller to
+// work with a particular instance.
+type Sandbox struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// SandboxID is a unique instance identifier within namespace
+	SandboxID string `protobuf:"bytes,1,opt,name=sandbox_id,json=sandboxId,proto3" json:"sandbox_id,omitempty"`
+	// Runtime specifies which runtime to use for executing this container.
+	Runtime *Sandbox_Runtime `protobuf:"bytes,2,opt,name=runtime,proto3" json:"runtime,omitempty"`
+	// Spec is sandbox configuration (kin of OCI runtime spec), spec's data will be written to a config.json file in the
+	// bundle directory (similary to OCI spec).
+	Spec *anypb.Any `protobuf:"bytes,3,opt,name=spec,proto3" json:"spec,omitempty"`
+	// Labels provides an area to include arbitrary data on containers.
+	Labels map[string]string `protobuf:"bytes,4,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// CreatedAt is the time the container was first created.
+	CreatedAt *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// UpdatedAt is the last time the container was mutated.
+	UpdatedAt *timestamppb.Timestamp `protobuf:"bytes,6,opt,name=updated_at,json=updatedAt,proto3" json:"updated_at,omitempty"`
+	// Extensions allow clients to provide optional blobs that can be handled by runtime.
+	Extensions map[string]*anypb.Any `protobuf:"bytes,7,rep,name=extensions,proto3" json:"extensions,omitempty" protobuf_key:"bytes,1,opt,name=key,proto3" protobuf_val:"bytes,2,opt,name=value,proto3"`
+	// Sandboxer is the name of the sandbox controller who manages the sandbox.
+	Sandboxer string `protobuf:"bytes,10,opt,name=sandboxer,proto3" json:"sandboxer,omitempty"`
+}
+
+func (x *Sandbox) Reset() {
+	*x = Sandbox{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_sandbox_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Sandbox) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Sandbox) ProtoMessage() {}
+
+func (x *Sandbox) ProtoReflect() protoreflect.Message {
+	mi := &file_types_sandbox_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Sandbox.ProtoReflect.Descriptor instead.
+func (*Sandbox) Descriptor() ([]byte, []int) {
+	return file_types_sandbox_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Sandbox) GetSandboxID() string {
+	if x != nil {
+		return x.SandboxID
+	}
+	return ""
+}
+
+func (x *Sandbox) GetRuntime() *Sandbox_Runtime {
+	if x != nil {
+		return x.Runtime
+	}
+	return nil
+}
+
+func (x *Sandbox) GetSpec() *anypb.Any {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *Sandbox) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *Sandbox) GetCreatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return nil
+}
+
+func (x *Sandbox) GetUpdatedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.UpdatedAt
+	}
+	return nil
+}
+
+func (x *Sandbox) GetExtensions() map[string]*anypb.Any {
+	if x != nil {
+		return x.Extensions
+	}
+	return nil
+}
+
+func (x *Sandbox) GetSandboxer() string {
+	if x != nil {
+		return x.Sandboxer
+	}
+	return ""
+}
+
+type Sandbox_Runtime struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Name is the name of the runtime.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Options specify additional runtime initialization options for the shim (this data will be available in StartShim).
+	// Typically this data expected to be runtime shim implementation specific.
+	Options *anypb.Any `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
+}
+
+func (x *Sandbox_Runtime) Reset() {
+	*x = Sandbox_Runtime{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_sandbox_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Sandbox_Runtime) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Sandbox_Runtime) ProtoMessage() {}
+
+func (x *Sandbox_Runtime) ProtoReflect() protoreflect.Message {
+	mi := &file_types_sandbox_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Sandbox_Runtime.ProtoReflect.Descriptor instead.
+func (*Sandbox_Runtime) Descriptor() ([]byte, []int) {
+	return file_types_sandbox_proto_rawDescGZIP(), []int{0, 0}
+}
+
+func (x *Sandbox_Runtime) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Sandbox_Runtime) GetOptions() *anypb.Any {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+var File_types_sandbox_proto protoreflect.FileDescriptor
+
+var file_types_sandbox_proto_rawDesc = []byte{
+	0x0a, 0x13, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x73, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x10, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72,
+	0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x22, 0x8c, 0x05, 0x0a, 0x07, 0x53, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78, 0x12,
+	0x1d, 0x0a, 0x0a, 0x73, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78, 0x49, 0x64, 0x12, 0x3b,
+	0x0a, 0x07, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x21, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70,
+	0x65, 0x73, 0x2e, 0x53, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78, 0x2e, 0x52, 0x75, 0x6e, 0x74, 0x69,
+	0x6d, 0x65, 0x52, 0x07, 0x72, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x28, 0x0a, 0x04, 0x73,
+	0x70, 0x65, 0x63, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52,
+	0x04, 0x73, 0x70, 0x65, 0x63, 0x12, 0x3d, 0x0a, 0x06, 0x6c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x25, 0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e, 0x53, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78,
+	0x2e, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x6c, 0x61,
+	0x62, 0x65, 0x6c, 0x73, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12,
+	0x39, 0x0a, 0x0a, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52,
+	0x09, 0x75, 0x70, 0x64, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x12, 0x49, 0x0a, 0x0a, 0x65, 0x78,
+	0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29,
+	0x2e, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x74, 0x79, 0x70, 0x65,
+	0x73, 0x2e, 0x53, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73,
+	0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0a, 0x65, 0x78, 0x74, 0x65, 0x6e,
+	0x73, 0x69, 0x6f, 0x6e, 0x73, 0x12, 0x1c, 0x0a, 0x09, 0x73, 0x61, 0x6e, 0x64, 0x62, 0x6f, 0x78,
+	0x65, 0x72, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x09, 0x73, 0x61, 0x6e, 0x64, 0x62, 0x6f,
+	0x78, 0x65, 0x72, 0x1a, 0x4d, 0x0a, 0x07, 0x52, 0x75, 0x6e, 0x74, 0x69, 0x6d, 0x65, 0x12, 0x12,
+	0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x6e, 0x61,
+	0x6d, 0x65, 0x12, 0x2e, 0x0a, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x07, 0x6f, 0x70, 0x74, 0x69, 0x6f,
+	0x6e, 0x73, 0x1a, 0x39, 0x0a, 0x0b, 0x4c, 0x61, 0x62, 0x65, 0x6c, 0x73, 0x45, 0x6e, 0x74, 0x72,
+	0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03,
+	0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x53, 0x0a,
+	0x0f, 0x45, 0x78, 0x74, 0x65, 0x6e, 0x73, 0x69, 0x6f, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x42, 0x32, 0x5a, 0x30, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d,
+	0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73,
+	0x3b, 0x74, 0x79, 0x70, 0x65, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_sandbox_proto_rawDescOnce sync.Once
+	file_types_sandbox_proto_rawDescData = file_types_sandbox_proto_rawDesc
+)
+
+func file_types_sandbox_proto_rawDescGZIP() []byte {
+	file_types_sandbox_proto_rawDescOnce.Do(func() {
+		file_types_sandbox_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_sandbox_proto_rawDescData)
+	})
+	return file_types_sandbox_proto_rawDescData
+}
+
+var file_types_sandbox_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_types_sandbox_proto_goTypes = []interface{}{
+	(*Sandbox)(nil),               // 0: containerd.types.Sandbox
+	(*Sandbox_Runtime)(nil),       // 1: containerd.types.Sandbox.Runtime
+	nil,                           // 2: containerd.types.Sandbox.LabelsEntry
+	nil,                           // 3: containerd.types.Sandbox.ExtensionsEntry
+	(*anypb.Any)(nil),             // 4: google.protobuf.Any
+	(*timestamppb.Timestamp)(nil), // 5: google.protobuf.Timestamp
+}
+var file_types_sandbox_proto_depIdxs = []int32{
+	1, // 0: containerd.types.Sandbox.runtime:type_name -> containerd.types.Sandbox.Runtime
+	4, // 1: containerd.types.Sandbox.spec:type_name -> google.protobuf.Any
+	2, // 2: containerd.types.Sandbox.labels:type_name -> containerd.types.Sandbox.LabelsEntry
+	5, // 3: containerd.types.Sandbox.created_at:type_name -> google.protobuf.Timestamp
+	5, // 4: containerd.types.Sandbox.updated_at:type_name -> google.protobuf.Timestamp
+	3, // 5: containerd.types.Sandbox.extensions:type_name -> containerd.types.Sandbox.ExtensionsEntry
+	4, // 6: containerd.types.Sandbox.Runtime.options:type_name -> google.protobuf.Any
+	4, // 7: containerd.types.Sandbox.ExtensionsEntry.value:type_name -> google.protobuf.Any
+	8, // [8:8] is the sub-list for method output_type
+	8, // [8:8] is the sub-list for method input_type
+	8, // [8:8] is the sub-list for extension type_name
+	8, // [8:8] is the sub-list for extension extendee
+	0, // [0:8] is the sub-list for field type_name
+}
+
+func init() { file_types_sandbox_proto_init() }
+func file_types_sandbox_proto_init() {
+	if File_types_sandbox_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_sandbox_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Sandbox); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_sandbox_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Sandbox_Runtime); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_sandbox_proto_rawDesc,
+			NumEnums:      0,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_sandbox_proto_goTypes,
+		DependencyIndexes: file_types_sandbox_proto_depIdxs,
+		MessageInfos:      file_types_sandbox_proto_msgTypes,
+	}.Build()
+	File_types_sandbox_proto = out.File
+	file_types_sandbox_proto_rawDesc = nil
+	file_types_sandbox_proto_goTypes = nil
+	file_types_sandbox_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/sandbox.proto b/vendor/github.com/containerd/containerd/api/types/sandbox.proto
new file mode 100644
index 0000000000..0236441925
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/sandbox.proto
@@ -0,0 +1,53 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.types;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/containerd/containerd/api/types;types";
+
+// Sandbox represents a sandbox metadata object that keeps all info required by controller to
+// work with a particular instance.
+message Sandbox {
+  // SandboxID is a unique instance identifier within namespace
+  string sandbox_id = 1;
+  message Runtime {
+    // Name is the name of the runtime.
+    string name = 1;
+    // Options specify additional runtime initialization options for the shim (this data will be available in StartShim).
+    // Typically this data expected to be runtime shim implementation specific.
+    google.protobuf.Any options = 2;
+  }
+  // Runtime specifies which runtime to use for executing this container.
+  Runtime runtime = 2;
+  // Spec is sandbox configuration (kin of OCI runtime spec), spec's data will be written to a config.json file in the
+  // bundle directory (similary to OCI spec).
+  google.protobuf.Any spec = 3;
+  // Labels provides an area to include arbitrary data on containers.
+  map<string, string> labels = 4;
+  // CreatedAt is the time the container was first created.
+  google.protobuf.Timestamp created_at = 5;
+  // UpdatedAt is the last time the container was mutated.
+  google.protobuf.Timestamp updated_at = 6;
+  // Extensions allow clients to provide optional blobs that can be handled by runtime.
+  map<string, google.protobuf.Any> extensions = 7;
+  // Sandboxer is the name of the sandbox controller who manages the sandbox.
+  string sandboxer = 10;
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/task/doc.go b/vendor/github.com/containerd/containerd/api/types/task/doc.go
new file mode 100644
index 0000000000..e10c7a4699
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/task/doc.go
@@ -0,0 +1,18 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package task defines the task service.
+package task
diff --git a/vendor/github.com/containerd/containerd/api/types/task/task.pb.go b/vendor/github.com/containerd/containerd/api/types/task/task.pb.go
new file mode 100644
index 0000000000..c81d4b7d33
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/task/task.pb.go
@@ -0,0 +1,404 @@
+//
+//Copyright The containerd Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.28.1
+// 	protoc        (unknown)
+// source: types/task/task.proto
+
+package task
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	anypb "google.golang.org/protobuf/types/known/anypb"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Status int32
+
+const (
+	Status_UNKNOWN Status = 0
+	Status_CREATED Status = 1
+	Status_RUNNING Status = 2
+	Status_STOPPED Status = 3
+	Status_PAUSED  Status = 4
+	Status_PAUSING Status = 5
+)
+
+// Enum value maps for Status.
+var (
+	Status_name = map[int32]string{
+		0: "UNKNOWN",
+		1: "CREATED",
+		2: "RUNNING",
+		3: "STOPPED",
+		4: "PAUSED",
+		5: "PAUSING",
+	}
+	Status_value = map[string]int32{
+		"UNKNOWN": 0,
+		"CREATED": 1,
+		"RUNNING": 2,
+		"STOPPED": 3,
+		"PAUSED":  4,
+		"PAUSING": 5,
+	}
+)
+
+func (x Status) Enum() *Status {
+	p := new(Status)
+	*p = x
+	return p
+}
+
+func (x Status) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Status) Descriptor() protoreflect.EnumDescriptor {
+	return file_types_task_task_proto_enumTypes[0].Descriptor()
+}
+
+func (Status) Type() protoreflect.EnumType {
+	return &file_types_task_task_proto_enumTypes[0]
+}
+
+func (x Status) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Status.Descriptor instead.
+func (Status) EnumDescriptor() ([]byte, []int) {
+	return file_types_task_task_proto_rawDescGZIP(), []int{0}
+}
+
+type Process struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ContainerID string                 `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	ID          string                 `protobuf:"bytes,2,opt,name=id,proto3" json:"id,omitempty"`
+	Pid         uint32                 `protobuf:"varint,3,opt,name=pid,proto3" json:"pid,omitempty"`
+	Status      Status                 `protobuf:"varint,4,opt,name=status,proto3,enum=containerd.v1.types.Status" json:"status,omitempty"`
+	Stdin       string                 `protobuf:"bytes,5,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	Stdout      string                 `protobuf:"bytes,6,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr      string                 `protobuf:"bytes,7,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	Terminal    bool                   `protobuf:"varint,8,opt,name=terminal,proto3" json:"terminal,omitempty"`
+	ExitStatus  uint32                 `protobuf:"varint,9,opt,name=exit_status,json=exitStatus,proto3" json:"exit_status,omitempty"`
+	ExitedAt    *timestamppb.Timestamp `protobuf:"bytes,10,opt,name=exited_at,json=exitedAt,proto3" json:"exited_at,omitempty"`
+}
+
+func (x *Process) Reset() {
+	*x = Process{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_task_task_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Process) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Process) ProtoMessage() {}
+
+func (x *Process) ProtoReflect() protoreflect.Message {
+	mi := &file_types_task_task_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Process.ProtoReflect.Descriptor instead.
+func (*Process) Descriptor() ([]byte, []int) {
+	return file_types_task_task_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *Process) GetContainerID() string {
+	if x != nil {
+		return x.ContainerID
+	}
+	return ""
+}
+
+func (x *Process) GetID() string {
+	if x != nil {
+		return x.ID
+	}
+	return ""
+}
+
+func (x *Process) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+func (x *Process) GetStatus() Status {
+	if x != nil {
+		return x.Status
+	}
+	return Status_UNKNOWN
+}
+
+func (x *Process) GetStdin() string {
+	if x != nil {
+		return x.Stdin
+	}
+	return ""
+}
+
+func (x *Process) GetStdout() string {
+	if x != nil {
+		return x.Stdout
+	}
+	return ""
+}
+
+func (x *Process) GetStderr() string {
+	if x != nil {
+		return x.Stderr
+	}
+	return ""
+}
+
+func (x *Process) GetTerminal() bool {
+	if x != nil {
+		return x.Terminal
+	}
+	return false
+}
+
+func (x *Process) GetExitStatus() uint32 {
+	if x != nil {
+		return x.ExitStatus
+	}
+	return 0
+}
+
+func (x *Process) GetExitedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.ExitedAt
+	}
+	return nil
+}
+
+type ProcessInfo struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// PID is the process ID.
+	Pid uint32 `protobuf:"varint,1,opt,name=pid,proto3" json:"pid,omitempty"`
+	// Info contains additional process information.
+	//
+	// Info varies by platform.
+	Info *anypb.Any `protobuf:"bytes,2,opt,name=info,proto3" json:"info,omitempty"`
+}
+
+func (x *ProcessInfo) Reset() {
+	*x = ProcessInfo{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_types_task_task_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *ProcessInfo) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProcessInfo) ProtoMessage() {}
+
+func (x *ProcessInfo) ProtoReflect() protoreflect.Message {
+	mi := &file_types_task_task_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProcessInfo.ProtoReflect.Descriptor instead.
+func (*ProcessInfo) Descriptor() ([]byte, []int) {
+	return file_types_task_task_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *ProcessInfo) GetPid() uint32 {
+	if x != nil {
+		return x.Pid
+	}
+	return 0
+}
+
+func (x *ProcessInfo) GetInfo() *anypb.Any {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+var File_types_task_task_proto protoreflect.FileDescriptor
+
+var file_types_task_task_proto_rawDesc = []byte{
+	0x0a, 0x15, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x73, 0x6b, 0x2f, 0x74, 0x61, 0x73,
+	0x6b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x13, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e,
+	0x65, 0x72, 0x64, 0x2e, 0x76, 0x31, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x1a, 0x19, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e,
+	0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61,
+	0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xbf, 0x02, 0x0a, 0x07, 0x50, 0x72, 0x6f,
+	0x63, 0x65, 0x73, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65,
+	0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x49, 0x64, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64, 0x18, 0x03,
+	0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x70, 0x69, 0x64, 0x12, 0x33, 0x0a, 0x06, 0x73, 0x74, 0x61,
+	0x74, 0x75, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x63, 0x6f, 0x6e, 0x74,
+	0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2e, 0x76, 0x31, 0x2e, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2e,
+	0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x14,
+	0x0a, 0x05, 0x73, 0x74, 0x64, 0x69, 0x6e, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73,
+	0x74, 0x64, 0x69, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74, 0x64, 0x6f, 0x75, 0x74, 0x12, 0x16, 0x0a, 0x06,
+	0x73, 0x74, 0x64, 0x65, 0x72, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x74,
+	0x64, 0x65, 0x72, 0x72, 0x12, 0x1a, 0x0a, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c,
+	0x18, 0x08, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x74, 0x65, 0x72, 0x6d, 0x69, 0x6e, 0x61, 0x6c,
+	0x12, 0x1f, 0x0a, 0x0b, 0x65, 0x78, 0x69, 0x74, 0x5f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18,
+	0x09, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x0a, 0x65, 0x78, 0x69, 0x74, 0x53, 0x74, 0x61, 0x74, 0x75,
+	0x73, 0x12, 0x37, 0x0a, 0x09, 0x65, 0x78, 0x69, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x0a,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x08, 0x65, 0x78, 0x69, 0x74, 0x65, 0x64, 0x41, 0x74, 0x22, 0x49, 0x0a, 0x0b, 0x50, 0x72,
+	0x6f, 0x63, 0x65, 0x73, 0x73, 0x49, 0x6e, 0x66, 0x6f, 0x12, 0x10, 0x0a, 0x03, 0x70, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52, 0x03, 0x70, 0x69, 0x64, 0x12, 0x28, 0x0a, 0x04, 0x69,
+	0x6e, 0x66, 0x6f, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52,
+	0x04, 0x69, 0x6e, 0x66, 0x6f, 0x2a, 0x55, 0x0a, 0x06, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x0b, 0x0a, 0x07, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x0b, 0x0a, 0x07,
+	0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x52, 0x55, 0x4e,
+	0x4e, 0x49, 0x4e, 0x47, 0x10, 0x02, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x54, 0x4f, 0x50, 0x50, 0x45,
+	0x44, 0x10, 0x03, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x41, 0x55, 0x53, 0x45, 0x44, 0x10, 0x04, 0x12,
+	0x0b, 0x0a, 0x07, 0x50, 0x41, 0x55, 0x53, 0x49, 0x4e, 0x47, 0x10, 0x05, 0x42, 0x31, 0x5a, 0x2f,
+	0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61,
+	0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64,
+	0x2f, 0x61, 0x70, 0x69, 0x2f, 0x74, 0x79, 0x70, 0x65, 0x73, 0x2f, 0x74, 0x61, 0x73, 0x6b, 0x62,
+	0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_types_task_task_proto_rawDescOnce sync.Once
+	file_types_task_task_proto_rawDescData = file_types_task_task_proto_rawDesc
+)
+
+func file_types_task_task_proto_rawDescGZIP() []byte {
+	file_types_task_task_proto_rawDescOnce.Do(func() {
+		file_types_task_task_proto_rawDescData = protoimpl.X.CompressGZIP(file_types_task_task_proto_rawDescData)
+	})
+	return file_types_task_task_proto_rawDescData
+}
+
+var file_types_task_task_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_types_task_task_proto_msgTypes = make([]protoimpl.MessageInfo, 2)
+var file_types_task_task_proto_goTypes = []interface{}{
+	(Status)(0),                   // 0: containerd.v1.types.Status
+	(*Process)(nil),               // 1: containerd.v1.types.Process
+	(*ProcessInfo)(nil),           // 2: containerd.v1.types.ProcessInfo
+	(*timestamppb.Timestamp)(nil), // 3: google.protobuf.Timestamp
+	(*anypb.Any)(nil),             // 4: google.protobuf.Any
+}
+var file_types_task_task_proto_depIdxs = []int32{
+	0, // 0: containerd.v1.types.Process.status:type_name -> containerd.v1.types.Status
+	3, // 1: containerd.v1.types.Process.exited_at:type_name -> google.protobuf.Timestamp
+	4, // 2: containerd.v1.types.ProcessInfo.info:type_name -> google.protobuf.Any
+	3, // [3:3] is the sub-list for method output_type
+	3, // [3:3] is the sub-list for method input_type
+	3, // [3:3] is the sub-list for extension type_name
+	3, // [3:3] is the sub-list for extension extendee
+	0, // [0:3] is the sub-list for field type_name
+}
+
+func init() { file_types_task_task_proto_init() }
+func file_types_task_task_proto_init() {
+	if File_types_task_task_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_types_task_task_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Process); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_types_task_task_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*ProcessInfo); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_types_task_task_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   2,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_types_task_task_proto_goTypes,
+		DependencyIndexes: file_types_task_task_proto_depIdxs,
+		EnumInfos:         file_types_task_task_proto_enumTypes,
+		MessageInfos:      file_types_task_task_proto_msgTypes,
+	}.Build()
+	File_types_task_task_proto = out.File
+	file_types_task_task_proto_rawDesc = nil
+	file_types_task_task_proto_goTypes = nil
+	file_types_task_task_proto_depIdxs = nil
+}
diff --git a/vendor/github.com/containerd/containerd/api/types/task/task.proto b/vendor/github.com/containerd/containerd/api/types/task/task.proto
new file mode 100644
index 0000000000..3a06236fac
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/api/types/task/task.proto
@@ -0,0 +1,55 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+        http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+syntax = "proto3";
+
+package containerd.v1.types;
+
+import "google/protobuf/any.proto";
+import "google/protobuf/timestamp.proto";
+
+option go_package = "github.com/containerd/containerd/api/types/task";
+
+enum Status {
+  UNKNOWN = 0;
+  CREATED = 1;
+  RUNNING = 2;
+  STOPPED = 3;
+  PAUSED = 4;
+  PAUSING = 5;
+}
+
+message Process {
+  string container_id = 1;
+  string id = 2;
+  uint32 pid = 3;
+  Status status = 4;
+  string stdin = 5;
+  string stdout = 6;
+  string stderr = 7;
+  bool terminal = 8;
+  uint32 exit_status = 9;
+  google.protobuf.Timestamp exited_at = 10;
+}
+
+message ProcessInfo {
+  // PID is the process ID.
+  uint32 pid = 1;
+  // Info contains additional process information.
+  //
+  // Info varies by platform.
+  google.protobuf.Any info = 2;
+}
diff --git a/vendor/github.com/containerd/ttrpc/Makefile b/vendor/github.com/containerd/ttrpc/Makefile
index c3a497dcac..cc1c725c0d 100644
--- a/vendor/github.com/containerd/ttrpc/Makefile
+++ b/vendor/github.com/containerd/ttrpc/Makefile
@@ -24,7 +24,7 @@ WHALE = "🇩"
 ONI = "👹"
 
 # Project binaries.
-COMMANDS=protoc-gen-go-ttrpc protoc-gen-gogottrpc
+COMMANDS=protoc-gen-go-ttrpc
 
 ifdef BUILDTAGS
     GO_BUILDTAGS = ${BUILDTAGS}
@@ -57,7 +57,7 @@ TESTFLAGS_PARALLEL ?= 8
 # Use this to replace `go test` with, for instance, `gotestsum`
 GOTEST ?= $(GO) test
 
-.PHONY: clean all AUTHORS build binaries test integration generate protos check-protos coverage ci check help install vendor install-protobuf install-protobuild
+.PHONY: clean all AUTHORS build binaries test integration generate protos check-protos coverage ci check help install vendor maintainer-clean
 .DEFAULT: default
 
 # Forcibly set the default goal to all, in case an include above brought in a rule definition.
@@ -65,7 +65,7 @@ GOTEST ?= $(GO) test
 
 all: binaries
 
-check: proto-fmt ## run all linters
+check: ## run all linters
 	@echo "$(WHALE) $@"
 	GOGC=75 golangci-lint run
 
@@ -78,9 +78,10 @@ generate: protos
 	@echo "$(WHALE) $@"
 	@PATH="${ROOTDIR}/bin:${PATH}" $(GO) generate -x ${PACKAGES}
 
-protos: bin/protoc-gen-gogottrpc bin/protoc-gen-go-ttrpc ## generate protobuf
+protos: bin/protoc-gen-go-ttrpc ## generate protobuf
 	@echo "$(WHALE) $@"
-	@(PATH="${ROOTDIR}/bin:${PATH}" protobuild --quiet ${PACKAGES})
+	(cd example && buf generate)
+	buf generate
 
 check-protos: protos ## check if protobufs needs to be generated again
 	@echo "$(WHALE) $@"
@@ -88,19 +89,6 @@ check-protos: protos ## check if protobufs needs to be generated again
 		((git diff | cat) && \
 		(echo "$(ONI) please run 'make protos' when making changes to proto files" && false))
 
-check-api-descriptors: protos ## check that protobuf changes aren't present.
-	@echo "$(WHALE) $@"
-	@test -z "$$(git status --short | grep ".pb.txt" | tee /dev/stderr)" || \
-		((git diff $$(find . -name '*.pb.txt') | cat) && \
-		(echo "$(ONI) please run 'make protos' when making changes to proto files and check-in the generated descriptor file changes" && false))
-
-proto-fmt: ## check format of proto files
-	@echo "$(WHALE) $@"
-	@test -z "$$(find . -name '*.proto' -type f -exec grep -Hn -e "^ " {} \; | tee /dev/stderr)" || \
-		(echo "$(ONI) please indent proto files with tabs only" && false)
-	@test -z "$$(find . -name '*.proto' -type f -exec grep -Hn "Meta meta = " {} \; | grep -v '(gogoproto.nullable) = false' | tee /dev/stderr)" || \
-		(echo "$(ONI) meta fields in proto files must have option (gogoproto.nullable) = false" && false)
-
 build: ## build the go packages
 	@echo "$(WHALE) $@"
 	@$(GO) build ${DEBUG_GO_GCFLAGS} ${GO_GCFLAGS} ${GO_BUILD_FLAGS} ${EXTRA_FLAGS} ${PACKAGES}
@@ -117,6 +105,10 @@ benchmark: ## run benchmarks tests
 	@echo "$(WHALE) $@"
 	@$(GO) test ${TESTFLAGS} -bench . -run Benchmark
 
+maintainer-clean:
+	@echo "$(WHALE) $@"
+	@find . -name '*.pb.go' -delete
+
 FORCE:
 
 define BUILD_BINARY
@@ -139,15 +131,6 @@ install: ## install binaries
 	@echo "$(WHALE) $@ $(BINPACKAGES)"
 	@$(GO) install $(BINPACKAGES)
 
-install-protobuf:
-	@echo "$(WHALE) $@"
-	@script/install-protobuf
-
-install-protobuild:
-	@echo "$(WHALE) $@"
-	@$(GO) install google.golang.org/protobuf/cmd/protoc-gen-go@v1.28.1
-	@$(GO) install github.com/containerd/protobuild@14832ccc41429f5c4f81028e5af08aa233a219cf
-
 coverage: ## generate coverprofiles from the unit tests, except tests that require root
 	@echo "$(WHALE) $@"
 	@rm -f coverage.txt
diff --git a/vendor/github.com/containerd/ttrpc/Protobuild.toml b/vendor/github.com/containerd/ttrpc/Protobuild.toml
deleted file mode 100644
index 0f6ccbd1e8..0000000000
--- a/vendor/github.com/containerd/ttrpc/Protobuild.toml
+++ /dev/null
@@ -1,28 +0,0 @@
-version = "2"
-generators = ["go"]
-
-# Control protoc include paths. Below are usually some good defaults, but feel
-# free to try it without them if it works for your project.
-[includes]
-  # Include paths that will be added before all others. Typically, you want to
-  # treat the root of the project as an include, but this may not be necessary.
-  before = ["."]
-
-  # Paths that will be added untouched to the end of the includes. We use
-  # `/usr/local/include` to pickup the common install location of protobuf.
-  # This is the default.
-  after = ["/usr/local/include"]
-
-# This section maps protobuf imports to Go packages. These will become
-# `-M` directives in the call to the go protobuf generator.
-[packages]
-  "google/protobuf/any.proto" = "github.com/gogo/protobuf/types"
-  "proto/status.proto" = "google.golang.org/genproto/googleapis/rpc/status"
-
-[[overrides]]
-# enable ttrpc and disable fieldpath and grpc for the shim
-prefixes = ["github.com/containerd/ttrpc/integration/streaming"]
-generators = ["go", "go-ttrpc"]
-
-[overrides.parameters.go-ttrpc]
-prefix = "TTRPC"
diff --git a/vendor/github.com/containerd/ttrpc/README.md b/vendor/github.com/containerd/ttrpc/README.md
index ce95f63bee..68f1639e9f 100644
--- a/vendor/github.com/containerd/ttrpc/README.md
+++ b/vendor/github.com/containerd/ttrpc/README.md
@@ -25,10 +25,6 @@ See the [protocol specification](./PROTOCOL.md).
 
 # Usage
 
-Create a gogo vanity binary (see
-[`cmd/protoc-gen-gogottrpc/main.go`](cmd/protoc-gen-gogottrpc/main.go) for an
-example with the ttrpc plugin enabled.
-
 It's recommended to use [`protobuild`](https://github.com/containerd/protobuild)
 to build the protobufs for this project, but this will work with protoc
 directly, if required.
diff --git a/vendor/github.com/containerd/ttrpc/buf.gen.yaml b/vendor/github.com/containerd/ttrpc/buf.gen.yaml
new file mode 100644
index 0000000000..56f8724633
--- /dev/null
+++ b/vendor/github.com/containerd/ttrpc/buf.gen.yaml
@@ -0,0 +1,11 @@
+version: v2
+plugins:
+  - remote: buf.build/protocolbuffers/go:v1.28.1
+    out: .
+    opt:
+      - paths=source_relative
+  - local: bin/protoc-gen-go-ttrpc
+    out: .
+    opt:
+      - paths=source_relative
+      - prefix=TTRPC
diff --git a/vendor/github.com/containerd/ttrpc/buf.lock b/vendor/github.com/containerd/ttrpc/buf.lock
new file mode 100644
index 0000000000..5df8acde68
--- /dev/null
+++ b/vendor/github.com/containerd/ttrpc/buf.lock
@@ -0,0 +1,6 @@
+# Generated by buf. DO NOT EDIT.
+version: v2
+deps:
+  - name: buf.build/googleapis/googleapis
+    commit: 004180b77378443887d3b55cabc00384
+    digest: b5:e8f475fe3330f31f5fd86ac689093bcd274e19611a09db91f41d637cb9197881ce89882b94d13a58738e53c91c6e4bae7dc1feba85f590164c975a89e25115dc
diff --git a/vendor/github.com/containerd/ttrpc/buf.yaml b/vendor/github.com/containerd/ttrpc/buf.yaml
new file mode 100644
index 0000000000..cf0cc872dc
--- /dev/null
+++ b/vendor/github.com/containerd/ttrpc/buf.yaml
@@ -0,0 +1,10 @@
+version: v2
+deps:
+  # For google/rpc/status.proto
+  - buf.build/googleapis/googleapis:004180b77378443887d3b55cabc00384
+modules:
+  - path: .
+    # example/ has own buf.yaml and buf.gen.yaml to not have
+    # TTRPC prefix.
+    excludes:
+      - example
diff --git a/vendor/github.com/containerd/ttrpc/client.go b/vendor/github.com/containerd/ttrpc/client.go
index be20ed4897..db82b41828 100644
--- a/vendor/github.com/containerd/ttrpc/client.go
+++ b/vendor/github.com/containerd/ttrpc/client.go
@@ -386,7 +386,7 @@ func (c *Client) receiveLoop() error {
 
 // createStream creates a new stream and registers it with the client
 // Introduce stream types for multiple or single response
-func (c *Client) createStream(flags uint8, b []byte) (*stream, error) {
+func (c *Client) createStream(flags uint8, b []byte, recvBuf int) (*stream, error) {
 	// sendLock must be held across both allocation of the stream ID and sending it across the wire.
 	// This ensures that new stream IDs sent on the wire are always increasing, which is a
 	// requirement of the TTRPC protocol.
@@ -417,7 +417,7 @@ func (c *Client) createStream(flags uint8, b []byte) (*stream, error) {
 		default:
 		}
 
-		s = newStream(c.nextStreamID, c)
+		s = newStream(c.nextStreamID, c, recvBuf)
 		c.streams[s.id] = s
 		c.nextStreamID = c.nextStreamID + 2
 
@@ -517,7 +517,7 @@ func (c *Client) NewStream(ctx context.Context, desc *StreamDesc, service, metho
 	} else {
 		flags = flagRemoteClosed
 	}
-	s, err := c.createStream(flags, p)
+	s, err := c.createStream(flags, p, streamRecvBufferSize)
 	if err != nil {
 		return nil, err
 	}
@@ -536,7 +536,7 @@ func (c *Client) dispatch(ctx context.Context, req *Request, resp *Response) err
 		return err
 	}
 
-	s, err := c.createStream(0, p)
+	s, err := c.createStream(0, p, 1)
 	if err != nil {
 		return err
 	}
diff --git a/vendor/github.com/containerd/ttrpc/errors.go b/vendor/github.com/containerd/ttrpc/errors.go
index 632dbe8bdf..1e6f6b9c9e 100644
--- a/vendor/github.com/containerd/ttrpc/errors.go
+++ b/vendor/github.com/containerd/ttrpc/errors.go
@@ -36,6 +36,12 @@ var (
 
 	// ErrStreamClosed is when the streaming connection is closed.
 	ErrStreamClosed = errors.New("ttrpc: stream closed")
+
+	// ErrStreamFull is returned when a stream's receive buffer is full
+	// and the message cannot be delivered without blocking the
+	// connection's receive loop. This prevents a single unconsumed
+	// stream from deadlocking all other streams on the same connection.
+	ErrStreamFull = errors.New("ttrpc: stream buffer full")
 )
 
 // OversizedMessageErr is used to indicate refusal to send an oversized message.
diff --git a/vendor/github.com/containerd/ttrpc/request.pb.go b/vendor/github.com/containerd/ttrpc/request.pb.go
index 3921ae5a35..fe1d749f75 100644
--- a/vendor/github.com/containerd/ttrpc/request.pb.go
+++ b/vendor/github.com/containerd/ttrpc/request.pb.go
@@ -1,8 +1,8 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.28.1
-// 	protoc        v3.20.1
-// source: github.com/containerd/ttrpc/request.proto
+// 	protoc        (unknown)
+// source: request.proto
 
 package ttrpc
 
@@ -36,7 +36,7 @@ type Request struct {
 func (x *Request) Reset() {
 	*x = Request{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[0]
+		mi := &file_request_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -49,7 +49,7 @@ func (x *Request) String() string {
 func (*Request) ProtoMessage() {}
 
 func (x *Request) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[0]
+	mi := &file_request_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -62,7 +62,7 @@ func (x *Request) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Request.ProtoReflect.Descriptor instead.
 func (*Request) Descriptor() ([]byte, []int) {
-	return file_github_com_containerd_ttrpc_request_proto_rawDescGZIP(), []int{0}
+	return file_request_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *Request) GetService() string {
@@ -112,7 +112,7 @@ type Response struct {
 func (x *Response) Reset() {
 	*x = Response{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[1]
+		mi := &file_request_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -125,7 +125,7 @@ func (x *Response) String() string {
 func (*Response) ProtoMessage() {}
 
 func (x *Response) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[1]
+	mi := &file_request_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -138,7 +138,7 @@ func (x *Response) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Response.ProtoReflect.Descriptor instead.
 func (*Response) Descriptor() ([]byte, []int) {
-	return file_github_com_containerd_ttrpc_request_proto_rawDescGZIP(), []int{1}
+	return file_request_proto_rawDescGZIP(), []int{1}
 }
 
 func (x *Response) GetStatus() *status.Status {
@@ -166,7 +166,7 @@ type StringList struct {
 func (x *StringList) Reset() {
 	*x = StringList{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[2]
+		mi := &file_request_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -179,7 +179,7 @@ func (x *StringList) String() string {
 func (*StringList) ProtoMessage() {}
 
 func (x *StringList) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[2]
+	mi := &file_request_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -192,7 +192,7 @@ func (x *StringList) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StringList.ProtoReflect.Descriptor instead.
 func (*StringList) Descriptor() ([]byte, []int) {
-	return file_github_com_containerd_ttrpc_request_proto_rawDescGZIP(), []int{2}
+	return file_request_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *StringList) GetList() []string {
@@ -214,7 +214,7 @@ type KeyValue struct {
 func (x *KeyValue) Reset() {
 	*x = KeyValue{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[3]
+		mi := &file_request_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -227,7 +227,7 @@ func (x *KeyValue) String() string {
 func (*KeyValue) ProtoMessage() {}
 
 func (x *KeyValue) ProtoReflect() protoreflect.Message {
-	mi := &file_github_com_containerd_ttrpc_request_proto_msgTypes[3]
+	mi := &file_request_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -240,7 +240,7 @@ func (x *KeyValue) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use KeyValue.ProtoReflect.Descriptor instead.
 func (*KeyValue) Descriptor() ([]byte, []int) {
-	return file_github_com_containerd_ttrpc_request_proto_rawDescGZIP(), []int{3}
+	return file_request_proto_rawDescGZIP(), []int{3}
 }
 
 func (x *KeyValue) GetKey() string {
@@ -257,62 +257,61 @@ func (x *KeyValue) GetValue() string {
 	return ""
 }
 
-var File_github_com_containerd_ttrpc_request_proto protoreflect.FileDescriptor
-
-var file_github_com_containerd_ttrpc_request_proto_rawDesc = []byte{
-	0x0a, 0x29, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e,
-	0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x74, 0x74, 0x72, 0x70, 0x63, 0x2f, 0x72, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x74, 0x74, 0x72,
-	0x70, 0x63, 0x1a, 0x12, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22, 0xa5, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x06,
-	0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65,
-	0x74, 0x68, 0x6f, 0x64, 0x12, 0x18, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x21,
-	0x0a, 0x0c, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18, 0x04,
-	0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74, 0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x4e, 0x61, 0x6e,
-	0x6f, 0x12, 0x2b, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x74, 0x74, 0x72, 0x70, 0x63, 0x2e, 0x4b, 0x65, 0x79, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x45,
-	0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x1f, 0x0a, 0x06, 0x73, 0x74,
-	0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x07, 0x2e, 0x53, 0x74, 0x61,
-	0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12, 0x18, 0x0a, 0x07, 0x70,
-	0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07, 0x70, 0x61,
-	0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x20, 0x0a, 0x0a, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x4c,
-	0x69, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28,
-	0x09, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x22, 0x32, 0x0a, 0x08, 0x4b, 0x65, 0x79, 0x56, 0x61,
-	0x6c, 0x75, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x42, 0x1d, 0x5a, 0x1b, 0x67,
-	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x6e, 0x74, 0x61, 0x69,
-	0x6e, 0x65, 0x72, 0x64, 0x2f, 0x74, 0x74, 0x72, 0x70, 0x63, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+var File_request_proto protoreflect.FileDescriptor
+
+var file_request_proto_rawDesc = []byte{
+	0x0a, 0x0d, 0x72, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
+	0x05, 0x74, 0x74, 0x72, 0x70, 0x63, 0x1a, 0x17, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x72,
+	0x70, 0x63, 0x2f, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0xa5, 0x01, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x18, 0x0a, 0x07, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x73, 0x65,
+	0x72, 0x76, 0x69, 0x63, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x18, 0x0a,
+	0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x07,
+	0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x74, 0x69, 0x6d, 0x65, 0x6f,
+	0x75, 0x74, 0x5f, 0x6e, 0x61, 0x6e, 0x6f, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x74,
+	0x69, 0x6d, 0x65, 0x6f, 0x75, 0x74, 0x4e, 0x61, 0x6e, 0x6f, 0x12, 0x2b, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x0f, 0x2e, 0x74,
+	0x74, 0x72, 0x70, 0x63, 0x2e, 0x4b, 0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0x50, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x2a, 0x0a, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x12, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x72, 0x70, 0x63,
+	0x2e, 0x53, 0x74, 0x61, 0x74, 0x75, 0x73, 0x52, 0x06, 0x73, 0x74, 0x61, 0x74, 0x75, 0x73, 0x12,
+	0x18, 0x0a, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
+	0x52, 0x07, 0x70, 0x61, 0x79, 0x6c, 0x6f, 0x61, 0x64, 0x22, 0x20, 0x0a, 0x0a, 0x53, 0x74, 0x72,
+	0x69, 0x6e, 0x67, 0x4c, 0x69, 0x73, 0x74, 0x12, 0x12, 0x0a, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x18,
+	0x01, 0x20, 0x03, 0x28, 0x09, 0x52, 0x04, 0x6c, 0x69, 0x73, 0x74, 0x22, 0x32, 0x0a, 0x08, 0x4b,
+	0x65, 0x79, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x42,
+	0x1d, 0x5a, 0x1b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f,
+	0x6e, 0x74, 0x61, 0x69, 0x6e, 0x65, 0x72, 0x64, 0x2f, 0x74, 0x74, 0x72, 0x70, 0x63, 0x62, 0x06,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
-	file_github_com_containerd_ttrpc_request_proto_rawDescOnce sync.Once
-	file_github_com_containerd_ttrpc_request_proto_rawDescData = file_github_com_containerd_ttrpc_request_proto_rawDesc
+	file_request_proto_rawDescOnce sync.Once
+	file_request_proto_rawDescData = file_request_proto_rawDesc
 )
 
-func file_github_com_containerd_ttrpc_request_proto_rawDescGZIP() []byte {
-	file_github_com_containerd_ttrpc_request_proto_rawDescOnce.Do(func() {
-		file_github_com_containerd_ttrpc_request_proto_rawDescData = protoimpl.X.CompressGZIP(file_github_com_containerd_ttrpc_request_proto_rawDescData)
+func file_request_proto_rawDescGZIP() []byte {
+	file_request_proto_rawDescOnce.Do(func() {
+		file_request_proto_rawDescData = protoimpl.X.CompressGZIP(file_request_proto_rawDescData)
 	})
-	return file_github_com_containerd_ttrpc_request_proto_rawDescData
+	return file_request_proto_rawDescData
 }
 
-var file_github_com_containerd_ttrpc_request_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
-var file_github_com_containerd_ttrpc_request_proto_goTypes = []interface{}{
+var file_request_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_request_proto_goTypes = []interface{}{
 	(*Request)(nil),       // 0: ttrpc.Request
 	(*Response)(nil),      // 1: ttrpc.Response
 	(*StringList)(nil),    // 2: ttrpc.StringList
 	(*KeyValue)(nil),      // 3: ttrpc.KeyValue
-	(*status.Status)(nil), // 4: Status
+	(*status.Status)(nil), // 4: google.rpc.Status
 }
-var file_github_com_containerd_ttrpc_request_proto_depIdxs = []int32{
+var file_request_proto_depIdxs = []int32{
 	3, // 0: ttrpc.Request.metadata:type_name -> ttrpc.KeyValue
-	4, // 1: ttrpc.Response.status:type_name -> Status
+	4, // 1: ttrpc.Response.status:type_name -> google.rpc.Status
 	2, // [2:2] is the sub-list for method output_type
 	2, // [2:2] is the sub-list for method input_type
 	2, // [2:2] is the sub-list for extension type_name
@@ -320,13 +319,13 @@ var file_github_com_containerd_ttrpc_request_proto_depIdxs = []int32{
 	0, // [0:2] is the sub-list for field type_name
 }
 
-func init() { file_github_com_containerd_ttrpc_request_proto_init() }
-func file_github_com_containerd_ttrpc_request_proto_init() {
-	if File_github_com_containerd_ttrpc_request_proto != nil {
+func init() { file_request_proto_init() }
+func file_request_proto_init() {
+	if File_request_proto != nil {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_github_com_containerd_ttrpc_request_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_request_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Request); i {
 			case 0:
 				return &v.state
@@ -338,7 +337,7 @@ func file_github_com_containerd_ttrpc_request_proto_init() {
 				return nil
 			}
 		}
-		file_github_com_containerd_ttrpc_request_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_request_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*Response); i {
 			case 0:
 				return &v.state
@@ -350,7 +349,7 @@ func file_github_com_containerd_ttrpc_request_proto_init() {
 				return nil
 			}
 		}
-		file_github_com_containerd_ttrpc_request_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+		file_request_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*StringList); i {
 			case 0:
 				return &v.state
@@ -362,7 +361,7 @@ func file_github_com_containerd_ttrpc_request_proto_init() {
 				return nil
 			}
 		}
-		file_github_com_containerd_ttrpc_request_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_request_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*KeyValue); i {
 			case 0:
 				return &v.state
@@ -379,18 +378,18 @@ func file_github_com_containerd_ttrpc_request_proto_init() {
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_github_com_containerd_ttrpc_request_proto_rawDesc,
+			RawDescriptor: file_request_proto_rawDesc,
 			NumEnums:      0,
 			NumMessages:   4,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
-		GoTypes:           file_github_com_containerd_ttrpc_request_proto_goTypes,
-		DependencyIndexes: file_github_com_containerd_ttrpc_request_proto_depIdxs,
-		MessageInfos:      file_github_com_containerd_ttrpc_request_proto_msgTypes,
+		GoTypes:           file_request_proto_goTypes,
+		DependencyIndexes: file_request_proto_depIdxs,
+		MessageInfos:      file_request_proto_msgTypes,
 	}.Build()
-	File_github_com_containerd_ttrpc_request_proto = out.File
-	file_github_com_containerd_ttrpc_request_proto_rawDesc = nil
-	file_github_com_containerd_ttrpc_request_proto_goTypes = nil
-	file_github_com_containerd_ttrpc_request_proto_depIdxs = nil
+	File_request_proto = out.File
+	file_request_proto_rawDesc = nil
+	file_request_proto_goTypes = nil
+	file_request_proto_depIdxs = nil
 }
diff --git a/vendor/github.com/containerd/ttrpc/request.proto b/vendor/github.com/containerd/ttrpc/request.proto
index 37da334fc2..3602eed1e7 100644
--- a/vendor/github.com/containerd/ttrpc/request.proto
+++ b/vendor/github.com/containerd/ttrpc/request.proto
@@ -2,7 +2,7 @@ syntax = "proto3";
 
 package ttrpc;
 
-import "proto/status.proto";
+import "google/rpc/status.proto";
 
 option go_package = "github.com/containerd/ttrpc";
 
@@ -15,7 +15,7 @@ message Request {
 }
 
 message Response {
-	Status status = 1;
+	google.rpc.Status status = 1;
 	bytes payload = 2;
 }
 
diff --git a/vendor/github.com/containerd/ttrpc/server.go b/vendor/github.com/containerd/ttrpc/server.go
index 9606a975dd..4162b15405 100644
--- a/vendor/github.com/containerd/ttrpc/server.go
+++ b/vendor/github.com/containerd/ttrpc/server.go
@@ -568,8 +568,6 @@ func (c *serverConn) run(sctx context.Context) {
 	}
 }
 
-var noopFunc = func() {}
-
 func getRequestContext(ctx context.Context, req *Request) (retCtx context.Context, cancel func()) {
 	if len(req.Metadata) > 0 {
 		md := MD{}
@@ -577,11 +575,10 @@ func getRequestContext(ctx context.Context, req *Request) (retCtx context.Contex
 		ctx = WithMetadata(ctx, md)
 	}
 
-	cancel = noopFunc
 	if req.TimeoutNano == 0 {
-		return ctx, cancel
+		// Cancellable so handlers' deferred cancel propagates to RecvMsg.
+		return context.WithCancel(ctx)
 	}
 
-	ctx, cancel = context.WithTimeout(ctx, time.Duration(req.TimeoutNano))
-	return ctx, cancel
+	return context.WithTimeout(ctx, time.Duration(req.TimeoutNano))
 }
diff --git a/vendor/github.com/containerd/ttrpc/services.go b/vendor/github.com/containerd/ttrpc/services.go
index 6d092bf950..ac7c752f74 100644
--- a/vendor/github.com/containerd/ttrpc/services.go
+++ b/vendor/github.com/containerd/ttrpc/services.go
@@ -23,6 +23,7 @@ import (
 	"io"
 	"os"
 	"path"
+	"time"
 	"unsafe"
 
 	"google.golang.org/grpc/codes"
@@ -128,10 +129,14 @@ func (s *serviceSet) handle(ctx context.Context, req *Request, respond func(*sta
 			StreamingClient: stream.StreamingClient,
 			StreamingServer: stream.StreamingServer,
 		}
+		recvBuf := streamRecvBufferSize
+		if !stream.StreamingClient {
+			recvBuf = 1
+		}
 		sh := &streamHandler{
 			ctx:     ctx,
 			respond: respond,
-			recv:    make(chan Unmarshaler, 5),
+			recv:    make(chan Unmarshaler, recvBuf),
 			info:    info,
 		}
 		go func() {
@@ -158,6 +163,12 @@ func (s *serviceSet) handle(ctx context.Context, req *Request, respond func(*sta
 	return nil, status.Errorf(codes.Unimplemented, "method %v", req.Method)
 }
 
+// streamRecvBufferSize is the buffer size for stream recv channels. It
+// should be large enough to absorb normal bursts without hitting the
+// 1-second timeout fallback in receive/data, but small enough that
+// per-stream memory overhead stays trivial.
+const streamRecvBufferSize = 64
+
 type streamHandler struct {
 	ctx     context.Context
 	respond func(*status.Status, []byte, bool, bool) error
@@ -184,6 +195,17 @@ func (s *streamHandler) data(unmarshal Unmarshaler) error {
 		return nil
 	case <-s.ctx.Done():
 		return s.ctx.Err()
+	default:
+		// If recv channel is full, wait up to a second for an item
+		// to drain and unblock, otherwise return an error.
+		select {
+		case s.recv <- unmarshal:
+			return nil
+		case <-s.ctx.Done():
+			return s.ctx.Err()
+		case <-time.After(time.Second):
+			return ErrStreamFull
+		}
 	}
 }
 
diff --git a/vendor/github.com/containerd/ttrpc/stream.go b/vendor/github.com/containerd/ttrpc/stream.go
index 739a4c9675..a6a71def67 100644
--- a/vendor/github.com/containerd/ttrpc/stream.go
+++ b/vendor/github.com/containerd/ttrpc/stream.go
@@ -19,6 +19,7 @@ package ttrpc
 import (
 	"context"
 	"sync"
+	"time"
 )
 
 type streamID uint32
@@ -38,11 +39,11 @@ type stream struct {
 	recvClose chan struct{}
 }
 
-func newStream(id streamID, send sender) *stream {
+func newStream(id streamID, send sender, recvBuf int) *stream {
 	return &stream{
 		id:        id,
 		sender:    send,
-		recv:      make(chan *streamMessage, 1),
+		recv:      make(chan *streamMessage, recvBuf),
 		recvClose: make(chan struct{}),
 	}
 }
@@ -63,6 +64,11 @@ func (s *stream) send(mt messageType, flags uint8, b []byte) error {
 	return s.sender.send(uint32(s.id), mt, flags, b)
 }
 
+// receive delivers a message to this stream from the connection receive loop.
+// If the stream's recv buffer is full, it waits up to 1 second for the
+// consumer to make progress. This keeps the receive loop moving for other
+// streams while still providing backpressure under normal operation. If the
+// timeout expires the stream is closed with ErrStreamFull.
 func (s *stream) receive(ctx context.Context, msg *streamMessage) error {
 	select {
 	case <-s.recvClose:
@@ -76,6 +82,20 @@ func (s *stream) receive(ctx context.Context, msg *streamMessage) error {
 		return nil
 	case <-ctx.Done():
 		return ctx.Err()
+	default:
+		// If recv channel is full, wait up to a second for an item
+		// to drain and unblock, otherwise close the stream.
+		select {
+		case <-s.recvClose:
+			return s.recvErr
+		case s.recv <- msg:
+			return nil
+		case <-ctx.Done():
+			return ctx.Err()
+		case <-time.After(time.Second):
+			s.closeWithError(ErrStreamFull)
+			return ErrStreamFull
+		}
 	}
 }
 
diff --git a/vendor/github.com/containerd/ttrpc/test.proto b/vendor/github.com/containerd/ttrpc/test.proto
deleted file mode 100644
index 0e114d5568..0000000000
--- a/vendor/github.com/containerd/ttrpc/test.proto
+++ /dev/null
@@ -1,16 +0,0 @@
-syntax = "proto3";
-
-package ttrpc;
-
-option go_package = "github.com/containerd/ttrpc/internal";
-
-message TestPayload {
-	string foo = 1;
-	int64 deadline = 2;
-	string metadata = 3;
-}
-
-message EchoPayload {
-	int64 seq = 1;
-	string msg = 2;
-}
diff --git a/vendor/k8s.io/cri-api/LICENSE b/vendor/k8s.io/cri-api/LICENSE
new file mode 100644
index 0000000000..8dada3edaf
--- /dev/null
+++ b/vendor/k8s.io/cri-api/LICENSE
@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go
new file mode 100644
index 0000000000..80a40e9d18
--- /dev/null
+++ b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.pb.go
@@ -0,0 +1,13482 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+//
+//Copyright 2020 The Kubernetes Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// To regenerate api.pb.go run `hack/update-codegen.sh protobindings`
+
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.36.11
+// 	protoc        v4.23.4
+// source: staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto
+
+package v1
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+	unsafe "unsafe"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type Protocol int32
+
+const (
+	Protocol_TCP  Protocol = 0
+	Protocol_UDP  Protocol = 1
+	Protocol_SCTP Protocol = 2
+)
+
+// Enum value maps for Protocol.
+var (
+	Protocol_name = map[int32]string{
+		0: "TCP",
+		1: "UDP",
+		2: "SCTP",
+	}
+	Protocol_value = map[string]int32{
+		"TCP":  0,
+		"UDP":  1,
+		"SCTP": 2,
+	}
+)
+
+func (x Protocol) Enum() *Protocol {
+	p := new(Protocol)
+	*p = x
+	return p
+}
+
+func (x Protocol) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Protocol) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[0].Descriptor()
+}
+
+func (Protocol) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[0]
+}
+
+func (x Protocol) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Protocol.Descriptor instead.
+func (Protocol) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{0}
+}
+
+type MountPropagation int32
+
+const (
+	// No mount propagation ("rprivate" in Linux terminology).
+	MountPropagation_PROPAGATION_PRIVATE MountPropagation = 0
+	// Mounts get propagated from the host to the container ("rslave" in Linux).
+	MountPropagation_PROPAGATION_HOST_TO_CONTAINER MountPropagation = 1
+	// Mounts get propagated from the host to the container and from the
+	// container to the host ("rshared" in Linux).
+	MountPropagation_PROPAGATION_BIDIRECTIONAL MountPropagation = 2
+)
+
+// Enum value maps for MountPropagation.
+var (
+	MountPropagation_name = map[int32]string{
+		0: "PROPAGATION_PRIVATE",
+		1: "PROPAGATION_HOST_TO_CONTAINER",
+		2: "PROPAGATION_BIDIRECTIONAL",
+	}
+	MountPropagation_value = map[string]int32{
+		"PROPAGATION_PRIVATE":           0,
+		"PROPAGATION_HOST_TO_CONTAINER": 1,
+		"PROPAGATION_BIDIRECTIONAL":     2,
+	}
+)
+
+func (x MountPropagation) Enum() *MountPropagation {
+	p := new(MountPropagation)
+	*p = x
+	return p
+}
+
+func (x MountPropagation) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MountPropagation) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[1].Descriptor()
+}
+
+func (MountPropagation) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[1]
+}
+
+func (x MountPropagation) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MountPropagation.Descriptor instead.
+func (MountPropagation) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{1}
+}
+
+// A NamespaceMode describes the intended namespace configuration for each
+// of the namespaces (Network, PID, IPC) in NamespaceOption. Runtimes should
+// map these modes as appropriate for the technology underlying the runtime.
+type NamespaceMode int32
+
+const (
+	// A POD namespace is common to all containers in a pod.
+	// For example, a container with a PID namespace of POD expects to view
+	// all of the processes in all of the containers in the pod.
+	NamespaceMode_POD NamespaceMode = 0
+	// A CONTAINER namespace is restricted to a single container.
+	// For example, a container with a PID namespace of CONTAINER expects to
+	// view only the processes in that container.
+	NamespaceMode_CONTAINER NamespaceMode = 1
+	// A NODE namespace is the namespace of the Kubernetes node.
+	// For example, a container with a PID namespace of NODE expects to view
+	// all of the processes on the host running the kubelet.
+	NamespaceMode_NODE NamespaceMode = 2
+	// TARGET targets the namespace of another container. When this is specified,
+	// a target_id must be specified in NamespaceOption and refer to a container
+	// previously created with NamespaceMode CONTAINER. This containers namespace
+	// will be made to match that of container target_id.
+	// For example, a container with a PID namespace of TARGET expects to view
+	// all of the processes that container target_id can view.
+	NamespaceMode_TARGET NamespaceMode = 3
+)
+
+// Enum value maps for NamespaceMode.
+var (
+	NamespaceMode_name = map[int32]string{
+		0: "POD",
+		1: "CONTAINER",
+		2: "NODE",
+		3: "TARGET",
+	}
+	NamespaceMode_value = map[string]int32{
+		"POD":       0,
+		"CONTAINER": 1,
+		"NODE":      2,
+		"TARGET":    3,
+	}
+)
+
+func (x NamespaceMode) Enum() *NamespaceMode {
+	p := new(NamespaceMode)
+	*p = x
+	return p
+}
+
+func (x NamespaceMode) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (NamespaceMode) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[2].Descriptor()
+}
+
+func (NamespaceMode) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[2]
+}
+
+func (x NamespaceMode) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use NamespaceMode.Descriptor instead.
+func (NamespaceMode) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{2}
+}
+
+// SupplementalGroupsPolicy defines how supplemental groups
+// of the first container processes are calculated.
+type SupplementalGroupsPolicy int32
+
+const (
+	// Merge means that the container's provided SupplementalGroups
+	// and FsGroup (specified in SecurityContext) will be merged with
+	// the primary user's groups as defined in the container image
+	// (in /etc/group).
+	SupplementalGroupsPolicy_Merge SupplementalGroupsPolicy = 0
+	// Strict means that the container's provided SupplementalGroups
+	// and FsGroup (specified in SecurityContext) will be used instead of
+	// any groups defined in the container image.
+	SupplementalGroupsPolicy_Strict SupplementalGroupsPolicy = 1
+)
+
+// Enum value maps for SupplementalGroupsPolicy.
+var (
+	SupplementalGroupsPolicy_name = map[int32]string{
+		0: "Merge",
+		1: "Strict",
+	}
+	SupplementalGroupsPolicy_value = map[string]int32{
+		"Merge":  0,
+		"Strict": 1,
+	}
+)
+
+func (x SupplementalGroupsPolicy) Enum() *SupplementalGroupsPolicy {
+	p := new(SupplementalGroupsPolicy)
+	*p = x
+	return p
+}
+
+func (x SupplementalGroupsPolicy) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SupplementalGroupsPolicy) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[3].Descriptor()
+}
+
+func (SupplementalGroupsPolicy) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[3]
+}
+
+func (x SupplementalGroupsPolicy) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SupplementalGroupsPolicy.Descriptor instead.
+func (SupplementalGroupsPolicy) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{3}
+}
+
+type PodSandboxState int32
+
+const (
+	PodSandboxState_SANDBOX_READY    PodSandboxState = 0
+	PodSandboxState_SANDBOX_NOTREADY PodSandboxState = 1
+)
+
+// Enum value maps for PodSandboxState.
+var (
+	PodSandboxState_name = map[int32]string{
+		0: "SANDBOX_READY",
+		1: "SANDBOX_NOTREADY",
+	}
+	PodSandboxState_value = map[string]int32{
+		"SANDBOX_READY":    0,
+		"SANDBOX_NOTREADY": 1,
+	}
+)
+
+func (x PodSandboxState) Enum() *PodSandboxState {
+	p := new(PodSandboxState)
+	*p = x
+	return p
+}
+
+func (x PodSandboxState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PodSandboxState) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[4].Descriptor()
+}
+
+func (PodSandboxState) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[4]
+}
+
+func (x PodSandboxState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PodSandboxState.Descriptor instead.
+func (PodSandboxState) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{4}
+}
+
+type Signal int32
+
+const (
+	Signal_SIGNAL_RUNTIME_DEFAULT Signal = 0
+	Signal_SIGNAL_SIGABRT         Signal = 1
+	Signal_SIGNAL_SIGALRM         Signal = 2
+	Signal_SIGNAL_SIGBUS          Signal = 3
+	Signal_SIGNAL_SIGCHLD         Signal = 4
+	Signal_SIGNAL_SIGCLD          Signal = 5
+	Signal_SIGNAL_SIGCONT         Signal = 6
+	Signal_SIGNAL_SIGFPE          Signal = 7
+	Signal_SIGNAL_SIGHUP          Signal = 8
+	Signal_SIGNAL_SIGILL          Signal = 9
+	Signal_SIGNAL_SIGINT          Signal = 10
+	Signal_SIGNAL_SIGIO           Signal = 11
+	Signal_SIGNAL_SIGIOT          Signal = 12
+	Signal_SIGNAL_SIGKILL         Signal = 13
+	Signal_SIGNAL_SIGPIPE         Signal = 14
+	Signal_SIGNAL_SIGPOLL         Signal = 15
+	Signal_SIGNAL_SIGPROF         Signal = 16
+	Signal_SIGNAL_SIGPWR          Signal = 17
+	Signal_SIGNAL_SIGQUIT         Signal = 18
+	Signal_SIGNAL_SIGSEGV         Signal = 19
+	Signal_SIGNAL_SIGSTKFLT       Signal = 20
+	Signal_SIGNAL_SIGSTOP         Signal = 21
+	Signal_SIGNAL_SIGSYS          Signal = 22
+	Signal_SIGNAL_SIGTERM         Signal = 23
+	Signal_SIGNAL_SIGTRAP         Signal = 24
+	Signal_SIGNAL_SIGTSTP         Signal = 25
+	Signal_SIGNAL_SIGTTIN         Signal = 26
+	Signal_SIGNAL_SIGTTOU         Signal = 27
+	Signal_SIGNAL_SIGURG          Signal = 28
+	Signal_SIGNAL_SIGUSR1         Signal = 29
+	Signal_SIGNAL_SIGUSR2         Signal = 30
+	Signal_SIGNAL_SIGVTALRM       Signal = 31
+	Signal_SIGNAL_SIGWINCH        Signal = 32
+	Signal_SIGNAL_SIGXCPU         Signal = 33
+	Signal_SIGNAL_SIGXFSZ         Signal = 34
+	Signal_SIGNAL_SIGRTMIN        Signal = 35
+	Signal_SIGNAL_SIGRTMINPLUS1   Signal = 36
+	Signal_SIGNAL_SIGRTMINPLUS2   Signal = 37
+	Signal_SIGNAL_SIGRTMINPLUS3   Signal = 38
+	Signal_SIGNAL_SIGRTMINPLUS4   Signal = 39
+	Signal_SIGNAL_SIGRTMINPLUS5   Signal = 40
+	Signal_SIGNAL_SIGRTMINPLUS6   Signal = 41
+	Signal_SIGNAL_SIGRTMINPLUS7   Signal = 42
+	Signal_SIGNAL_SIGRTMINPLUS8   Signal = 43
+	Signal_SIGNAL_SIGRTMINPLUS9   Signal = 44
+	Signal_SIGNAL_SIGRTMINPLUS10  Signal = 45
+	Signal_SIGNAL_SIGRTMINPLUS11  Signal = 46
+	Signal_SIGNAL_SIGRTMINPLUS12  Signal = 47
+	Signal_SIGNAL_SIGRTMINPLUS13  Signal = 48
+	Signal_SIGNAL_SIGRTMINPLUS14  Signal = 49
+	Signal_SIGNAL_SIGRTMINPLUS15  Signal = 50
+	Signal_SIGNAL_SIGRTMAXMINUS14 Signal = 51
+	Signal_SIGNAL_SIGRTMAXMINUS13 Signal = 52
+	Signal_SIGNAL_SIGRTMAXMINUS12 Signal = 53
+	Signal_SIGNAL_SIGRTMAXMINUS11 Signal = 54
+	Signal_SIGNAL_SIGRTMAXMINUS10 Signal = 55
+	Signal_SIGNAL_SIGRTMAXMINUS9  Signal = 56
+	Signal_SIGNAL_SIGRTMAXMINUS8  Signal = 57
+	Signal_SIGNAL_SIGRTMAXMINUS7  Signal = 58
+	Signal_SIGNAL_SIGRTMAXMINUS6  Signal = 59
+	Signal_SIGNAL_SIGRTMAXMINUS5  Signal = 60
+	Signal_SIGNAL_SIGRTMAXMINUS4  Signal = 61
+	Signal_SIGNAL_SIGRTMAXMINUS3  Signal = 62
+	Signal_SIGNAL_SIGRTMAXMINUS2  Signal = 63
+	Signal_SIGNAL_SIGRTMAXMINUS1  Signal = 64
+	Signal_SIGNAL_SIGRTMAX        Signal = 65
+)
+
+// Enum value maps for Signal.
+var (
+	Signal_name = map[int32]string{
+		0:  "SIGNAL_RUNTIME_DEFAULT",
+		1:  "SIGNAL_SIGABRT",
+		2:  "SIGNAL_SIGALRM",
+		3:  "SIGNAL_SIGBUS",
+		4:  "SIGNAL_SIGCHLD",
+		5:  "SIGNAL_SIGCLD",
+		6:  "SIGNAL_SIGCONT",
+		7:  "SIGNAL_SIGFPE",
+		8:  "SIGNAL_SIGHUP",
+		9:  "SIGNAL_SIGILL",
+		10: "SIGNAL_SIGINT",
+		11: "SIGNAL_SIGIO",
+		12: "SIGNAL_SIGIOT",
+		13: "SIGNAL_SIGKILL",
+		14: "SIGNAL_SIGPIPE",
+		15: "SIGNAL_SIGPOLL",
+		16: "SIGNAL_SIGPROF",
+		17: "SIGNAL_SIGPWR",
+		18: "SIGNAL_SIGQUIT",
+		19: "SIGNAL_SIGSEGV",
+		20: "SIGNAL_SIGSTKFLT",
+		21: "SIGNAL_SIGSTOP",
+		22: "SIGNAL_SIGSYS",
+		23: "SIGNAL_SIGTERM",
+		24: "SIGNAL_SIGTRAP",
+		25: "SIGNAL_SIGTSTP",
+		26: "SIGNAL_SIGTTIN",
+		27: "SIGNAL_SIGTTOU",
+		28: "SIGNAL_SIGURG",
+		29: "SIGNAL_SIGUSR1",
+		30: "SIGNAL_SIGUSR2",
+		31: "SIGNAL_SIGVTALRM",
+		32: "SIGNAL_SIGWINCH",
+		33: "SIGNAL_SIGXCPU",
+		34: "SIGNAL_SIGXFSZ",
+		35: "SIGNAL_SIGRTMIN",
+		36: "SIGNAL_SIGRTMINPLUS1",
+		37: "SIGNAL_SIGRTMINPLUS2",
+		38: "SIGNAL_SIGRTMINPLUS3",
+		39: "SIGNAL_SIGRTMINPLUS4",
+		40: "SIGNAL_SIGRTMINPLUS5",
+		41: "SIGNAL_SIGRTMINPLUS6",
+		42: "SIGNAL_SIGRTMINPLUS7",
+		43: "SIGNAL_SIGRTMINPLUS8",
+		44: "SIGNAL_SIGRTMINPLUS9",
+		45: "SIGNAL_SIGRTMINPLUS10",
+		46: "SIGNAL_SIGRTMINPLUS11",
+		47: "SIGNAL_SIGRTMINPLUS12",
+		48: "SIGNAL_SIGRTMINPLUS13",
+		49: "SIGNAL_SIGRTMINPLUS14",
+		50: "SIGNAL_SIGRTMINPLUS15",
+		51: "SIGNAL_SIGRTMAXMINUS14",
+		52: "SIGNAL_SIGRTMAXMINUS13",
+		53: "SIGNAL_SIGRTMAXMINUS12",
+		54: "SIGNAL_SIGRTMAXMINUS11",
+		55: "SIGNAL_SIGRTMAXMINUS10",
+		56: "SIGNAL_SIGRTMAXMINUS9",
+		57: "SIGNAL_SIGRTMAXMINUS8",
+		58: "SIGNAL_SIGRTMAXMINUS7",
+		59: "SIGNAL_SIGRTMAXMINUS6",
+		60: "SIGNAL_SIGRTMAXMINUS5",
+		61: "SIGNAL_SIGRTMAXMINUS4",
+		62: "SIGNAL_SIGRTMAXMINUS3",
+		63: "SIGNAL_SIGRTMAXMINUS2",
+		64: "SIGNAL_SIGRTMAXMINUS1",
+		65: "SIGNAL_SIGRTMAX",
+	}
+	Signal_value = map[string]int32{
+		"SIGNAL_RUNTIME_DEFAULT": 0,
+		"SIGNAL_SIGABRT":         1,
+		"SIGNAL_SIGALRM":         2,
+		"SIGNAL_SIGBUS":          3,
+		"SIGNAL_SIGCHLD":         4,
+		"SIGNAL_SIGCLD":          5,
+		"SIGNAL_SIGCONT":         6,
+		"SIGNAL_SIGFPE":          7,
+		"SIGNAL_SIGHUP":          8,
+		"SIGNAL_SIGILL":          9,
+		"SIGNAL_SIGINT":          10,
+		"SIGNAL_SIGIO":           11,
+		"SIGNAL_SIGIOT":          12,
+		"SIGNAL_SIGKILL":         13,
+		"SIGNAL_SIGPIPE":         14,
+		"SIGNAL_SIGPOLL":         15,
+		"SIGNAL_SIGPROF":         16,
+		"SIGNAL_SIGPWR":          17,
+		"SIGNAL_SIGQUIT":         18,
+		"SIGNAL_SIGSEGV":         19,
+		"SIGNAL_SIGSTKFLT":       20,
+		"SIGNAL_SIGSTOP":         21,
+		"SIGNAL_SIGSYS":          22,
+		"SIGNAL_SIGTERM":         23,
+		"SIGNAL_SIGTRAP":         24,
+		"SIGNAL_SIGTSTP":         25,
+		"SIGNAL_SIGTTIN":         26,
+		"SIGNAL_SIGTTOU":         27,
+		"SIGNAL_SIGURG":          28,
+		"SIGNAL_SIGUSR1":         29,
+		"SIGNAL_SIGUSR2":         30,
+		"SIGNAL_SIGVTALRM":       31,
+		"SIGNAL_SIGWINCH":        32,
+		"SIGNAL_SIGXCPU":         33,
+		"SIGNAL_SIGXFSZ":         34,
+		"SIGNAL_SIGRTMIN":        35,
+		"SIGNAL_SIGRTMINPLUS1":   36,
+		"SIGNAL_SIGRTMINPLUS2":   37,
+		"SIGNAL_SIGRTMINPLUS3":   38,
+		"SIGNAL_SIGRTMINPLUS4":   39,
+		"SIGNAL_SIGRTMINPLUS5":   40,
+		"SIGNAL_SIGRTMINPLUS6":   41,
+		"SIGNAL_SIGRTMINPLUS7":   42,
+		"SIGNAL_SIGRTMINPLUS8":   43,
+		"SIGNAL_SIGRTMINPLUS9":   44,
+		"SIGNAL_SIGRTMINPLUS10":  45,
+		"SIGNAL_SIGRTMINPLUS11":  46,
+		"SIGNAL_SIGRTMINPLUS12":  47,
+		"SIGNAL_SIGRTMINPLUS13":  48,
+		"SIGNAL_SIGRTMINPLUS14":  49,
+		"SIGNAL_SIGRTMINPLUS15":  50,
+		"SIGNAL_SIGRTMAXMINUS14": 51,
+		"SIGNAL_SIGRTMAXMINUS13": 52,
+		"SIGNAL_SIGRTMAXMINUS12": 53,
+		"SIGNAL_SIGRTMAXMINUS11": 54,
+		"SIGNAL_SIGRTMAXMINUS10": 55,
+		"SIGNAL_SIGRTMAXMINUS9":  56,
+		"SIGNAL_SIGRTMAXMINUS8":  57,
+		"SIGNAL_SIGRTMAXMINUS7":  58,
+		"SIGNAL_SIGRTMAXMINUS6":  59,
+		"SIGNAL_SIGRTMAXMINUS5":  60,
+		"SIGNAL_SIGRTMAXMINUS4":  61,
+		"SIGNAL_SIGRTMAXMINUS3":  62,
+		"SIGNAL_SIGRTMAXMINUS2":  63,
+		"SIGNAL_SIGRTMAXMINUS1":  64,
+		"SIGNAL_SIGRTMAX":        65,
+	}
+)
+
+func (x Signal) Enum() *Signal {
+	p := new(Signal)
+	*p = x
+	return p
+}
+
+func (x Signal) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (Signal) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[5].Descriptor()
+}
+
+func (Signal) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[5]
+}
+
+func (x Signal) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use Signal.Descriptor instead.
+func (Signal) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{5}
+}
+
+type ContainerState int32
+
+const (
+	ContainerState_CONTAINER_CREATED ContainerState = 0
+	ContainerState_CONTAINER_RUNNING ContainerState = 1
+	ContainerState_CONTAINER_EXITED  ContainerState = 2
+	ContainerState_CONTAINER_UNKNOWN ContainerState = 3
+)
+
+// Enum value maps for ContainerState.
+var (
+	ContainerState_name = map[int32]string{
+		0: "CONTAINER_CREATED",
+		1: "CONTAINER_RUNNING",
+		2: "CONTAINER_EXITED",
+		3: "CONTAINER_UNKNOWN",
+	}
+	ContainerState_value = map[string]int32{
+		"CONTAINER_CREATED": 0,
+		"CONTAINER_RUNNING": 1,
+		"CONTAINER_EXITED":  2,
+		"CONTAINER_UNKNOWN": 3,
+	}
+)
+
+func (x ContainerState) Enum() *ContainerState {
+	p := new(ContainerState)
+	*p = x
+	return p
+}
+
+func (x ContainerState) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ContainerState) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[6].Descriptor()
+}
+
+func (ContainerState) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[6]
+}
+
+func (x ContainerState) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ContainerState.Descriptor instead.
+func (ContainerState) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{6}
+}
+
+type ContainerEventType int32
+
+const (
+	// Container created
+	ContainerEventType_CONTAINER_CREATED_EVENT ContainerEventType = 0
+	// Container started
+	ContainerEventType_CONTAINER_STARTED_EVENT ContainerEventType = 1
+	// Container stopped
+	ContainerEventType_CONTAINER_STOPPED_EVENT ContainerEventType = 2
+	// Container deleted
+	ContainerEventType_CONTAINER_DELETED_EVENT ContainerEventType = 3
+)
+
+// Enum value maps for ContainerEventType.
+var (
+	ContainerEventType_name = map[int32]string{
+		0: "CONTAINER_CREATED_EVENT",
+		1: "CONTAINER_STARTED_EVENT",
+		2: "CONTAINER_STOPPED_EVENT",
+		3: "CONTAINER_DELETED_EVENT",
+	}
+	ContainerEventType_value = map[string]int32{
+		"CONTAINER_CREATED_EVENT": 0,
+		"CONTAINER_STARTED_EVENT": 1,
+		"CONTAINER_STOPPED_EVENT": 2,
+		"CONTAINER_DELETED_EVENT": 3,
+	}
+)
+
+func (x ContainerEventType) Enum() *ContainerEventType {
+	p := new(ContainerEventType)
+	*p = x
+	return p
+}
+
+func (x ContainerEventType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (ContainerEventType) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[7].Descriptor()
+}
+
+func (ContainerEventType) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[7]
+}
+
+func (x ContainerEventType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use ContainerEventType.Descriptor instead.
+func (ContainerEventType) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{7}
+}
+
+type MetricType int32
+
+const (
+	MetricType_COUNTER MetricType = 0
+	MetricType_GAUGE   MetricType = 1
+)
+
+// Enum value maps for MetricType.
+var (
+	MetricType_name = map[int32]string{
+		0: "COUNTER",
+		1: "GAUGE",
+	}
+	MetricType_value = map[string]int32{
+		"COUNTER": 0,
+		"GAUGE":   1,
+	}
+)
+
+func (x MetricType) Enum() *MetricType {
+	p := new(MetricType)
+	*p = x
+	return p
+}
+
+func (x MetricType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (MetricType) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[8].Descriptor()
+}
+
+func (MetricType) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[8]
+}
+
+func (x MetricType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use MetricType.Descriptor instead.
+func (MetricType) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{8}
+}
+
+type CgroupDriver int32
+
+const (
+	CgroupDriver_SYSTEMD  CgroupDriver = 0
+	CgroupDriver_CGROUPFS CgroupDriver = 1
+)
+
+// Enum value maps for CgroupDriver.
+var (
+	CgroupDriver_name = map[int32]string{
+		0: "SYSTEMD",
+		1: "CGROUPFS",
+	}
+	CgroupDriver_value = map[string]int32{
+		"SYSTEMD":  0,
+		"CGROUPFS": 1,
+	}
+)
+
+func (x CgroupDriver) Enum() *CgroupDriver {
+	p := new(CgroupDriver)
+	*p = x
+	return p
+}
+
+func (x CgroupDriver) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (CgroupDriver) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[9].Descriptor()
+}
+
+func (CgroupDriver) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[9]
+}
+
+func (x CgroupDriver) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use CgroupDriver.Descriptor instead.
+func (CgroupDriver) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{9}
+}
+
+// Available profile types.
+type SecurityProfile_ProfileType int32
+
+const (
+	// The container runtime default profile should be used.
+	SecurityProfile_RuntimeDefault SecurityProfile_ProfileType = 0
+	// Disable the feature for the sandbox or the container.
+	SecurityProfile_Unconfined SecurityProfile_ProfileType = 1
+	// A pre-defined profile on the node should be used.
+	SecurityProfile_Localhost SecurityProfile_ProfileType = 2
+)
+
+// Enum value maps for SecurityProfile_ProfileType.
+var (
+	SecurityProfile_ProfileType_name = map[int32]string{
+		0: "RuntimeDefault",
+		1: "Unconfined",
+		2: "Localhost",
+	}
+	SecurityProfile_ProfileType_value = map[string]int32{
+		"RuntimeDefault": 0,
+		"Unconfined":     1,
+		"Localhost":      2,
+	}
+)
+
+func (x SecurityProfile_ProfileType) Enum() *SecurityProfile_ProfileType {
+	p := new(SecurityProfile_ProfileType)
+	*p = x
+	return p
+}
+
+func (x SecurityProfile_ProfileType) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (SecurityProfile_ProfileType) Descriptor() protoreflect.EnumDescriptor {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[10].Descriptor()
+}
+
+func (SecurityProfile_ProfileType) Type() protoreflect.EnumType {
+	return &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes[10]
+}
+
+func (x SecurityProfile_ProfileType) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use SecurityProfile_ProfileType.Descriptor instead.
+func (SecurityProfile_ProfileType) EnumDescriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{10, 0}
+}
+
+type VersionRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Version of the kubelet runtime API.
+	Version       string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *VersionRequest) Reset() {
+	*x = VersionRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[0]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VersionRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VersionRequest) ProtoMessage() {}
+
+func (x *VersionRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[0]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VersionRequest.ProtoReflect.Descriptor instead.
+func (*VersionRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *VersionRequest) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+type VersionResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Version of the kubelet runtime API.
+	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
+	// Name of the container runtime.
+	RuntimeName string `protobuf:"bytes,2,opt,name=runtime_name,json=runtimeName,proto3" json:"runtime_name,omitempty"`
+	// Version of the container runtime. The string must be
+	// semver-compatible.
+	RuntimeVersion string `protobuf:"bytes,3,opt,name=runtime_version,json=runtimeVersion,proto3" json:"runtime_version,omitempty"`
+	// API version of the container runtime. The string must be
+	// semver-compatible.
+	RuntimeApiVersion string `protobuf:"bytes,4,opt,name=runtime_api_version,json=runtimeApiVersion,proto3" json:"runtime_api_version,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *VersionResponse) Reset() {
+	*x = VersionResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[1]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *VersionResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*VersionResponse) ProtoMessage() {}
+
+func (x *VersionResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[1]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use VersionResponse.ProtoReflect.Descriptor instead.
+func (*VersionResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{1}
+}
+
+func (x *VersionResponse) GetVersion() string {
+	if x != nil {
+		return x.Version
+	}
+	return ""
+}
+
+func (x *VersionResponse) GetRuntimeName() string {
+	if x != nil {
+		return x.RuntimeName
+	}
+	return ""
+}
+
+func (x *VersionResponse) GetRuntimeVersion() string {
+	if x != nil {
+		return x.RuntimeVersion
+	}
+	return ""
+}
+
+func (x *VersionResponse) GetRuntimeApiVersion() string {
+	if x != nil {
+		return x.RuntimeApiVersion
+	}
+	return ""
+}
+
+// DNSConfig specifies the DNS servers and search domains of a sandbox.
+type DNSConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of DNS servers of the cluster.
+	Servers []string `protobuf:"bytes,1,rep,name=servers,proto3" json:"servers,omitempty"`
+	// List of DNS search domains of the cluster.
+	Searches []string `protobuf:"bytes,2,rep,name=searches,proto3" json:"searches,omitempty"`
+	// List of DNS options. See https://linux.die.net/man/5/resolv.conf
+	// for all available options.
+	Options       []string `protobuf:"bytes,3,rep,name=options,proto3" json:"options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *DNSConfig) Reset() {
+	*x = DNSConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[2]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *DNSConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*DNSConfig) ProtoMessage() {}
+
+func (x *DNSConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[2]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use DNSConfig.ProtoReflect.Descriptor instead.
+func (*DNSConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *DNSConfig) GetServers() []string {
+	if x != nil {
+		return x.Servers
+	}
+	return nil
+}
+
+func (x *DNSConfig) GetSearches() []string {
+	if x != nil {
+		return x.Searches
+	}
+	return nil
+}
+
+func (x *DNSConfig) GetOptions() []string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+// PortMapping specifies the port mapping configurations of a sandbox.
+type PortMapping struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Protocol of the port mapping.
+	Protocol Protocol `protobuf:"varint,1,opt,name=protocol,proto3,enum=runtime.v1.Protocol" json:"protocol,omitempty"`
+	// Port number within the container. Default: 0 (not specified).
+	ContainerPort int32 `protobuf:"varint,2,opt,name=container_port,json=containerPort,proto3" json:"container_port,omitempty"`
+	// Port number on the host to map the container port to.
+	//
+	//   - Valid host port range is 1-65535.
+	//   - The value 0 has explicit semantic meaning: it indicates NO host port should be allocated.
+	//   - The value 0 does NOT indicate dynamic port allocation. Future implementations
+	//     of dynamic allocation will use different values/semantics.
+	//   - Implementations MUST handle the case where this field is explicitly set to 0,
+	//     This field SHOULD be omitted when no port is required.
+	//
+	// Default: If omitted, container port will not be exposed on the host.
+	HostPort int32 `protobuf:"varint,3,opt,name=host_port,json=hostPort,proto3" json:"host_port,omitempty"`
+	// Host IP.
+	HostIp        string `protobuf:"bytes,4,opt,name=host_ip,json=hostIp,proto3" json:"host_ip,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PortMapping) Reset() {
+	*x = PortMapping{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[3]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PortMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortMapping) ProtoMessage() {}
+
+func (x *PortMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[3]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortMapping.ProtoReflect.Descriptor instead.
+func (*PortMapping) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{3}
+}
+
+func (x *PortMapping) GetProtocol() Protocol {
+	if x != nil {
+		return x.Protocol
+	}
+	return Protocol_TCP
+}
+
+func (x *PortMapping) GetContainerPort() int32 {
+	if x != nil {
+		return x.ContainerPort
+	}
+	return 0
+}
+
+func (x *PortMapping) GetHostPort() int32 {
+	if x != nil {
+		return x.HostPort
+	}
+	return 0
+}
+
+func (x *PortMapping) GetHostIp() string {
+	if x != nil {
+		return x.HostIp
+	}
+	return ""
+}
+
+// Mount specifies a host volume to mount into a container.
+type Mount struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Path of the mount within the container.
+	ContainerPath string `protobuf:"bytes,1,opt,name=container_path,json=containerPath,proto3" json:"container_path,omitempty"`
+	// Path of the mount on the host. Has to be empty if the image field below
+	// is provided, because those fields are mutually exclusive. If the image
+	// field below is nil and the host path doesn't exist, then runtimes should
+	// report an error. If the hostpath is a symbolic link, runtimes should
+	// follow the symlink and mount the real destination to container.
+	HostPath string `protobuf:"bytes,2,opt,name=host_path,json=hostPath,proto3" json:"host_path,omitempty"`
+	// If set, the mount is read-only.
+	Readonly bool `protobuf:"varint,3,opt,name=readonly,proto3" json:"readonly,omitempty"`
+	// If set, the mount needs SELinux relabeling.
+	SelinuxRelabel bool `protobuf:"varint,4,opt,name=selinux_relabel,json=selinuxRelabel,proto3" json:"selinux_relabel,omitempty"`
+	// Requested propagation mode.
+	Propagation MountPropagation `protobuf:"varint,5,opt,name=propagation,proto3,enum=runtime.v1.MountPropagation" json:"propagation,omitempty"`
+	// UidMappings specifies the runtime UID mappings for the mount.
+	UidMappings []*IDMapping `protobuf:"bytes,6,rep,name=uidMappings,proto3" json:"uidMappings,omitempty"`
+	// GidMappings specifies the runtime GID mappings for the mount.
+	GidMappings []*IDMapping `protobuf:"bytes,7,rep,name=gidMappings,proto3" json:"gidMappings,omitempty"`
+	// If set to true, the mount is made recursive read-only.
+	// In this CRI API, recursive_read_only is a plain true/false boolean, although its equivalent
+	// in the Kubernetes core API is a quaternary that can be nil, "Enabled", "IfPossible", or "Disabled".
+	// kubelet translates that quaternary value in the core API into a boolean in this CRI API.
+	// Remarks:
+	// - nil is just treated as false
+	// - when set to true, readonly must be explicitly set to true, and propagation must be PRIVATE (0).
+	// - (readonly == false && recursive_read_only == false) does not make the mount read-only.
+	RecursiveReadOnly bool `protobuf:"varint,8,opt,name=recursive_read_only,json=recursiveReadOnly,proto3" json:"recursive_read_only,omitempty"`
+	// Mount an image reference (image ID, with or without digest), which is a
+	// special use case for image volume mounts. If this field is set, then
+	// host_path should be unset. All image mounts are per feature definition
+	// readonly. The kubelet does an PullImage RPC and evaluates the returned
+	// PullImageResponse.image_ref value, which is then set to the
+	// ImageSpec.image field. Runtimes are expected to mount the image as
+	// required.
+	// Introduced in the Image Volume Source KEP: https://kep.k8s.io/4639
+	Image *ImageSpec `protobuf:"bytes,9,opt,name=image,proto3" json:"image,omitempty"`
+	// Specific image sub path to be used from inside the image instead of its
+	// root, only necessary if the above image field is set. If the sub path is
+	// not empty and does not exist in the image, then runtimes should fail and
+	// return an error.
+	// Introduced in the Image Volume Source KEP beta graduation: https://kep.k8s.io/4639
+	ImageSubPath string `protobuf:"bytes,10,opt,name=image_sub_path,json=imageSubPath,proto3" json:"image_sub_path,omitempty"`
+	// mount_options specifies additional bind mount options (e.g., noexec,
+	// nodev, nosuid) that the runtime must apply when mounting this volume
+	// into the container. These are passed as OCI mount options.
+	MountOptions  []string `protobuf:"bytes,11,rep,name=mount_options,json=mountOptions,proto3" json:"mount_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Mount) Reset() {
+	*x = Mount{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[4]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Mount) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Mount) ProtoMessage() {}
+
+func (x *Mount) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[4]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Mount.ProtoReflect.Descriptor instead.
+func (*Mount) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{4}
+}
+
+func (x *Mount) GetContainerPath() string {
+	if x != nil {
+		return x.ContainerPath
+	}
+	return ""
+}
+
+func (x *Mount) GetHostPath() string {
+	if x != nil {
+		return x.HostPath
+	}
+	return ""
+}
+
+func (x *Mount) GetReadonly() bool {
+	if x != nil {
+		return x.Readonly
+	}
+	return false
+}
+
+func (x *Mount) GetSelinuxRelabel() bool {
+	if x != nil {
+		return x.SelinuxRelabel
+	}
+	return false
+}
+
+func (x *Mount) GetPropagation() MountPropagation {
+	if x != nil {
+		return x.Propagation
+	}
+	return MountPropagation_PROPAGATION_PRIVATE
+}
+
+func (x *Mount) GetUidMappings() []*IDMapping {
+	if x != nil {
+		return x.UidMappings
+	}
+	return nil
+}
+
+func (x *Mount) GetGidMappings() []*IDMapping {
+	if x != nil {
+		return x.GidMappings
+	}
+	return nil
+}
+
+func (x *Mount) GetRecursiveReadOnly() bool {
+	if x != nil {
+		return x.RecursiveReadOnly
+	}
+	return false
+}
+
+func (x *Mount) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *Mount) GetImageSubPath() string {
+	if x != nil {
+		return x.ImageSubPath
+	}
+	return ""
+}
+
+func (x *Mount) GetMountOptions() []string {
+	if x != nil {
+		return x.MountOptions
+	}
+	return nil
+}
+
+// IDMapping describes host to container ID mappings for a pod sandbox.
+type IDMapping struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// HostId is the id on the host.
+	HostId uint32 `protobuf:"varint,1,opt,name=host_id,json=hostId,proto3" json:"host_id,omitempty"`
+	// ContainerId is the id in the container.
+	ContainerId uint32 `protobuf:"varint,2,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Length is the size of the range to map.
+	Length        uint32 `protobuf:"varint,3,opt,name=length,proto3" json:"length,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IDMapping) Reset() {
+	*x = IDMapping{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[5]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IDMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IDMapping) ProtoMessage() {}
+
+func (x *IDMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[5]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IDMapping.ProtoReflect.Descriptor instead.
+func (*IDMapping) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{5}
+}
+
+func (x *IDMapping) GetHostId() uint32 {
+	if x != nil {
+		return x.HostId
+	}
+	return 0
+}
+
+func (x *IDMapping) GetContainerId() uint32 {
+	if x != nil {
+		return x.ContainerId
+	}
+	return 0
+}
+
+func (x *IDMapping) GetLength() uint32 {
+	if x != nil {
+		return x.Length
+	}
+	return 0
+}
+
+// UserNamespace describes the intended user namespace configuration for a pod sandbox.
+type UserNamespace struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Mode is the NamespaceMode for this UserNamespace.
+	// Note: NamespaceMode for UserNamespace currently supports only POD and NODE, not CONTAINER OR TARGET.
+	Mode NamespaceMode `protobuf:"varint,1,opt,name=mode,proto3,enum=runtime.v1.NamespaceMode" json:"mode,omitempty"`
+	// Uids specifies the UID mappings for the user namespace.
+	Uids []*IDMapping `protobuf:"bytes,2,rep,name=uids,proto3" json:"uids,omitempty"`
+	// Gids specifies the GID mappings for the user namespace.
+	Gids          []*IDMapping `protobuf:"bytes,3,rep,name=gids,proto3" json:"gids,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UserNamespace) Reset() {
+	*x = UserNamespace{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[6]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UserNamespace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UserNamespace) ProtoMessage() {}
+
+func (x *UserNamespace) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[6]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UserNamespace.ProtoReflect.Descriptor instead.
+func (*UserNamespace) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{6}
+}
+
+func (x *UserNamespace) GetMode() NamespaceMode {
+	if x != nil {
+		return x.Mode
+	}
+	return NamespaceMode_POD
+}
+
+func (x *UserNamespace) GetUids() []*IDMapping {
+	if x != nil {
+		return x.Uids
+	}
+	return nil
+}
+
+func (x *UserNamespace) GetGids() []*IDMapping {
+	if x != nil {
+		return x.Gids
+	}
+	return nil
+}
+
+// NamespaceOption provides options for Linux namespaces.
+type NamespaceOption struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Network namespace for this container/sandbox.
+	// Note: There is currently no way to set CONTAINER scoped network in the Kubernetes API.
+	// Namespaces currently set by the kubelet: POD, NODE
+	Network NamespaceMode `protobuf:"varint,1,opt,name=network,proto3,enum=runtime.v1.NamespaceMode" json:"network,omitempty"`
+	// PID namespace for this container/sandbox.
+	// Note: The CRI default is POD, but the v1.PodSpec default is CONTAINER.
+	// The kubelet's runtime manager will set this to CONTAINER explicitly for v1 pods.
+	// Namespaces currently set by the kubelet: POD, CONTAINER, NODE, TARGET
+	Pid NamespaceMode `protobuf:"varint,2,opt,name=pid,proto3,enum=runtime.v1.NamespaceMode" json:"pid,omitempty"`
+	// IPC namespace for this container/sandbox.
+	// Note: There is currently no way to set CONTAINER scoped IPC in the Kubernetes API.
+	// Namespaces currently set by the kubelet: POD, NODE
+	Ipc NamespaceMode `protobuf:"varint,3,opt,name=ipc,proto3,enum=runtime.v1.NamespaceMode" json:"ipc,omitempty"`
+	// Target Container ID for NamespaceMode of TARGET. This container must have been
+	// previously created in the same pod. It is not possible to specify different targets
+	// for each namespace.
+	TargetId string `protobuf:"bytes,4,opt,name=target_id,json=targetId,proto3" json:"target_id,omitempty"`
+	// UsernsOptions for this pod sandbox.
+	// The Kubelet picks the user namespace configuration to use for the pod sandbox.  The mappings
+	// are specified as part of the UserNamespace struct.  If the struct is nil, then the POD mode
+	// must be assumed.  This is done for backward compatibility with older Kubelet versions that
+	// do not set a user namespace.
+	UsernsOptions *UserNamespace `protobuf:"bytes,5,opt,name=userns_options,json=usernsOptions,proto3" json:"userns_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NamespaceOption) Reset() {
+	*x = NamespaceOption{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[7]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NamespaceOption) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NamespaceOption) ProtoMessage() {}
+
+func (x *NamespaceOption) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[7]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NamespaceOption.ProtoReflect.Descriptor instead.
+func (*NamespaceOption) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{7}
+}
+
+func (x *NamespaceOption) GetNetwork() NamespaceMode {
+	if x != nil {
+		return x.Network
+	}
+	return NamespaceMode_POD
+}
+
+func (x *NamespaceOption) GetPid() NamespaceMode {
+	if x != nil {
+		return x.Pid
+	}
+	return NamespaceMode_POD
+}
+
+func (x *NamespaceOption) GetIpc() NamespaceMode {
+	if x != nil {
+		return x.Ipc
+	}
+	return NamespaceMode_POD
+}
+
+func (x *NamespaceOption) GetTargetId() string {
+	if x != nil {
+		return x.TargetId
+	}
+	return ""
+}
+
+func (x *NamespaceOption) GetUsernsOptions() *UserNamespace {
+	if x != nil {
+		return x.UsernsOptions
+	}
+	return nil
+}
+
+// Int64Value is the wrapper of int64.
+type Int64Value struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The value.
+	Value         int64 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Int64Value) Reset() {
+	*x = Int64Value{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[8]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Int64Value) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Int64Value) ProtoMessage() {}
+
+func (x *Int64Value) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[8]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Int64Value.ProtoReflect.Descriptor instead.
+func (*Int64Value) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{8}
+}
+
+func (x *Int64Value) GetValue() int64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// LinuxSandboxSecurityContext holds linux security configuration that will be
+// applied to a sandbox. Note that:
+//  1. It does not apply to containers in the pods.
+//  2. It may not be applicable to a PodSandbox which does not contain any running
+//     process.
+type LinuxSandboxSecurityContext struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Configurations for the sandbox's namespaces.
+	// This will be used only if the PodSandbox uses namespace for isolation.
+	NamespaceOptions *NamespaceOption `protobuf:"bytes,1,opt,name=namespace_options,json=namespaceOptions,proto3" json:"namespace_options,omitempty"`
+	// Optional SELinux context to be applied.
+	SelinuxOptions *SELinuxOption `protobuf:"bytes,2,opt,name=selinux_options,json=selinuxOptions,proto3" json:"selinux_options,omitempty"`
+	// UID to run sandbox processes as, when applicable.
+	RunAsUser *Int64Value `protobuf:"bytes,3,opt,name=run_as_user,json=runAsUser,proto3" json:"run_as_user,omitempty"`
+	// GID to run sandbox processes as, when applicable. run_as_group should only
+	// be specified when run_as_user is specified; otherwise, the runtime MUST error.
+	RunAsGroup *Int64Value `protobuf:"bytes,8,opt,name=run_as_group,json=runAsGroup,proto3" json:"run_as_group,omitempty"`
+	// If set, the root filesystem of the sandbox is read-only.
+	ReadonlyRootfs bool `protobuf:"varint,4,opt,name=readonly_rootfs,json=readonlyRootfs,proto3" json:"readonly_rootfs,omitempty"`
+	// List of groups applied to the first process run in each container.
+	// supplemental_groups_policy can control how groups will be calculated.
+	SupplementalGroups []int64 `protobuf:"varint,5,rep,packed,name=supplemental_groups,json=supplementalGroups,proto3" json:"supplemental_groups,omitempty"`
+	// supplemental_groups_policy defines how supplemental groups of the first
+	// container processes are calculated.
+	// Valid values are "Merge" and "Strict".
+	// If not specified, "Merge" is used.
+	SupplementalGroupsPolicy SupplementalGroupsPolicy `protobuf:"varint,11,opt,name=supplemental_groups_policy,json=supplementalGroupsPolicy,proto3,enum=runtime.v1.SupplementalGroupsPolicy" json:"supplemental_groups_policy,omitempty"`
+	// Indicates whether the sandbox will be asked to run a privileged
+	// container. If a privileged container is to be executed within it, this
+	// MUST be true.
+	// This allows a sandbox to take additional security precautions if no
+	// privileged containers are expected to be run.
+	Privileged bool `protobuf:"varint,6,opt,name=privileged,proto3" json:"privileged,omitempty"`
+	// Seccomp profile for the sandbox.
+	Seccomp *SecurityProfile `protobuf:"bytes,9,opt,name=seccomp,proto3" json:"seccomp,omitempty"`
+	// AppArmor profile for the sandbox.
+	Apparmor *SecurityProfile `protobuf:"bytes,10,opt,name=apparmor,proto3" json:"apparmor,omitempty"`
+	// Seccomp profile for the sandbox, candidate values are:
+	//   - runtime/default: the default profile for the container runtime
+	//   - unconfined: unconfined profile, ie, no seccomp sandboxing
+	//   - localhost/<full-path-to-profile>: the profile installed on the node.
+	//     <full-path-to-profile> is the full path of the profile.
+	//
+	// Default: "", which is identical with unconfined.
+	//
+	// Deprecated: Marked as deprecated in staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto.
+	SeccompProfilePath string `protobuf:"bytes,7,opt,name=seccomp_profile_path,json=seccompProfilePath,proto3" json:"seccomp_profile_path,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *LinuxSandboxSecurityContext) Reset() {
+	*x = LinuxSandboxSecurityContext{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[9]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxSandboxSecurityContext) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxSandboxSecurityContext) ProtoMessage() {}
+
+func (x *LinuxSandboxSecurityContext) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[9]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxSandboxSecurityContext.ProtoReflect.Descriptor instead.
+func (*LinuxSandboxSecurityContext) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{9}
+}
+
+func (x *LinuxSandboxSecurityContext) GetNamespaceOptions() *NamespaceOption {
+	if x != nil {
+		return x.NamespaceOptions
+	}
+	return nil
+}
+
+func (x *LinuxSandboxSecurityContext) GetSelinuxOptions() *SELinuxOption {
+	if x != nil {
+		return x.SelinuxOptions
+	}
+	return nil
+}
+
+func (x *LinuxSandboxSecurityContext) GetRunAsUser() *Int64Value {
+	if x != nil {
+		return x.RunAsUser
+	}
+	return nil
+}
+
+func (x *LinuxSandboxSecurityContext) GetRunAsGroup() *Int64Value {
+	if x != nil {
+		return x.RunAsGroup
+	}
+	return nil
+}
+
+func (x *LinuxSandboxSecurityContext) GetReadonlyRootfs() bool {
+	if x != nil {
+		return x.ReadonlyRootfs
+	}
+	return false
+}
+
+func (x *LinuxSandboxSecurityContext) GetSupplementalGroups() []int64 {
+	if x != nil {
+		return x.SupplementalGroups
+	}
+	return nil
+}
+
+func (x *LinuxSandboxSecurityContext) GetSupplementalGroupsPolicy() SupplementalGroupsPolicy {
+	if x != nil {
+		return x.SupplementalGroupsPolicy
+	}
+	return SupplementalGroupsPolicy_Merge
+}
+
+func (x *LinuxSandboxSecurityContext) GetPrivileged() bool {
+	if x != nil {
+		return x.Privileged
+	}
+	return false
+}
+
+func (x *LinuxSandboxSecurityContext) GetSeccomp() *SecurityProfile {
+	if x != nil {
+		return x.Seccomp
+	}
+	return nil
+}
+
+func (x *LinuxSandboxSecurityContext) GetApparmor() *SecurityProfile {
+	if x != nil {
+		return x.Apparmor
+	}
+	return nil
+}
+
+// Deprecated: Marked as deprecated in staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto.
+func (x *LinuxSandboxSecurityContext) GetSeccompProfilePath() string {
+	if x != nil {
+		return x.SeccompProfilePath
+	}
+	return ""
+}
+
+// A security profile which can be used for sandboxes and containers.
+type SecurityProfile struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Indicator which `ProfileType` should be applied.
+	ProfileType SecurityProfile_ProfileType `protobuf:"varint,1,opt,name=profile_type,json=profileType,proto3,enum=runtime.v1.SecurityProfile_ProfileType" json:"profile_type,omitempty"`
+	// Indicates that a pre-defined profile on the node should be used.
+	// Must only be set if `ProfileType` is `Localhost`.
+	// For seccomp, it must be an absolute path to the seccomp profile.
+	// For AppArmor, this field is the AppArmor `<profile name>/`
+	LocalhostRef  string `protobuf:"bytes,2,opt,name=localhost_ref,json=localhostRef,proto3" json:"localhost_ref,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SecurityProfile) Reset() {
+	*x = SecurityProfile{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[10]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SecurityProfile) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SecurityProfile) ProtoMessage() {}
+
+func (x *SecurityProfile) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[10]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SecurityProfile.ProtoReflect.Descriptor instead.
+func (*SecurityProfile) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{10}
+}
+
+func (x *SecurityProfile) GetProfileType() SecurityProfile_ProfileType {
+	if x != nil {
+		return x.ProfileType
+	}
+	return SecurityProfile_RuntimeDefault
+}
+
+func (x *SecurityProfile) GetLocalhostRef() string {
+	if x != nil {
+		return x.LocalhostRef
+	}
+	return ""
+}
+
+// LinuxPodSandboxConfig holds platform-specific configurations for Linux
+// host platforms and Linux-based containers.
+type LinuxPodSandboxConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Parent cgroup of the PodSandbox.
+	// The cgroupfs style syntax will be used, but the container runtime can
+	// convert it to systemd semantics if needed.
+	CgroupParent string `protobuf:"bytes,1,opt,name=cgroup_parent,json=cgroupParent,proto3" json:"cgroup_parent,omitempty"`
+	// LinuxSandboxSecurityContext holds sandbox security attributes.
+	SecurityContext *LinuxSandboxSecurityContext `protobuf:"bytes,2,opt,name=security_context,json=securityContext,proto3" json:"security_context,omitempty"`
+	// Sysctls holds linux sysctls config for the sandbox.
+	Sysctls map[string]string `protobuf:"bytes,3,rep,name=sysctls,proto3" json:"sysctls,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Optional overhead represents the overheads associated with this sandbox
+	Overhead *LinuxContainerResources `protobuf:"bytes,4,opt,name=overhead,proto3" json:"overhead,omitempty"`
+	// Optional resources represents the sum of container resources for this sandbox
+	Resources     *LinuxContainerResources `protobuf:"bytes,5,opt,name=resources,proto3" json:"resources,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LinuxPodSandboxConfig) Reset() {
+	*x = LinuxPodSandboxConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[11]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxPodSandboxConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxPodSandboxConfig) ProtoMessage() {}
+
+func (x *LinuxPodSandboxConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[11]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxPodSandboxConfig.ProtoReflect.Descriptor instead.
+func (*LinuxPodSandboxConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{11}
+}
+
+func (x *LinuxPodSandboxConfig) GetCgroupParent() string {
+	if x != nil {
+		return x.CgroupParent
+	}
+	return ""
+}
+
+func (x *LinuxPodSandboxConfig) GetSecurityContext() *LinuxSandboxSecurityContext {
+	if x != nil {
+		return x.SecurityContext
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxConfig) GetSysctls() map[string]string {
+	if x != nil {
+		return x.Sysctls
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxConfig) GetOverhead() *LinuxContainerResources {
+	if x != nil {
+		return x.Overhead
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxConfig) GetResources() *LinuxContainerResources {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+// PodSandboxMetadata holds all necessary information for building the sandbox name.
+// The container runtime is encouraged to expose the metadata associated with the
+// PodSandbox in its user interface for better user experience. For example,
+// the runtime can construct a unique PodSandboxName based on the metadata.
+type PodSandboxMetadata struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Pod name of the sandbox. Same as the pod name in the Pod ObjectMeta.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Pod UID of the sandbox. Same as the pod UID in the Pod ObjectMeta.
+	Uid string `protobuf:"bytes,2,opt,name=uid,proto3" json:"uid,omitempty"`
+	// Pod namespace of the sandbox. Same as the pod namespace in the Pod ObjectMeta.
+	Namespace string `protobuf:"bytes,3,opt,name=namespace,proto3" json:"namespace,omitempty"`
+	// Attempt number of creating the sandbox. Default: 0.
+	Attempt       uint32 `protobuf:"varint,4,opt,name=attempt,proto3" json:"attempt,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxMetadata) Reset() {
+	*x = PodSandboxMetadata{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[12]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxMetadata) ProtoMessage() {}
+
+func (x *PodSandboxMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[12]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxMetadata.ProtoReflect.Descriptor instead.
+func (*PodSandboxMetadata) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{12}
+}
+
+func (x *PodSandboxMetadata) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *PodSandboxMetadata) GetUid() string {
+	if x != nil {
+		return x.Uid
+	}
+	return ""
+}
+
+func (x *PodSandboxMetadata) GetNamespace() string {
+	if x != nil {
+		return x.Namespace
+	}
+	return ""
+}
+
+func (x *PodSandboxMetadata) GetAttempt() uint32 {
+	if x != nil {
+		return x.Attempt
+	}
+	return 0
+}
+
+// PodSandboxConfig holds all the required and optional fields for creating a
+// sandbox.
+type PodSandboxConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Metadata of the sandbox. This information will uniquely identify the
+	// sandbox, and the runtime should leverage this to ensure correct
+	// operation. The runtime may also use this information to improve UX, such
+	// as by constructing a readable name.
+	Metadata *PodSandboxMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Hostname of the sandbox. Hostname could only be empty when the pod
+	// network namespace is NODE.
+	Hostname string `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"`
+	// Path to the directory on the host in which container log files are
+	// stored.
+	// By default the log of a container going into the LogDirectory will be
+	// hooked up to STDOUT and STDERR. However, the LogDirectory may contain
+	// binary log files with structured logging data from the individual
+	// containers. For example, the files might be newline separated JSON
+	// structured logs, systemd-journald journal files, gRPC trace files, etc.
+	// E.g.,
+	//
+	//	PodSandboxConfig.LogDirectory = `/var/log/pods/<NAMESPACE>_<NAME>_<UID>/`
+	//	ContainerConfig.LogPath = `containerName/Instance#.log`
+	LogDirectory string `protobuf:"bytes,3,opt,name=log_directory,json=logDirectory,proto3" json:"log_directory,omitempty"`
+	// DNS config for the sandbox.
+	DnsConfig *DNSConfig `protobuf:"bytes,4,opt,name=dns_config,json=dnsConfig,proto3" json:"dns_config,omitempty"`
+	// Port mappings for the sandbox.
+	PortMappings []*PortMapping `protobuf:"bytes,5,rep,name=port_mappings,json=portMappings,proto3" json:"port_mappings,omitempty"`
+	// Key-value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,6,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map that may be set by the kubelet to store and
+	// retrieve arbitrary metadata. This will include any annotations set on a
+	// pod through the Kubernetes API.
+	//
+	// Annotations MUST NOT be altered by the runtime; the annotations stored
+	// here MUST be returned in the PodSandboxStatus associated with the pod
+	// this PodSandboxConfig creates.
+	//
+	// In general, in order to preserve a well-defined interface between the
+	// kubelet and the container runtime, annotations SHOULD NOT influence
+	// runtime behaviour.
+	//
+	// Annotations can also be useful for runtime authors to experiment with
+	// new features that are opaque to the Kubernetes APIs (both user-facing
+	// and the CRI). Whenever possible, however, runtime authors SHOULD
+	// consider proposing new typed fields for any new features instead.
+	Annotations map[string]string `protobuf:"bytes,7,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Optional configurations specific to Linux hosts.
+	Linux *LinuxPodSandboxConfig `protobuf:"bytes,8,opt,name=linux,proto3" json:"linux,omitempty"`
+	// Optional configurations specific to Windows hosts.
+	Windows       *WindowsPodSandboxConfig `protobuf:"bytes,9,opt,name=windows,proto3" json:"windows,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxConfig) Reset() {
+	*x = PodSandboxConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[13]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxConfig) ProtoMessage() {}
+
+func (x *PodSandboxConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[13]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxConfig.ProtoReflect.Descriptor instead.
+func (*PodSandboxConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{13}
+}
+
+func (x *PodSandboxConfig) GetMetadata() *PodSandboxMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *PodSandboxConfig) GetHostname() string {
+	if x != nil {
+		return x.Hostname
+	}
+	return ""
+}
+
+func (x *PodSandboxConfig) GetLogDirectory() string {
+	if x != nil {
+		return x.LogDirectory
+	}
+	return ""
+}
+
+func (x *PodSandboxConfig) GetDnsConfig() *DNSConfig {
+	if x != nil {
+		return x.DnsConfig
+	}
+	return nil
+}
+
+func (x *PodSandboxConfig) GetPortMappings() []*PortMapping {
+	if x != nil {
+		return x.PortMappings
+	}
+	return nil
+}
+
+func (x *PodSandboxConfig) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *PodSandboxConfig) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *PodSandboxConfig) GetLinux() *LinuxPodSandboxConfig {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+func (x *PodSandboxConfig) GetWindows() *WindowsPodSandboxConfig {
+	if x != nil {
+		return x.Windows
+	}
+	return nil
+}
+
+type RunPodSandboxRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Configuration for creating a PodSandbox.
+	Config *PodSandboxConfig `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
+	// Named runtime configuration to use for this PodSandbox.
+	// If the runtime handler is unknown, this request should be rejected.  An
+	// empty string should select the default handler, equivalent to the
+	// behavior before this feature was added.
+	// See https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
+	RuntimeHandler string `protobuf:"bytes,2,opt,name=runtime_handler,json=runtimeHandler,proto3" json:"runtime_handler,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *RunPodSandboxRequest) Reset() {
+	*x = RunPodSandboxRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[14]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RunPodSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RunPodSandboxRequest) ProtoMessage() {}
+
+func (x *RunPodSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[14]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RunPodSandboxRequest.ProtoReflect.Descriptor instead.
+func (*RunPodSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{14}
+}
+
+func (x *RunPodSandboxRequest) GetConfig() *PodSandboxConfig {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *RunPodSandboxRequest) GetRuntimeHandler() string {
+	if x != nil {
+		return x.RuntimeHandler
+	}
+	return ""
+}
+
+type RunPodSandboxResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox to run.
+	PodSandboxId  string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RunPodSandboxResponse) Reset() {
+	*x = RunPodSandboxResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[15]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RunPodSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RunPodSandboxResponse) ProtoMessage() {}
+
+func (x *RunPodSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[15]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RunPodSandboxResponse.ProtoReflect.Descriptor instead.
+func (*RunPodSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{15}
+}
+
+func (x *RunPodSandboxResponse) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+type StopPodSandboxRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox to stop.
+	PodSandboxId  string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StopPodSandboxRequest) Reset() {
+	*x = StopPodSandboxRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[16]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StopPodSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopPodSandboxRequest) ProtoMessage() {}
+
+func (x *StopPodSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[16]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopPodSandboxRequest.ProtoReflect.Descriptor instead.
+func (*StopPodSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{16}
+}
+
+func (x *StopPodSandboxRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+type StopPodSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StopPodSandboxResponse) Reset() {
+	*x = StopPodSandboxResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[17]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StopPodSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopPodSandboxResponse) ProtoMessage() {}
+
+func (x *StopPodSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[17]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopPodSandboxResponse.ProtoReflect.Descriptor instead.
+func (*StopPodSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{17}
+}
+
+type RemovePodSandboxRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox to remove.
+	PodSandboxId  string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RemovePodSandboxRequest) Reset() {
+	*x = RemovePodSandboxRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[18]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RemovePodSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemovePodSandboxRequest) ProtoMessage() {}
+
+func (x *RemovePodSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[18]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemovePodSandboxRequest.ProtoReflect.Descriptor instead.
+func (*RemovePodSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *RemovePodSandboxRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+type RemovePodSandboxResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RemovePodSandboxResponse) Reset() {
+	*x = RemovePodSandboxResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RemovePodSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemovePodSandboxResponse) ProtoMessage() {}
+
+func (x *RemovePodSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemovePodSandboxResponse.ProtoReflect.Descriptor instead.
+func (*RemovePodSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{19}
+}
+
+type PodSandboxStatusRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox for which to retrieve status.
+	PodSandboxId string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Verbose indicates whether to return extra information about the pod sandbox.
+	Verbose       bool `protobuf:"varint,2,opt,name=verbose,proto3" json:"verbose,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStatusRequest) Reset() {
+	*x = PodSandboxStatusRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[20]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStatusRequest) ProtoMessage() {}
+
+func (x *PodSandboxStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[20]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStatusRequest.ProtoReflect.Descriptor instead.
+func (*PodSandboxStatusRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *PodSandboxStatusRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *PodSandboxStatusRequest) GetVerbose() bool {
+	if x != nil {
+		return x.Verbose
+	}
+	return false
+}
+
+// PodIP represents an ip of a Pod
+type PodIP struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// an ip is a string representation of an IPv4 or an IPv6
+	Ip            string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodIP) Reset() {
+	*x = PodIP{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[21]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodIP) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodIP) ProtoMessage() {}
+
+func (x *PodIP) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[21]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodIP.ProtoReflect.Descriptor instead.
+func (*PodIP) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *PodIP) GetIp() string {
+	if x != nil {
+		return x.Ip
+	}
+	return ""
+}
+
+// PodSandboxNetworkStatus is the status of the network for a PodSandbox.
+// Currently ignored for pods sharing the host networking namespace.
+type PodSandboxNetworkStatus struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// IP address of the PodSandbox.
+	Ip string `protobuf:"bytes,1,opt,name=ip,proto3" json:"ip,omitempty"`
+	// list of additional ips (not inclusive of PodSandboxNetworkStatus.Ip) of the PodSandBoxNetworkStatus
+	AdditionalIps []*PodIP `protobuf:"bytes,2,rep,name=additional_ips,json=additionalIps,proto3" json:"additional_ips,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxNetworkStatus) Reset() {
+	*x = PodSandboxNetworkStatus{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[22]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxNetworkStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxNetworkStatus) ProtoMessage() {}
+
+func (x *PodSandboxNetworkStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[22]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxNetworkStatus.ProtoReflect.Descriptor instead.
+func (*PodSandboxNetworkStatus) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *PodSandboxNetworkStatus) GetIp() string {
+	if x != nil {
+		return x.Ip
+	}
+	return ""
+}
+
+func (x *PodSandboxNetworkStatus) GetAdditionalIps() []*PodIP {
+	if x != nil {
+		return x.AdditionalIps
+	}
+	return nil
+}
+
+// Namespace contains paths to the namespaces.
+type Namespace struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Namespace options for Linux namespaces.
+	Options       *NamespaceOption `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Namespace) Reset() {
+	*x = Namespace{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[23]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Namespace) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Namespace) ProtoMessage() {}
+
+func (x *Namespace) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[23]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Namespace.ProtoReflect.Descriptor instead.
+func (*Namespace) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{23}
+}
+
+func (x *Namespace) GetOptions() *NamespaceOption {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+// LinuxSandboxStatus contains status specific to Linux sandboxes.
+type LinuxPodSandboxStatus struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Paths to the sandbox's namespaces.
+	Namespaces    *Namespace `protobuf:"bytes,1,opt,name=namespaces,proto3" json:"namespaces,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LinuxPodSandboxStatus) Reset() {
+	*x = LinuxPodSandboxStatus{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[24]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxPodSandboxStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxPodSandboxStatus) ProtoMessage() {}
+
+func (x *LinuxPodSandboxStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[24]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxPodSandboxStatus.ProtoReflect.Descriptor instead.
+func (*LinuxPodSandboxStatus) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{24}
+}
+
+func (x *LinuxPodSandboxStatus) GetNamespaces() *Namespace {
+	if x != nil {
+		return x.Namespaces
+	}
+	return nil
+}
+
+// PodSandboxStatus contains the status of the PodSandbox.
+type PodSandboxStatus struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the sandbox.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Metadata of the sandbox.
+	Metadata *PodSandboxMetadata `protobuf:"bytes,2,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// State of the sandbox.
+	State PodSandboxState `protobuf:"varint,3,opt,name=state,proto3,enum=runtime.v1.PodSandboxState" json:"state,omitempty"`
+	// Creation timestamp of the sandbox in nanoseconds. Must be > 0.
+	CreatedAt int64 `protobuf:"varint,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Network contains network status if network is handled by the runtime.
+	Network *PodSandboxNetworkStatus `protobuf:"bytes,5,opt,name=network,proto3" json:"network,omitempty"`
+	// Linux-specific status to a pod sandbox.
+	Linux *LinuxPodSandboxStatus `protobuf:"bytes,6,opt,name=linux,proto3" json:"linux,omitempty"`
+	// Labels are key-value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,7,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// Annotations MUST NOT be altered by the runtime; the value of this field
+	// MUST be identical to that of the corresponding PodSandboxConfig used to
+	// instantiate the pod sandbox this status represents.
+	Annotations map[string]string `protobuf:"bytes,8,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// runtime configuration used for this PodSandbox.
+	RuntimeHandler string `protobuf:"bytes,9,opt,name=runtime_handler,json=runtimeHandler,proto3" json:"runtime_handler,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *PodSandboxStatus) Reset() {
+	*x = PodSandboxStatus{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[25]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStatus) ProtoMessage() {}
+
+func (x *PodSandboxStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[25]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStatus.ProtoReflect.Descriptor instead.
+func (*PodSandboxStatus) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{25}
+}
+
+func (x *PodSandboxStatus) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *PodSandboxStatus) GetMetadata() *PodSandboxMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *PodSandboxStatus) GetState() PodSandboxState {
+	if x != nil {
+		return x.State
+	}
+	return PodSandboxState_SANDBOX_READY
+}
+
+func (x *PodSandboxStatus) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *PodSandboxStatus) GetNetwork() *PodSandboxNetworkStatus {
+	if x != nil {
+		return x.Network
+	}
+	return nil
+}
+
+func (x *PodSandboxStatus) GetLinux() *LinuxPodSandboxStatus {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+func (x *PodSandboxStatus) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *PodSandboxStatus) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *PodSandboxStatus) GetRuntimeHandler() string {
+	if x != nil {
+		return x.RuntimeHandler
+	}
+	return ""
+}
+
+type PodSandboxStatusResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Status of the PodSandbox.
+	Status *PodSandboxStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	// Info is extra information of the PodSandbox. The key could be arbitrary string, and
+	// value should be in json format. The information could include anything useful for
+	// debug, e.g. network namespace for linux container based container runtime.
+	// It should only be returned non-empty when Verbose is true.
+	Info map[string]string `protobuf:"bytes,2,rep,name=info,proto3" json:"info,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Container statuses
+	ContainersStatuses []*ContainerStatus `protobuf:"bytes,3,rep,name=containers_statuses,json=containersStatuses,proto3" json:"containers_statuses,omitempty"`
+	// Timestamp in nanoseconds at which container and pod statuses were recorded
+	Timestamp     int64 `protobuf:"varint,4,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStatusResponse) Reset() {
+	*x = PodSandboxStatusResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[26]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStatusResponse) ProtoMessage() {}
+
+func (x *PodSandboxStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[26]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStatusResponse.ProtoReflect.Descriptor instead.
+func (*PodSandboxStatusResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{26}
+}
+
+func (x *PodSandboxStatusResponse) GetStatus() *PodSandboxStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+func (x *PodSandboxStatusResponse) GetInfo() map[string]string {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+func (x *PodSandboxStatusResponse) GetContainersStatuses() []*ContainerStatus {
+	if x != nil {
+		return x.ContainersStatuses
+	}
+	return nil
+}
+
+func (x *PodSandboxStatusResponse) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+// PodSandboxStateValue is the wrapper of PodSandboxState.
+type PodSandboxStateValue struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// State of the sandbox.
+	State         PodSandboxState `protobuf:"varint,1,opt,name=state,proto3,enum=runtime.v1.PodSandboxState" json:"state,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStateValue) Reset() {
+	*x = PodSandboxStateValue{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[27]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStateValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStateValue) ProtoMessage() {}
+
+func (x *PodSandboxStateValue) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[27]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStateValue.ProtoReflect.Descriptor instead.
+func (*PodSandboxStateValue) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{27}
+}
+
+func (x *PodSandboxStateValue) GetState() PodSandboxState {
+	if x != nil {
+		return x.State
+	}
+	return PodSandboxState_SANDBOX_READY
+}
+
+// PodSandboxFilter is used to filter a list of PodSandboxes.
+// All those fields are combined with 'AND'
+type PodSandboxFilter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the sandbox.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// State of the sandbox.
+	State *PodSandboxStateValue `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
+	// LabelSelector to select matches.
+	// Only api.MatchLabels is supported for now and the requirements
+	// are ANDed. MatchExpressions is not supported yet.
+	LabelSelector map[string]string `protobuf:"bytes,3,rep,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxFilter) Reset() {
+	*x = PodSandboxFilter{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[28]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxFilter) ProtoMessage() {}
+
+func (x *PodSandboxFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[28]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxFilter.ProtoReflect.Descriptor instead.
+func (*PodSandboxFilter) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{28}
+}
+
+func (x *PodSandboxFilter) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *PodSandboxFilter) GetState() *PodSandboxStateValue {
+	if x != nil {
+		return x.State
+	}
+	return nil
+}
+
+func (x *PodSandboxFilter) GetLabelSelector() map[string]string {
+	if x != nil {
+		return x.LabelSelector
+	}
+	return nil
+}
+
+type ListPodSandboxRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PodSandboxFilter to filter a list of PodSandboxes.
+	Filter        *PodSandboxFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPodSandboxRequest) Reset() {
+	*x = ListPodSandboxRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[29]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPodSandboxRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPodSandboxRequest) ProtoMessage() {}
+
+func (x *ListPodSandboxRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[29]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPodSandboxRequest.ProtoReflect.Descriptor instead.
+func (*ListPodSandboxRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{29}
+}
+
+func (x *ListPodSandboxRequest) GetFilter() *PodSandboxFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+// PodSandbox contains minimal information about a sandbox.
+type PodSandbox struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Metadata of the PodSandbox.
+	Metadata *PodSandboxMetadata `protobuf:"bytes,2,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// State of the PodSandbox.
+	State PodSandboxState `protobuf:"varint,3,opt,name=state,proto3,enum=runtime.v1.PodSandboxState" json:"state,omitempty"`
+	// Creation timestamps of the PodSandbox in nanoseconds. Must be > 0.
+	CreatedAt int64 `protobuf:"varint,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Labels of the PodSandbox.
+	Labels map[string]string `protobuf:"bytes,5,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// Annotations MUST NOT be altered by the runtime; the value of this field
+	// MUST be identical to that of the corresponding PodSandboxConfig used to
+	// instantiate this PodSandbox.
+	Annotations map[string]string `protobuf:"bytes,6,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// runtime configuration used for this PodSandbox.
+	RuntimeHandler string `protobuf:"bytes,7,opt,name=runtime_handler,json=runtimeHandler,proto3" json:"runtime_handler,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *PodSandbox) Reset() {
+	*x = PodSandbox{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[30]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandbox) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandbox) ProtoMessage() {}
+
+func (x *PodSandbox) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[30]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandbox.ProtoReflect.Descriptor instead.
+func (*PodSandbox) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{30}
+}
+
+func (x *PodSandbox) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *PodSandbox) GetMetadata() *PodSandboxMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *PodSandbox) GetState() PodSandboxState {
+	if x != nil {
+		return x.State
+	}
+	return PodSandboxState_SANDBOX_READY
+}
+
+func (x *PodSandbox) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *PodSandbox) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *PodSandbox) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *PodSandbox) GetRuntimeHandler() string {
+	if x != nil {
+		return x.RuntimeHandler
+	}
+	return ""
+}
+
+type ListPodSandboxResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of PodSandboxes.
+	Items         []*PodSandbox `protobuf:"bytes,1,rep,name=items,proto3" json:"items,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPodSandboxResponse) Reset() {
+	*x = ListPodSandboxResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[31]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPodSandboxResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPodSandboxResponse) ProtoMessage() {}
+
+func (x *ListPodSandboxResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[31]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPodSandboxResponse.ProtoReflect.Descriptor instead.
+func (*ListPodSandboxResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{31}
+}
+
+func (x *ListPodSandboxResponse) GetItems() []*PodSandbox {
+	if x != nil {
+		return x.Items
+	}
+	return nil
+}
+
+type StreamPodSandboxesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter for the list request.
+	Filter        *PodSandboxFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamPodSandboxesRequest) Reset() {
+	*x = StreamPodSandboxesRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[32]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamPodSandboxesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamPodSandboxesRequest) ProtoMessage() {}
+
+func (x *StreamPodSandboxesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[32]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamPodSandboxesRequest.ProtoReflect.Descriptor instead.
+func (*StreamPodSandboxesRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{32}
+}
+
+func (x *StreamPodSandboxesRequest) GetFilter() *PodSandboxFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+type StreamPodSandboxesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of PodSandboxes.
+	PodSandboxes  []*PodSandbox `protobuf:"bytes,1,rep,name=pod_sandboxes,json=podSandboxes,proto3" json:"pod_sandboxes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamPodSandboxesResponse) Reset() {
+	*x = StreamPodSandboxesResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[33]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamPodSandboxesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamPodSandboxesResponse) ProtoMessage() {}
+
+func (x *StreamPodSandboxesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[33]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamPodSandboxesResponse.ProtoReflect.Descriptor instead.
+func (*StreamPodSandboxesResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{33}
+}
+
+func (x *StreamPodSandboxesResponse) GetPodSandboxes() []*PodSandbox {
+	if x != nil {
+		return x.PodSandboxes
+	}
+	return nil
+}
+
+type PodSandboxStatsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the pod sandbox for which to retrieve stats.
+	PodSandboxId  string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStatsRequest) Reset() {
+	*x = PodSandboxStatsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[34]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStatsRequest) ProtoMessage() {}
+
+func (x *PodSandboxStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[34]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStatsRequest.ProtoReflect.Descriptor instead.
+func (*PodSandboxStatsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{34}
+}
+
+func (x *PodSandboxStatsRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+type PodSandboxStatsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Stats         *PodSandboxStats       `protobuf:"bytes,1,opt,name=stats,proto3" json:"stats,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStatsResponse) Reset() {
+	*x = PodSandboxStatsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[35]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStatsResponse) ProtoMessage() {}
+
+func (x *PodSandboxStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[35]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStatsResponse.ProtoReflect.Descriptor instead.
+func (*PodSandboxStatsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{35}
+}
+
+func (x *PodSandboxStatsResponse) GetStats() *PodSandboxStats {
+	if x != nil {
+		return x.Stats
+	}
+	return nil
+}
+
+// PodSandboxStatsFilter is used to filter the list of pod sandboxes to retrieve stats for.
+// All those fields are combined with 'AND'.
+type PodSandboxStatsFilter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the pod sandbox.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// LabelSelector to select matches.
+	// Only api.MatchLabels is supported for now and the requirements
+	// are ANDed. MatchExpressions is not supported yet.
+	LabelSelector map[string]string `protobuf:"bytes,2,rep,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStatsFilter) Reset() {
+	*x = PodSandboxStatsFilter{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[36]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStatsFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStatsFilter) ProtoMessage() {}
+
+func (x *PodSandboxStatsFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[36]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStatsFilter.ProtoReflect.Descriptor instead.
+func (*PodSandboxStatsFilter) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{36}
+}
+
+func (x *PodSandboxStatsFilter) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *PodSandboxStatsFilter) GetLabelSelector() map[string]string {
+	if x != nil {
+		return x.LabelSelector
+	}
+	return nil
+}
+
+type ListPodSandboxStatsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter for the list request.
+	Filter        *PodSandboxStatsFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPodSandboxStatsRequest) Reset() {
+	*x = ListPodSandboxStatsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[37]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPodSandboxStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPodSandboxStatsRequest) ProtoMessage() {}
+
+func (x *ListPodSandboxStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[37]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPodSandboxStatsRequest.ProtoReflect.Descriptor instead.
+func (*ListPodSandboxStatsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{37}
+}
+
+func (x *ListPodSandboxStatsRequest) GetFilter() *PodSandboxStatsFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+type ListPodSandboxStatsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Stats of the pod sandbox.
+	Stats         []*PodSandboxStats `protobuf:"bytes,1,rep,name=stats,proto3" json:"stats,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPodSandboxStatsResponse) Reset() {
+	*x = ListPodSandboxStatsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[38]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPodSandboxStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPodSandboxStatsResponse) ProtoMessage() {}
+
+func (x *ListPodSandboxStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[38]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPodSandboxStatsResponse.ProtoReflect.Descriptor instead.
+func (*ListPodSandboxStatsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{38}
+}
+
+func (x *ListPodSandboxStatsResponse) GetStats() []*PodSandboxStats {
+	if x != nil {
+		return x.Stats
+	}
+	return nil
+}
+
+type StreamPodSandboxStatsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter for the list request.
+	Filter        *PodSandboxStatsFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamPodSandboxStatsRequest) Reset() {
+	*x = StreamPodSandboxStatsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[39]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamPodSandboxStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamPodSandboxStatsRequest) ProtoMessage() {}
+
+func (x *StreamPodSandboxStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[39]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamPodSandboxStatsRequest.ProtoReflect.Descriptor instead.
+func (*StreamPodSandboxStatsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{39}
+}
+
+func (x *StreamPodSandboxStatsRequest) GetFilter() *PodSandboxStatsFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+type StreamPodSandboxStatsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of pod sandbox stats.
+	PodSandboxStats []*PodSandboxStats `protobuf:"bytes,1,rep,name=pod_sandbox_stats,json=podSandboxStats,proto3" json:"pod_sandbox_stats,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *StreamPodSandboxStatsResponse) Reset() {
+	*x = StreamPodSandboxStatsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[40]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamPodSandboxStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamPodSandboxStatsResponse) ProtoMessage() {}
+
+func (x *StreamPodSandboxStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[40]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamPodSandboxStatsResponse.ProtoReflect.Descriptor instead.
+func (*StreamPodSandboxStatsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{40}
+}
+
+func (x *StreamPodSandboxStatsResponse) GetPodSandboxStats() []*PodSandboxStats {
+	if x != nil {
+		return x.PodSandboxStats
+	}
+	return nil
+}
+
+// PodSandboxAttributes provides basic information of the pod sandbox.
+type PodSandboxAttributes struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the pod sandbox.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Metadata of the pod sandbox.
+	Metadata *PodSandboxMetadata `protobuf:"bytes,2,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Key-value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// Annotations MUST NOT be altered by the runtime; the value of this field
+	// MUST be identical to that of the corresponding PodSandboxStatus used to
+	// instantiate the PodSandbox this status represents.
+	Annotations   map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxAttributes) Reset() {
+	*x = PodSandboxAttributes{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[41]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxAttributes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxAttributes) ProtoMessage() {}
+
+func (x *PodSandboxAttributes) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[41]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxAttributes.ProtoReflect.Descriptor instead.
+func (*PodSandboxAttributes) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{41}
+}
+
+func (x *PodSandboxAttributes) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *PodSandboxAttributes) GetMetadata() *PodSandboxMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *PodSandboxAttributes) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *PodSandboxAttributes) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+// PodSandboxStats provides the resource usage statistics for a pod.
+// The linux or windows field will be populated depending on the platform.
+type PodSandboxStats struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Information of the pod.
+	Attributes *PodSandboxAttributes `protobuf:"bytes,1,opt,name=attributes,proto3" json:"attributes,omitempty"`
+	// Stats from linux.
+	Linux *LinuxPodSandboxStats `protobuf:"bytes,2,opt,name=linux,proto3" json:"linux,omitempty"`
+	// Stats from windows.
+	Windows       *WindowsPodSandboxStats `protobuf:"bytes,3,opt,name=windows,proto3" json:"windows,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PodSandboxStats) Reset() {
+	*x = PodSandboxStats{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[42]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxStats) ProtoMessage() {}
+
+func (x *PodSandboxStats) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[42]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxStats.ProtoReflect.Descriptor instead.
+func (*PodSandboxStats) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{42}
+}
+
+func (x *PodSandboxStats) GetAttributes() *PodSandboxAttributes {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *PodSandboxStats) GetLinux() *LinuxPodSandboxStats {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+func (x *PodSandboxStats) GetWindows() *WindowsPodSandboxStats {
+	if x != nil {
+		return x.Windows
+	}
+	return nil
+}
+
+// LinuxPodSandboxStats provides the resource usage statistics for a pod sandbox on linux.
+type LinuxPodSandboxStats struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// CPU usage gathered for the pod sandbox.
+	Cpu *CpuUsage `protobuf:"bytes,1,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	// Memory usage gathered for the pod sandbox.
+	Memory *MemoryUsage `protobuf:"bytes,2,opt,name=memory,proto3" json:"memory,omitempty"`
+	// Network usage gathered for the pod sandbox
+	Network *NetworkUsage `protobuf:"bytes,3,opt,name=network,proto3" json:"network,omitempty"`
+	// Stats pertaining to processes in the pod sandbox.
+	Process *ProcessUsage `protobuf:"bytes,4,opt,name=process,proto3" json:"process,omitempty"`
+	// Stats of containers in the measured pod sandbox.
+	Containers []*ContainerStats `protobuf:"bytes,5,rep,name=containers,proto3" json:"containers,omitempty"`
+	// IO usage gathered for the pod sandbox.
+	Io            *IoUsage `protobuf:"bytes,6,opt,name=io,proto3" json:"io,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LinuxPodSandboxStats) Reset() {
+	*x = LinuxPodSandboxStats{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[43]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxPodSandboxStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxPodSandboxStats) ProtoMessage() {}
+
+func (x *LinuxPodSandboxStats) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[43]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxPodSandboxStats.ProtoReflect.Descriptor instead.
+func (*LinuxPodSandboxStats) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{43}
+}
+
+func (x *LinuxPodSandboxStats) GetCpu() *CpuUsage {
+	if x != nil {
+		return x.Cpu
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxStats) GetMemory() *MemoryUsage {
+	if x != nil {
+		return x.Memory
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxStats) GetNetwork() *NetworkUsage {
+	if x != nil {
+		return x.Network
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxStats) GetProcess() *ProcessUsage {
+	if x != nil {
+		return x.Process
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxStats) GetContainers() []*ContainerStats {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+func (x *LinuxPodSandboxStats) GetIo() *IoUsage {
+	if x != nil {
+		return x.Io
+	}
+	return nil
+}
+
+// WindowsPodSandboxStats provides the resource usage statistics for a pod sandbox on windows
+type WindowsPodSandboxStats struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// CPU usage gathered for the pod sandbox.
+	Cpu *WindowsCpuUsage `protobuf:"bytes,1,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	// Memory usage gathered for the pod sandbox.
+	Memory *WindowsMemoryUsage `protobuf:"bytes,2,opt,name=memory,proto3" json:"memory,omitempty"`
+	// Network usage gathered for the pod sandbox
+	Network *WindowsNetworkUsage `protobuf:"bytes,3,opt,name=network,proto3" json:"network,omitempty"`
+	// Stats pertaining to processes in the pod sandbox.
+	Process *WindowsProcessUsage `protobuf:"bytes,4,opt,name=process,proto3" json:"process,omitempty"`
+	// Stats of containers in the measured pod sandbox.
+	Containers    []*WindowsContainerStats `protobuf:"bytes,5,rep,name=containers,proto3" json:"containers,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsPodSandboxStats) Reset() {
+	*x = WindowsPodSandboxStats{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[44]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsPodSandboxStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsPodSandboxStats) ProtoMessage() {}
+
+func (x *WindowsPodSandboxStats) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[44]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsPodSandboxStats.ProtoReflect.Descriptor instead.
+func (*WindowsPodSandboxStats) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{44}
+}
+
+func (x *WindowsPodSandboxStats) GetCpu() *WindowsCpuUsage {
+	if x != nil {
+		return x.Cpu
+	}
+	return nil
+}
+
+func (x *WindowsPodSandboxStats) GetMemory() *WindowsMemoryUsage {
+	if x != nil {
+		return x.Memory
+	}
+	return nil
+}
+
+func (x *WindowsPodSandboxStats) GetNetwork() *WindowsNetworkUsage {
+	if x != nil {
+		return x.Network
+	}
+	return nil
+}
+
+func (x *WindowsPodSandboxStats) GetProcess() *WindowsProcessUsage {
+	if x != nil {
+		return x.Process
+	}
+	return nil
+}
+
+func (x *WindowsPodSandboxStats) GetContainers() []*WindowsContainerStats {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+// NetworkUsage contains data about network resources.
+type NetworkUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Stats for the default network interface.
+	DefaultInterface *NetworkInterfaceUsage `protobuf:"bytes,2,opt,name=default_interface,json=defaultInterface,proto3" json:"default_interface,omitempty"`
+	// Stats for all found network interfaces, excluding the default.
+	Interfaces    []*NetworkInterfaceUsage `protobuf:"bytes,3,rep,name=interfaces,proto3" json:"interfaces,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NetworkUsage) Reset() {
+	*x = NetworkUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[45]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NetworkUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkUsage) ProtoMessage() {}
+
+func (x *NetworkUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[45]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkUsage.ProtoReflect.Descriptor instead.
+func (*NetworkUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{45}
+}
+
+func (x *NetworkUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *NetworkUsage) GetDefaultInterface() *NetworkInterfaceUsage {
+	if x != nil {
+		return x.DefaultInterface
+	}
+	return nil
+}
+
+func (x *NetworkUsage) GetInterfaces() []*NetworkInterfaceUsage {
+	if x != nil {
+		return x.Interfaces
+	}
+	return nil
+}
+
+// WindowsNetworkUsage contains data about network resources specific to Windows.
+type WindowsNetworkUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Stats for the default network interface.
+	DefaultInterface *WindowsNetworkInterfaceUsage `protobuf:"bytes,2,opt,name=default_interface,json=defaultInterface,proto3" json:"default_interface,omitempty"`
+	// Stats for all found network interfaces, excluding the default.
+	Interfaces    []*WindowsNetworkInterfaceUsage `protobuf:"bytes,3,rep,name=interfaces,proto3" json:"interfaces,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsNetworkUsage) Reset() {
+	*x = WindowsNetworkUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[46]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsNetworkUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsNetworkUsage) ProtoMessage() {}
+
+func (x *WindowsNetworkUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[46]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsNetworkUsage.ProtoReflect.Descriptor instead.
+func (*WindowsNetworkUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{46}
+}
+
+func (x *WindowsNetworkUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *WindowsNetworkUsage) GetDefaultInterface() *WindowsNetworkInterfaceUsage {
+	if x != nil {
+		return x.DefaultInterface
+	}
+	return nil
+}
+
+func (x *WindowsNetworkUsage) GetInterfaces() []*WindowsNetworkInterfaceUsage {
+	if x != nil {
+		return x.Interfaces
+	}
+	return nil
+}
+
+// NetworkInterfaceUsage contains resource value data about a network interface.
+type NetworkInterfaceUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The name of the network interface.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Cumulative count of bytes received.
+	RxBytes *UInt64Value `protobuf:"bytes,2,opt,name=rx_bytes,json=rxBytes,proto3" json:"rx_bytes,omitempty"`
+	// Cumulative count of receive errors encountered.
+	RxErrors *UInt64Value `protobuf:"bytes,3,opt,name=rx_errors,json=rxErrors,proto3" json:"rx_errors,omitempty"`
+	// Cumulative count of bytes transmitted.
+	TxBytes *UInt64Value `protobuf:"bytes,4,opt,name=tx_bytes,json=txBytes,proto3" json:"tx_bytes,omitempty"`
+	// Cumulative count of transmit errors encountered.
+	TxErrors      *UInt64Value `protobuf:"bytes,5,opt,name=tx_errors,json=txErrors,proto3" json:"tx_errors,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NetworkInterfaceUsage) Reset() {
+	*x = NetworkInterfaceUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[47]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NetworkInterfaceUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkInterfaceUsage) ProtoMessage() {}
+
+func (x *NetworkInterfaceUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[47]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkInterfaceUsage.ProtoReflect.Descriptor instead.
+func (*NetworkInterfaceUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{47}
+}
+
+func (x *NetworkInterfaceUsage) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *NetworkInterfaceUsage) GetRxBytes() *UInt64Value {
+	if x != nil {
+		return x.RxBytes
+	}
+	return nil
+}
+
+func (x *NetworkInterfaceUsage) GetRxErrors() *UInt64Value {
+	if x != nil {
+		return x.RxErrors
+	}
+	return nil
+}
+
+func (x *NetworkInterfaceUsage) GetTxBytes() *UInt64Value {
+	if x != nil {
+		return x.TxBytes
+	}
+	return nil
+}
+
+func (x *NetworkInterfaceUsage) GetTxErrors() *UInt64Value {
+	if x != nil {
+		return x.TxErrors
+	}
+	return nil
+}
+
+// WindowsNetworkInterfaceUsage contains resource value data about a network interface specific for Windows.
+type WindowsNetworkInterfaceUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The name of the network interface.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Cumulative count of bytes received.
+	RxBytes *UInt64Value `protobuf:"bytes,2,opt,name=rx_bytes,json=rxBytes,proto3" json:"rx_bytes,omitempty"`
+	// Cumulative count of receive errors encountered.
+	RxPacketsDropped *UInt64Value `protobuf:"bytes,3,opt,name=rx_packets_dropped,json=rxPacketsDropped,proto3" json:"rx_packets_dropped,omitempty"`
+	// Cumulative count of bytes transmitted.
+	TxBytes *UInt64Value `protobuf:"bytes,4,opt,name=tx_bytes,json=txBytes,proto3" json:"tx_bytes,omitempty"`
+	// Cumulative count of transmit errors encountered.
+	TxPacketsDropped *UInt64Value `protobuf:"bytes,5,opt,name=tx_packets_dropped,json=txPacketsDropped,proto3" json:"tx_packets_dropped,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *WindowsNetworkInterfaceUsage) Reset() {
+	*x = WindowsNetworkInterfaceUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[48]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsNetworkInterfaceUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsNetworkInterfaceUsage) ProtoMessage() {}
+
+func (x *WindowsNetworkInterfaceUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[48]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsNetworkInterfaceUsage.ProtoReflect.Descriptor instead.
+func (*WindowsNetworkInterfaceUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{48}
+}
+
+func (x *WindowsNetworkInterfaceUsage) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *WindowsNetworkInterfaceUsage) GetRxBytes() *UInt64Value {
+	if x != nil {
+		return x.RxBytes
+	}
+	return nil
+}
+
+func (x *WindowsNetworkInterfaceUsage) GetRxPacketsDropped() *UInt64Value {
+	if x != nil {
+		return x.RxPacketsDropped
+	}
+	return nil
+}
+
+func (x *WindowsNetworkInterfaceUsage) GetTxBytes() *UInt64Value {
+	if x != nil {
+		return x.TxBytes
+	}
+	return nil
+}
+
+func (x *WindowsNetworkInterfaceUsage) GetTxPacketsDropped() *UInt64Value {
+	if x != nil {
+		return x.TxPacketsDropped
+	}
+	return nil
+}
+
+// ProcessUsage are stats pertaining to processes.
+type ProcessUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Number of processes.
+	ProcessCount  *UInt64Value `protobuf:"bytes,2,opt,name=process_count,json=processCount,proto3" json:"process_count,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ProcessUsage) Reset() {
+	*x = ProcessUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[49]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ProcessUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ProcessUsage) ProtoMessage() {}
+
+func (x *ProcessUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[49]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ProcessUsage.ProtoReflect.Descriptor instead.
+func (*ProcessUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{49}
+}
+
+func (x *ProcessUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *ProcessUsage) GetProcessCount() *UInt64Value {
+	if x != nil {
+		return x.ProcessCount
+	}
+	return nil
+}
+
+// WindowsProcessUsage are stats pertaining to processes specific to Windows.
+type WindowsProcessUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Number of processes.
+	ProcessCount  *UInt64Value `protobuf:"bytes,2,opt,name=process_count,json=processCount,proto3" json:"process_count,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsProcessUsage) Reset() {
+	*x = WindowsProcessUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[50]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsProcessUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsProcessUsage) ProtoMessage() {}
+
+func (x *WindowsProcessUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[50]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsProcessUsage.ProtoReflect.Descriptor instead.
+func (*WindowsProcessUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{50}
+}
+
+func (x *WindowsProcessUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *WindowsProcessUsage) GetProcessCount() *UInt64Value {
+	if x != nil {
+		return x.ProcessCount
+	}
+	return nil
+}
+
+// ImageSpec is an internal representation of an image.
+type ImageSpec struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Container's Image field (e.g. imageID or imageDigest).
+	Image string `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// ImageSpec Annotations can be used to help the runtime target specific
+	// images in multi-arch images.
+	Annotations map[string]string `protobuf:"bytes,2,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// The container image reference specified by the user (e.g. image[:tag] or digest).
+	// Only set if available within the RPC context.
+	UserSpecifiedImage string `protobuf:"bytes,18,opt,name=user_specified_image,json=userSpecifiedImage,proto3" json:"user_specified_image,omitempty"`
+	// Runtime handler to use for pulling the image.
+	// If the runtime handler is unknown, the request should be rejected.
+	// An empty string would select the default runtime handler.
+	RuntimeHandler string `protobuf:"bytes,19,opt,name=runtime_handler,json=runtimeHandler,proto3" json:"runtime_handler,omitempty"`
+	// The digest of the image used for this volume.
+	// It should have a value that's similar to the pod's status.containerStatuses[i].imageID.
+	ImageRef      string `protobuf:"bytes,20,opt,name=image_ref,json=imageRef,proto3" json:"image_ref,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ImageSpec) Reset() {
+	*x = ImageSpec{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[51]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ImageSpec) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImageSpec) ProtoMessage() {}
+
+func (x *ImageSpec) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[51]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImageSpec.ProtoReflect.Descriptor instead.
+func (*ImageSpec) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{51}
+}
+
+func (x *ImageSpec) GetImage() string {
+	if x != nil {
+		return x.Image
+	}
+	return ""
+}
+
+func (x *ImageSpec) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *ImageSpec) GetUserSpecifiedImage() string {
+	if x != nil {
+		return x.UserSpecifiedImage
+	}
+	return ""
+}
+
+func (x *ImageSpec) GetRuntimeHandler() string {
+	if x != nil {
+		return x.RuntimeHandler
+	}
+	return ""
+}
+
+func (x *ImageSpec) GetImageRef() string {
+	if x != nil {
+		return x.ImageRef
+	}
+	return ""
+}
+
+type KeyValue struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Key           string                 `protobuf:"bytes,1,opt,name=key,proto3" json:"key,omitempty"`
+	Value         []byte                 `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *KeyValue) Reset() {
+	*x = KeyValue{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[52]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *KeyValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*KeyValue) ProtoMessage() {}
+
+func (x *KeyValue) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[52]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use KeyValue.ProtoReflect.Descriptor instead.
+func (*KeyValue) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{52}
+}
+
+func (x *KeyValue) GetKey() string {
+	if x != nil {
+		return x.Key
+	}
+	return ""
+}
+
+func (x *KeyValue) GetValue() []byte {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+// LinuxContainerResources specifies Linux specific configuration for
+// resources.
+type LinuxContainerResources struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// CPU CFS (Completely Fair Scheduler) period. Default: 0 (not specified).
+	CpuPeriod int64 `protobuf:"varint,1,opt,name=cpu_period,json=cpuPeriod,proto3" json:"cpu_period,omitempty"`
+	// CPU CFS (Completely Fair Scheduler) quota. Default: 0 (not specified).
+	CpuQuota int64 `protobuf:"varint,2,opt,name=cpu_quota,json=cpuQuota,proto3" json:"cpu_quota,omitempty"`
+	// CPU shares (relative weight vs. other containers). Default: 0 (not specified).
+	CpuShares int64 `protobuf:"varint,3,opt,name=cpu_shares,json=cpuShares,proto3" json:"cpu_shares,omitempty"`
+	// Memory limit in bytes. Default: 0 (not specified).
+	MemoryLimitInBytes int64 `protobuf:"varint,4,opt,name=memory_limit_in_bytes,json=memoryLimitInBytes,proto3" json:"memory_limit_in_bytes,omitempty"`
+	// OOMScoreAdj adjusts the oom-killer score. Default: 0 (not specified).
+	OomScoreAdj int64 `protobuf:"varint,5,opt,name=oom_score_adj,json=oomScoreAdj,proto3" json:"oom_score_adj,omitempty"`
+	// CpusetCpus constrains the allowed set of logical CPUs. Default: "" (not specified).
+	CpusetCpus string `protobuf:"bytes,6,opt,name=cpuset_cpus,json=cpusetCpus,proto3" json:"cpuset_cpus,omitempty"`
+	// CpusetMems constrains the allowed set of memory nodes. Default: "" (not specified).
+	CpusetMems string `protobuf:"bytes,7,opt,name=cpuset_mems,json=cpusetMems,proto3" json:"cpuset_mems,omitempty"`
+	// List of HugepageLimits to limit the HugeTLB usage of container per page size. Default: nil (not specified).
+	HugepageLimits []*HugepageLimit `protobuf:"bytes,8,rep,name=hugepage_limits,json=hugepageLimits,proto3" json:"hugepage_limits,omitempty"`
+	// Unified resources for cgroup v2. Default: nil (not specified).
+	// Each key/value in the map refers to the cgroup v2.
+	// e.g. "memory.max": "6937202688" or "io.weight": "default 100".
+	Unified map[string]string `protobuf:"bytes,9,rep,name=unified,proto3" json:"unified,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Memory swap limit in bytes. Default 0 (not specified).
+	MemorySwapLimitInBytes int64 `protobuf:"varint,10,opt,name=memory_swap_limit_in_bytes,json=memorySwapLimitInBytes,proto3" json:"memory_swap_limit_in_bytes,omitempty"`
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
+}
+
+func (x *LinuxContainerResources) Reset() {
+	*x = LinuxContainerResources{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[53]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxContainerResources) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxContainerResources) ProtoMessage() {}
+
+func (x *LinuxContainerResources) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[53]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxContainerResources.ProtoReflect.Descriptor instead.
+func (*LinuxContainerResources) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{53}
+}
+
+func (x *LinuxContainerResources) GetCpuPeriod() int64 {
+	if x != nil {
+		return x.CpuPeriod
+	}
+	return 0
+}
+
+func (x *LinuxContainerResources) GetCpuQuota() int64 {
+	if x != nil {
+		return x.CpuQuota
+	}
+	return 0
+}
+
+func (x *LinuxContainerResources) GetCpuShares() int64 {
+	if x != nil {
+		return x.CpuShares
+	}
+	return 0
+}
+
+func (x *LinuxContainerResources) GetMemoryLimitInBytes() int64 {
+	if x != nil {
+		return x.MemoryLimitInBytes
+	}
+	return 0
+}
+
+func (x *LinuxContainerResources) GetOomScoreAdj() int64 {
+	if x != nil {
+		return x.OomScoreAdj
+	}
+	return 0
+}
+
+func (x *LinuxContainerResources) GetCpusetCpus() string {
+	if x != nil {
+		return x.CpusetCpus
+	}
+	return ""
+}
+
+func (x *LinuxContainerResources) GetCpusetMems() string {
+	if x != nil {
+		return x.CpusetMems
+	}
+	return ""
+}
+
+func (x *LinuxContainerResources) GetHugepageLimits() []*HugepageLimit {
+	if x != nil {
+		return x.HugepageLimits
+	}
+	return nil
+}
+
+func (x *LinuxContainerResources) GetUnified() map[string]string {
+	if x != nil {
+		return x.Unified
+	}
+	return nil
+}
+
+func (x *LinuxContainerResources) GetMemorySwapLimitInBytes() int64 {
+	if x != nil {
+		return x.MemorySwapLimitInBytes
+	}
+	return 0
+}
+
+// HugepageLimit corresponds to the file`hugetlb.<hugepagesize>.limit_in_byte` in container level cgroup.
+// For example, `PageSize=1GB`, `Limit=1073741824` means setting `1073741824` bytes to hugetlb.1GB.limit_in_bytes.
+type HugepageLimit struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The value of PageSize has the format <size><unit-prefix>B (2MB, 1GB),
+	// and must match the <hugepagesize> of the corresponding control file found in `hugetlb.<hugepagesize>.limit_in_bytes`.
+	// The values of <unit-prefix> are intended to be parsed using base 1024("1KB" = 1024, "1MB" = 1048576, etc).
+	PageSize string `protobuf:"bytes,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
+	// limit in bytes of hugepagesize HugeTLB usage.
+	Limit         uint64 `protobuf:"varint,2,opt,name=limit,proto3" json:"limit,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *HugepageLimit) Reset() {
+	*x = HugepageLimit{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[54]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *HugepageLimit) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*HugepageLimit) ProtoMessage() {}
+
+func (x *HugepageLimit) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[54]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use HugepageLimit.ProtoReflect.Descriptor instead.
+func (*HugepageLimit) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{54}
+}
+
+func (x *HugepageLimit) GetPageSize() string {
+	if x != nil {
+		return x.PageSize
+	}
+	return ""
+}
+
+func (x *HugepageLimit) GetLimit() uint64 {
+	if x != nil {
+		return x.Limit
+	}
+	return 0
+}
+
+// SELinuxOption are the labels to be applied to the container.
+type SELinuxOption struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	User          string                 `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
+	Role          string                 `protobuf:"bytes,2,opt,name=role,proto3" json:"role,omitempty"`
+	Type          string                 `protobuf:"bytes,3,opt,name=type,proto3" json:"type,omitempty"`
+	Level         string                 `protobuf:"bytes,4,opt,name=level,proto3" json:"level,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *SELinuxOption) Reset() {
+	*x = SELinuxOption{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[55]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SELinuxOption) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SELinuxOption) ProtoMessage() {}
+
+func (x *SELinuxOption) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[55]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SELinuxOption.ProtoReflect.Descriptor instead.
+func (*SELinuxOption) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{55}
+}
+
+func (x *SELinuxOption) GetUser() string {
+	if x != nil {
+		return x.User
+	}
+	return ""
+}
+
+func (x *SELinuxOption) GetRole() string {
+	if x != nil {
+		return x.Role
+	}
+	return ""
+}
+
+func (x *SELinuxOption) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *SELinuxOption) GetLevel() string {
+	if x != nil {
+		return x.Level
+	}
+	return ""
+}
+
+// Capability contains the container capabilities to add or drop
+// Dropping a capability will drop it from all sets.
+// If a capability is added to only the add_capabilities list then it gets added to permitted,
+// inheritable, effective and bounding sets, i.e. all sets except the ambient set.
+// If a capability is added to only the add_ambient_capabilities list then it gets added to all sets, i.e permitted
+// inheritable, effective, bounding and ambient sets.
+// If a capability is added to add_capabilities and add_ambient_capabilities lists then it gets added to all sets, i.e.
+// permitted, inheritable, effective, bounding and ambient sets.
+type Capability struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of capabilities to add.
+	AddCapabilities []string `protobuf:"bytes,1,rep,name=add_capabilities,json=addCapabilities,proto3" json:"add_capabilities,omitempty"`
+	// List of capabilities to drop.
+	DropCapabilities []string `protobuf:"bytes,2,rep,name=drop_capabilities,json=dropCapabilities,proto3" json:"drop_capabilities,omitempty"`
+	// List of ambient capabilities to add.
+	AddAmbientCapabilities []string `protobuf:"bytes,3,rep,name=add_ambient_capabilities,json=addAmbientCapabilities,proto3" json:"add_ambient_capabilities,omitempty"`
+	unknownFields          protoimpl.UnknownFields
+	sizeCache              protoimpl.SizeCache
+}
+
+func (x *Capability) Reset() {
+	*x = Capability{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[56]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Capability) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Capability) ProtoMessage() {}
+
+func (x *Capability) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[56]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Capability.ProtoReflect.Descriptor instead.
+func (*Capability) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{56}
+}
+
+func (x *Capability) GetAddCapabilities() []string {
+	if x != nil {
+		return x.AddCapabilities
+	}
+	return nil
+}
+
+func (x *Capability) GetDropCapabilities() []string {
+	if x != nil {
+		return x.DropCapabilities
+	}
+	return nil
+}
+
+func (x *Capability) GetAddAmbientCapabilities() []string {
+	if x != nil {
+		return x.AddAmbientCapabilities
+	}
+	return nil
+}
+
+// LinuxContainerSecurityContext holds linux security configuration that will be applied to a container.
+type LinuxContainerSecurityContext struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Capabilities to add or drop.
+	Capabilities *Capability `protobuf:"bytes,1,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
+	// If set, run container in privileged mode.
+	// Privileged mode is incompatible with the following options. If
+	// privileged is set, the following features MAY have no effect:
+	// 1. capabilities
+	// 2. selinux_options
+	// 4. seccomp
+	// 5. apparmor
+	//
+	// Privileged mode implies the following specific options are applied:
+	// 1. All capabilities are added.
+	// 2. Sensitive paths, such as kernel module paths within sysfs, are not masked.
+	// 3. Any sysfs and procfs mounts are mounted RW.
+	// 4. AppArmor confinement is not applied.
+	// 5. Seccomp restrictions are not applied.
+	// 6. The device cgroup does not restrict access to any devices.
+	// 7. All devices from the host's /dev are available within the container.
+	// 8. SELinux restrictions are not applied (e.g. label=disabled).
+	Privileged bool `protobuf:"varint,2,opt,name=privileged,proto3" json:"privileged,omitempty"`
+	// Configurations for the container's namespaces.
+	// Only used if the container uses namespace for isolation.
+	NamespaceOptions *NamespaceOption `protobuf:"bytes,3,opt,name=namespace_options,json=namespaceOptions,proto3" json:"namespace_options,omitempty"`
+	// SELinux context to be optionally applied.
+	SelinuxOptions *SELinuxOption `protobuf:"bytes,4,opt,name=selinux_options,json=selinuxOptions,proto3" json:"selinux_options,omitempty"`
+	// UID to run the container process as. Only one of run_as_user and
+	// run_as_username can be specified at a time.
+	RunAsUser *Int64Value `protobuf:"bytes,5,opt,name=run_as_user,json=runAsUser,proto3" json:"run_as_user,omitempty"`
+	// GID to run the container process as. run_as_group should only be specified
+	// when run_as_user or run_as_username is specified; otherwise, the runtime
+	// MUST error.
+	RunAsGroup *Int64Value `protobuf:"bytes,12,opt,name=run_as_group,json=runAsGroup,proto3" json:"run_as_group,omitempty"`
+	// User name to run the container process as. If specified, the user MUST
+	// exist in the container image (i.e. in the /etc/passwd inside the image),
+	// and be resolved there by the runtime; otherwise, the runtime MUST error.
+	RunAsUsername string `protobuf:"bytes,6,opt,name=run_as_username,json=runAsUsername,proto3" json:"run_as_username,omitempty"`
+	// If set, the root filesystem of the container is read-only.
+	ReadonlyRootfs bool `protobuf:"varint,7,opt,name=readonly_rootfs,json=readonlyRootfs,proto3" json:"readonly_rootfs,omitempty"`
+	// List of groups applied to the first process run in each container.
+	// supplemental_groups_policy can control how groups will be calculated.
+	SupplementalGroups []int64 `protobuf:"varint,8,rep,packed,name=supplemental_groups,json=supplementalGroups,proto3" json:"supplemental_groups,omitempty"`
+	// supplemental_groups_policy defines how supplemental groups of the first
+	// container processes are calculated.
+	// Valid values are "Merge" and "Strict".
+	// If not specified, "Merge" is used.
+	SupplementalGroupsPolicy SupplementalGroupsPolicy `protobuf:"varint,17,opt,name=supplemental_groups_policy,json=supplementalGroupsPolicy,proto3,enum=runtime.v1.SupplementalGroupsPolicy" json:"supplemental_groups_policy,omitempty"`
+	// no_new_privs defines if the flag for no_new_privs should be set on the
+	// container.
+	NoNewPrivs bool `protobuf:"varint,11,opt,name=no_new_privs,json=noNewPrivs,proto3" json:"no_new_privs,omitempty"`
+	// masked_paths is a slice of paths that should be masked by the container
+	// runtime, this can be passed directly to the OCI spec.
+	MaskedPaths []string `protobuf:"bytes,13,rep,name=masked_paths,json=maskedPaths,proto3" json:"masked_paths,omitempty"`
+	// readonly_paths is a slice of paths that should be set as readonly by the
+	// container runtime, this can be passed directly to the OCI spec.
+	ReadonlyPaths []string `protobuf:"bytes,14,rep,name=readonly_paths,json=readonlyPaths,proto3" json:"readonly_paths,omitempty"`
+	// Seccomp profile for the container.
+	Seccomp *SecurityProfile `protobuf:"bytes,15,opt,name=seccomp,proto3" json:"seccomp,omitempty"`
+	// AppArmor profile for the container.
+	Apparmor *SecurityProfile `protobuf:"bytes,16,opt,name=apparmor,proto3" json:"apparmor,omitempty"`
+	// AppArmor profile for the container, candidate values are:
+	//   - runtime/default: equivalent to not specifying a profile.
+	//   - unconfined: no profiles are loaded
+	//   - localhost/<profile_name>: profile loaded on the node
+	//     (localhost) by name. The possible profile names are detailed at
+	//     https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference
+	//
+	// Deprecated: Marked as deprecated in staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto.
+	ApparmorProfile string `protobuf:"bytes,9,opt,name=apparmor_profile,json=apparmorProfile,proto3" json:"apparmor_profile,omitempty"`
+	// Seccomp profile for the container, candidate values are:
+	//   - runtime/default: the default profile for the container runtime
+	//   - unconfined: unconfined profile, ie, no seccomp sandboxing
+	//   - localhost/<full-path-to-profile>: the profile installed on the node.
+	//     <full-path-to-profile> is the full path of the profile.
+	//
+	// Default: "", which is identical with unconfined.
+	//
+	// Deprecated: Marked as deprecated in staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto.
+	SeccompProfilePath string `protobuf:"bytes,10,opt,name=seccomp_profile_path,json=seccompProfilePath,proto3" json:"seccomp_profile_path,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *LinuxContainerSecurityContext) Reset() {
+	*x = LinuxContainerSecurityContext{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[57]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxContainerSecurityContext) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxContainerSecurityContext) ProtoMessage() {}
+
+func (x *LinuxContainerSecurityContext) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[57]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxContainerSecurityContext.ProtoReflect.Descriptor instead.
+func (*LinuxContainerSecurityContext) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{57}
+}
+
+func (x *LinuxContainerSecurityContext) GetCapabilities() *Capability {
+	if x != nil {
+		return x.Capabilities
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetPrivileged() bool {
+	if x != nil {
+		return x.Privileged
+	}
+	return false
+}
+
+func (x *LinuxContainerSecurityContext) GetNamespaceOptions() *NamespaceOption {
+	if x != nil {
+		return x.NamespaceOptions
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetSelinuxOptions() *SELinuxOption {
+	if x != nil {
+		return x.SelinuxOptions
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetRunAsUser() *Int64Value {
+	if x != nil {
+		return x.RunAsUser
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetRunAsGroup() *Int64Value {
+	if x != nil {
+		return x.RunAsGroup
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetRunAsUsername() string {
+	if x != nil {
+		return x.RunAsUsername
+	}
+	return ""
+}
+
+func (x *LinuxContainerSecurityContext) GetReadonlyRootfs() bool {
+	if x != nil {
+		return x.ReadonlyRootfs
+	}
+	return false
+}
+
+func (x *LinuxContainerSecurityContext) GetSupplementalGroups() []int64 {
+	if x != nil {
+		return x.SupplementalGroups
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetSupplementalGroupsPolicy() SupplementalGroupsPolicy {
+	if x != nil {
+		return x.SupplementalGroupsPolicy
+	}
+	return SupplementalGroupsPolicy_Merge
+}
+
+func (x *LinuxContainerSecurityContext) GetNoNewPrivs() bool {
+	if x != nil {
+		return x.NoNewPrivs
+	}
+	return false
+}
+
+func (x *LinuxContainerSecurityContext) GetMaskedPaths() []string {
+	if x != nil {
+		return x.MaskedPaths
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetReadonlyPaths() []string {
+	if x != nil {
+		return x.ReadonlyPaths
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetSeccomp() *SecurityProfile {
+	if x != nil {
+		return x.Seccomp
+	}
+	return nil
+}
+
+func (x *LinuxContainerSecurityContext) GetApparmor() *SecurityProfile {
+	if x != nil {
+		return x.Apparmor
+	}
+	return nil
+}
+
+// Deprecated: Marked as deprecated in staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto.
+func (x *LinuxContainerSecurityContext) GetApparmorProfile() string {
+	if x != nil {
+		return x.ApparmorProfile
+	}
+	return ""
+}
+
+// Deprecated: Marked as deprecated in staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto.
+func (x *LinuxContainerSecurityContext) GetSeccompProfilePath() string {
+	if x != nil {
+		return x.SeccompProfilePath
+	}
+	return ""
+}
+
+// LinuxContainerConfig contains platform-specific configuration for
+// Linux-based containers.
+type LinuxContainerConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Resources specification for the container.
+	Resources *LinuxContainerResources `protobuf:"bytes,1,opt,name=resources,proto3" json:"resources,omitempty"`
+	// LinuxContainerSecurityContext configuration for the container.
+	SecurityContext *LinuxContainerSecurityContext `protobuf:"bytes,2,opt,name=security_context,json=securityContext,proto3" json:"security_context,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *LinuxContainerConfig) Reset() {
+	*x = LinuxContainerConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[58]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxContainerConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxContainerConfig) ProtoMessage() {}
+
+func (x *LinuxContainerConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[58]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxContainerConfig.ProtoReflect.Descriptor instead.
+func (*LinuxContainerConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{58}
+}
+
+func (x *LinuxContainerConfig) GetResources() *LinuxContainerResources {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *LinuxContainerConfig) GetSecurityContext() *LinuxContainerSecurityContext {
+	if x != nil {
+		return x.SecurityContext
+	}
+	return nil
+}
+
+type LinuxContainerUser struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// uid is the primary uid initially attached to the first process in the container
+	Uid int64 `protobuf:"varint,1,opt,name=uid,proto3" json:"uid,omitempty"`
+	// gid is the primary gid initially attached to the first process in the container
+	Gid int64 `protobuf:"varint,2,opt,name=gid,proto3" json:"gid,omitempty"`
+	// supplemental_groups are the supplemental groups initially attached to the first process in the container
+	SupplementalGroups []int64 `protobuf:"varint,3,rep,packed,name=supplemental_groups,json=supplementalGroups,proto3" json:"supplemental_groups,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *LinuxContainerUser) Reset() {
+	*x = LinuxContainerUser{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[59]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxContainerUser) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxContainerUser) ProtoMessage() {}
+
+func (x *LinuxContainerUser) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[59]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxContainerUser.ProtoReflect.Descriptor instead.
+func (*LinuxContainerUser) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{59}
+}
+
+func (x *LinuxContainerUser) GetUid() int64 {
+	if x != nil {
+		return x.Uid
+	}
+	return 0
+}
+
+func (x *LinuxContainerUser) GetGid() int64 {
+	if x != nil {
+		return x.Gid
+	}
+	return 0
+}
+
+func (x *LinuxContainerUser) GetSupplementalGroups() []int64 {
+	if x != nil {
+		return x.SupplementalGroups
+	}
+	return nil
+}
+
+// WindowsNamespaceOption provides options for Windows namespaces.
+type WindowsNamespaceOption struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Network namespace for this container/sandbox.
+	// This is currently never set by the kubelet
+	Network       NamespaceMode `protobuf:"varint,1,opt,name=network,proto3,enum=runtime.v1.NamespaceMode" json:"network,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsNamespaceOption) Reset() {
+	*x = WindowsNamespaceOption{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[60]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsNamespaceOption) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsNamespaceOption) ProtoMessage() {}
+
+func (x *WindowsNamespaceOption) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[60]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsNamespaceOption.ProtoReflect.Descriptor instead.
+func (*WindowsNamespaceOption) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{60}
+}
+
+func (x *WindowsNamespaceOption) GetNetwork() NamespaceMode {
+	if x != nil {
+		return x.Network
+	}
+	return NamespaceMode_POD
+}
+
+// WindowsSandboxSecurityContext holds platform-specific configurations that will be
+// applied to a sandbox.
+// These settings will only apply to the sandbox container.
+type WindowsSandboxSecurityContext struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// User name to run the container process as. If specified, the user MUST
+	// exist in the container image and be resolved there by the runtime;
+	// otherwise, the runtime MUST return error.
+	RunAsUsername string `protobuf:"bytes,1,opt,name=run_as_username,json=runAsUsername,proto3" json:"run_as_username,omitempty"`
+	// The contents of the GMSA credential spec to use to run this container.
+	CredentialSpec string `protobuf:"bytes,2,opt,name=credential_spec,json=credentialSpec,proto3" json:"credential_spec,omitempty"`
+	// Indicates whether the container requested to run as a HostProcess container.
+	HostProcess bool `protobuf:"varint,3,opt,name=host_process,json=hostProcess,proto3" json:"host_process,omitempty"`
+	// Configuration for the sandbox's namespaces
+	NamespaceOptions *WindowsNamespaceOption `protobuf:"bytes,4,opt,name=namespace_options,json=namespaceOptions,proto3" json:"namespace_options,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *WindowsSandboxSecurityContext) Reset() {
+	*x = WindowsSandboxSecurityContext{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[61]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsSandboxSecurityContext) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsSandboxSecurityContext) ProtoMessage() {}
+
+func (x *WindowsSandboxSecurityContext) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[61]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsSandboxSecurityContext.ProtoReflect.Descriptor instead.
+func (*WindowsSandboxSecurityContext) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{61}
+}
+
+func (x *WindowsSandboxSecurityContext) GetRunAsUsername() string {
+	if x != nil {
+		return x.RunAsUsername
+	}
+	return ""
+}
+
+func (x *WindowsSandboxSecurityContext) GetCredentialSpec() string {
+	if x != nil {
+		return x.CredentialSpec
+	}
+	return ""
+}
+
+func (x *WindowsSandboxSecurityContext) GetHostProcess() bool {
+	if x != nil {
+		return x.HostProcess
+	}
+	return false
+}
+
+func (x *WindowsSandboxSecurityContext) GetNamespaceOptions() *WindowsNamespaceOption {
+	if x != nil {
+		return x.NamespaceOptions
+	}
+	return nil
+}
+
+// WindowsPodSandboxConfig holds platform-specific configurations for Windows
+// host platforms and Windows-based containers.
+type WindowsPodSandboxConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// WindowsSandboxSecurityContext holds sandbox security attributes.
+	SecurityContext *WindowsSandboxSecurityContext `protobuf:"bytes,1,opt,name=security_context,json=securityContext,proto3" json:"security_context,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *WindowsPodSandboxConfig) Reset() {
+	*x = WindowsPodSandboxConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[62]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsPodSandboxConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsPodSandboxConfig) ProtoMessage() {}
+
+func (x *WindowsPodSandboxConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[62]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsPodSandboxConfig.ProtoReflect.Descriptor instead.
+func (*WindowsPodSandboxConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{62}
+}
+
+func (x *WindowsPodSandboxConfig) GetSecurityContext() *WindowsSandboxSecurityContext {
+	if x != nil {
+		return x.SecurityContext
+	}
+	return nil
+}
+
+// WindowsContainerSecurityContext holds windows security configuration that will be applied to a container.
+type WindowsContainerSecurityContext struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// User name to run the container process as. If specified, the user MUST
+	// exist in the container image and be resolved there by the runtime;
+	// otherwise, the runtime MUST return error.
+	RunAsUsername string `protobuf:"bytes,1,opt,name=run_as_username,json=runAsUsername,proto3" json:"run_as_username,omitempty"`
+	// The contents of the GMSA credential spec to use to run this container.
+	CredentialSpec string `protobuf:"bytes,2,opt,name=credential_spec,json=credentialSpec,proto3" json:"credential_spec,omitempty"`
+	// Indicates whether a container is to be run as a HostProcess container.
+	HostProcess   bool `protobuf:"varint,3,opt,name=host_process,json=hostProcess,proto3" json:"host_process,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsContainerSecurityContext) Reset() {
+	*x = WindowsContainerSecurityContext{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[63]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsContainerSecurityContext) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsContainerSecurityContext) ProtoMessage() {}
+
+func (x *WindowsContainerSecurityContext) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[63]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsContainerSecurityContext.ProtoReflect.Descriptor instead.
+func (*WindowsContainerSecurityContext) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{63}
+}
+
+func (x *WindowsContainerSecurityContext) GetRunAsUsername() string {
+	if x != nil {
+		return x.RunAsUsername
+	}
+	return ""
+}
+
+func (x *WindowsContainerSecurityContext) GetCredentialSpec() string {
+	if x != nil {
+		return x.CredentialSpec
+	}
+	return ""
+}
+
+func (x *WindowsContainerSecurityContext) GetHostProcess() bool {
+	if x != nil {
+		return x.HostProcess
+	}
+	return false
+}
+
+// WindowsContainerConfig contains platform-specific configuration for
+// Windows-based containers.
+type WindowsContainerConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Resources specification for the container.
+	Resources *WindowsContainerResources `protobuf:"bytes,1,opt,name=resources,proto3" json:"resources,omitempty"`
+	// WindowsContainerSecurityContext configuration for the container.
+	SecurityContext *WindowsContainerSecurityContext `protobuf:"bytes,2,opt,name=security_context,json=securityContext,proto3" json:"security_context,omitempty"`
+	unknownFields   protoimpl.UnknownFields
+	sizeCache       protoimpl.SizeCache
+}
+
+func (x *WindowsContainerConfig) Reset() {
+	*x = WindowsContainerConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[64]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsContainerConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsContainerConfig) ProtoMessage() {}
+
+func (x *WindowsContainerConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[64]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsContainerConfig.ProtoReflect.Descriptor instead.
+func (*WindowsContainerConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{64}
+}
+
+func (x *WindowsContainerConfig) GetResources() *WindowsContainerResources {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *WindowsContainerConfig) GetSecurityContext() *WindowsContainerSecurityContext {
+	if x != nil {
+		return x.SecurityContext
+	}
+	return nil
+}
+
+// WindowsContainerResources specifies Windows specific configuration for
+// resources.
+type WindowsContainerResources struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// CPU shares (relative weight vs. other containers). Default: 0 (not specified).
+	CpuShares int64 `protobuf:"varint,1,opt,name=cpu_shares,json=cpuShares,proto3" json:"cpu_shares,omitempty"`
+	// Number of CPUs available to the container. Default: 0 (not specified).
+	CpuCount int64 `protobuf:"varint,2,opt,name=cpu_count,json=cpuCount,proto3" json:"cpu_count,omitempty"`
+	// Specifies the portion of processor cycles that this container can use as a percentage times 100.
+	CpuMaximum int64 `protobuf:"varint,3,opt,name=cpu_maximum,json=cpuMaximum,proto3" json:"cpu_maximum,omitempty"`
+	// Memory limit in bytes. Default: 0 (not specified).
+	MemoryLimitInBytes int64 `protobuf:"varint,4,opt,name=memory_limit_in_bytes,json=memoryLimitInBytes,proto3" json:"memory_limit_in_bytes,omitempty"`
+	// Specifies the size of the rootfs / scratch space in bytes to be configured for this container. Default: 0 (not specified).
+	RootfsSizeInBytes int64 `protobuf:"varint,5,opt,name=rootfs_size_in_bytes,json=rootfsSizeInBytes,proto3" json:"rootfs_size_in_bytes,omitempty"`
+	// Optionally specifies the set of CPUs to affinitize for this container.
+	AffinityCpus  []*WindowsCpuGroupAffinity `protobuf:"bytes,6,rep,name=affinity_cpus,json=affinityCpus,proto3" json:"affinity_cpus,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsContainerResources) Reset() {
+	*x = WindowsContainerResources{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[65]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsContainerResources) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsContainerResources) ProtoMessage() {}
+
+func (x *WindowsContainerResources) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[65]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsContainerResources.ProtoReflect.Descriptor instead.
+func (*WindowsContainerResources) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{65}
+}
+
+func (x *WindowsContainerResources) GetCpuShares() int64 {
+	if x != nil {
+		return x.CpuShares
+	}
+	return 0
+}
+
+func (x *WindowsContainerResources) GetCpuCount() int64 {
+	if x != nil {
+		return x.CpuCount
+	}
+	return 0
+}
+
+func (x *WindowsContainerResources) GetCpuMaximum() int64 {
+	if x != nil {
+		return x.CpuMaximum
+	}
+	return 0
+}
+
+func (x *WindowsContainerResources) GetMemoryLimitInBytes() int64 {
+	if x != nil {
+		return x.MemoryLimitInBytes
+	}
+	return 0
+}
+
+func (x *WindowsContainerResources) GetRootfsSizeInBytes() int64 {
+	if x != nil {
+		return x.RootfsSizeInBytes
+	}
+	return 0
+}
+
+func (x *WindowsContainerResources) GetAffinityCpus() []*WindowsCpuGroupAffinity {
+	if x != nil {
+		return x.AffinityCpus
+	}
+	return nil
+}
+
+// WindowsCpuGroupAffinity specifies the CPU mask and group to affinitize.
+// This is similar to the following _GROUP_AFFINITY structure:
+// https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/miniport/ns-miniport-_group_affinity
+type WindowsCpuGroupAffinity struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// CPU mask relative to this CPU group.
+	CpuMask uint64 `protobuf:"varint,1,opt,name=cpu_mask,json=cpuMask,proto3" json:"cpu_mask,omitempty"`
+	// Processor group the mask refers to, as returned by
+	// GetLogicalProcessorInformationEx.
+	CpuGroup      uint32 `protobuf:"varint,2,opt,name=cpu_group,json=cpuGroup,proto3" json:"cpu_group,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsCpuGroupAffinity) Reset() {
+	*x = WindowsCpuGroupAffinity{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[66]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsCpuGroupAffinity) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsCpuGroupAffinity) ProtoMessage() {}
+
+func (x *WindowsCpuGroupAffinity) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[66]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsCpuGroupAffinity.ProtoReflect.Descriptor instead.
+func (*WindowsCpuGroupAffinity) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{66}
+}
+
+func (x *WindowsCpuGroupAffinity) GetCpuMask() uint64 {
+	if x != nil {
+		return x.CpuMask
+	}
+	return 0
+}
+
+func (x *WindowsCpuGroupAffinity) GetCpuGroup() uint32 {
+	if x != nil {
+		return x.CpuGroup
+	}
+	return 0
+}
+
+// ContainerMetadata holds all necessary information for building the container
+// name. The container runtime is encouraged to expose the metadata in its user
+// interface for better user experience. E.g., runtime can construct a unique
+// container name based on the metadata. Note that (name, attempt) is unique
+// within a sandbox for the entire lifetime of the sandbox.
+type ContainerMetadata struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name of the container. Same as the container name in the PodSpec.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Attempt number of creating the container. Default: 0.
+	Attempt       uint32 `protobuf:"varint,2,opt,name=attempt,proto3" json:"attempt,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerMetadata) Reset() {
+	*x = ContainerMetadata{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[67]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerMetadata) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerMetadata) ProtoMessage() {}
+
+func (x *ContainerMetadata) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[67]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerMetadata.ProtoReflect.Descriptor instead.
+func (*ContainerMetadata) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{67}
+}
+
+func (x *ContainerMetadata) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *ContainerMetadata) GetAttempt() uint32 {
+	if x != nil {
+		return x.Attempt
+	}
+	return 0
+}
+
+// Device specifies a host device to mount into a container.
+type Device struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Path of the device within the container.
+	ContainerPath string `protobuf:"bytes,1,opt,name=container_path,json=containerPath,proto3" json:"container_path,omitempty"`
+	// Path of the device on the host.
+	HostPath string `protobuf:"bytes,2,opt,name=host_path,json=hostPath,proto3" json:"host_path,omitempty"`
+	// Cgroups permissions of the device, candidates are one or more of
+	// * r - allows container to read from the specified device.
+	// * w - allows container to write to the specified device.
+	// * m - allows container to create device files that do not yet exist.
+	Permissions   string `protobuf:"bytes,3,opt,name=permissions,proto3" json:"permissions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Device) Reset() {
+	*x = Device{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[68]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Device) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Device) ProtoMessage() {}
+
+func (x *Device) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[68]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Device.ProtoReflect.Descriptor instead.
+func (*Device) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{68}
+}
+
+func (x *Device) GetContainerPath() string {
+	if x != nil {
+		return x.ContainerPath
+	}
+	return ""
+}
+
+func (x *Device) GetHostPath() string {
+	if x != nil {
+		return x.HostPath
+	}
+	return ""
+}
+
+func (x *Device) GetPermissions() string {
+	if x != nil {
+		return x.Permissions
+	}
+	return ""
+}
+
+// CDIDevice specifies a CDI device information.
+type CDIDevice struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Fully qualified CDI device name
+	// for example: vendor.com/gpu=gpudevice1
+	// see more details in the CDI specification:
+	// https://github.com/container-orchestrated-devices/container-device-interface/blob/main/SPEC.md
+	Name          string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CDIDevice) Reset() {
+	*x = CDIDevice{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[69]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CDIDevice) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CDIDevice) ProtoMessage() {}
+
+func (x *CDIDevice) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[69]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CDIDevice.ProtoReflect.Descriptor instead.
+func (*CDIDevice) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{69}
+}
+
+func (x *CDIDevice) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+// ContainerConfig holds all the required and optional fields for creating a
+// container.
+type ContainerConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Metadata of the container. This information will uniquely identify the
+	// container, and the runtime should leverage this to ensure correct
+	// operation. The runtime may also use this information to improve UX, such
+	// as by constructing a readable name.
+	Metadata *ContainerMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Image to use.
+	Image *ImageSpec `protobuf:"bytes,2,opt,name=image,proto3" json:"image,omitempty"`
+	// Command to execute (i.e., entrypoint for docker)
+	Command []string `protobuf:"bytes,3,rep,name=command,proto3" json:"command,omitempty"`
+	// Args for the Command (i.e., command for docker)
+	Args []string `protobuf:"bytes,4,rep,name=args,proto3" json:"args,omitempty"`
+	// Current working directory of the command.
+	WorkingDir string `protobuf:"bytes,5,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
+	// List of environment variable to set in the container.
+	Envs []*KeyValue `protobuf:"bytes,6,rep,name=envs,proto3" json:"envs,omitempty"`
+	// Mounts for the container.
+	Mounts []*Mount `protobuf:"bytes,7,rep,name=mounts,proto3" json:"mounts,omitempty"`
+	// Devices for the container.
+	Devices []*Device `protobuf:"bytes,8,rep,name=devices,proto3" json:"devices,omitempty"`
+	// Key-value pairs that may be used to scope and select individual resources.
+	// Label keys are of the form:
+	//
+	//	label-key ::= prefixed-name | name
+	//	prefixed-name ::= prefix '/' name
+	//	prefix ::= DNS_SUBDOMAIN
+	//	name ::= DNS_LABEL
+	Labels map[string]string `protobuf:"bytes,9,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map that may be used by the kubelet to store and
+	// retrieve arbitrary metadata.
+	//
+	// Annotations MUST NOT be altered by the runtime; the annotations stored
+	// here MUST be returned in the ContainerStatus associated with the container
+	// this ContainerConfig creates.
+	//
+	// In general, in order to preserve a well-defined interface between the
+	// kubelet and the container runtime, annotations SHOULD NOT influence
+	// runtime behaviour.
+	Annotations map[string]string `protobuf:"bytes,10,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Path relative to PodSandboxConfig.LogDirectory for container to store
+	// the log (STDOUT and STDERR) on the host.
+	// E.g.,
+	//
+	//	PodSandboxConfig.LogDirectory = `/var/log/pods/<NAMESPACE>_<NAME>_<UID>/`
+	//	ContainerConfig.LogPath = `containerName/Instance#.log`
+	LogPath string `protobuf:"bytes,11,opt,name=log_path,json=logPath,proto3" json:"log_path,omitempty"`
+	// Variables for interactive containers, these have very specialized
+	// use-cases (e.g. debugging).
+	Stdin     bool `protobuf:"varint,12,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	StdinOnce bool `protobuf:"varint,13,opt,name=stdin_once,json=stdinOnce,proto3" json:"stdin_once,omitempty"`
+	Tty       bool `protobuf:"varint,14,opt,name=tty,proto3" json:"tty,omitempty"`
+	// Configuration specific to Linux containers.
+	Linux *LinuxContainerConfig `protobuf:"bytes,15,opt,name=linux,proto3" json:"linux,omitempty"`
+	// Configuration specific to Windows containers.
+	Windows *WindowsContainerConfig `protobuf:"bytes,16,opt,name=windows,proto3" json:"windows,omitempty"`
+	// CDI devices for the container.
+	CDIDevices []*CDIDevice `protobuf:"bytes,17,rep,name=CDI_devices,json=CDIDevices,proto3" json:"CDI_devices,omitempty"`
+	// The custom stop signal for the container
+	StopSignal    Signal `protobuf:"varint,18,opt,name=stop_signal,json=stopSignal,proto3,enum=runtime.v1.Signal" json:"stop_signal,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerConfig) Reset() {
+	*x = ContainerConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[70]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerConfig) ProtoMessage() {}
+
+func (x *ContainerConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[70]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerConfig.ProtoReflect.Descriptor instead.
+func (*ContainerConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{70}
+}
+
+func (x *ContainerConfig) GetMetadata() *ContainerMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetCommand() []string {
+	if x != nil {
+		return x.Command
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetArgs() []string {
+	if x != nil {
+		return x.Args
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetWorkingDir() string {
+	if x != nil {
+		return x.WorkingDir
+	}
+	return ""
+}
+
+func (x *ContainerConfig) GetEnvs() []*KeyValue {
+	if x != nil {
+		return x.Envs
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetMounts() []*Mount {
+	if x != nil {
+		return x.Mounts
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetDevices() []*Device {
+	if x != nil {
+		return x.Devices
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetLogPath() string {
+	if x != nil {
+		return x.LogPath
+	}
+	return ""
+}
+
+func (x *ContainerConfig) GetStdin() bool {
+	if x != nil {
+		return x.Stdin
+	}
+	return false
+}
+
+func (x *ContainerConfig) GetStdinOnce() bool {
+	if x != nil {
+		return x.StdinOnce
+	}
+	return false
+}
+
+func (x *ContainerConfig) GetTty() bool {
+	if x != nil {
+		return x.Tty
+	}
+	return false
+}
+
+func (x *ContainerConfig) GetLinux() *LinuxContainerConfig {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetWindows() *WindowsContainerConfig {
+	if x != nil {
+		return x.Windows
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetCDIDevices() []*CDIDevice {
+	if x != nil {
+		return x.CDIDevices
+	}
+	return nil
+}
+
+func (x *ContainerConfig) GetStopSignal() Signal {
+	if x != nil {
+		return x.StopSignal
+	}
+	return Signal_SIGNAL_RUNTIME_DEFAULT
+}
+
+type CreateContainerRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox in which the container should be created.
+	PodSandboxId string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Config of the container.
+	Config *ContainerConfig `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+	// Config of the PodSandbox. This is the same config that was passed
+	// to RunPodSandboxRequest to create the PodSandbox. It is passed again
+	// here just for easy reference. The PodSandboxConfig is immutable and
+	// remains the same throughout the lifetime of the pod.
+	SandboxConfig *PodSandboxConfig `protobuf:"bytes,3,opt,name=sandbox_config,json=sandboxConfig,proto3" json:"sandbox_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateContainerRequest) Reset() {
+	*x = CreateContainerRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[71]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateContainerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateContainerRequest) ProtoMessage() {}
+
+func (x *CreateContainerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[71]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateContainerRequest.ProtoReflect.Descriptor instead.
+func (*CreateContainerRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{71}
+}
+
+func (x *CreateContainerRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *CreateContainerRequest) GetConfig() *ContainerConfig {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *CreateContainerRequest) GetSandboxConfig() *PodSandboxConfig {
+	if x != nil {
+		return x.SandboxConfig
+	}
+	return nil
+}
+
+type CreateContainerResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the created container.
+	ContainerId   string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CreateContainerResponse) Reset() {
+	*x = CreateContainerResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[72]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CreateContainerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CreateContainerResponse) ProtoMessage() {}
+
+func (x *CreateContainerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[72]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CreateContainerResponse.ProtoReflect.Descriptor instead.
+func (*CreateContainerResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{72}
+}
+
+func (x *CreateContainerResponse) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+type StartContainerRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to start.
+	ContainerId   string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StartContainerRequest) Reset() {
+	*x = StartContainerRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[73]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StartContainerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartContainerRequest) ProtoMessage() {}
+
+func (x *StartContainerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[73]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartContainerRequest.ProtoReflect.Descriptor instead.
+func (*StartContainerRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{73}
+}
+
+func (x *StartContainerRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+type StartContainerResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StartContainerResponse) Reset() {
+	*x = StartContainerResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[74]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StartContainerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StartContainerResponse) ProtoMessage() {}
+
+func (x *StartContainerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[74]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StartContainerResponse.ProtoReflect.Descriptor instead.
+func (*StartContainerResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{74}
+}
+
+type StopContainerRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to stop.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Timeout in seconds to wait for the container to stop before forcibly
+	// terminating it. Default: 0 (forcibly terminate the container immediately)
+	Timeout       int64 `protobuf:"varint,2,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StopContainerRequest) Reset() {
+	*x = StopContainerRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[75]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StopContainerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopContainerRequest) ProtoMessage() {}
+
+func (x *StopContainerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[75]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopContainerRequest.ProtoReflect.Descriptor instead.
+func (*StopContainerRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{75}
+}
+
+func (x *StopContainerRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *StopContainerRequest) GetTimeout() int64 {
+	if x != nil {
+		return x.Timeout
+	}
+	return 0
+}
+
+type StopContainerResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StopContainerResponse) Reset() {
+	*x = StopContainerResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[76]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StopContainerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StopContainerResponse) ProtoMessage() {}
+
+func (x *StopContainerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[76]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StopContainerResponse.ProtoReflect.Descriptor instead.
+func (*StopContainerResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{76}
+}
+
+type RemoveContainerRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to remove.
+	ContainerId   string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RemoveContainerRequest) Reset() {
+	*x = RemoveContainerRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[77]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RemoveContainerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveContainerRequest) ProtoMessage() {}
+
+func (x *RemoveContainerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[77]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveContainerRequest.ProtoReflect.Descriptor instead.
+func (*RemoveContainerRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{77}
+}
+
+func (x *RemoveContainerRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+type RemoveContainerResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RemoveContainerResponse) Reset() {
+	*x = RemoveContainerResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[78]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RemoveContainerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveContainerResponse) ProtoMessage() {}
+
+func (x *RemoveContainerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[78]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveContainerResponse.ProtoReflect.Descriptor instead.
+func (*RemoveContainerResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{78}
+}
+
+// ContainerStateValue is the wrapper of ContainerState.
+type ContainerStateValue struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// State of the container.
+	State         ContainerState `protobuf:"varint,1,opt,name=state,proto3,enum=runtime.v1.ContainerState" json:"state,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStateValue) Reset() {
+	*x = ContainerStateValue{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[79]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStateValue) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStateValue) ProtoMessage() {}
+
+func (x *ContainerStateValue) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[79]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStateValue.ProtoReflect.Descriptor instead.
+func (*ContainerStateValue) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{79}
+}
+
+func (x *ContainerStateValue) GetState() ContainerState {
+	if x != nil {
+		return x.State
+	}
+	return ContainerState_CONTAINER_CREATED
+}
+
+// ContainerFilter is used to filter containers.
+// All those fields are combined with 'AND'
+type ContainerFilter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// State of the container.
+	State *ContainerStateValue `protobuf:"bytes,2,opt,name=state,proto3" json:"state,omitempty"`
+	// ID of the PodSandbox.
+	PodSandboxId string `protobuf:"bytes,3,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// LabelSelector to select matches.
+	// Only api.MatchLabels is supported for now and the requirements
+	// are ANDed. MatchExpressions is not supported yet.
+	LabelSelector map[string]string `protobuf:"bytes,4,rep,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerFilter) Reset() {
+	*x = ContainerFilter{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[80]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerFilter) ProtoMessage() {}
+
+func (x *ContainerFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[80]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerFilter.ProtoReflect.Descriptor instead.
+func (*ContainerFilter) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{80}
+}
+
+func (x *ContainerFilter) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ContainerFilter) GetState() *ContainerStateValue {
+	if x != nil {
+		return x.State
+	}
+	return nil
+}
+
+func (x *ContainerFilter) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *ContainerFilter) GetLabelSelector() map[string]string {
+	if x != nil {
+		return x.LabelSelector
+	}
+	return nil
+}
+
+type ListContainersRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Filter        *ContainerFilter       `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListContainersRequest) Reset() {
+	*x = ListContainersRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[81]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListContainersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListContainersRequest) ProtoMessage() {}
+
+func (x *ListContainersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[81]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListContainersRequest.ProtoReflect.Descriptor instead.
+func (*ListContainersRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{81}
+}
+
+func (x *ListContainersRequest) GetFilter() *ContainerFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+// Container provides the runtime information for a container, such as ID, hash,
+// state of the container.
+type Container struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container, used by the container runtime to identify
+	// a container.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// ID of the sandbox to which this container belongs.
+	PodSandboxId string `protobuf:"bytes,2,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Metadata of the container.
+	Metadata *ContainerMetadata `protobuf:"bytes,3,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Spec of the image.
+	Image *ImageSpec `protobuf:"bytes,4,opt,name=image,proto3" json:"image,omitempty"`
+	// Digested reference to the image in use.
+	ImageRef string `protobuf:"bytes,5,opt,name=image_ref,json=imageRef,proto3" json:"image_ref,omitempty"`
+	// State of the container.
+	State ContainerState `protobuf:"varint,6,opt,name=state,proto3,enum=runtime.v1.ContainerState" json:"state,omitempty"`
+	// Creation time of the container in nanoseconds.
+	CreatedAt int64 `protobuf:"varint,7,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Key-value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,8,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// Annotations MUST NOT be altered by the runtime; the value of this field
+	// MUST be identical to that of the corresponding ContainerConfig used to
+	// instantiate this Container.
+	Annotations map[string]string `protobuf:"bytes,9,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Reference to the unique identifier of the image on the node, as
+	// returned in the image and runtime service apis.
+	//
+	// This value MUST always match `PullImageResponse.image_ref` when referring
+	// to the same image.
+	ImageId       string `protobuf:"bytes,10,opt,name=image_id,json=imageId,proto3" json:"image_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Container) Reset() {
+	*x = Container{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[82]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Container) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Container) ProtoMessage() {}
+
+func (x *Container) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[82]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Container.ProtoReflect.Descriptor instead.
+func (*Container) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{82}
+}
+
+func (x *Container) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Container) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *Container) GetMetadata() *ContainerMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *Container) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *Container) GetImageRef() string {
+	if x != nil {
+		return x.ImageRef
+	}
+	return ""
+}
+
+func (x *Container) GetState() ContainerState {
+	if x != nil {
+		return x.State
+	}
+	return ContainerState_CONTAINER_CREATED
+}
+
+func (x *Container) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *Container) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *Container) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *Container) GetImageId() string {
+	if x != nil {
+		return x.ImageId
+	}
+	return ""
+}
+
+type ListContainersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of containers.
+	Containers    []*Container `protobuf:"bytes,1,rep,name=containers,proto3" json:"containers,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListContainersResponse) Reset() {
+	*x = ListContainersResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[83]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListContainersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListContainersResponse) ProtoMessage() {}
+
+func (x *ListContainersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[83]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListContainersResponse.ProtoReflect.Descriptor instead.
+func (*ListContainersResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{83}
+}
+
+func (x *ListContainersResponse) GetContainers() []*Container {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+type StreamContainersRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter for the list request.
+	Filter        *ContainerFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamContainersRequest) Reset() {
+	*x = StreamContainersRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[84]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamContainersRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamContainersRequest) ProtoMessage() {}
+
+func (x *StreamContainersRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[84]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamContainersRequest.ProtoReflect.Descriptor instead.
+func (*StreamContainersRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{84}
+}
+
+func (x *StreamContainersRequest) GetFilter() *ContainerFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+type StreamContainersResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of containers.
+	Containers    []*Container `protobuf:"bytes,1,rep,name=containers,proto3" json:"containers,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamContainersResponse) Reset() {
+	*x = StreamContainersResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[85]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamContainersResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamContainersResponse) ProtoMessage() {}
+
+func (x *StreamContainersResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[85]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamContainersResponse.ProtoReflect.Descriptor instead.
+func (*StreamContainersResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{85}
+}
+
+func (x *StreamContainersResponse) GetContainers() []*Container {
+	if x != nil {
+		return x.Containers
+	}
+	return nil
+}
+
+type ContainerStatusRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container for which to retrieve status.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Verbose indicates whether to return extra information about the container.
+	Verbose       bool `protobuf:"varint,2,opt,name=verbose,proto3" json:"verbose,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStatusRequest) Reset() {
+	*x = ContainerStatusRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[86]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStatusRequest) ProtoMessage() {}
+
+func (x *ContainerStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[86]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStatusRequest.ProtoReflect.Descriptor instead.
+func (*ContainerStatusRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{86}
+}
+
+func (x *ContainerStatusRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *ContainerStatusRequest) GetVerbose() bool {
+	if x != nil {
+		return x.Verbose
+	}
+	return false
+}
+
+// ContainerStatus represents the status of a container.
+type ContainerStatus struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Metadata of the container.
+	Metadata *ContainerMetadata `protobuf:"bytes,2,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Status of the container.
+	State ContainerState `protobuf:"varint,3,opt,name=state,proto3,enum=runtime.v1.ContainerState" json:"state,omitempty"`
+	// Creation time of the container in nanoseconds.
+	CreatedAt int64 `protobuf:"varint,4,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Start time of the container in nanoseconds. Default: 0 (not specified).
+	StartedAt int64 `protobuf:"varint,5,opt,name=started_at,json=startedAt,proto3" json:"started_at,omitempty"`
+	// Finish time of the container in nanoseconds. Default: 0 (not specified).
+	FinishedAt int64 `protobuf:"varint,6,opt,name=finished_at,json=finishedAt,proto3" json:"finished_at,omitempty"`
+	// Exit code of the container. Only required when finished_at != 0. Default: 0.
+	ExitCode int32 `protobuf:"varint,7,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
+	// Spec of the image.
+	Image *ImageSpec `protobuf:"bytes,8,opt,name=image,proto3" json:"image,omitempty"`
+	// Digested reference to the image in use.
+	ImageRef string `protobuf:"bytes,9,opt,name=image_ref,json=imageRef,proto3" json:"image_ref,omitempty"`
+	// Brief CamelCase string explaining why container is in its current state.
+	// Must be set to "OOMKilled" for containers terminated by cgroup-based Out-of-Memory killer.
+	Reason string `protobuf:"bytes,10,opt,name=reason,proto3" json:"reason,omitempty"`
+	// Human-readable message indicating details about why container is in its
+	// current state.
+	Message string `protobuf:"bytes,11,opt,name=message,proto3" json:"message,omitempty"`
+	// Key-value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,12,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// Annotations MUST NOT be altered by the runtime; the value of this field
+	// MUST be identical to that of the corresponding ContainerConfig used to
+	// instantiate the Container this status represents.
+	Annotations map[string]string `protobuf:"bytes,13,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Mounts for the container.
+	Mounts []*Mount `protobuf:"bytes,14,rep,name=mounts,proto3" json:"mounts,omitempty"`
+	// Log path of container.
+	LogPath string `protobuf:"bytes,15,opt,name=log_path,json=logPath,proto3" json:"log_path,omitempty"`
+	// Resource limits configuration of the container.
+	Resources *ContainerResources `protobuf:"bytes,16,opt,name=resources,proto3" json:"resources,omitempty"`
+	// Reference to the unique identifier of the image on the node, as
+	// returned in the image and runtime service apis.
+	//
+	// This value MUST always match `PullImageResponse.image_ref` when referring
+	// to the same image.
+	ImageId string `protobuf:"bytes,17,opt,name=image_id,json=imageId,proto3" json:"image_id,omitempty"`
+	// User identities initially attached to the container
+	User *ContainerUser `protobuf:"bytes,18,opt,name=user,proto3" json:"user,omitempty"`
+	// Returns the stop signal used by the container runtime to terminate the container
+	StopSignal    Signal `protobuf:"varint,19,opt,name=stop_signal,json=stopSignal,proto3,enum=runtime.v1.Signal" json:"stop_signal,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStatus) Reset() {
+	*x = ContainerStatus{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[87]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStatus) ProtoMessage() {}
+
+func (x *ContainerStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[87]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStatus.ProtoReflect.Descriptor instead.
+func (*ContainerStatus) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{87}
+}
+
+func (x *ContainerStatus) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ContainerStatus) GetMetadata() *ContainerMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetState() ContainerState {
+	if x != nil {
+		return x.State
+	}
+	return ContainerState_CONTAINER_CREATED
+}
+
+func (x *ContainerStatus) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *ContainerStatus) GetStartedAt() int64 {
+	if x != nil {
+		return x.StartedAt
+	}
+	return 0
+}
+
+func (x *ContainerStatus) GetFinishedAt() int64 {
+	if x != nil {
+		return x.FinishedAt
+	}
+	return 0
+}
+
+func (x *ContainerStatus) GetExitCode() int32 {
+	if x != nil {
+		return x.ExitCode
+	}
+	return 0
+}
+
+func (x *ContainerStatus) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetImageRef() string {
+	if x != nil {
+		return x.ImageRef
+	}
+	return ""
+}
+
+func (x *ContainerStatus) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+func (x *ContainerStatus) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+func (x *ContainerStatus) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetMounts() []*Mount {
+	if x != nil {
+		return x.Mounts
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetLogPath() string {
+	if x != nil {
+		return x.LogPath
+	}
+	return ""
+}
+
+func (x *ContainerStatus) GetResources() *ContainerResources {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetImageId() string {
+	if x != nil {
+		return x.ImageId
+	}
+	return ""
+}
+
+func (x *ContainerStatus) GetUser() *ContainerUser {
+	if x != nil {
+		return x.User
+	}
+	return nil
+}
+
+func (x *ContainerStatus) GetStopSignal() Signal {
+	if x != nil {
+		return x.StopSignal
+	}
+	return Signal_SIGNAL_RUNTIME_DEFAULT
+}
+
+type ContainerStatusResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Status of the container.
+	Status *ContainerStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	// Info is extra information of the Container. The key could be arbitrary string, and
+	// value should be in json format. The information could include anything useful for
+	// debug, e.g. pid for linux container based container runtime.
+	// It should only be returned non-empty when Verbose is true.
+	Info          map[string]string `protobuf:"bytes,2,rep,name=info,proto3" json:"info,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStatusResponse) Reset() {
+	*x = ContainerStatusResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[88]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStatusResponse) ProtoMessage() {}
+
+func (x *ContainerStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[88]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStatusResponse.ProtoReflect.Descriptor instead.
+func (*ContainerStatusResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{88}
+}
+
+func (x *ContainerStatusResponse) GetStatus() *ContainerStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+func (x *ContainerStatusResponse) GetInfo() map[string]string {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+// ContainerResources holds resource limits configuration for a container.
+type ContainerResources struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Resource limits configuration specific to Linux container.
+	Linux *LinuxContainerResources `protobuf:"bytes,1,opt,name=linux,proto3" json:"linux,omitempty"`
+	// Resource limits configuration specific to Windows container.
+	Windows       *WindowsContainerResources `protobuf:"bytes,2,opt,name=windows,proto3" json:"windows,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerResources) Reset() {
+	*x = ContainerResources{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[89]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerResources) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerResources) ProtoMessage() {}
+
+func (x *ContainerResources) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[89]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerResources.ProtoReflect.Descriptor instead.
+func (*ContainerResources) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{89}
+}
+
+func (x *ContainerResources) GetLinux() *LinuxContainerResources {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+func (x *ContainerResources) GetWindows() *WindowsContainerResources {
+	if x != nil {
+		return x.Windows
+	}
+	return nil
+}
+
+type ContainerUser struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// User identities initially attached to first process in the Linux container.
+	// Note that the actual running identity can be changed if the process has enough privilege to do so.
+	Linux         *LinuxContainerUser `protobuf:"bytes,1,opt,name=linux,proto3" json:"linux,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerUser) Reset() {
+	*x = ContainerUser{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[90]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerUser) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerUser) ProtoMessage() {}
+
+func (x *ContainerUser) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[90]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerUser.ProtoReflect.Descriptor instead.
+func (*ContainerUser) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{90}
+}
+
+func (x *ContainerUser) GetLinux() *LinuxContainerUser {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+type UpdateContainerResourcesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to update.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Resource configuration specific to Linux containers.
+	Linux *LinuxContainerResources `protobuf:"bytes,2,opt,name=linux,proto3" json:"linux,omitempty"`
+	// Resource configuration specific to Windows containers.
+	Windows *WindowsContainerResources `protobuf:"bytes,3,opt,name=windows,proto3" json:"windows,omitempty"`
+	// Unstructured key-value map holding arbitrary additional information for
+	// container resources updating. This can be used for specifying experimental
+	// resources to update or other options to use when updating the container.
+	Annotations   map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateContainerResourcesRequest) Reset() {
+	*x = UpdateContainerResourcesRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[91]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateContainerResourcesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateContainerResourcesRequest) ProtoMessage() {}
+
+func (x *UpdateContainerResourcesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[91]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateContainerResourcesRequest.ProtoReflect.Descriptor instead.
+func (*UpdateContainerResourcesRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{91}
+}
+
+func (x *UpdateContainerResourcesRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *UpdateContainerResourcesRequest) GetLinux() *LinuxContainerResources {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+func (x *UpdateContainerResourcesRequest) GetWindows() *WindowsContainerResources {
+	if x != nil {
+		return x.Windows
+	}
+	return nil
+}
+
+func (x *UpdateContainerResourcesRequest) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+type UpdateContainerResourcesResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateContainerResourcesResponse) Reset() {
+	*x = UpdateContainerResourcesResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[92]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateContainerResourcesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateContainerResourcesResponse) ProtoMessage() {}
+
+func (x *UpdateContainerResourcesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[92]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateContainerResourcesResponse.ProtoReflect.Descriptor instead.
+func (*UpdateContainerResourcesResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{92}
+}
+
+type ExecSyncRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Command to execute.
+	Cmd []string `protobuf:"bytes,2,rep,name=cmd,proto3" json:"cmd,omitempty"`
+	// Timeout in seconds to stop the command. Default: 0 (run forever).
+	Timeout       int64 `protobuf:"varint,3,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecSyncRequest) Reset() {
+	*x = ExecSyncRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[93]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecSyncRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecSyncRequest) ProtoMessage() {}
+
+func (x *ExecSyncRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[93]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecSyncRequest.ProtoReflect.Descriptor instead.
+func (*ExecSyncRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{93}
+}
+
+func (x *ExecSyncRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *ExecSyncRequest) GetCmd() []string {
+	if x != nil {
+		return x.Cmd
+	}
+	return nil
+}
+
+func (x *ExecSyncRequest) GetTimeout() int64 {
+	if x != nil {
+		return x.Timeout
+	}
+	return 0
+}
+
+type ExecSyncResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Captured command stdout output.
+	// The runtime should cap the output of this response to 16MB.
+	// If the stdout of the command produces more than 16MB, the remaining output
+	// should be discarded, and the command should proceed with no error.
+	// See CVE-2022-1708 and CVE-2022-31030 for more information.
+	Stdout []byte `protobuf:"bytes,1,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	// Captured command stderr output.
+	// The runtime should cap the output of this response to 16MB.
+	// If the stderr of the command produces more than 16MB, the remaining output
+	// should be discarded, and the command should proceed with no error.
+	// See CVE-2022-1708 and CVE-2022-31030 for more information.
+	Stderr []byte `protobuf:"bytes,2,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	// Exit code the command finished with. Default: 0 (success).
+	ExitCode      int32 `protobuf:"varint,3,opt,name=exit_code,json=exitCode,proto3" json:"exit_code,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecSyncResponse) Reset() {
+	*x = ExecSyncResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[94]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecSyncResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecSyncResponse) ProtoMessage() {}
+
+func (x *ExecSyncResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[94]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecSyncResponse.ProtoReflect.Descriptor instead.
+func (*ExecSyncResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{94}
+}
+
+func (x *ExecSyncResponse) GetStdout() []byte {
+	if x != nil {
+		return x.Stdout
+	}
+	return nil
+}
+
+func (x *ExecSyncResponse) GetStderr() []byte {
+	if x != nil {
+		return x.Stderr
+	}
+	return nil
+}
+
+func (x *ExecSyncResponse) GetExitCode() int32 {
+	if x != nil {
+		return x.ExitCode
+	}
+	return 0
+}
+
+type ExecRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container in which to execute the command.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Command to execute.
+	Cmd []string `protobuf:"bytes,2,rep,name=cmd,proto3" json:"cmd,omitempty"`
+	// Whether to exec the command in a TTY.
+	Tty bool `protobuf:"varint,3,opt,name=tty,proto3" json:"tty,omitempty"`
+	// Whether to stream stdin.
+	// One of `stdin`, `stdout`, and `stderr` MUST be true.
+	Stdin bool `protobuf:"varint,4,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	// Whether to stream stdout.
+	// One of `stdin`, `stdout`, and `stderr` MUST be true.
+	Stdout bool `protobuf:"varint,5,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	// Whether to stream stderr.
+	// One of `stdin`, `stdout`, and `stderr` MUST be true.
+	// If `tty` is true, `stderr` MUST be false. Multiplexing is not supported
+	// in this case. The output of stdout and stderr will be combined to a
+	// single stream.
+	Stderr        bool `protobuf:"varint,6,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecRequest) Reset() {
+	*x = ExecRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[95]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecRequest) ProtoMessage() {}
+
+func (x *ExecRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[95]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecRequest.ProtoReflect.Descriptor instead.
+func (*ExecRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{95}
+}
+
+func (x *ExecRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *ExecRequest) GetCmd() []string {
+	if x != nil {
+		return x.Cmd
+	}
+	return nil
+}
+
+func (x *ExecRequest) GetTty() bool {
+	if x != nil {
+		return x.Tty
+	}
+	return false
+}
+
+func (x *ExecRequest) GetStdin() bool {
+	if x != nil {
+		return x.Stdin
+	}
+	return false
+}
+
+func (x *ExecRequest) GetStdout() bool {
+	if x != nil {
+		return x.Stdout
+	}
+	return false
+}
+
+func (x *ExecRequest) GetStderr() bool {
+	if x != nil {
+		return x.Stderr
+	}
+	return false
+}
+
+type ExecResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Fully qualified URL of the exec streaming server.
+	Url           string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ExecResponse) Reset() {
+	*x = ExecResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[96]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ExecResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ExecResponse) ProtoMessage() {}
+
+func (x *ExecResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[96]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ExecResponse.ProtoReflect.Descriptor instead.
+func (*ExecResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{96}
+}
+
+func (x *ExecResponse) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+type AttachRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to which to attach.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Whether to stream stdin.
+	// One of `stdin`, `stdout`, and `stderr` MUST be true.
+	Stdin bool `protobuf:"varint,2,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	// Whether the process being attached is running in a TTY.
+	// This must match the TTY setting in the ContainerConfig.
+	Tty bool `protobuf:"varint,3,opt,name=tty,proto3" json:"tty,omitempty"`
+	// Whether to stream stdout.
+	// One of `stdin`, `stdout`, and `stderr` MUST be true.
+	Stdout bool `protobuf:"varint,4,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	// Whether to stream stderr.
+	// One of `stdin`, `stdout`, and `stderr` MUST be true.
+	// If `tty` is true, `stderr` MUST be false. Multiplexing is not supported
+	// in this case. The output of stdout and stderr will be combined to a
+	// single stream.
+	Stderr        bool `protobuf:"varint,5,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AttachRequest) Reset() {
+	*x = AttachRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[97]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AttachRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AttachRequest) ProtoMessage() {}
+
+func (x *AttachRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[97]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AttachRequest.ProtoReflect.Descriptor instead.
+func (*AttachRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{97}
+}
+
+func (x *AttachRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *AttachRequest) GetStdin() bool {
+	if x != nil {
+		return x.Stdin
+	}
+	return false
+}
+
+func (x *AttachRequest) GetTty() bool {
+	if x != nil {
+		return x.Tty
+	}
+	return false
+}
+
+func (x *AttachRequest) GetStdout() bool {
+	if x != nil {
+		return x.Stdout
+	}
+	return false
+}
+
+func (x *AttachRequest) GetStderr() bool {
+	if x != nil {
+		return x.Stderr
+	}
+	return false
+}
+
+type AttachResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Fully qualified URL of the attach streaming server.
+	Url           string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AttachResponse) Reset() {
+	*x = AttachResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[98]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AttachResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AttachResponse) ProtoMessage() {}
+
+func (x *AttachResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[98]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AttachResponse.ProtoReflect.Descriptor instead.
+func (*AttachResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{98}
+}
+
+func (x *AttachResponse) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+type PortForwardRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to which to forward the port.
+	PodSandboxId string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Port to forward.
+	Port          []int32 `protobuf:"varint,2,rep,packed,name=port,proto3" json:"port,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PortForwardRequest) Reset() {
+	*x = PortForwardRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[99]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PortForwardRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardRequest) ProtoMessage() {}
+
+func (x *PortForwardRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[99]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardRequest.ProtoReflect.Descriptor instead.
+func (*PortForwardRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{99}
+}
+
+func (x *PortForwardRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *PortForwardRequest) GetPort() []int32 {
+	if x != nil {
+		return x.Port
+	}
+	return nil
+}
+
+type PortForwardResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Fully qualified URL of the port-forward streaming server.
+	Url           string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PortForwardResponse) Reset() {
+	*x = PortForwardResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[100]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PortForwardResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PortForwardResponse) ProtoMessage() {}
+
+func (x *PortForwardResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[100]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PortForwardResponse.ProtoReflect.Descriptor instead.
+func (*PortForwardResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{100}
+}
+
+func (x *PortForwardResponse) GetUrl() string {
+	if x != nil {
+		return x.Url
+	}
+	return ""
+}
+
+type ImageFilter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Spec of the image.
+	Image         *ImageSpec `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ImageFilter) Reset() {
+	*x = ImageFilter{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[101]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ImageFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImageFilter) ProtoMessage() {}
+
+func (x *ImageFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[101]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImageFilter.ProtoReflect.Descriptor instead.
+func (*ImageFilter) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{101}
+}
+
+func (x *ImageFilter) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+type ListImagesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter to list images.
+	Filter        *ImageFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListImagesRequest) Reset() {
+	*x = ListImagesRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[102]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListImagesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListImagesRequest) ProtoMessage() {}
+
+func (x *ListImagesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[102]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListImagesRequest.ProtoReflect.Descriptor instead.
+func (*ListImagesRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{102}
+}
+
+func (x *ListImagesRequest) GetFilter() *ImageFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+// Basic information about a container image.
+type Image struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Reference to the unique identifier of the image on the node, as
+	// returned in the image and runtime service apis.
+	//
+	// This value MUST always match `PullImageResponse.image_ref` when referring
+	// to the same image.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Other names by which this image is known.
+	RepoTags []string `protobuf:"bytes,2,rep,name=repo_tags,json=repoTags,proto3" json:"repo_tags,omitempty"`
+	// Digests by which this image is known.
+	RepoDigests []string `protobuf:"bytes,3,rep,name=repo_digests,json=repoDigests,proto3" json:"repo_digests,omitempty"`
+	// Size of the image in bytes. Must be > 0.
+	Size uint64 `protobuf:"varint,4,opt,name=size,proto3" json:"size,omitempty"`
+	// UID that will run the command(s). This is used as a default if no user is
+	// specified when creating the container. UID and the following user name
+	// are mutually exclusive.
+	Uid *Int64Value `protobuf:"bytes,5,opt,name=uid,proto3" json:"uid,omitempty"`
+	// User name that will run the command(s). This is used if UID is not set
+	// and no user is specified when creating container.
+	Username string `protobuf:"bytes,6,opt,name=username,proto3" json:"username,omitempty"`
+	// ImageSpec for image which includes annotations
+	Spec *ImageSpec `protobuf:"bytes,7,opt,name=spec,proto3" json:"spec,omitempty"`
+	// Recommendation on whether this image should be exempt from garbage collection.
+	// It must only be treated as a recommendation -- the client can still request that the image be deleted,
+	// and the runtime must oblige.
+	Pinned        bool `protobuf:"varint,8,opt,name=pinned,proto3" json:"pinned,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Image) Reset() {
+	*x = Image{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[103]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Image) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Image) ProtoMessage() {}
+
+func (x *Image) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[103]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Image.ProtoReflect.Descriptor instead.
+func (*Image) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{103}
+}
+
+func (x *Image) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *Image) GetRepoTags() []string {
+	if x != nil {
+		return x.RepoTags
+	}
+	return nil
+}
+
+func (x *Image) GetRepoDigests() []string {
+	if x != nil {
+		return x.RepoDigests
+	}
+	return nil
+}
+
+func (x *Image) GetSize() uint64 {
+	if x != nil {
+		return x.Size
+	}
+	return 0
+}
+
+func (x *Image) GetUid() *Int64Value {
+	if x != nil {
+		return x.Uid
+	}
+	return nil
+}
+
+func (x *Image) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *Image) GetSpec() *ImageSpec {
+	if x != nil {
+		return x.Spec
+	}
+	return nil
+}
+
+func (x *Image) GetPinned() bool {
+	if x != nil {
+		return x.Pinned
+	}
+	return false
+}
+
+type ListImagesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of images.
+	Images        []*Image `protobuf:"bytes,1,rep,name=images,proto3" json:"images,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListImagesResponse) Reset() {
+	*x = ListImagesResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[104]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListImagesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListImagesResponse) ProtoMessage() {}
+
+func (x *ListImagesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[104]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListImagesResponse.ProtoReflect.Descriptor instead.
+func (*ListImagesResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{104}
+}
+
+func (x *ListImagesResponse) GetImages() []*Image {
+	if x != nil {
+		return x.Images
+	}
+	return nil
+}
+
+type StreamImagesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter to list images.
+	Filter        *ImageFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamImagesRequest) Reset() {
+	*x = StreamImagesRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[105]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamImagesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamImagesRequest) ProtoMessage() {}
+
+func (x *StreamImagesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[105]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamImagesRequest.ProtoReflect.Descriptor instead.
+func (*StreamImagesRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{105}
+}
+
+func (x *StreamImagesRequest) GetFilter() *ImageFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+type StreamImagesResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of images.
+	Images        []*Image `protobuf:"bytes,1,rep,name=images,proto3" json:"images,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamImagesResponse) Reset() {
+	*x = StreamImagesResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[106]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamImagesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamImagesResponse) ProtoMessage() {}
+
+func (x *StreamImagesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[106]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamImagesResponse.ProtoReflect.Descriptor instead.
+func (*StreamImagesResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{106}
+}
+
+func (x *StreamImagesResponse) GetImages() []*Image {
+	if x != nil {
+		return x.Images
+	}
+	return nil
+}
+
+type ImageStatusRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Spec of the image.
+	Image *ImageSpec `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	// Verbose indicates whether to return extra information about the image.
+	Verbose       bool `protobuf:"varint,2,opt,name=verbose,proto3" json:"verbose,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ImageStatusRequest) Reset() {
+	*x = ImageStatusRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[107]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ImageStatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImageStatusRequest) ProtoMessage() {}
+
+func (x *ImageStatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[107]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImageStatusRequest.ProtoReflect.Descriptor instead.
+func (*ImageStatusRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{107}
+}
+
+func (x *ImageStatusRequest) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *ImageStatusRequest) GetVerbose() bool {
+	if x != nil {
+		return x.Verbose
+	}
+	return false
+}
+
+type ImageStatusResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Status of the image.
+	Image *Image `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	// Info is extra information of the Image. The key could be arbitrary string, and
+	// value should be in json format. The information could include anything useful
+	// for debug, e.g. image config for oci image based container runtime.
+	// It should only be returned non-empty when Verbose is true.
+	Info          map[string]string `protobuf:"bytes,2,rep,name=info,proto3" json:"info,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ImageStatusResponse) Reset() {
+	*x = ImageStatusResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[108]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ImageStatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImageStatusResponse) ProtoMessage() {}
+
+func (x *ImageStatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[108]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImageStatusResponse.ProtoReflect.Descriptor instead.
+func (*ImageStatusResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{108}
+}
+
+func (x *ImageStatusResponse) GetImage() *Image {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *ImageStatusResponse) GetInfo() map[string]string {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+// AuthConfig contains authorization information for connecting to a registry.
+type AuthConfig struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Username      string                 `protobuf:"bytes,1,opt,name=username,proto3" json:"username,omitempty"`
+	Password      string                 `protobuf:"bytes,2,opt,name=password,proto3" json:"password,omitempty"`
+	Auth          string                 `protobuf:"bytes,3,opt,name=auth,proto3" json:"auth,omitempty"`
+	ServerAddress string                 `protobuf:"bytes,4,opt,name=server_address,json=serverAddress,proto3" json:"server_address,omitempty"`
+	// IdentityToken is used to authenticate the user and get
+	// an access token for the registry.
+	IdentityToken string `protobuf:"bytes,5,opt,name=identity_token,json=identityToken,proto3" json:"identity_token,omitempty"`
+	// RegistryToken is a bearer token to be sent to a registry
+	RegistryToken string `protobuf:"bytes,6,opt,name=registry_token,json=registryToken,proto3" json:"registry_token,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *AuthConfig) Reset() {
+	*x = AuthConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[109]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *AuthConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*AuthConfig) ProtoMessage() {}
+
+func (x *AuthConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[109]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use AuthConfig.ProtoReflect.Descriptor instead.
+func (*AuthConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{109}
+}
+
+func (x *AuthConfig) GetUsername() string {
+	if x != nil {
+		return x.Username
+	}
+	return ""
+}
+
+func (x *AuthConfig) GetPassword() string {
+	if x != nil {
+		return x.Password
+	}
+	return ""
+}
+
+func (x *AuthConfig) GetAuth() string {
+	if x != nil {
+		return x.Auth
+	}
+	return ""
+}
+
+func (x *AuthConfig) GetServerAddress() string {
+	if x != nil {
+		return x.ServerAddress
+	}
+	return ""
+}
+
+func (x *AuthConfig) GetIdentityToken() string {
+	if x != nil {
+		return x.IdentityToken
+	}
+	return ""
+}
+
+func (x *AuthConfig) GetRegistryToken() string {
+	if x != nil {
+		return x.RegistryToken
+	}
+	return ""
+}
+
+type PullImageRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Spec of the image.
+	Image *ImageSpec `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	// Authentication configuration for pulling the image.
+	Auth *AuthConfig `protobuf:"bytes,2,opt,name=auth,proto3" json:"auth,omitempty"`
+	// Config of the PodSandbox, which is used to pull image in PodSandbox context.
+	SandboxConfig *PodSandboxConfig `protobuf:"bytes,3,opt,name=sandbox_config,json=sandboxConfig,proto3" json:"sandbox_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PullImageRequest) Reset() {
+	*x = PullImageRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[110]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PullImageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PullImageRequest) ProtoMessage() {}
+
+func (x *PullImageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[110]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PullImageRequest.ProtoReflect.Descriptor instead.
+func (*PullImageRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{110}
+}
+
+func (x *PullImageRequest) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+func (x *PullImageRequest) GetAuth() *AuthConfig {
+	if x != nil {
+		return x.Auth
+	}
+	return nil
+}
+
+func (x *PullImageRequest) GetSandboxConfig() *PodSandboxConfig {
+	if x != nil {
+		return x.SandboxConfig
+	}
+	return nil
+}
+
+type PullImageResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Reference to the unique identifier of the image on the node, as
+	// returned in the image and runtime service apis.
+	//
+	// When referring to the same image, the container runtime MUST always return
+	// the same value for:
+	//   - Image.id
+	//   - Container.image_id
+	//   - ContainerStatus.image_id
+	//   - PullImageResponse.image_ref
+	//
+	// Note: this field has a stricter meaning starting with v1.36.
+	// It used to be image ID OR digest, which are different values,
+	// and would not necessarily match other ID fields in the Container,
+	// ContainerStatus, and Image messages
+	ImageRef      string `protobuf:"bytes,1,opt,name=image_ref,json=imageRef,proto3" json:"image_ref,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PullImageResponse) Reset() {
+	*x = PullImageResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[111]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PullImageResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PullImageResponse) ProtoMessage() {}
+
+func (x *PullImageResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[111]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PullImageResponse.ProtoReflect.Descriptor instead.
+func (*PullImageResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{111}
+}
+
+func (x *PullImageResponse) GetImageRef() string {
+	if x != nil {
+		return x.ImageRef
+	}
+	return ""
+}
+
+type RemoveImageRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Spec of the image to remove.
+	Image         *ImageSpec `protobuf:"bytes,1,opt,name=image,proto3" json:"image,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RemoveImageRequest) Reset() {
+	*x = RemoveImageRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[112]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RemoveImageRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveImageRequest) ProtoMessage() {}
+
+func (x *RemoveImageRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[112]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveImageRequest.ProtoReflect.Descriptor instead.
+func (*RemoveImageRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{112}
+}
+
+func (x *RemoveImageRequest) GetImage() *ImageSpec {
+	if x != nil {
+		return x.Image
+	}
+	return nil
+}
+
+type RemoveImageResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RemoveImageResponse) Reset() {
+	*x = RemoveImageResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[113]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RemoveImageResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RemoveImageResponse) ProtoMessage() {}
+
+func (x *RemoveImageResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[113]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RemoveImageResponse.ProtoReflect.Descriptor instead.
+func (*RemoveImageResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{113}
+}
+
+type NetworkConfig struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// CIDR to use for pod IP addresses. If the CIDR is empty, runtimes
+	// should omit it.
+	PodCidr       string `protobuf:"bytes,1,opt,name=pod_cidr,json=podCidr,proto3" json:"pod_cidr,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *NetworkConfig) Reset() {
+	*x = NetworkConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[114]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *NetworkConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*NetworkConfig) ProtoMessage() {}
+
+func (x *NetworkConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[114]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use NetworkConfig.ProtoReflect.Descriptor instead.
+func (*NetworkConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{114}
+}
+
+func (x *NetworkConfig) GetPodCidr() string {
+	if x != nil {
+		return x.PodCidr
+	}
+	return ""
+}
+
+type RuntimeConfig struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	NetworkConfig *NetworkConfig         `protobuf:"bytes,1,opt,name=network_config,json=networkConfig,proto3" json:"network_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeConfig) Reset() {
+	*x = RuntimeConfig{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[115]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeConfig) ProtoMessage() {}
+
+func (x *RuntimeConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[115]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeConfig.ProtoReflect.Descriptor instead.
+func (*RuntimeConfig) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{115}
+}
+
+func (x *RuntimeConfig) GetNetworkConfig() *NetworkConfig {
+	if x != nil {
+		return x.NetworkConfig
+	}
+	return nil
+}
+
+type UpdateRuntimeConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	RuntimeConfig *RuntimeConfig         `protobuf:"bytes,1,opt,name=runtime_config,json=runtimeConfig,proto3" json:"runtime_config,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateRuntimeConfigRequest) Reset() {
+	*x = UpdateRuntimeConfigRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[116]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateRuntimeConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateRuntimeConfigRequest) ProtoMessage() {}
+
+func (x *UpdateRuntimeConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[116]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateRuntimeConfigRequest.ProtoReflect.Descriptor instead.
+func (*UpdateRuntimeConfigRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{116}
+}
+
+func (x *UpdateRuntimeConfigRequest) GetRuntimeConfig() *RuntimeConfig {
+	if x != nil {
+		return x.RuntimeConfig
+	}
+	return nil
+}
+
+type UpdateRuntimeConfigResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdateRuntimeConfigResponse) Reset() {
+	*x = UpdateRuntimeConfigResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[117]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdateRuntimeConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdateRuntimeConfigResponse) ProtoMessage() {}
+
+func (x *UpdateRuntimeConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[117]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdateRuntimeConfigResponse.ProtoReflect.Descriptor instead.
+func (*UpdateRuntimeConfigResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{117}
+}
+
+// RuntimeCondition contains condition information for the runtime.
+// There are 2 kinds of runtime conditions:
+// 1. Required conditions: Conditions are required for kubelet to work
+// properly. If any required condition is unmet, the node will be not ready.
+// The required conditions include:
+//   - RuntimeReady: RuntimeReady means the runtime is up and ready to accept
+//     basic containers e.g. container only needs host network.
+//   - NetworkReady: NetworkReady means the runtime network is up and ready to
+//     accept containers which require container network.
+//
+// 2. Optional conditions: Conditions are informative to the user, but kubelet
+// will not rely on. Since condition type is an arbitrary string, all conditions
+// not required are optional. These conditions will be exposed to users to help
+// them understand the status of the system.
+type RuntimeCondition struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Type of runtime condition.
+	Type string `protobuf:"bytes,1,opt,name=type,proto3" json:"type,omitempty"`
+	// Status of the condition, one of true/false. Default: false.
+	Status bool `protobuf:"varint,2,opt,name=status,proto3" json:"status,omitempty"`
+	// Brief CamelCase string containing reason for the condition's last transition.
+	Reason string `protobuf:"bytes,3,opt,name=reason,proto3" json:"reason,omitempty"`
+	// Human-readable message indicating details about last transition.
+	Message       string `protobuf:"bytes,4,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeCondition) Reset() {
+	*x = RuntimeCondition{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[118]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeCondition) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeCondition) ProtoMessage() {}
+
+func (x *RuntimeCondition) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[118]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeCondition.ProtoReflect.Descriptor instead.
+func (*RuntimeCondition) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{118}
+}
+
+func (x *RuntimeCondition) GetType() string {
+	if x != nil {
+		return x.Type
+	}
+	return ""
+}
+
+func (x *RuntimeCondition) GetStatus() bool {
+	if x != nil {
+		return x.Status
+	}
+	return false
+}
+
+func (x *RuntimeCondition) GetReason() string {
+	if x != nil {
+		return x.Reason
+	}
+	return ""
+}
+
+func (x *RuntimeCondition) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
+// RuntimeStatus is information about the current status of the runtime.
+type RuntimeStatus struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of current observed runtime conditions.
+	Conditions    []*RuntimeCondition `protobuf:"bytes,1,rep,name=conditions,proto3" json:"conditions,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeStatus) Reset() {
+	*x = RuntimeStatus{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[119]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeStatus) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeStatus) ProtoMessage() {}
+
+func (x *RuntimeStatus) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[119]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeStatus.ProtoReflect.Descriptor instead.
+func (*RuntimeStatus) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{119}
+}
+
+func (x *RuntimeStatus) GetConditions() []*RuntimeCondition {
+	if x != nil {
+		return x.Conditions
+	}
+	return nil
+}
+
+type StatusRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Verbose indicates whether to return extra information about the runtime.
+	Verbose       bool `protobuf:"varint,1,opt,name=verbose,proto3" json:"verbose,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StatusRequest) Reset() {
+	*x = StatusRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[120]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StatusRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StatusRequest) ProtoMessage() {}
+
+func (x *StatusRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[120]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StatusRequest.ProtoReflect.Descriptor instead.
+func (*StatusRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{120}
+}
+
+func (x *StatusRequest) GetVerbose() bool {
+	if x != nil {
+		return x.Verbose
+	}
+	return false
+}
+
+// RuntimeHandlerFeatures is a set of features implemented by the runtime handler.
+type RuntimeHandlerFeatures struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// recursive_read_only_mounts is set to true if the runtime handler supports
+	// recursive read-only mounts.
+	// For runc-compatible runtimes, availability of this feature can be detected by checking whether
+	// the Linux kernel version is >= 5.12, and,  `runc features | jq .mountOptions` contains "rro".
+	RecursiveReadOnlyMounts bool `protobuf:"varint,1,opt,name=recursive_read_only_mounts,json=recursiveReadOnlyMounts,proto3" json:"recursive_read_only_mounts,omitempty"`
+	// user_namespaces is set to true if the runtime handler supports user namespaces as implemented
+	// in Kubernetes. This means support for both, user namespaces and idmap mounts.
+	UserNamespaces bool `protobuf:"varint,2,opt,name=user_namespaces,json=userNamespaces,proto3" json:"user_namespaces,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *RuntimeHandlerFeatures) Reset() {
+	*x = RuntimeHandlerFeatures{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[121]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeHandlerFeatures) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeHandlerFeatures) ProtoMessage() {}
+
+func (x *RuntimeHandlerFeatures) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[121]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeHandlerFeatures.ProtoReflect.Descriptor instead.
+func (*RuntimeHandlerFeatures) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{121}
+}
+
+func (x *RuntimeHandlerFeatures) GetRecursiveReadOnlyMounts() bool {
+	if x != nil {
+		return x.RecursiveReadOnlyMounts
+	}
+	return false
+}
+
+func (x *RuntimeHandlerFeatures) GetUserNamespaces() bool {
+	if x != nil {
+		return x.UserNamespaces
+	}
+	return false
+}
+
+type RuntimeHandler struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name must be unique in StatusResponse.
+	// An empty string denotes the default handler.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Supported features.
+	Features      *RuntimeHandlerFeatures `protobuf:"bytes,2,opt,name=features,proto3" json:"features,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeHandler) Reset() {
+	*x = RuntimeHandler{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[122]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeHandler) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeHandler) ProtoMessage() {}
+
+func (x *RuntimeHandler) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[122]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeHandler.ProtoReflect.Descriptor instead.
+func (*RuntimeHandler) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{122}
+}
+
+func (x *RuntimeHandler) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RuntimeHandler) GetFeatures() *RuntimeHandlerFeatures {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
+// RuntimeFeatures describes the set of features implemented by the CRI implementation.
+// The features contained in the RuntimeFeatures should depend only on the cri implementation
+// independent of runtime handlers.
+type RuntimeFeatures struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// supplemental_groups_policy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
+	SupplementalGroupsPolicy bool `protobuf:"varint,1,opt,name=supplemental_groups_policy,json=supplementalGroupsPolicy,proto3" json:"supplemental_groups_policy,omitempty"`
+	// user_namespaces_host_network is set to true if the runtime supports containers using both
+	// host network and user namespace simultaneously.
+	UserNamespacesHostNetwork bool `protobuf:"varint,2,opt,name=user_namespaces_host_network,json=userNamespacesHostNetwork,proto3" json:"user_namespaces_host_network,omitempty"`
+	// mount_options is set to true if the runtime supports additional bind
+	// mount options (noexec, nodev, nosuid) on container mounts.
+	MountOptions  bool `protobuf:"varint,3,opt,name=mount_options,json=mountOptions,proto3" json:"mount_options,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeFeatures) Reset() {
+	*x = RuntimeFeatures{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[123]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeFeatures) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeFeatures) ProtoMessage() {}
+
+func (x *RuntimeFeatures) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[123]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeFeatures.ProtoReflect.Descriptor instead.
+func (*RuntimeFeatures) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{123}
+}
+
+func (x *RuntimeFeatures) GetSupplementalGroupsPolicy() bool {
+	if x != nil {
+		return x.SupplementalGroupsPolicy
+	}
+	return false
+}
+
+func (x *RuntimeFeatures) GetUserNamespacesHostNetwork() bool {
+	if x != nil {
+		return x.UserNamespacesHostNetwork
+	}
+	return false
+}
+
+func (x *RuntimeFeatures) GetMountOptions() bool {
+	if x != nil {
+		return x.MountOptions
+	}
+	return false
+}
+
+type StatusResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Status of the Runtime.
+	Status *RuntimeStatus `protobuf:"bytes,1,opt,name=status,proto3" json:"status,omitempty"`
+	// Info is extra information of the Runtime. The key could be arbitrary string, and
+	// value should be in json format. The information could include anything useful for
+	// debug, e.g. plugins used by the container runtime.
+	// It should only be returned non-empty when Verbose is true.
+	Info map[string]string `protobuf:"bytes,2,rep,name=info,proto3" json:"info,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Runtime handlers.
+	RuntimeHandlers []*RuntimeHandler `protobuf:"bytes,3,rep,name=runtime_handlers,json=runtimeHandlers,proto3" json:"runtime_handlers,omitempty"`
+	// features describes the set of features implemented by the CRI implementation.
+	// This field is supposed to propagate to NodeFeatures in Kubernetes API.
+	Features      *RuntimeFeatures `protobuf:"bytes,4,opt,name=features,proto3" json:"features,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StatusResponse) Reset() {
+	*x = StatusResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[124]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StatusResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StatusResponse) ProtoMessage() {}
+
+func (x *StatusResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[124]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StatusResponse.ProtoReflect.Descriptor instead.
+func (*StatusResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{124}
+}
+
+func (x *StatusResponse) GetStatus() *RuntimeStatus {
+	if x != nil {
+		return x.Status
+	}
+	return nil
+}
+
+func (x *StatusResponse) GetInfo() map[string]string {
+	if x != nil {
+		return x.Info
+	}
+	return nil
+}
+
+func (x *StatusResponse) GetRuntimeHandlers() []*RuntimeHandler {
+	if x != nil {
+		return x.RuntimeHandlers
+	}
+	return nil
+}
+
+func (x *StatusResponse) GetFeatures() *RuntimeFeatures {
+	if x != nil {
+		return x.Features
+	}
+	return nil
+}
+
+type ImageFsInfoRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ImageFsInfoRequest) Reset() {
+	*x = ImageFsInfoRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[125]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ImageFsInfoRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImageFsInfoRequest) ProtoMessage() {}
+
+func (x *ImageFsInfoRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[125]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImageFsInfoRequest.ProtoReflect.Descriptor instead.
+func (*ImageFsInfoRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{125}
+}
+
+// UInt64Value is the wrapper of uint64.
+type UInt64Value struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The value.
+	Value         uint64 `protobuf:"varint,1,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UInt64Value) Reset() {
+	*x = UInt64Value{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[126]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UInt64Value) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UInt64Value) ProtoMessage() {}
+
+func (x *UInt64Value) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[126]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UInt64Value.ProtoReflect.Descriptor instead.
+func (*UInt64Value) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{126}
+}
+
+func (x *UInt64Value) GetValue() uint64 {
+	if x != nil {
+		return x.Value
+	}
+	return 0
+}
+
+// FilesystemIdentifier uniquely identify the filesystem.
+type FilesystemIdentifier struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Mountpoint of a filesystem.
+	Mountpoint    string `protobuf:"bytes,1,opt,name=mountpoint,proto3" json:"mountpoint,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *FilesystemIdentifier) Reset() {
+	*x = FilesystemIdentifier{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[127]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FilesystemIdentifier) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FilesystemIdentifier) ProtoMessage() {}
+
+func (x *FilesystemIdentifier) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[127]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FilesystemIdentifier.ProtoReflect.Descriptor instead.
+func (*FilesystemIdentifier) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{127}
+}
+
+func (x *FilesystemIdentifier) GetMountpoint() string {
+	if x != nil {
+		return x.Mountpoint
+	}
+	return ""
+}
+
+// FilesystemUsage provides the filesystem usage information.
+type FilesystemUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// The unique identifier of the filesystem.
+	FsId *FilesystemIdentifier `protobuf:"bytes,2,opt,name=fs_id,json=fsId,proto3" json:"fs_id,omitempty"`
+	// UsedBytes represents the bytes used for images on the filesystem.
+	// This may differ from the total bytes used on the filesystem and may not
+	// equal CapacityBytes - AvailableBytes.
+	UsedBytes *UInt64Value `protobuf:"bytes,3,opt,name=used_bytes,json=usedBytes,proto3" json:"used_bytes,omitempty"`
+	// InodesUsed represents the inodes used by the images.
+	// This may not equal InodesCapacity - InodesAvailable because the underlying
+	// filesystem may also be used for purposes other than storing images.
+	InodesUsed    *UInt64Value `protobuf:"bytes,4,opt,name=inodes_used,json=inodesUsed,proto3" json:"inodes_used,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *FilesystemUsage) Reset() {
+	*x = FilesystemUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[128]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *FilesystemUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*FilesystemUsage) ProtoMessage() {}
+
+func (x *FilesystemUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[128]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use FilesystemUsage.ProtoReflect.Descriptor instead.
+func (*FilesystemUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{128}
+}
+
+func (x *FilesystemUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *FilesystemUsage) GetFsId() *FilesystemIdentifier {
+	if x != nil {
+		return x.FsId
+	}
+	return nil
+}
+
+func (x *FilesystemUsage) GetUsedBytes() *UInt64Value {
+	if x != nil {
+		return x.UsedBytes
+	}
+	return nil
+}
+
+func (x *FilesystemUsage) GetInodesUsed() *UInt64Value {
+	if x != nil {
+		return x.InodesUsed
+	}
+	return nil
+}
+
+// WindowsFilesystemUsage provides the filesystem usage information specific to Windows.
+type WindowsFilesystemUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// The unique identifier of the filesystem.
+	FsId *FilesystemIdentifier `protobuf:"bytes,2,opt,name=fs_id,json=fsId,proto3" json:"fs_id,omitempty"`
+	// UsedBytes represents the bytes used for images on the filesystem.
+	// This may differ from the total bytes used on the filesystem and may not
+	// equal CapacityBytes - AvailableBytes.
+	UsedBytes     *UInt64Value `protobuf:"bytes,3,opt,name=used_bytes,json=usedBytes,proto3" json:"used_bytes,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsFilesystemUsage) Reset() {
+	*x = WindowsFilesystemUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[129]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsFilesystemUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsFilesystemUsage) ProtoMessage() {}
+
+func (x *WindowsFilesystemUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[129]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsFilesystemUsage.ProtoReflect.Descriptor instead.
+func (*WindowsFilesystemUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{129}
+}
+
+func (x *WindowsFilesystemUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *WindowsFilesystemUsage) GetFsId() *FilesystemIdentifier {
+	if x != nil {
+		return x.FsId
+	}
+	return nil
+}
+
+func (x *WindowsFilesystemUsage) GetUsedBytes() *UInt64Value {
+	if x != nil {
+		return x.UsedBytes
+	}
+	return nil
+}
+
+type ImageFsInfoResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Information of image filesystem(s).
+	ImageFilesystems []*FilesystemUsage `protobuf:"bytes,1,rep,name=image_filesystems,json=imageFilesystems,proto3" json:"image_filesystems,omitempty"`
+	// Information of container filesystem(s).
+	// This is an optional field, may be used for example if container and image
+	// storage are separated.
+	// Default will be to return this as empty.
+	ContainerFilesystems []*FilesystemUsage `protobuf:"bytes,2,rep,name=container_filesystems,json=containerFilesystems,proto3" json:"container_filesystems,omitempty"`
+	unknownFields        protoimpl.UnknownFields
+	sizeCache            protoimpl.SizeCache
+}
+
+func (x *ImageFsInfoResponse) Reset() {
+	*x = ImageFsInfoResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[130]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ImageFsInfoResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ImageFsInfoResponse) ProtoMessage() {}
+
+func (x *ImageFsInfoResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[130]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ImageFsInfoResponse.ProtoReflect.Descriptor instead.
+func (*ImageFsInfoResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{130}
+}
+
+func (x *ImageFsInfoResponse) GetImageFilesystems() []*FilesystemUsage {
+	if x != nil {
+		return x.ImageFilesystems
+	}
+	return nil
+}
+
+func (x *ImageFsInfoResponse) GetContainerFilesystems() []*FilesystemUsage {
+	if x != nil {
+		return x.ContainerFilesystems
+	}
+	return nil
+}
+
+type ContainerStatsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container for which to retrieve stats.
+	ContainerId   string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStatsRequest) Reset() {
+	*x = ContainerStatsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[131]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStatsRequest) ProtoMessage() {}
+
+func (x *ContainerStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[131]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStatsRequest.ProtoReflect.Descriptor instead.
+func (*ContainerStatsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{131}
+}
+
+func (x *ContainerStatsRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+type ContainerStatsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Stats of the container.
+	Stats         *ContainerStats `protobuf:"bytes,1,opt,name=stats,proto3" json:"stats,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStatsResponse) Reset() {
+	*x = ContainerStatsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[132]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStatsResponse) ProtoMessage() {}
+
+func (x *ContainerStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[132]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStatsResponse.ProtoReflect.Descriptor instead.
+func (*ContainerStatsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{132}
+}
+
+func (x *ContainerStatsResponse) GetStats() *ContainerStats {
+	if x != nil {
+		return x.Stats
+	}
+	return nil
+}
+
+type ListContainerStatsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter for the list request.
+	Filter        *ContainerStatsFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListContainerStatsRequest) Reset() {
+	*x = ListContainerStatsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[133]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListContainerStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListContainerStatsRequest) ProtoMessage() {}
+
+func (x *ListContainerStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[133]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListContainerStatsRequest.ProtoReflect.Descriptor instead.
+func (*ListContainerStatsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{133}
+}
+
+func (x *ListContainerStatsRequest) GetFilter() *ContainerStatsFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+// ContainerStatsFilter is used to filter containers.
+// All those fields are combined with 'AND'
+type ContainerStatsFilter struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// ID of the PodSandbox.
+	PodSandboxId string `protobuf:"bytes,2,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// LabelSelector to select matches.
+	// Only api.MatchLabels is supported for now and the requirements
+	// are ANDed. MatchExpressions is not supported yet.
+	LabelSelector map[string]string `protobuf:"bytes,3,rep,name=label_selector,json=labelSelector,proto3" json:"label_selector,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStatsFilter) Reset() {
+	*x = ContainerStatsFilter{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[134]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStatsFilter) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStatsFilter) ProtoMessage() {}
+
+func (x *ContainerStatsFilter) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[134]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStatsFilter.ProtoReflect.Descriptor instead.
+func (*ContainerStatsFilter) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{134}
+}
+
+func (x *ContainerStatsFilter) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ContainerStatsFilter) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *ContainerStatsFilter) GetLabelSelector() map[string]string {
+	if x != nil {
+		return x.LabelSelector
+	}
+	return nil
+}
+
+type ListContainerStatsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Stats of the container.
+	Stats         []*ContainerStats `protobuf:"bytes,1,rep,name=stats,proto3" json:"stats,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListContainerStatsResponse) Reset() {
+	*x = ListContainerStatsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[135]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListContainerStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListContainerStatsResponse) ProtoMessage() {}
+
+func (x *ListContainerStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[135]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListContainerStatsResponse.ProtoReflect.Descriptor instead.
+func (*ListContainerStatsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{135}
+}
+
+func (x *ListContainerStatsResponse) GetStats() []*ContainerStats {
+	if x != nil {
+		return x.Stats
+	}
+	return nil
+}
+
+type StreamContainerStatsRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Filter for the list request.
+	Filter        *ContainerStatsFilter `protobuf:"bytes,1,opt,name=filter,proto3" json:"filter,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamContainerStatsRequest) Reset() {
+	*x = StreamContainerStatsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[136]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamContainerStatsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamContainerStatsRequest) ProtoMessage() {}
+
+func (x *StreamContainerStatsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[136]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamContainerStatsRequest.ProtoReflect.Descriptor instead.
+func (*StreamContainerStatsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{136}
+}
+
+func (x *StreamContainerStatsRequest) GetFilter() *ContainerStatsFilter {
+	if x != nil {
+		return x.Filter
+	}
+	return nil
+}
+
+type StreamContainerStatsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of container stats.
+	ContainerStats []*ContainerStats `protobuf:"bytes,1,rep,name=container_stats,json=containerStats,proto3" json:"container_stats,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *StreamContainerStatsResponse) Reset() {
+	*x = StreamContainerStatsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[137]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamContainerStatsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamContainerStatsResponse) ProtoMessage() {}
+
+func (x *StreamContainerStatsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[137]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamContainerStatsResponse.ProtoReflect.Descriptor instead.
+func (*StreamContainerStatsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{137}
+}
+
+func (x *StreamContainerStatsResponse) GetContainerStats() []*ContainerStats {
+	if x != nil {
+		return x.ContainerStats
+	}
+	return nil
+}
+
+// ContainerAttributes provides basic information of the container.
+type ContainerAttributes struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container.
+	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	// Metadata of the container.
+	Metadata *ContainerMetadata `protobuf:"bytes,2,opt,name=metadata,proto3" json:"metadata,omitempty"`
+	// Key-value pairs that may be used to scope and select individual resources.
+	Labels map[string]string `protobuf:"bytes,3,rep,name=labels,proto3" json:"labels,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Unstructured key-value map holding arbitrary metadata.
+	// Annotations MUST NOT be altered by the runtime; the value of this field
+	// MUST be identical to that of the corresponding ContainerConfig used to
+	// instantiate the Container this status represents.
+	Annotations   map[string]string `protobuf:"bytes,4,rep,name=annotations,proto3" json:"annotations,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerAttributes) Reset() {
+	*x = ContainerAttributes{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[138]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerAttributes) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerAttributes) ProtoMessage() {}
+
+func (x *ContainerAttributes) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[138]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerAttributes.ProtoReflect.Descriptor instead.
+func (*ContainerAttributes) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{138}
+}
+
+func (x *ContainerAttributes) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *ContainerAttributes) GetMetadata() *ContainerMetadata {
+	if x != nil {
+		return x.Metadata
+	}
+	return nil
+}
+
+func (x *ContainerAttributes) GetLabels() map[string]string {
+	if x != nil {
+		return x.Labels
+	}
+	return nil
+}
+
+func (x *ContainerAttributes) GetAnnotations() map[string]string {
+	if x != nil {
+		return x.Annotations
+	}
+	return nil
+}
+
+// ContainerStats provides the resource usage statistics for a container.
+type ContainerStats struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Information of the container.
+	Attributes *ContainerAttributes `protobuf:"bytes,1,opt,name=attributes,proto3" json:"attributes,omitempty"`
+	// CPU usage gathered from the container.
+	Cpu *CpuUsage `protobuf:"bytes,2,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	// Memory usage gathered from the container.
+	Memory *MemoryUsage `protobuf:"bytes,3,opt,name=memory,proto3" json:"memory,omitempty"`
+	// Usage of the writable layer.
+	WritableLayer *FilesystemUsage `protobuf:"bytes,4,opt,name=writable_layer,json=writableLayer,proto3" json:"writable_layer,omitempty"`
+	// Swap usage gathered from the container.
+	Swap *SwapUsage `protobuf:"bytes,5,opt,name=swap,proto3" json:"swap,omitempty"`
+	// IO usage gathered from the container.
+	Io            *IoUsage `protobuf:"bytes,6,opt,name=io,proto3" json:"io,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerStats) Reset() {
+	*x = ContainerStats{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[139]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerStats) ProtoMessage() {}
+
+func (x *ContainerStats) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[139]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerStats.ProtoReflect.Descriptor instead.
+func (*ContainerStats) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{139}
+}
+
+func (x *ContainerStats) GetAttributes() *ContainerAttributes {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *ContainerStats) GetCpu() *CpuUsage {
+	if x != nil {
+		return x.Cpu
+	}
+	return nil
+}
+
+func (x *ContainerStats) GetMemory() *MemoryUsage {
+	if x != nil {
+		return x.Memory
+	}
+	return nil
+}
+
+func (x *ContainerStats) GetWritableLayer() *FilesystemUsage {
+	if x != nil {
+		return x.WritableLayer
+	}
+	return nil
+}
+
+func (x *ContainerStats) GetSwap() *SwapUsage {
+	if x != nil {
+		return x.Swap
+	}
+	return nil
+}
+
+func (x *ContainerStats) GetIo() *IoUsage {
+	if x != nil {
+		return x.Io
+	}
+	return nil
+}
+
+// WindowsContainerStats provides the resource usage statistics for a container specific for Windows
+type WindowsContainerStats struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Information of the container.
+	Attributes *ContainerAttributes `protobuf:"bytes,1,opt,name=attributes,proto3" json:"attributes,omitempty"`
+	// CPU usage gathered from the container.
+	Cpu *WindowsCpuUsage `protobuf:"bytes,2,opt,name=cpu,proto3" json:"cpu,omitempty"`
+	// Memory usage gathered from the container.
+	Memory *WindowsMemoryUsage `protobuf:"bytes,3,opt,name=memory,proto3" json:"memory,omitempty"`
+	// Usage of the writable layer.
+	WritableLayer *WindowsFilesystemUsage `protobuf:"bytes,4,opt,name=writable_layer,json=writableLayer,proto3" json:"writable_layer,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *WindowsContainerStats) Reset() {
+	*x = WindowsContainerStats{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[140]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsContainerStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsContainerStats) ProtoMessage() {}
+
+func (x *WindowsContainerStats) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[140]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsContainerStats.ProtoReflect.Descriptor instead.
+func (*WindowsContainerStats) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{140}
+}
+
+func (x *WindowsContainerStats) GetAttributes() *ContainerAttributes {
+	if x != nil {
+		return x.Attributes
+	}
+	return nil
+}
+
+func (x *WindowsContainerStats) GetCpu() *WindowsCpuUsage {
+	if x != nil {
+		return x.Cpu
+	}
+	return nil
+}
+
+func (x *WindowsContainerStats) GetMemory() *WindowsMemoryUsage {
+	if x != nil {
+		return x.Memory
+	}
+	return nil
+}
+
+func (x *WindowsContainerStats) GetWritableLayer() *WindowsFilesystemUsage {
+	if x != nil {
+		return x.WritableLayer
+	}
+	return nil
+}
+
+// PSI statistics for an individual resource.
+type PsiStats struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// PSI data for all tasks in the cgroup.
+	Full *PsiData `protobuf:"bytes,1,opt,name=Full,proto3" json:"Full,omitempty"`
+	// PSI data for some tasks in the cgroup.
+	Some          *PsiData `protobuf:"bytes,2,opt,name=Some,proto3" json:"Some,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PsiStats) Reset() {
+	*x = PsiStats{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[141]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PsiStats) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PsiStats) ProtoMessage() {}
+
+func (x *PsiStats) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[141]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PsiStats.ProtoReflect.Descriptor instead.
+func (*PsiStats) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{141}
+}
+
+func (x *PsiStats) GetFull() *PsiData {
+	if x != nil {
+		return x.Full
+	}
+	return nil
+}
+
+func (x *PsiStats) GetSome() *PsiData {
+	if x != nil {
+		return x.Some
+	}
+	return nil
+}
+
+// PSI data for an individual resource.
+type PsiData struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Total time duration for tasks in the cgroup have waited due to congestion.
+	// Unit: nanoseconds.
+	Total uint64 `protobuf:"varint,1,opt,name=Total,proto3" json:"Total,omitempty"`
+	// The average (in %) tasks have waited due to congestion over a 10 second window.
+	Avg10 float64 `protobuf:"fixed64,2,opt,name=Avg10,proto3" json:"Avg10,omitempty"`
+	// The average (in %) tasks have waited due to congestion over a 60 second window.
+	Avg60 float64 `protobuf:"fixed64,3,opt,name=Avg60,proto3" json:"Avg60,omitempty"`
+	// The average (in %) tasks have waited due to congestion over a 300 second window.
+	Avg300        float64 `protobuf:"fixed64,4,opt,name=Avg300,proto3" json:"Avg300,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *PsiData) Reset() {
+	*x = PsiData{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[142]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PsiData) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PsiData) ProtoMessage() {}
+
+func (x *PsiData) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[142]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PsiData.ProtoReflect.Descriptor instead.
+func (*PsiData) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{142}
+}
+
+func (x *PsiData) GetTotal() uint64 {
+	if x != nil {
+		return x.Total
+	}
+	return 0
+}
+
+func (x *PsiData) GetAvg10() float64 {
+	if x != nil {
+		return x.Avg10
+	}
+	return 0
+}
+
+func (x *PsiData) GetAvg60() float64 {
+	if x != nil {
+		return x.Avg60
+	}
+	return 0
+}
+
+func (x *PsiData) GetAvg300() float64 {
+	if x != nil {
+		return x.Avg300
+	}
+	return 0
+}
+
+// CpuUsage provides the CPU usage information.
+type CpuUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Cumulative CPU usage (sum across all cores) since object creation.
+	UsageCoreNanoSeconds *UInt64Value `protobuf:"bytes,2,opt,name=usage_core_nano_seconds,json=usageCoreNanoSeconds,proto3" json:"usage_core_nano_seconds,omitempty"`
+	// Total CPU usage (sum of all cores) averaged over the sample window.
+	// The "core" unit can be interpreted as CPU core-nanoseconds per second.
+	UsageNanoCores *UInt64Value `protobuf:"bytes,3,opt,name=usage_nano_cores,json=usageNanoCores,proto3" json:"usage_nano_cores,omitempty"`
+	// CPU PSI statistics.
+	Psi           *PsiStats `protobuf:"bytes,4,opt,name=psi,proto3" json:"psi,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CpuUsage) Reset() {
+	*x = CpuUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[143]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CpuUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CpuUsage) ProtoMessage() {}
+
+func (x *CpuUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[143]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CpuUsage.ProtoReflect.Descriptor instead.
+func (*CpuUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{143}
+}
+
+func (x *CpuUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *CpuUsage) GetUsageCoreNanoSeconds() *UInt64Value {
+	if x != nil {
+		return x.UsageCoreNanoSeconds
+	}
+	return nil
+}
+
+func (x *CpuUsage) GetUsageNanoCores() *UInt64Value {
+	if x != nil {
+		return x.UsageNanoCores
+	}
+	return nil
+}
+
+func (x *CpuUsage) GetPsi() *PsiStats {
+	if x != nil {
+		return x.Psi
+	}
+	return nil
+}
+
+// WindowsCpuUsage provides the CPU usage information specific to Windows
+type WindowsCpuUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Cumulative CPU usage (sum across all cores) since object creation.
+	UsageCoreNanoSeconds *UInt64Value `protobuf:"bytes,2,opt,name=usage_core_nano_seconds,json=usageCoreNanoSeconds,proto3" json:"usage_core_nano_seconds,omitempty"`
+	// Total CPU usage (sum of all cores) averaged over the sample window.
+	// The "core" unit can be interpreted as CPU core-nanoseconds per second.
+	UsageNanoCores *UInt64Value `protobuf:"bytes,3,opt,name=usage_nano_cores,json=usageNanoCores,proto3" json:"usage_nano_cores,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *WindowsCpuUsage) Reset() {
+	*x = WindowsCpuUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[144]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsCpuUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsCpuUsage) ProtoMessage() {}
+
+func (x *WindowsCpuUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[144]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsCpuUsage.ProtoReflect.Descriptor instead.
+func (*WindowsCpuUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{144}
+}
+
+func (x *WindowsCpuUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *WindowsCpuUsage) GetUsageCoreNanoSeconds() *UInt64Value {
+	if x != nil {
+		return x.UsageCoreNanoSeconds
+	}
+	return nil
+}
+
+func (x *WindowsCpuUsage) GetUsageNanoCores() *UInt64Value {
+	if x != nil {
+		return x.UsageNanoCores
+	}
+	return nil
+}
+
+// MemoryUsage provides the memory usage information.
+type MemoryUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// The amount of working set memory in bytes.
+	WorkingSetBytes *UInt64Value `protobuf:"bytes,2,opt,name=working_set_bytes,json=workingSetBytes,proto3" json:"working_set_bytes,omitempty"`
+	// Available memory for use. This is defined as the memory limit - workingSetBytes.
+	AvailableBytes *UInt64Value `protobuf:"bytes,3,opt,name=available_bytes,json=availableBytes,proto3" json:"available_bytes,omitempty"`
+	// Total memory in use. This includes all memory regardless of when it was accessed.
+	UsageBytes *UInt64Value `protobuf:"bytes,4,opt,name=usage_bytes,json=usageBytes,proto3" json:"usage_bytes,omitempty"`
+	// The amount of anonymous and swap cache memory (includes transparent hugepages).
+	RssBytes *UInt64Value `protobuf:"bytes,5,opt,name=rss_bytes,json=rssBytes,proto3" json:"rss_bytes,omitempty"`
+	// Cumulative number of minor page faults.
+	PageFaults *UInt64Value `protobuf:"bytes,6,opt,name=page_faults,json=pageFaults,proto3" json:"page_faults,omitempty"`
+	// Cumulative number of major page faults.
+	MajorPageFaults *UInt64Value `protobuf:"bytes,7,opt,name=major_page_faults,json=majorPageFaults,proto3" json:"major_page_faults,omitempty"`
+	// Memory PSI statistics.
+	Psi           *PsiStats `protobuf:"bytes,8,opt,name=psi,proto3" json:"psi,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MemoryUsage) Reset() {
+	*x = MemoryUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[145]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MemoryUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MemoryUsage) ProtoMessage() {}
+
+func (x *MemoryUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[145]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MemoryUsage.ProtoReflect.Descriptor instead.
+func (*MemoryUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{145}
+}
+
+func (x *MemoryUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *MemoryUsage) GetWorkingSetBytes() *UInt64Value {
+	if x != nil {
+		return x.WorkingSetBytes
+	}
+	return nil
+}
+
+func (x *MemoryUsage) GetAvailableBytes() *UInt64Value {
+	if x != nil {
+		return x.AvailableBytes
+	}
+	return nil
+}
+
+func (x *MemoryUsage) GetUsageBytes() *UInt64Value {
+	if x != nil {
+		return x.UsageBytes
+	}
+	return nil
+}
+
+func (x *MemoryUsage) GetRssBytes() *UInt64Value {
+	if x != nil {
+		return x.RssBytes
+	}
+	return nil
+}
+
+func (x *MemoryUsage) GetPageFaults() *UInt64Value {
+	if x != nil {
+		return x.PageFaults
+	}
+	return nil
+}
+
+func (x *MemoryUsage) GetMajorPageFaults() *UInt64Value {
+	if x != nil {
+		return x.MajorPageFaults
+	}
+	return nil
+}
+
+func (x *MemoryUsage) GetPsi() *PsiStats {
+	if x != nil {
+		return x.Psi
+	}
+	return nil
+}
+
+type IoUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// IO PSI statistics.
+	Psi           *PsiStats `protobuf:"bytes,2,opt,name=psi,proto3" json:"psi,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *IoUsage) Reset() {
+	*x = IoUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[146]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *IoUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IoUsage) ProtoMessage() {}
+
+func (x *IoUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[146]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IoUsage.ProtoReflect.Descriptor instead.
+func (*IoUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{146}
+}
+
+func (x *IoUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *IoUsage) GetPsi() *PsiStats {
+	if x != nil {
+		return x.Psi
+	}
+	return nil
+}
+
+type SwapUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// Available swap for use. This is defined as the swap limit - swapUsageBytes.
+	SwapAvailableBytes *UInt64Value `protobuf:"bytes,2,opt,name=swap_available_bytes,json=swapAvailableBytes,proto3" json:"swap_available_bytes,omitempty"`
+	// Total memory in use. This includes all memory regardless of when it was accessed.
+	SwapUsageBytes *UInt64Value `protobuf:"bytes,3,opt,name=swap_usage_bytes,json=swapUsageBytes,proto3" json:"swap_usage_bytes,omitempty"`
+	unknownFields  protoimpl.UnknownFields
+	sizeCache      protoimpl.SizeCache
+}
+
+func (x *SwapUsage) Reset() {
+	*x = SwapUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[147]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *SwapUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*SwapUsage) ProtoMessage() {}
+
+func (x *SwapUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[147]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use SwapUsage.ProtoReflect.Descriptor instead.
+func (*SwapUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{147}
+}
+
+func (x *SwapUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *SwapUsage) GetSwapAvailableBytes() *UInt64Value {
+	if x != nil {
+		return x.SwapAvailableBytes
+	}
+	return nil
+}
+
+func (x *SwapUsage) GetSwapUsageBytes() *UInt64Value {
+	if x != nil {
+		return x.SwapUsageBytes
+	}
+	return nil
+}
+
+// WindowsMemoryUsage provides the memory usage information specific to Windows
+type WindowsMemoryUsage struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Timestamp in nanoseconds at which the information were collected. Must be > 0.
+	Timestamp int64 `protobuf:"varint,1,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	// The amount of working set memory in bytes.
+	WorkingSetBytes *UInt64Value `protobuf:"bytes,2,opt,name=working_set_bytes,json=workingSetBytes,proto3" json:"working_set_bytes,omitempty"`
+	// Available memory for use. This is defined as the memory limit - commit_memory_bytes.
+	AvailableBytes *UInt64Value `protobuf:"bytes,3,opt,name=available_bytes,json=availableBytes,proto3" json:"available_bytes,omitempty"`
+	// Cumulative number of page faults.
+	PageFaults *UInt64Value `protobuf:"bytes,4,opt,name=page_faults,json=pageFaults,proto3" json:"page_faults,omitempty"`
+	// Total commit memory in use. Commit memory is total of physical and virtual memory in use.
+	CommitMemoryBytes *UInt64Value `protobuf:"bytes,5,opt,name=commit_memory_bytes,json=commitMemoryBytes,proto3" json:"commit_memory_bytes,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *WindowsMemoryUsage) Reset() {
+	*x = WindowsMemoryUsage{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[148]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *WindowsMemoryUsage) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WindowsMemoryUsage) ProtoMessage() {}
+
+func (x *WindowsMemoryUsage) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[148]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WindowsMemoryUsage.ProtoReflect.Descriptor instead.
+func (*WindowsMemoryUsage) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{148}
+}
+
+func (x *WindowsMemoryUsage) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *WindowsMemoryUsage) GetWorkingSetBytes() *UInt64Value {
+	if x != nil {
+		return x.WorkingSetBytes
+	}
+	return nil
+}
+
+func (x *WindowsMemoryUsage) GetAvailableBytes() *UInt64Value {
+	if x != nil {
+		return x.AvailableBytes
+	}
+	return nil
+}
+
+func (x *WindowsMemoryUsage) GetPageFaults() *UInt64Value {
+	if x != nil {
+		return x.PageFaults
+	}
+	return nil
+}
+
+func (x *WindowsMemoryUsage) GetCommitMemoryBytes() *UInt64Value {
+	if x != nil {
+		return x.CommitMemoryBytes
+	}
+	return nil
+}
+
+type ReopenContainerLogRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container for which to reopen the log.
+	ContainerId   string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ReopenContainerLogRequest) Reset() {
+	*x = ReopenContainerLogRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[149]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ReopenContainerLogRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReopenContainerLogRequest) ProtoMessage() {}
+
+func (x *ReopenContainerLogRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[149]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReopenContainerLogRequest.ProtoReflect.Descriptor instead.
+func (*ReopenContainerLogRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{149}
+}
+
+func (x *ReopenContainerLogRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+type ReopenContainerLogResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ReopenContainerLogResponse) Reset() {
+	*x = ReopenContainerLogResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[150]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ReopenContainerLogResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ReopenContainerLogResponse) ProtoMessage() {}
+
+func (x *ReopenContainerLogResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[150]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ReopenContainerLogResponse.ProtoReflect.Descriptor instead.
+func (*ReopenContainerLogResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{150}
+}
+
+type CheckpointContainerRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container to be checkpointed.
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Location of the checkpoint archive used for export
+	Location string `protobuf:"bytes,2,opt,name=location,proto3" json:"location,omitempty"`
+	// Timeout in seconds for the checkpoint to complete.
+	// Timeout of zero means to use the CRI default.
+	// Timeout > 0 means to use the user specified timeout.
+	Timeout       int64 `protobuf:"varint,3,opt,name=timeout,proto3" json:"timeout,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointContainerRequest) Reset() {
+	*x = CheckpointContainerRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[151]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointContainerRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointContainerRequest) ProtoMessage() {}
+
+func (x *CheckpointContainerRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[151]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointContainerRequest.ProtoReflect.Descriptor instead.
+func (*CheckpointContainerRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{151}
+}
+
+func (x *CheckpointContainerRequest) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *CheckpointContainerRequest) GetLocation() string {
+	if x != nil {
+		return x.Location
+	}
+	return ""
+}
+
+func (x *CheckpointContainerRequest) GetTimeout() int64 {
+	if x != nil {
+		return x.Timeout
+	}
+	return 0
+}
+
+type CheckpointContainerResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointContainerResponse) Reset() {
+	*x = CheckpointContainerResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[152]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointContainerResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointContainerResponse) ProtoMessage() {}
+
+func (x *CheckpointContainerResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[152]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointContainerResponse.ProtoReflect.Descriptor instead.
+func (*CheckpointContainerResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{152}
+}
+
+type CheckpointPodRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the pod sandbox to be checkpointed.
+	PodSandboxId string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Absolute path to an existing, empty directory where the runtime must
+	// write the checkpoint. The caller owns the directory, makes it writable by
+	// the runtime, and should restrict access to the caller and runtime. The
+	// runtime must not remove the directory. A Pod checkpoint is a collection
+	// of runtime-defined files; their layout and format are opaque to the
+	// caller. The runtime must not write outside this directory and must remove
+	// partial artifacts before returning an error.
+	OutputPath string `protobuf:"bytes,2,opt,name=output_path,json=outputPath,proto3" json:"output_path,omitempty"`
+	// IDs of the containers to include in the checkpoint. The list must be
+	// non-empty, must not contain duplicates, and must contain exactly the
+	// running containers selected by the caller. Every container must belong to
+	// `pod_sandbox_id` and be running; otherwise the runtime must fail the
+	// request without producing a checkpoint.
+	ContainerIds []string `protobuf:"bytes,3,rep,name=container_ids,json=containerIds,proto3" json:"container_ids,omitempty"`
+	// Optional opaque runtime-specific checkpoint options supplied by the CRI
+	// caller. Keys are interpreted in the scope of the pod sandbox's runtime
+	// handler. Kubernetes does not expose these options in its alpha API and
+	// kubelet sends an empty map. Direct CRI callers may set keys documented by
+	// the selected runtime. The runtime must reject unsupported or invalid keys
+	// and values rather than silently ignore them. Options must not contain
+	// secrets.
+	Options       map[string]string `protobuf:"bytes,4,rep,name=options,proto3" json:"options,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointPodRequest) Reset() {
+	*x = CheckpointPodRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[153]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointPodRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointPodRequest) ProtoMessage() {}
+
+func (x *CheckpointPodRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[153]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointPodRequest.ProtoReflect.Descriptor instead.
+func (*CheckpointPodRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{153}
+}
+
+func (x *CheckpointPodRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *CheckpointPodRequest) GetOutputPath() string {
+	if x != nil {
+		return x.OutputPath
+	}
+	return ""
+}
+
+func (x *CheckpointPodRequest) GetContainerIds() []string {
+	if x != nil {
+		return x.ContainerIds
+	}
+	return nil
+}
+
+func (x *CheckpointPodRequest) GetOptions() map[string]string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+// Empty: the checkpoint is written under the request's `output_path` directory,
+// which the caller provided and already knows, so there is no separate location
+// or object name to return.
+type CheckpointPodResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *CheckpointPodResponse) Reset() {
+	*x = CheckpointPodResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[154]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *CheckpointPodResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckpointPodResponse) ProtoMessage() {}
+
+func (x *CheckpointPodResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[154]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckpointPodResponse.ProtoReflect.Descriptor instead.
+func (*CheckpointPodResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{154}
+}
+
+type RestorePodRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Absolute path to the directory containing the checkpoint data to restore.
+	// The runtime must not modify the checkpoint data. The data format and
+	// layout are runtime-defined.
+	CheckpointPath string `protobuf:"bytes,1,opt,name=checkpoint_path,json=checkpointPath,proto3" json:"checkpoint_path,omitempty"`
+	// Pod sandbox configuration supplied by the kubelet, with node-local restore-time
+	// updates (new Pod UID, cgroup parent path, log directory). Pod-spec equality between
+	// the live Pod and status.checkpointedPodTemplate of the referenced PodCheckpoint is
+	// enforced at API-server admission (and re-checked by the kubelet before this call);
+	// arbitrary user overrides are not permitted.
+	Config *PodSandboxConfig `protobuf:"bytes,2,opt,name=config,proto3" json:"config,omitempty"`
+	// Runtime handler to use for restoring the pod sandbox and its containers.
+	// The handler selects the configured runtime implementation that interprets
+	// the runtime-specific checkpoint data. The selected handler must be
+	// compatible with the checkpoint; the runtime must reject a checkpoint it
+	// cannot restore. An empty value selects the default handler, as for
+	// RunPodSandboxRequest. The runtime must reject an unknown non-empty handler.
+	RuntimeHandler string `protobuf:"bytes,3,opt,name=runtime_handler,json=runtimeHandler,proto3" json:"runtime_handler,omitempty"`
+	// Optional opaque runtime-specific restore options supplied by the CRI
+	// caller. Keys are interpreted in the scope of `runtime_handler`.
+	// Kubernetes does not expose these options in its alpha API and kubelet
+	// sends an empty map. Direct CRI callers may set keys documented by the
+	// selected runtime. The runtime must reject unsupported or invalid keys and
+	// values rather than silently ignore them. Options must not contain secrets.
+	Options map[string]string `protobuf:"bytes,4,rep,name=options,proto3" json:"options,omitempty" protobuf_key:"bytes,1,opt,name=key" protobuf_val:"bytes,2,opt,name=value"`
+	// Complete restore-time configurations for all containers represented by
+	// the checkpoint. The list must be non-empty. Every entry must have a
+	// non-empty, unique metadata name, and those names must be the exact set of
+	// container names in the checkpoint. The runtime must match containers by
+	// metadata name. The checkpoint is authoritative for filesystem and
+	// process state. Image, command, args, working directory, environment, and
+	// process credentials describe the expected checkpointed process; they
+	// must not start or mutate it, and any mismatch the runtime can validate
+	// must fail the restore. The runtime applies restore-time settings outside
+	// checkpoint-owned process state, including labels, annotations, mounts,
+	// devices, Linux resources, logging, and security constraints, and must
+	// fail settings incompatible with the checkpoint.
+	ContainerConfigs []*ContainerConfig `protobuf:"bytes,5,rep,name=container_configs,json=containerConfigs,proto3" json:"container_configs,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *RestorePodRequest) Reset() {
+	*x = RestorePodRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[155]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestorePodRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestorePodRequest) ProtoMessage() {}
+
+func (x *RestorePodRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[155]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestorePodRequest.ProtoReflect.Descriptor instead.
+func (*RestorePodRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{155}
+}
+
+func (x *RestorePodRequest) GetCheckpointPath() string {
+	if x != nil {
+		return x.CheckpointPath
+	}
+	return ""
+}
+
+func (x *RestorePodRequest) GetConfig() *PodSandboxConfig {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+func (x *RestorePodRequest) GetRuntimeHandler() string {
+	if x != nil {
+		return x.RuntimeHandler
+	}
+	return ""
+}
+
+func (x *RestorePodRequest) GetOptions() map[string]string {
+	if x != nil {
+		return x.Options
+	}
+	return nil
+}
+
+func (x *RestorePodRequest) GetContainerConfigs() []*ContainerConfig {
+	if x != nil {
+		return x.ContainerConfigs
+	}
+	return nil
+}
+
+type RestoredContainer struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name from the restored container's ContainerMetadata. This identifies
+	// which requested container configuration produced the runtime ID.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Non-empty runtime ID of the restored container.
+	ContainerId   string `protobuf:"bytes,2,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RestoredContainer) Reset() {
+	*x = RestoredContainer{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[156]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestoredContainer) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestoredContainer) ProtoMessage() {}
+
+func (x *RestoredContainer) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[156]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestoredContainer.ProtoReflect.Descriptor instead.
+func (*RestoredContainer) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{156}
+}
+
+func (x *RestoredContainer) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *RestoredContainer) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+type RestorePodResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Non-empty ID of the restored pod sandbox.
+	PodSandboxId string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Restored containers in CREATED state, without having executed the
+	// restored process (see RestorePod). This must contain exactly one entry
+	// for every request.container_configs entry. Names and container IDs
+	// must each be non-empty and unique.
+	RestoredContainers []*RestoredContainer `protobuf:"bytes,2,rep,name=restored_containers,json=restoredContainers,proto3" json:"restored_containers,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *RestorePodResponse) Reset() {
+	*x = RestorePodResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[157]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RestorePodResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RestorePodResponse) ProtoMessage() {}
+
+func (x *RestorePodResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[157]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RestorePodResponse.ProtoReflect.Descriptor instead.
+func (*RestorePodResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{157}
+}
+
+func (x *RestorePodResponse) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *RestorePodResponse) GetRestoredContainers() []*RestoredContainer {
+	if x != nil {
+		return x.RestoredContainers
+	}
+	return nil
+}
+
+type GetEventsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *GetEventsRequest) Reset() {
+	*x = GetEventsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[158]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *GetEventsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetEventsRequest) ProtoMessage() {}
+
+func (x *GetEventsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[158]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetEventsRequest.ProtoReflect.Descriptor instead.
+func (*GetEventsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{158}
+}
+
+type ContainerEventResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the container
+	ContainerId string `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	// Type of the container event
+	ContainerEventType ContainerEventType `protobuf:"varint,2,opt,name=container_event_type,json=containerEventType,proto3,enum=runtime.v1.ContainerEventType" json:"container_event_type,omitempty"`
+	// Creation timestamp in nanoseconds of this event
+	CreatedAt int64 `protobuf:"varint,3,opt,name=created_at,json=createdAt,proto3" json:"created_at,omitempty"`
+	// Sandbox status
+	PodSandboxStatus *PodSandboxStatus `protobuf:"bytes,4,opt,name=pod_sandbox_status,json=podSandboxStatus,proto3" json:"pod_sandbox_status,omitempty"`
+	// Container statuses
+	ContainersStatuses []*ContainerStatus `protobuf:"bytes,5,rep,name=containers_statuses,json=containersStatuses,proto3" json:"containers_statuses,omitempty"`
+	unknownFields      protoimpl.UnknownFields
+	sizeCache          protoimpl.SizeCache
+}
+
+func (x *ContainerEventResponse) Reset() {
+	*x = ContainerEventResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[159]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerEventResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerEventResponse) ProtoMessage() {}
+
+func (x *ContainerEventResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[159]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerEventResponse.ProtoReflect.Descriptor instead.
+func (*ContainerEventResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{159}
+}
+
+func (x *ContainerEventResponse) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *ContainerEventResponse) GetContainerEventType() ContainerEventType {
+	if x != nil {
+		return x.ContainerEventType
+	}
+	return ContainerEventType_CONTAINER_CREATED_EVENT
+}
+
+func (x *ContainerEventResponse) GetCreatedAt() int64 {
+	if x != nil {
+		return x.CreatedAt
+	}
+	return 0
+}
+
+func (x *ContainerEventResponse) GetPodSandboxStatus() *PodSandboxStatus {
+	if x != nil {
+		return x.PodSandboxStatus
+	}
+	return nil
+}
+
+func (x *ContainerEventResponse) GetContainersStatuses() []*ContainerStatus {
+	if x != nil {
+		return x.ContainersStatuses
+	}
+	return nil
+}
+
+type ListMetricDescriptorsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListMetricDescriptorsRequest) Reset() {
+	*x = ListMetricDescriptorsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[160]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListMetricDescriptorsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListMetricDescriptorsRequest) ProtoMessage() {}
+
+func (x *ListMetricDescriptorsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[160]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListMetricDescriptorsRequest.ProtoReflect.Descriptor instead.
+func (*ListMetricDescriptorsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{160}
+}
+
+type ListMetricDescriptorsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Descriptors   []*MetricDescriptor    `protobuf:"bytes,1,rep,name=descriptors,proto3" json:"descriptors,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListMetricDescriptorsResponse) Reset() {
+	*x = ListMetricDescriptorsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[161]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListMetricDescriptorsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListMetricDescriptorsResponse) ProtoMessage() {}
+
+func (x *ListMetricDescriptorsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[161]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListMetricDescriptorsResponse.ProtoReflect.Descriptor instead.
+func (*ListMetricDescriptorsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{161}
+}
+
+func (x *ListMetricDescriptorsResponse) GetDescriptors() []*MetricDescriptor {
+	if x != nil {
+		return x.Descriptors
+	}
+	return nil
+}
+
+type MetricDescriptor struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// The name field will be used as a unique identifier of this MetricDescriptor,
+	// and be used in conjunction with the Metric structure to populate the full Metric.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Help string `protobuf:"bytes,2,opt,name=help,proto3" json:"help,omitempty"`
+	// When a metric uses this metric descriptor, it should only define
+	// labels that have previously been declared in label_keys.
+	// It is the responsibility of the runtime to correctly keep sorted the keys and values.
+	// If the two slices have different length, the behavior is undefined.
+	LabelKeys     []string `protobuf:"bytes,3,rep,name=label_keys,json=labelKeys,proto3" json:"label_keys,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *MetricDescriptor) Reset() {
+	*x = MetricDescriptor{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[162]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *MetricDescriptor) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*MetricDescriptor) ProtoMessage() {}
+
+func (x *MetricDescriptor) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[162]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use MetricDescriptor.ProtoReflect.Descriptor instead.
+func (*MetricDescriptor) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{162}
+}
+
+func (x *MetricDescriptor) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *MetricDescriptor) GetHelp() string {
+	if x != nil {
+		return x.Help
+	}
+	return ""
+}
+
+func (x *MetricDescriptor) GetLabelKeys() []string {
+	if x != nil {
+		return x.LabelKeys
+	}
+	return nil
+}
+
+type ListPodSandboxMetricsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPodSandboxMetricsRequest) Reset() {
+	*x = ListPodSandboxMetricsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[163]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPodSandboxMetricsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPodSandboxMetricsRequest) ProtoMessage() {}
+
+func (x *ListPodSandboxMetricsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[163]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPodSandboxMetricsRequest.ProtoReflect.Descriptor instead.
+func (*ListPodSandboxMetricsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{163}
+}
+
+type ListPodSandboxMetricsResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	PodMetrics    []*PodSandboxMetrics   `protobuf:"bytes,1,rep,name=pod_metrics,json=podMetrics,proto3" json:"pod_metrics,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ListPodSandboxMetricsResponse) Reset() {
+	*x = ListPodSandboxMetricsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[164]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ListPodSandboxMetricsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ListPodSandboxMetricsResponse) ProtoMessage() {}
+
+func (x *ListPodSandboxMetricsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[164]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ListPodSandboxMetricsResponse.ProtoReflect.Descriptor instead.
+func (*ListPodSandboxMetricsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{164}
+}
+
+func (x *ListPodSandboxMetricsResponse) GetPodMetrics() []*PodSandboxMetrics {
+	if x != nil {
+		return x.PodMetrics
+	}
+	return nil
+}
+
+type StreamPodSandboxMetricsRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *StreamPodSandboxMetricsRequest) Reset() {
+	*x = StreamPodSandboxMetricsRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[165]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamPodSandboxMetricsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamPodSandboxMetricsRequest) ProtoMessage() {}
+
+func (x *StreamPodSandboxMetricsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[165]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamPodSandboxMetricsRequest.ProtoReflect.Descriptor instead.
+func (*StreamPodSandboxMetricsRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{165}
+}
+
+type StreamPodSandboxMetricsResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// List of pod sandbox metrics.
+	PodSandboxMetrics []*PodSandboxMetrics `protobuf:"bytes,1,rep,name=pod_sandbox_metrics,json=podSandboxMetrics,proto3" json:"pod_sandbox_metrics,omitempty"`
+	unknownFields     protoimpl.UnknownFields
+	sizeCache         protoimpl.SizeCache
+}
+
+func (x *StreamPodSandboxMetricsResponse) Reset() {
+	*x = StreamPodSandboxMetricsResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[166]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *StreamPodSandboxMetricsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*StreamPodSandboxMetricsResponse) ProtoMessage() {}
+
+func (x *StreamPodSandboxMetricsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[166]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use StreamPodSandboxMetricsResponse.ProtoReflect.Descriptor instead.
+func (*StreamPodSandboxMetricsResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{166}
+}
+
+func (x *StreamPodSandboxMetricsResponse) GetPodSandboxMetrics() []*PodSandboxMetrics {
+	if x != nil {
+		return x.PodSandboxMetrics
+	}
+	return nil
+}
+
+type PodSandboxMetrics struct {
+	state            protoimpl.MessageState `protogen:"open.v1"`
+	PodSandboxId     string                 `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	Metrics          []*Metric              `protobuf:"bytes,2,rep,name=metrics,proto3" json:"metrics,omitempty"`
+	ContainerMetrics []*ContainerMetrics    `protobuf:"bytes,3,rep,name=container_metrics,json=containerMetrics,proto3" json:"container_metrics,omitempty"`
+	unknownFields    protoimpl.UnknownFields
+	sizeCache        protoimpl.SizeCache
+}
+
+func (x *PodSandboxMetrics) Reset() {
+	*x = PodSandboxMetrics{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[167]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *PodSandboxMetrics) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*PodSandboxMetrics) ProtoMessage() {}
+
+func (x *PodSandboxMetrics) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[167]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use PodSandboxMetrics.ProtoReflect.Descriptor instead.
+func (*PodSandboxMetrics) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{167}
+}
+
+func (x *PodSandboxMetrics) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *PodSandboxMetrics) GetMetrics() []*Metric {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
+func (x *PodSandboxMetrics) GetContainerMetrics() []*ContainerMetrics {
+	if x != nil {
+		return x.ContainerMetrics
+	}
+	return nil
+}
+
+type ContainerMetrics struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	ContainerId   string                 `protobuf:"bytes,1,opt,name=container_id,json=containerId,proto3" json:"container_id,omitempty"`
+	Metrics       []*Metric              `protobuf:"bytes,2,rep,name=metrics,proto3" json:"metrics,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ContainerMetrics) Reset() {
+	*x = ContainerMetrics{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[168]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ContainerMetrics) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ContainerMetrics) ProtoMessage() {}
+
+func (x *ContainerMetrics) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[168]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ContainerMetrics.ProtoReflect.Descriptor instead.
+func (*ContainerMetrics) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{168}
+}
+
+func (x *ContainerMetrics) GetContainerId() string {
+	if x != nil {
+		return x.ContainerId
+	}
+	return ""
+}
+
+func (x *ContainerMetrics) GetMetrics() []*Metric {
+	if x != nil {
+		return x.Metrics
+	}
+	return nil
+}
+
+type Metric struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Name must match a name previously returned in a MetricDescriptors call,
+	// otherwise, it will be ignored.
+	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	// Timestamp should be 0 if the metric was gathered live.
+	// If it was cached, the Timestamp should reflect the time in nanoseconds it was collected.
+	Timestamp  int64      `protobuf:"varint,2,opt,name=timestamp,proto3" json:"timestamp,omitempty"`
+	MetricType MetricType `protobuf:"varint,3,opt,name=metric_type,json=metricType,proto3,enum=runtime.v1.MetricType" json:"metric_type,omitempty"`
+	// The corresponding LabelValues to the LabelKeys defined in the MetricDescriptor.
+	// It is the responsibility of the runtime to correctly keep sorted the keys and values.
+	// If the two slices have different length, the behavior is undefined.
+	LabelValues   []string     `protobuf:"bytes,4,rep,name=label_values,json=labelValues,proto3" json:"label_values,omitempty"`
+	Value         *UInt64Value `protobuf:"bytes,5,opt,name=value,proto3" json:"value,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *Metric) Reset() {
+	*x = Metric{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[169]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *Metric) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Metric) ProtoMessage() {}
+
+func (x *Metric) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[169]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Metric.ProtoReflect.Descriptor instead.
+func (*Metric) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{169}
+}
+
+func (x *Metric) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *Metric) GetTimestamp() int64 {
+	if x != nil {
+		return x.Timestamp
+	}
+	return 0
+}
+
+func (x *Metric) GetMetricType() MetricType {
+	if x != nil {
+		return x.MetricType
+	}
+	return MetricType_COUNTER
+}
+
+func (x *Metric) GetLabelValues() []string {
+	if x != nil {
+		return x.LabelValues
+	}
+	return nil
+}
+
+func (x *Metric) GetValue() *UInt64Value {
+	if x != nil {
+		return x.Value
+	}
+	return nil
+}
+
+type RuntimeConfigRequest struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeConfigRequest) Reset() {
+	*x = RuntimeConfigRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[170]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeConfigRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeConfigRequest) ProtoMessage() {}
+
+func (x *RuntimeConfigRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[170]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeConfigRequest.ProtoReflect.Descriptor instead.
+func (*RuntimeConfigRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{170}
+}
+
+type RuntimeConfigResponse struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Configuration information for Linux-based runtimes. This field contains
+	// global runtime configuration options that are not specific to runtime
+	// handlers.
+	Linux         *LinuxRuntimeConfiguration `protobuf:"bytes,1,opt,name=linux,proto3" json:"linux,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *RuntimeConfigResponse) Reset() {
+	*x = RuntimeConfigResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[171]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *RuntimeConfigResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RuntimeConfigResponse) ProtoMessage() {}
+
+func (x *RuntimeConfigResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[171]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RuntimeConfigResponse.ProtoReflect.Descriptor instead.
+func (*RuntimeConfigResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{171}
+}
+
+func (x *RuntimeConfigResponse) GetLinux() *LinuxRuntimeConfiguration {
+	if x != nil {
+		return x.Linux
+	}
+	return nil
+}
+
+type LinuxRuntimeConfiguration struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// Cgroup driver to use
+	// Note: this field should not change for the lifecycle of the Kubelet,
+	// or while there are running containers.
+	// The Kubelet will not re-request this after startup, and will construct the cgroup
+	// hierarchy assuming it is static.
+	// If the runtime wishes to change this value, it must be accompanied by removal of
+	// all pods, and a restart of the Kubelet. The easiest way to do this is with a full node reboot.
+	CgroupDriver  CgroupDriver `protobuf:"varint,1,opt,name=cgroup_driver,json=cgroupDriver,proto3,enum=runtime.v1.CgroupDriver" json:"cgroup_driver,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *LinuxRuntimeConfiguration) Reset() {
+	*x = LinuxRuntimeConfiguration{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[172]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *LinuxRuntimeConfiguration) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LinuxRuntimeConfiguration) ProtoMessage() {}
+
+func (x *LinuxRuntimeConfiguration) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[172]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LinuxRuntimeConfiguration.ProtoReflect.Descriptor instead.
+func (*LinuxRuntimeConfiguration) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{172}
+}
+
+func (x *LinuxRuntimeConfiguration) GetCgroupDriver() CgroupDriver {
+	if x != nil {
+		return x.CgroupDriver
+	}
+	return CgroupDriver_SYSTEMD
+}
+
+type UpdatePodSandboxResourcesRequest struct {
+	state protoimpl.MessageState `protogen:"open.v1"`
+	// ID of the PodSandbox to update.
+	PodSandboxId string `protobuf:"bytes,1,opt,name=pod_sandbox_id,json=podSandboxId,proto3" json:"pod_sandbox_id,omitempty"`
+	// Optional overhead represents the overheads associated with this sandbox
+	Overhead *LinuxContainerResources `protobuf:"bytes,2,opt,name=overhead,proto3" json:"overhead,omitempty"`
+	// Optional resources represents the sum of container resources for this sandbox
+	Resources     *LinuxContainerResources `protobuf:"bytes,3,opt,name=resources,proto3" json:"resources,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePodSandboxResourcesRequest) Reset() {
+	*x = UpdatePodSandboxResourcesRequest{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[173]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePodSandboxResourcesRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePodSandboxResourcesRequest) ProtoMessage() {}
+
+func (x *UpdatePodSandboxResourcesRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[173]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePodSandboxResourcesRequest.ProtoReflect.Descriptor instead.
+func (*UpdatePodSandboxResourcesRequest) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{173}
+}
+
+func (x *UpdatePodSandboxResourcesRequest) GetPodSandboxId() string {
+	if x != nil {
+		return x.PodSandboxId
+	}
+	return ""
+}
+
+func (x *UpdatePodSandboxResourcesRequest) GetOverhead() *LinuxContainerResources {
+	if x != nil {
+		return x.Overhead
+	}
+	return nil
+}
+
+func (x *UpdatePodSandboxResourcesRequest) GetResources() *LinuxContainerResources {
+	if x != nil {
+		return x.Resources
+	}
+	return nil
+}
+
+type UpdatePodSandboxResourcesResponse struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *UpdatePodSandboxResourcesResponse) Reset() {
+	*x = UpdatePodSandboxResourcesResponse{}
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[174]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *UpdatePodSandboxResourcesResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UpdatePodSandboxResourcesResponse) ProtoMessage() {}
+
+func (x *UpdatePodSandboxResourcesResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes[174]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UpdatePodSandboxResourcesResponse.ProtoReflect.Descriptor instead.
+func (*UpdatePodSandboxResourcesResponse) Descriptor() ([]byte, []int) {
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP(), []int{174}
+}
+
+var File_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto protoreflect.FileDescriptor
+
+const file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDesc = "" +
+	"\n" +
+	"8staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto\x12\n" +
+	"runtime.v1\"*\n" +
+	"\x0eVersionRequest\x12\x18\n" +
+	"\aversion\x18\x01 \x01(\tR\aversion\"\xa7\x01\n" +
+	"\x0fVersionResponse\x12\x18\n" +
+	"\aversion\x18\x01 \x01(\tR\aversion\x12!\n" +
+	"\fruntime_name\x18\x02 \x01(\tR\vruntimeName\x12'\n" +
+	"\x0fruntime_version\x18\x03 \x01(\tR\x0eruntimeVersion\x12.\n" +
+	"\x13runtime_api_version\x18\x04 \x01(\tR\x11runtimeApiVersion\"[\n" +
+	"\tDNSConfig\x12\x18\n" +
+	"\aservers\x18\x01 \x03(\tR\aservers\x12\x1a\n" +
+	"\bsearches\x18\x02 \x03(\tR\bsearches\x12\x18\n" +
+	"\aoptions\x18\x03 \x03(\tR\aoptions\"\x9c\x01\n" +
+	"\vPortMapping\x120\n" +
+	"\bprotocol\x18\x01 \x01(\x0e2\x14.runtime.v1.ProtocolR\bprotocol\x12%\n" +
+	"\x0econtainer_port\x18\x02 \x01(\x05R\rcontainerPort\x12\x1b\n" +
+	"\thost_port\x18\x03 \x01(\x05R\bhostPort\x12\x17\n" +
+	"\ahost_ip\x18\x04 \x01(\tR\x06hostIp\"\xea\x03\n" +
+	"\x05Mount\x12%\n" +
+	"\x0econtainer_path\x18\x01 \x01(\tR\rcontainerPath\x12\x1b\n" +
+	"\thost_path\x18\x02 \x01(\tR\bhostPath\x12\x1a\n" +
+	"\breadonly\x18\x03 \x01(\bR\breadonly\x12'\n" +
+	"\x0fselinux_relabel\x18\x04 \x01(\bR\x0eselinuxRelabel\x12>\n" +
+	"\vpropagation\x18\x05 \x01(\x0e2\x1c.runtime.v1.MountPropagationR\vpropagation\x127\n" +
+	"\vuidMappings\x18\x06 \x03(\v2\x15.runtime.v1.IDMappingR\vuidMappings\x127\n" +
+	"\vgidMappings\x18\a \x03(\v2\x15.runtime.v1.IDMappingR\vgidMappings\x12.\n" +
+	"\x13recursive_read_only\x18\b \x01(\bR\x11recursiveReadOnly\x12+\n" +
+	"\x05image\x18\t \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\x12$\n" +
+	"\x0eimage_sub_path\x18\n" +
+	" \x01(\tR\fimageSubPath\x12#\n" +
+	"\rmount_options\x18\v \x03(\tR\fmountOptions\"_\n" +
+	"\tIDMapping\x12\x17\n" +
+	"\ahost_id\x18\x01 \x01(\rR\x06hostId\x12!\n" +
+	"\fcontainer_id\x18\x02 \x01(\rR\vcontainerId\x12\x16\n" +
+	"\x06length\x18\x03 \x01(\rR\x06length\"\x94\x01\n" +
+	"\rUserNamespace\x12-\n" +
+	"\x04mode\x18\x01 \x01(\x0e2\x19.runtime.v1.NamespaceModeR\x04mode\x12)\n" +
+	"\x04uids\x18\x02 \x03(\v2\x15.runtime.v1.IDMappingR\x04uids\x12)\n" +
+	"\x04gids\x18\x03 \x03(\v2\x15.runtime.v1.IDMappingR\x04gids\"\xff\x01\n" +
+	"\x0fNamespaceOption\x123\n" +
+	"\anetwork\x18\x01 \x01(\x0e2\x19.runtime.v1.NamespaceModeR\anetwork\x12+\n" +
+	"\x03pid\x18\x02 \x01(\x0e2\x19.runtime.v1.NamespaceModeR\x03pid\x12+\n" +
+	"\x03ipc\x18\x03 \x01(\x0e2\x19.runtime.v1.NamespaceModeR\x03ipc\x12\x1b\n" +
+	"\ttarget_id\x18\x04 \x01(\tR\btargetId\x12@\n" +
+	"\x0euserns_options\x18\x05 \x01(\v2\x19.runtime.v1.UserNamespaceR\rusernsOptions\"\"\n" +
+	"\n" +
+	"Int64Value\x12\x14\n" +
+	"\x05value\x18\x01 \x01(\x03R\x05value\"\xa1\x05\n" +
+	"\x1bLinuxSandboxSecurityContext\x12H\n" +
+	"\x11namespace_options\x18\x01 \x01(\v2\x1b.runtime.v1.NamespaceOptionR\x10namespaceOptions\x12B\n" +
+	"\x0fselinux_options\x18\x02 \x01(\v2\x19.runtime.v1.SELinuxOptionR\x0eselinuxOptions\x126\n" +
+	"\vrun_as_user\x18\x03 \x01(\v2\x16.runtime.v1.Int64ValueR\trunAsUser\x128\n" +
+	"\frun_as_group\x18\b \x01(\v2\x16.runtime.v1.Int64ValueR\n" +
+	"runAsGroup\x12'\n" +
+	"\x0freadonly_rootfs\x18\x04 \x01(\bR\x0ereadonlyRootfs\x12/\n" +
+	"\x13supplemental_groups\x18\x05 \x03(\x03R\x12supplementalGroups\x12b\n" +
+	"\x1asupplemental_groups_policy\x18\v \x01(\x0e2$.runtime.v1.SupplementalGroupsPolicyR\x18supplementalGroupsPolicy\x12\x1e\n" +
+	"\n" +
+	"privileged\x18\x06 \x01(\bR\n" +
+	"privileged\x125\n" +
+	"\aseccomp\x18\t \x01(\v2\x1b.runtime.v1.SecurityProfileR\aseccomp\x127\n" +
+	"\bapparmor\x18\n" +
+	" \x01(\v2\x1b.runtime.v1.SecurityProfileR\bapparmor\x124\n" +
+	"\x14seccomp_profile_path\x18\a \x01(\tB\x02\x18\x01R\x12seccompProfilePath\"\xc4\x01\n" +
+	"\x0fSecurityProfile\x12J\n" +
+	"\fprofile_type\x18\x01 \x01(\x0e2'.runtime.v1.SecurityProfile.ProfileTypeR\vprofileType\x12#\n" +
+	"\rlocalhost_ref\x18\x02 \x01(\tR\flocalhostRef\"@\n" +
+	"\vProfileType\x12\x12\n" +
+	"\x0eRuntimeDefault\x10\x00\x12\x0e\n" +
+	"\n" +
+	"Unconfined\x10\x01\x12\r\n" +
+	"\tLocalhost\x10\x02\"\x9a\x03\n" +
+	"\x15LinuxPodSandboxConfig\x12#\n" +
+	"\rcgroup_parent\x18\x01 \x01(\tR\fcgroupParent\x12R\n" +
+	"\x10security_context\x18\x02 \x01(\v2'.runtime.v1.LinuxSandboxSecurityContextR\x0fsecurityContext\x12H\n" +
+	"\asysctls\x18\x03 \x03(\v2..runtime.v1.LinuxPodSandboxConfig.SysctlsEntryR\asysctls\x12?\n" +
+	"\boverhead\x18\x04 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\boverhead\x12A\n" +
+	"\tresources\x18\x05 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\tresources\x1a:\n" +
+	"\fSysctlsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"r\n" +
+	"\x12PodSandboxMetadata\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x10\n" +
+	"\x03uid\x18\x02 \x01(\tR\x03uid\x12\x1c\n" +
+	"\tnamespace\x18\x03 \x01(\tR\tnamespace\x12\x18\n" +
+	"\aattempt\x18\x04 \x01(\rR\aattempt\"\x89\x05\n" +
+	"\x10PodSandboxConfig\x12:\n" +
+	"\bmetadata\x18\x01 \x01(\v2\x1e.runtime.v1.PodSandboxMetadataR\bmetadata\x12\x1a\n" +
+	"\bhostname\x18\x02 \x01(\tR\bhostname\x12#\n" +
+	"\rlog_directory\x18\x03 \x01(\tR\flogDirectory\x124\n" +
+	"\n" +
+	"dns_config\x18\x04 \x01(\v2\x15.runtime.v1.DNSConfigR\tdnsConfig\x12<\n" +
+	"\rport_mappings\x18\x05 \x03(\v2\x17.runtime.v1.PortMappingR\fportMappings\x12@\n" +
+	"\x06labels\x18\x06 \x03(\v2(.runtime.v1.PodSandboxConfig.LabelsEntryR\x06labels\x12O\n" +
+	"\vannotations\x18\a \x03(\v2-.runtime.v1.PodSandboxConfig.AnnotationsEntryR\vannotations\x127\n" +
+	"\x05linux\x18\b \x01(\v2!.runtime.v1.LinuxPodSandboxConfigR\x05linux\x12=\n" +
+	"\awindows\x18\t \x01(\v2#.runtime.v1.WindowsPodSandboxConfigR\awindows\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"u\n" +
+	"\x14RunPodSandboxRequest\x124\n" +
+	"\x06config\x18\x01 \x01(\v2\x1c.runtime.v1.PodSandboxConfigR\x06config\x12'\n" +
+	"\x0fruntime_handler\x18\x02 \x01(\tR\x0eruntimeHandler\"=\n" +
+	"\x15RunPodSandboxResponse\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\"=\n" +
+	"\x15StopPodSandboxRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\"\x18\n" +
+	"\x16StopPodSandboxResponse\"?\n" +
+	"\x17RemovePodSandboxRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\"\x1a\n" +
+	"\x18RemovePodSandboxResponse\"Y\n" +
+	"\x17PodSandboxStatusRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x12\x18\n" +
+	"\averbose\x18\x02 \x01(\bR\averbose\"\x17\n" +
+	"\x05PodIP\x12\x0e\n" +
+	"\x02ip\x18\x01 \x01(\tR\x02ip\"c\n" +
+	"\x17PodSandboxNetworkStatus\x12\x0e\n" +
+	"\x02ip\x18\x01 \x01(\tR\x02ip\x128\n" +
+	"\x0eadditional_ips\x18\x02 \x03(\v2\x11.runtime.v1.PodIPR\radditionalIps\"B\n" +
+	"\tNamespace\x125\n" +
+	"\aoptions\x18\x02 \x01(\v2\x1b.runtime.v1.NamespaceOptionR\aoptions\"N\n" +
+	"\x15LinuxPodSandboxStatus\x125\n" +
+	"\n" +
+	"namespaces\x18\x01 \x01(\v2\x15.runtime.v1.NamespaceR\n" +
+	"namespaces\"\xdf\x04\n" +
+	"\x10PodSandboxStatus\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12:\n" +
+	"\bmetadata\x18\x02 \x01(\v2\x1e.runtime.v1.PodSandboxMetadataR\bmetadata\x121\n" +
+	"\x05state\x18\x03 \x01(\x0e2\x1b.runtime.v1.PodSandboxStateR\x05state\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x04 \x01(\x03R\tcreatedAt\x12=\n" +
+	"\anetwork\x18\x05 \x01(\v2#.runtime.v1.PodSandboxNetworkStatusR\anetwork\x127\n" +
+	"\x05linux\x18\x06 \x01(\v2!.runtime.v1.LinuxPodSandboxStatusR\x05linux\x12@\n" +
+	"\x06labels\x18\a \x03(\v2(.runtime.v1.PodSandboxStatus.LabelsEntryR\x06labels\x12O\n" +
+	"\vannotations\x18\b \x03(\v2-.runtime.v1.PodSandboxStatus.AnnotationsEntryR\vannotations\x12'\n" +
+	"\x0fruntime_handler\x18\t \x01(\tR\x0eruntimeHandler\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xb9\x02\n" +
+	"\x18PodSandboxStatusResponse\x124\n" +
+	"\x06status\x18\x01 \x01(\v2\x1c.runtime.v1.PodSandboxStatusR\x06status\x12B\n" +
+	"\x04info\x18\x02 \x03(\v2..runtime.v1.PodSandboxStatusResponse.InfoEntryR\x04info\x12L\n" +
+	"\x13containers_statuses\x18\x03 \x03(\v2\x1b.runtime.v1.ContainerStatusR\x12containersStatuses\x12\x1c\n" +
+	"\ttimestamp\x18\x04 \x01(\x03R\ttimestamp\x1a7\n" +
+	"\tInfoEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"I\n" +
+	"\x14PodSandboxStateValue\x121\n" +
+	"\x05state\x18\x01 \x01(\x0e2\x1b.runtime.v1.PodSandboxStateR\x05state\"\xf4\x01\n" +
+	"\x10PodSandboxFilter\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x126\n" +
+	"\x05state\x18\x02 \x01(\v2 .runtime.v1.PodSandboxStateValueR\x05state\x12V\n" +
+	"\x0elabel_selector\x18\x03 \x03(\v2/.runtime.v1.PodSandboxFilter.LabelSelectorEntryR\rlabelSelector\x1a@\n" +
+	"\x12LabelSelectorEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"M\n" +
+	"\x15ListPodSandboxRequest\x124\n" +
+	"\x06filter\x18\x01 \x01(\v2\x1c.runtime.v1.PodSandboxFilterR\x06filter\"\xd5\x03\n" +
+	"\n" +
+	"PodSandbox\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12:\n" +
+	"\bmetadata\x18\x02 \x01(\v2\x1e.runtime.v1.PodSandboxMetadataR\bmetadata\x121\n" +
+	"\x05state\x18\x03 \x01(\x0e2\x1b.runtime.v1.PodSandboxStateR\x05state\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x04 \x01(\x03R\tcreatedAt\x12:\n" +
+	"\x06labels\x18\x05 \x03(\v2\".runtime.v1.PodSandbox.LabelsEntryR\x06labels\x12I\n" +
+	"\vannotations\x18\x06 \x03(\v2'.runtime.v1.PodSandbox.AnnotationsEntryR\vannotations\x12'\n" +
+	"\x0fruntime_handler\x18\a \x01(\tR\x0eruntimeHandler\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"F\n" +
+	"\x16ListPodSandboxResponse\x12,\n" +
+	"\x05items\x18\x01 \x03(\v2\x16.runtime.v1.PodSandboxR\x05items\"Q\n" +
+	"\x19StreamPodSandboxesRequest\x124\n" +
+	"\x06filter\x18\x01 \x01(\v2\x1c.runtime.v1.PodSandboxFilterR\x06filter\"Y\n" +
+	"\x1aStreamPodSandboxesResponse\x12;\n" +
+	"\rpod_sandboxes\x18\x01 \x03(\v2\x16.runtime.v1.PodSandboxR\fpodSandboxes\">\n" +
+	"\x16PodSandboxStatsRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\"L\n" +
+	"\x17PodSandboxStatsResponse\x121\n" +
+	"\x05stats\x18\x01 \x01(\v2\x1b.runtime.v1.PodSandboxStatsR\x05stats\"\xc6\x01\n" +
+	"\x15PodSandboxStatsFilter\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12[\n" +
+	"\x0elabel_selector\x18\x02 \x03(\v24.runtime.v1.PodSandboxStatsFilter.LabelSelectorEntryR\rlabelSelector\x1a@\n" +
+	"\x12LabelSelectorEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"W\n" +
+	"\x1aListPodSandboxStatsRequest\x129\n" +
+	"\x06filter\x18\x01 \x01(\v2!.runtime.v1.PodSandboxStatsFilterR\x06filter\"P\n" +
+	"\x1bListPodSandboxStatsResponse\x121\n" +
+	"\x05stats\x18\x01 \x03(\v2\x1b.runtime.v1.PodSandboxStatsR\x05stats\"Y\n" +
+	"\x1cStreamPodSandboxStatsRequest\x129\n" +
+	"\x06filter\x18\x01 \x01(\v2!.runtime.v1.PodSandboxStatsFilterR\x06filter\"h\n" +
+	"\x1dStreamPodSandboxStatsResponse\x12G\n" +
+	"\x11pod_sandbox_stats\x18\x01 \x03(\v2\x1b.runtime.v1.PodSandboxStatsR\x0fpodSandboxStats\"\xf8\x02\n" +
+	"\x14PodSandboxAttributes\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12:\n" +
+	"\bmetadata\x18\x02 \x01(\v2\x1e.runtime.v1.PodSandboxMetadataR\bmetadata\x12D\n" +
+	"\x06labels\x18\x03 \x03(\v2,.runtime.v1.PodSandboxAttributes.LabelsEntryR\x06labels\x12S\n" +
+	"\vannotations\x18\x04 \x03(\v21.runtime.v1.PodSandboxAttributes.AnnotationsEntryR\vannotations\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xc9\x01\n" +
+	"\x0fPodSandboxStats\x12@\n" +
+	"\n" +
+	"attributes\x18\x01 \x01(\v2 .runtime.v1.PodSandboxAttributesR\n" +
+	"attributes\x126\n" +
+	"\x05linux\x18\x02 \x01(\v2 .runtime.v1.LinuxPodSandboxStatsR\x05linux\x12<\n" +
+	"\awindows\x18\x03 \x01(\v2\".runtime.v1.WindowsPodSandboxStatsR\awindows\"\xb8\x02\n" +
+	"\x14LinuxPodSandboxStats\x12&\n" +
+	"\x03cpu\x18\x01 \x01(\v2\x14.runtime.v1.CpuUsageR\x03cpu\x12/\n" +
+	"\x06memory\x18\x02 \x01(\v2\x17.runtime.v1.MemoryUsageR\x06memory\x122\n" +
+	"\anetwork\x18\x03 \x01(\v2\x18.runtime.v1.NetworkUsageR\anetwork\x122\n" +
+	"\aprocess\x18\x04 \x01(\v2\x18.runtime.v1.ProcessUsageR\aprocess\x12:\n" +
+	"\n" +
+	"containers\x18\x05 \x03(\v2\x1a.runtime.v1.ContainerStatsR\n" +
+	"containers\x12#\n" +
+	"\x02io\x18\x06 \x01(\v2\x13.runtime.v1.IoUsageR\x02io\"\xb8\x02\n" +
+	"\x16WindowsPodSandboxStats\x12-\n" +
+	"\x03cpu\x18\x01 \x01(\v2\x1b.runtime.v1.WindowsCpuUsageR\x03cpu\x126\n" +
+	"\x06memory\x18\x02 \x01(\v2\x1e.runtime.v1.WindowsMemoryUsageR\x06memory\x129\n" +
+	"\anetwork\x18\x03 \x01(\v2\x1f.runtime.v1.WindowsNetworkUsageR\anetwork\x129\n" +
+	"\aprocess\x18\x04 \x01(\v2\x1f.runtime.v1.WindowsProcessUsageR\aprocess\x12A\n" +
+	"\n" +
+	"containers\x18\x05 \x03(\v2!.runtime.v1.WindowsContainerStatsR\n" +
+	"containers\"\xbf\x01\n" +
+	"\fNetworkUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12N\n" +
+	"\x11default_interface\x18\x02 \x01(\v2!.runtime.v1.NetworkInterfaceUsageR\x10defaultInterface\x12A\n" +
+	"\n" +
+	"interfaces\x18\x03 \x03(\v2!.runtime.v1.NetworkInterfaceUsageR\n" +
+	"interfaces\"\xd4\x01\n" +
+	"\x13WindowsNetworkUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12U\n" +
+	"\x11default_interface\x18\x02 \x01(\v2(.runtime.v1.WindowsNetworkInterfaceUsageR\x10defaultInterface\x12H\n" +
+	"\n" +
+	"interfaces\x18\x03 \x03(\v2(.runtime.v1.WindowsNetworkInterfaceUsageR\n" +
+	"interfaces\"\xff\x01\n" +
+	"\x15NetworkInterfaceUsage\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x122\n" +
+	"\brx_bytes\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\arxBytes\x124\n" +
+	"\trx_errors\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\brxErrors\x122\n" +
+	"\btx_bytes\x18\x04 \x01(\v2\x17.runtime.v1.UInt64ValueR\atxBytes\x124\n" +
+	"\ttx_errors\x18\x05 \x01(\v2\x17.runtime.v1.UInt64ValueR\btxErrors\"\xa8\x02\n" +
+	"\x1cWindowsNetworkInterfaceUsage\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x122\n" +
+	"\brx_bytes\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\arxBytes\x12E\n" +
+	"\x12rx_packets_dropped\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\x10rxPacketsDropped\x122\n" +
+	"\btx_bytes\x18\x04 \x01(\v2\x17.runtime.v1.UInt64ValueR\atxBytes\x12E\n" +
+	"\x12tx_packets_dropped\x18\x05 \x01(\v2\x17.runtime.v1.UInt64ValueR\x10txPacketsDropped\"j\n" +
+	"\fProcessUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12<\n" +
+	"\rprocess_count\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\fprocessCount\"q\n" +
+	"\x13WindowsProcessUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12<\n" +
+	"\rprocess_count\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\fprocessCount\"\xa3\x02\n" +
+	"\tImageSpec\x12\x14\n" +
+	"\x05image\x18\x01 \x01(\tR\x05image\x12H\n" +
+	"\vannotations\x18\x02 \x03(\v2&.runtime.v1.ImageSpec.AnnotationsEntryR\vannotations\x120\n" +
+	"\x14user_specified_image\x18\x12 \x01(\tR\x12userSpecifiedImage\x12'\n" +
+	"\x0fruntime_handler\x18\x13 \x01(\tR\x0eruntimeHandler\x12\x1b\n" +
+	"\timage_ref\x18\x14 \x01(\tR\bimageRef\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"2\n" +
+	"\bKeyValue\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\fR\x05value\"\x95\x04\n" +
+	"\x17LinuxContainerResources\x12\x1d\n" +
+	"\n" +
+	"cpu_period\x18\x01 \x01(\x03R\tcpuPeriod\x12\x1b\n" +
+	"\tcpu_quota\x18\x02 \x01(\x03R\bcpuQuota\x12\x1d\n" +
+	"\n" +
+	"cpu_shares\x18\x03 \x01(\x03R\tcpuShares\x121\n" +
+	"\x15memory_limit_in_bytes\x18\x04 \x01(\x03R\x12memoryLimitInBytes\x12\"\n" +
+	"\room_score_adj\x18\x05 \x01(\x03R\voomScoreAdj\x12\x1f\n" +
+	"\vcpuset_cpus\x18\x06 \x01(\tR\n" +
+	"cpusetCpus\x12\x1f\n" +
+	"\vcpuset_mems\x18\a \x01(\tR\n" +
+	"cpusetMems\x12B\n" +
+	"\x0fhugepage_limits\x18\b \x03(\v2\x19.runtime.v1.HugepageLimitR\x0ehugepageLimits\x12J\n" +
+	"\aunified\x18\t \x03(\v20.runtime.v1.LinuxContainerResources.UnifiedEntryR\aunified\x12:\n" +
+	"\x1amemory_swap_limit_in_bytes\x18\n" +
+	" \x01(\x03R\x16memorySwapLimitInBytes\x1a:\n" +
+	"\fUnifiedEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"B\n" +
+	"\rHugepageLimit\x12\x1b\n" +
+	"\tpage_size\x18\x01 \x01(\tR\bpageSize\x12\x14\n" +
+	"\x05limit\x18\x02 \x01(\x04R\x05limit\"a\n" +
+	"\rSELinuxOption\x12\x12\n" +
+	"\x04user\x18\x01 \x01(\tR\x04user\x12\x12\n" +
+	"\x04role\x18\x02 \x01(\tR\x04role\x12\x12\n" +
+	"\x04type\x18\x03 \x01(\tR\x04type\x12\x14\n" +
+	"\x05level\x18\x04 \x01(\tR\x05level\"\x9e\x01\n" +
+	"\n" +
+	"Capability\x12)\n" +
+	"\x10add_capabilities\x18\x01 \x03(\tR\x0faddCapabilities\x12+\n" +
+	"\x11drop_capabilities\x18\x02 \x03(\tR\x10dropCapabilities\x128\n" +
+	"\x18add_ambient_capabilities\x18\x03 \x03(\tR\x16addAmbientCapabilities\"\xa2\a\n" +
+	"\x1dLinuxContainerSecurityContext\x12:\n" +
+	"\fcapabilities\x18\x01 \x01(\v2\x16.runtime.v1.CapabilityR\fcapabilities\x12\x1e\n" +
+	"\n" +
+	"privileged\x18\x02 \x01(\bR\n" +
+	"privileged\x12H\n" +
+	"\x11namespace_options\x18\x03 \x01(\v2\x1b.runtime.v1.NamespaceOptionR\x10namespaceOptions\x12B\n" +
+	"\x0fselinux_options\x18\x04 \x01(\v2\x19.runtime.v1.SELinuxOptionR\x0eselinuxOptions\x126\n" +
+	"\vrun_as_user\x18\x05 \x01(\v2\x16.runtime.v1.Int64ValueR\trunAsUser\x128\n" +
+	"\frun_as_group\x18\f \x01(\v2\x16.runtime.v1.Int64ValueR\n" +
+	"runAsGroup\x12&\n" +
+	"\x0frun_as_username\x18\x06 \x01(\tR\rrunAsUsername\x12'\n" +
+	"\x0freadonly_rootfs\x18\a \x01(\bR\x0ereadonlyRootfs\x12/\n" +
+	"\x13supplemental_groups\x18\b \x03(\x03R\x12supplementalGroups\x12b\n" +
+	"\x1asupplemental_groups_policy\x18\x11 \x01(\x0e2$.runtime.v1.SupplementalGroupsPolicyR\x18supplementalGroupsPolicy\x12 \n" +
+	"\fno_new_privs\x18\v \x01(\bR\n" +
+	"noNewPrivs\x12!\n" +
+	"\fmasked_paths\x18\r \x03(\tR\vmaskedPaths\x12%\n" +
+	"\x0ereadonly_paths\x18\x0e \x03(\tR\rreadonlyPaths\x125\n" +
+	"\aseccomp\x18\x0f \x01(\v2\x1b.runtime.v1.SecurityProfileR\aseccomp\x127\n" +
+	"\bapparmor\x18\x10 \x01(\v2\x1b.runtime.v1.SecurityProfileR\bapparmor\x12-\n" +
+	"\x10apparmor_profile\x18\t \x01(\tB\x02\x18\x01R\x0fapparmorProfile\x124\n" +
+	"\x14seccomp_profile_path\x18\n" +
+	" \x01(\tB\x02\x18\x01R\x12seccompProfilePath\"\xaf\x01\n" +
+	"\x14LinuxContainerConfig\x12A\n" +
+	"\tresources\x18\x01 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\tresources\x12T\n" +
+	"\x10security_context\x18\x02 \x01(\v2).runtime.v1.LinuxContainerSecurityContextR\x0fsecurityContext\"i\n" +
+	"\x12LinuxContainerUser\x12\x10\n" +
+	"\x03uid\x18\x01 \x01(\x03R\x03uid\x12\x10\n" +
+	"\x03gid\x18\x02 \x01(\x03R\x03gid\x12/\n" +
+	"\x13supplemental_groups\x18\x03 \x03(\x03R\x12supplementalGroups\"M\n" +
+	"\x16WindowsNamespaceOption\x123\n" +
+	"\anetwork\x18\x01 \x01(\x0e2\x19.runtime.v1.NamespaceModeR\anetwork\"\xe4\x01\n" +
+	"\x1dWindowsSandboxSecurityContext\x12&\n" +
+	"\x0frun_as_username\x18\x01 \x01(\tR\rrunAsUsername\x12'\n" +
+	"\x0fcredential_spec\x18\x02 \x01(\tR\x0ecredentialSpec\x12!\n" +
+	"\fhost_process\x18\x03 \x01(\bR\vhostProcess\x12O\n" +
+	"\x11namespace_options\x18\x04 \x01(\v2\".runtime.v1.WindowsNamespaceOptionR\x10namespaceOptions\"o\n" +
+	"\x17WindowsPodSandboxConfig\x12T\n" +
+	"\x10security_context\x18\x01 \x01(\v2).runtime.v1.WindowsSandboxSecurityContextR\x0fsecurityContext\"\x95\x01\n" +
+	"\x1fWindowsContainerSecurityContext\x12&\n" +
+	"\x0frun_as_username\x18\x01 \x01(\tR\rrunAsUsername\x12'\n" +
+	"\x0fcredential_spec\x18\x02 \x01(\tR\x0ecredentialSpec\x12!\n" +
+	"\fhost_process\x18\x03 \x01(\bR\vhostProcess\"\xb5\x01\n" +
+	"\x16WindowsContainerConfig\x12C\n" +
+	"\tresources\x18\x01 \x01(\v2%.runtime.v1.WindowsContainerResourcesR\tresources\x12V\n" +
+	"\x10security_context\x18\x02 \x01(\v2+.runtime.v1.WindowsContainerSecurityContextR\x0fsecurityContext\"\xa6\x02\n" +
+	"\x19WindowsContainerResources\x12\x1d\n" +
+	"\n" +
+	"cpu_shares\x18\x01 \x01(\x03R\tcpuShares\x12\x1b\n" +
+	"\tcpu_count\x18\x02 \x01(\x03R\bcpuCount\x12\x1f\n" +
+	"\vcpu_maximum\x18\x03 \x01(\x03R\n" +
+	"cpuMaximum\x121\n" +
+	"\x15memory_limit_in_bytes\x18\x04 \x01(\x03R\x12memoryLimitInBytes\x12/\n" +
+	"\x14rootfs_size_in_bytes\x18\x05 \x01(\x03R\x11rootfsSizeInBytes\x12H\n" +
+	"\raffinity_cpus\x18\x06 \x03(\v2#.runtime.v1.WindowsCpuGroupAffinityR\faffinityCpus\"Q\n" +
+	"\x17WindowsCpuGroupAffinity\x12\x19\n" +
+	"\bcpu_mask\x18\x01 \x01(\x04R\acpuMask\x12\x1b\n" +
+	"\tcpu_group\x18\x02 \x01(\rR\bcpuGroup\"A\n" +
+	"\x11ContainerMetadata\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x18\n" +
+	"\aattempt\x18\x02 \x01(\rR\aattempt\"n\n" +
+	"\x06Device\x12%\n" +
+	"\x0econtainer_path\x18\x01 \x01(\tR\rcontainerPath\x12\x1b\n" +
+	"\thost_path\x18\x02 \x01(\tR\bhostPath\x12 \n" +
+	"\vpermissions\x18\x03 \x01(\tR\vpermissions\"\x1f\n" +
+	"\tCDIDevice\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\"\x9c\a\n" +
+	"\x0fContainerConfig\x129\n" +
+	"\bmetadata\x18\x01 \x01(\v2\x1d.runtime.v1.ContainerMetadataR\bmetadata\x12+\n" +
+	"\x05image\x18\x02 \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\x12\x18\n" +
+	"\acommand\x18\x03 \x03(\tR\acommand\x12\x12\n" +
+	"\x04args\x18\x04 \x03(\tR\x04args\x12\x1f\n" +
+	"\vworking_dir\x18\x05 \x01(\tR\n" +
+	"workingDir\x12(\n" +
+	"\x04envs\x18\x06 \x03(\v2\x14.runtime.v1.KeyValueR\x04envs\x12)\n" +
+	"\x06mounts\x18\a \x03(\v2\x11.runtime.v1.MountR\x06mounts\x12,\n" +
+	"\adevices\x18\b \x03(\v2\x12.runtime.v1.DeviceR\adevices\x12?\n" +
+	"\x06labels\x18\t \x03(\v2'.runtime.v1.ContainerConfig.LabelsEntryR\x06labels\x12N\n" +
+	"\vannotations\x18\n" +
+	" \x03(\v2,.runtime.v1.ContainerConfig.AnnotationsEntryR\vannotations\x12\x19\n" +
+	"\blog_path\x18\v \x01(\tR\alogPath\x12\x14\n" +
+	"\x05stdin\x18\f \x01(\bR\x05stdin\x12\x1d\n" +
+	"\n" +
+	"stdin_once\x18\r \x01(\bR\tstdinOnce\x12\x10\n" +
+	"\x03tty\x18\x0e \x01(\bR\x03tty\x126\n" +
+	"\x05linux\x18\x0f \x01(\v2 .runtime.v1.LinuxContainerConfigR\x05linux\x12<\n" +
+	"\awindows\x18\x10 \x01(\v2\".runtime.v1.WindowsContainerConfigR\awindows\x126\n" +
+	"\vCDI_devices\x18\x11 \x03(\v2\x15.runtime.v1.CDIDeviceR\n" +
+	"CDIDevices\x123\n" +
+	"\vstop_signal\x18\x12 \x01(\x0e2\x12.runtime.v1.SignalR\n" +
+	"stopSignal\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xb8\x01\n" +
+	"\x16CreateContainerRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x123\n" +
+	"\x06config\x18\x02 \x01(\v2\x1b.runtime.v1.ContainerConfigR\x06config\x12C\n" +
+	"\x0esandbox_config\x18\x03 \x01(\v2\x1c.runtime.v1.PodSandboxConfigR\rsandboxConfig\"<\n" +
+	"\x17CreateContainerResponse\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\":\n" +
+	"\x15StartContainerRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\"\x18\n" +
+	"\x16StartContainerResponse\"S\n" +
+	"\x14StopContainerRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12\x18\n" +
+	"\atimeout\x18\x02 \x01(\x03R\atimeout\"\x17\n" +
+	"\x15StopContainerResponse\";\n" +
+	"\x16RemoveContainerRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\"\x19\n" +
+	"\x17RemoveContainerResponse\"G\n" +
+	"\x13ContainerStateValue\x120\n" +
+	"\x05state\x18\x01 \x01(\x0e2\x1a.runtime.v1.ContainerStateR\x05state\"\x97\x02\n" +
+	"\x0fContainerFilter\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x125\n" +
+	"\x05state\x18\x02 \x01(\v2\x1f.runtime.v1.ContainerStateValueR\x05state\x12$\n" +
+	"\x0epod_sandbox_id\x18\x03 \x01(\tR\fpodSandboxId\x12U\n" +
+	"\x0elabel_selector\x18\x04 \x03(\v2..runtime.v1.ContainerFilter.LabelSelectorEntryR\rlabelSelector\x1a@\n" +
+	"\x12LabelSelectorEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"L\n" +
+	"\x15ListContainersRequest\x123\n" +
+	"\x06filter\x18\x01 \x01(\v2\x1b.runtime.v1.ContainerFilterR\x06filter\"\xb2\x04\n" +
+	"\tContainer\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12$\n" +
+	"\x0epod_sandbox_id\x18\x02 \x01(\tR\fpodSandboxId\x129\n" +
+	"\bmetadata\x18\x03 \x01(\v2\x1d.runtime.v1.ContainerMetadataR\bmetadata\x12+\n" +
+	"\x05image\x18\x04 \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\x12\x1b\n" +
+	"\timage_ref\x18\x05 \x01(\tR\bimageRef\x120\n" +
+	"\x05state\x18\x06 \x01(\x0e2\x1a.runtime.v1.ContainerStateR\x05state\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\a \x01(\x03R\tcreatedAt\x129\n" +
+	"\x06labels\x18\b \x03(\v2!.runtime.v1.Container.LabelsEntryR\x06labels\x12H\n" +
+	"\vannotations\x18\t \x03(\v2&.runtime.v1.Container.AnnotationsEntryR\vannotations\x12\x19\n" +
+	"\bimage_id\x18\n" +
+	" \x01(\tR\aimageId\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"O\n" +
+	"\x16ListContainersResponse\x125\n" +
+	"\n" +
+	"containers\x18\x01 \x03(\v2\x15.runtime.v1.ContainerR\n" +
+	"containers\"N\n" +
+	"\x17StreamContainersRequest\x123\n" +
+	"\x06filter\x18\x01 \x01(\v2\x1b.runtime.v1.ContainerFilterR\x06filter\"Q\n" +
+	"\x18StreamContainersResponse\x125\n" +
+	"\n" +
+	"containers\x18\x01 \x03(\v2\x15.runtime.v1.ContainerR\n" +
+	"containers\"U\n" +
+	"\x16ContainerStatusRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12\x18\n" +
+	"\averbose\x18\x02 \x01(\bR\averbose\"\x95\a\n" +
+	"\x0fContainerStatus\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x129\n" +
+	"\bmetadata\x18\x02 \x01(\v2\x1d.runtime.v1.ContainerMetadataR\bmetadata\x120\n" +
+	"\x05state\x18\x03 \x01(\x0e2\x1a.runtime.v1.ContainerStateR\x05state\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x04 \x01(\x03R\tcreatedAt\x12\x1d\n" +
+	"\n" +
+	"started_at\x18\x05 \x01(\x03R\tstartedAt\x12\x1f\n" +
+	"\vfinished_at\x18\x06 \x01(\x03R\n" +
+	"finishedAt\x12\x1b\n" +
+	"\texit_code\x18\a \x01(\x05R\bexitCode\x12+\n" +
+	"\x05image\x18\b \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\x12\x1b\n" +
+	"\timage_ref\x18\t \x01(\tR\bimageRef\x12\x16\n" +
+	"\x06reason\x18\n" +
+	" \x01(\tR\x06reason\x12\x18\n" +
+	"\amessage\x18\v \x01(\tR\amessage\x12?\n" +
+	"\x06labels\x18\f \x03(\v2'.runtime.v1.ContainerStatus.LabelsEntryR\x06labels\x12N\n" +
+	"\vannotations\x18\r \x03(\v2,.runtime.v1.ContainerStatus.AnnotationsEntryR\vannotations\x12)\n" +
+	"\x06mounts\x18\x0e \x03(\v2\x11.runtime.v1.MountR\x06mounts\x12\x19\n" +
+	"\blog_path\x18\x0f \x01(\tR\alogPath\x12<\n" +
+	"\tresources\x18\x10 \x01(\v2\x1e.runtime.v1.ContainerResourcesR\tresources\x12\x19\n" +
+	"\bimage_id\x18\x11 \x01(\tR\aimageId\x12-\n" +
+	"\x04user\x18\x12 \x01(\v2\x19.runtime.v1.ContainerUserR\x04user\x123\n" +
+	"\vstop_signal\x18\x13 \x01(\x0e2\x12.runtime.v1.SignalR\n" +
+	"stopSignal\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xca\x01\n" +
+	"\x17ContainerStatusResponse\x123\n" +
+	"\x06status\x18\x01 \x01(\v2\x1b.runtime.v1.ContainerStatusR\x06status\x12A\n" +
+	"\x04info\x18\x02 \x03(\v2-.runtime.v1.ContainerStatusResponse.InfoEntryR\x04info\x1a7\n" +
+	"\tInfoEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x90\x01\n" +
+	"\x12ContainerResources\x129\n" +
+	"\x05linux\x18\x01 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\x05linux\x12?\n" +
+	"\awindows\x18\x02 \x01(\v2%.runtime.v1.WindowsContainerResourcesR\awindows\"E\n" +
+	"\rContainerUser\x124\n" +
+	"\x05linux\x18\x01 \x01(\v2\x1e.runtime.v1.LinuxContainerUserR\x05linux\"\xe0\x02\n" +
+	"\x1fUpdateContainerResourcesRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x129\n" +
+	"\x05linux\x18\x02 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\x05linux\x12?\n" +
+	"\awindows\x18\x03 \x01(\v2%.runtime.v1.WindowsContainerResourcesR\awindows\x12^\n" +
+	"\vannotations\x18\x04 \x03(\v2<.runtime.v1.UpdateContainerResourcesRequest.AnnotationsEntryR\vannotations\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\"\n" +
+	" UpdateContainerResourcesResponse\"`\n" +
+	"\x0fExecSyncRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12\x10\n" +
+	"\x03cmd\x18\x02 \x03(\tR\x03cmd\x12\x18\n" +
+	"\atimeout\x18\x03 \x01(\x03R\atimeout\"_\n" +
+	"\x10ExecSyncResponse\x12\x16\n" +
+	"\x06stdout\x18\x01 \x01(\fR\x06stdout\x12\x16\n" +
+	"\x06stderr\x18\x02 \x01(\fR\x06stderr\x12\x1b\n" +
+	"\texit_code\x18\x03 \x01(\x05R\bexitCode\"\x9a\x01\n" +
+	"\vExecRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12\x10\n" +
+	"\x03cmd\x18\x02 \x03(\tR\x03cmd\x12\x10\n" +
+	"\x03tty\x18\x03 \x01(\bR\x03tty\x12\x14\n" +
+	"\x05stdin\x18\x04 \x01(\bR\x05stdin\x12\x16\n" +
+	"\x06stdout\x18\x05 \x01(\bR\x06stdout\x12\x16\n" +
+	"\x06stderr\x18\x06 \x01(\bR\x06stderr\" \n" +
+	"\fExecResponse\x12\x10\n" +
+	"\x03url\x18\x01 \x01(\tR\x03url\"\x8a\x01\n" +
+	"\rAttachRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12\x14\n" +
+	"\x05stdin\x18\x02 \x01(\bR\x05stdin\x12\x10\n" +
+	"\x03tty\x18\x03 \x01(\bR\x03tty\x12\x16\n" +
+	"\x06stdout\x18\x04 \x01(\bR\x06stdout\x12\x16\n" +
+	"\x06stderr\x18\x05 \x01(\bR\x06stderr\"\"\n" +
+	"\x0eAttachResponse\x12\x10\n" +
+	"\x03url\x18\x01 \x01(\tR\x03url\"N\n" +
+	"\x12PortForwardRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x12\x12\n" +
+	"\x04port\x18\x02 \x03(\x05R\x04port\"'\n" +
+	"\x13PortForwardResponse\x12\x10\n" +
+	"\x03url\x18\x01 \x01(\tR\x03url\":\n" +
+	"\vImageFilter\x12+\n" +
+	"\x05image\x18\x01 \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\"D\n" +
+	"\x11ListImagesRequest\x12/\n" +
+	"\x06filter\x18\x01 \x01(\v2\x17.runtime.v1.ImageFilterR\x06filter\"\xf4\x01\n" +
+	"\x05Image\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12\x1b\n" +
+	"\trepo_tags\x18\x02 \x03(\tR\brepoTags\x12!\n" +
+	"\frepo_digests\x18\x03 \x03(\tR\vrepoDigests\x12\x12\n" +
+	"\x04size\x18\x04 \x01(\x04R\x04size\x12(\n" +
+	"\x03uid\x18\x05 \x01(\v2\x16.runtime.v1.Int64ValueR\x03uid\x12\x1a\n" +
+	"\busername\x18\x06 \x01(\tR\busername\x12)\n" +
+	"\x04spec\x18\a \x01(\v2\x15.runtime.v1.ImageSpecR\x04spec\x12\x16\n" +
+	"\x06pinned\x18\b \x01(\bR\x06pinned\"?\n" +
+	"\x12ListImagesResponse\x12)\n" +
+	"\x06images\x18\x01 \x03(\v2\x11.runtime.v1.ImageR\x06images\"F\n" +
+	"\x13StreamImagesRequest\x12/\n" +
+	"\x06filter\x18\x01 \x01(\v2\x17.runtime.v1.ImageFilterR\x06filter\"A\n" +
+	"\x14StreamImagesResponse\x12)\n" +
+	"\x06images\x18\x01 \x03(\v2\x11.runtime.v1.ImageR\x06images\"[\n" +
+	"\x12ImageStatusRequest\x12+\n" +
+	"\x05image\x18\x01 \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\x12\x18\n" +
+	"\averbose\x18\x02 \x01(\bR\averbose\"\xb6\x01\n" +
+	"\x13ImageStatusResponse\x12'\n" +
+	"\x05image\x18\x01 \x01(\v2\x11.runtime.v1.ImageR\x05image\x12=\n" +
+	"\x04info\x18\x02 \x03(\v2).runtime.v1.ImageStatusResponse.InfoEntryR\x04info\x1a7\n" +
+	"\tInfoEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xe1\x01\n" +
+	"\n" +
+	"AuthConfig\x12\x1a\n" +
+	"\busername\x18\x01 \x01(\tR\busername\x12\x1f\n" +
+	"\bpassword\x18\x02 \x01(\tB\x03\x80\x01\x01R\bpassword\x12\x17\n" +
+	"\x04auth\x18\x03 \x01(\tB\x03\x80\x01\x01R\x04auth\x12%\n" +
+	"\x0eserver_address\x18\x04 \x01(\tR\rserverAddress\x12*\n" +
+	"\x0eidentity_token\x18\x05 \x01(\tB\x03\x80\x01\x01R\ridentityToken\x12*\n" +
+	"\x0eregistry_token\x18\x06 \x01(\tB\x03\x80\x01\x01R\rregistryToken\"\xb0\x01\n" +
+	"\x10PullImageRequest\x12+\n" +
+	"\x05image\x18\x01 \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\x12*\n" +
+	"\x04auth\x18\x02 \x01(\v2\x16.runtime.v1.AuthConfigR\x04auth\x12C\n" +
+	"\x0esandbox_config\x18\x03 \x01(\v2\x1c.runtime.v1.PodSandboxConfigR\rsandboxConfig\"0\n" +
+	"\x11PullImageResponse\x12\x1b\n" +
+	"\timage_ref\x18\x01 \x01(\tR\bimageRef\"A\n" +
+	"\x12RemoveImageRequest\x12+\n" +
+	"\x05image\x18\x01 \x01(\v2\x15.runtime.v1.ImageSpecR\x05image\"\x15\n" +
+	"\x13RemoveImageResponse\"*\n" +
+	"\rNetworkConfig\x12\x19\n" +
+	"\bpod_cidr\x18\x01 \x01(\tR\apodCidr\"Q\n" +
+	"\rRuntimeConfig\x12@\n" +
+	"\x0enetwork_config\x18\x01 \x01(\v2\x19.runtime.v1.NetworkConfigR\rnetworkConfig\"^\n" +
+	"\x1aUpdateRuntimeConfigRequest\x12@\n" +
+	"\x0eruntime_config\x18\x01 \x01(\v2\x19.runtime.v1.RuntimeConfigR\rruntimeConfig\"\x1d\n" +
+	"\x1bUpdateRuntimeConfigResponse\"p\n" +
+	"\x10RuntimeCondition\x12\x12\n" +
+	"\x04type\x18\x01 \x01(\tR\x04type\x12\x16\n" +
+	"\x06status\x18\x02 \x01(\bR\x06status\x12\x16\n" +
+	"\x06reason\x18\x03 \x01(\tR\x06reason\x12\x18\n" +
+	"\amessage\x18\x04 \x01(\tR\amessage\"M\n" +
+	"\rRuntimeStatus\x12<\n" +
+	"\n" +
+	"conditions\x18\x01 \x03(\v2\x1c.runtime.v1.RuntimeConditionR\n" +
+	"conditions\")\n" +
+	"\rStatusRequest\x12\x18\n" +
+	"\averbose\x18\x01 \x01(\bR\averbose\"~\n" +
+	"\x16RuntimeHandlerFeatures\x12;\n" +
+	"\x1arecursive_read_only_mounts\x18\x01 \x01(\bR\x17recursiveReadOnlyMounts\x12'\n" +
+	"\x0fuser_namespaces\x18\x02 \x01(\bR\x0euserNamespaces\"d\n" +
+	"\x0eRuntimeHandler\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12>\n" +
+	"\bfeatures\x18\x02 \x01(\v2\".runtime.v1.RuntimeHandlerFeaturesR\bfeatures\"\xb5\x01\n" +
+	"\x0fRuntimeFeatures\x12<\n" +
+	"\x1asupplemental_groups_policy\x18\x01 \x01(\bR\x18supplementalGroupsPolicy\x12?\n" +
+	"\x1cuser_namespaces_host_network\x18\x02 \x01(\bR\x19userNamespacesHostNetwork\x12#\n" +
+	"\rmount_options\x18\x03 \x01(\bR\fmountOptions\"\xb6\x02\n" +
+	"\x0eStatusResponse\x121\n" +
+	"\x06status\x18\x01 \x01(\v2\x19.runtime.v1.RuntimeStatusR\x06status\x128\n" +
+	"\x04info\x18\x02 \x03(\v2$.runtime.v1.StatusResponse.InfoEntryR\x04info\x12E\n" +
+	"\x10runtime_handlers\x18\x03 \x03(\v2\x1a.runtime.v1.RuntimeHandlerR\x0fruntimeHandlers\x127\n" +
+	"\bfeatures\x18\x04 \x01(\v2\x1b.runtime.v1.RuntimeFeaturesR\bfeatures\x1a7\n" +
+	"\tInfoEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x14\n" +
+	"\x12ImageFsInfoRequest\"#\n" +
+	"\vUInt64Value\x12\x14\n" +
+	"\x05value\x18\x01 \x01(\x04R\x05value\"6\n" +
+	"\x14FilesystemIdentifier\x12\x1e\n" +
+	"\n" +
+	"mountpoint\x18\x01 \x01(\tR\n" +
+	"mountpoint\"\xd8\x01\n" +
+	"\x0fFilesystemUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x125\n" +
+	"\x05fs_id\x18\x02 \x01(\v2 .runtime.v1.FilesystemIdentifierR\x04fsId\x126\n" +
+	"\n" +
+	"used_bytes\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\tusedBytes\x128\n" +
+	"\vinodes_used\x18\x04 \x01(\v2\x17.runtime.v1.UInt64ValueR\n" +
+	"inodesUsed\"\xa5\x01\n" +
+	"\x16WindowsFilesystemUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x125\n" +
+	"\x05fs_id\x18\x02 \x01(\v2 .runtime.v1.FilesystemIdentifierR\x04fsId\x126\n" +
+	"\n" +
+	"used_bytes\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\tusedBytes\"\xb1\x01\n" +
+	"\x13ImageFsInfoResponse\x12H\n" +
+	"\x11image_filesystems\x18\x01 \x03(\v2\x1b.runtime.v1.FilesystemUsageR\x10imageFilesystems\x12P\n" +
+	"\x15container_filesystems\x18\x02 \x03(\v2\x1b.runtime.v1.FilesystemUsageR\x14containerFilesystems\":\n" +
+	"\x15ContainerStatsRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\"J\n" +
+	"\x16ContainerStatsResponse\x120\n" +
+	"\x05stats\x18\x01 \x01(\v2\x1a.runtime.v1.ContainerStatsR\x05stats\"U\n" +
+	"\x19ListContainerStatsRequest\x128\n" +
+	"\x06filter\x18\x01 \x01(\v2 .runtime.v1.ContainerStatsFilterR\x06filter\"\xea\x01\n" +
+	"\x14ContainerStatsFilter\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x12$\n" +
+	"\x0epod_sandbox_id\x18\x02 \x01(\tR\fpodSandboxId\x12Z\n" +
+	"\x0elabel_selector\x18\x03 \x03(\v23.runtime.v1.ContainerStatsFilter.LabelSelectorEntryR\rlabelSelector\x1a@\n" +
+	"\x12LabelSelectorEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"N\n" +
+	"\x1aListContainerStatsResponse\x120\n" +
+	"\x05stats\x18\x01 \x03(\v2\x1a.runtime.v1.ContainerStatsR\x05stats\"W\n" +
+	"\x1bStreamContainerStatsRequest\x128\n" +
+	"\x06filter\x18\x01 \x01(\v2 .runtime.v1.ContainerStatsFilterR\x06filter\"c\n" +
+	"\x1cStreamContainerStatsResponse\x12C\n" +
+	"\x0fcontainer_stats\x18\x01 \x03(\v2\x1a.runtime.v1.ContainerStatsR\x0econtainerStats\"\xf4\x02\n" +
+	"\x13ContainerAttributes\x12\x0e\n" +
+	"\x02id\x18\x01 \x01(\tR\x02id\x129\n" +
+	"\bmetadata\x18\x02 \x01(\v2\x1d.runtime.v1.ContainerMetadataR\bmetadata\x12C\n" +
+	"\x06labels\x18\x03 \x03(\v2+.runtime.v1.ContainerAttributes.LabelsEntryR\x06labels\x12R\n" +
+	"\vannotations\x18\x04 \x03(\v20.runtime.v1.ContainerAttributes.AnnotationsEntryR\vannotations\x1a9\n" +
+	"\vLabelsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\x1a>\n" +
+	"\x10AnnotationsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\xbe\x02\n" +
+	"\x0eContainerStats\x12?\n" +
+	"\n" +
+	"attributes\x18\x01 \x01(\v2\x1f.runtime.v1.ContainerAttributesR\n" +
+	"attributes\x12&\n" +
+	"\x03cpu\x18\x02 \x01(\v2\x14.runtime.v1.CpuUsageR\x03cpu\x12/\n" +
+	"\x06memory\x18\x03 \x01(\v2\x17.runtime.v1.MemoryUsageR\x06memory\x12B\n" +
+	"\x0ewritable_layer\x18\x04 \x01(\v2\x1b.runtime.v1.FilesystemUsageR\rwritableLayer\x12)\n" +
+	"\x04swap\x18\x05 \x01(\v2\x15.runtime.v1.SwapUsageR\x04swap\x12#\n" +
+	"\x02io\x18\x06 \x01(\v2\x13.runtime.v1.IoUsageR\x02io\"\x8a\x02\n" +
+	"\x15WindowsContainerStats\x12?\n" +
+	"\n" +
+	"attributes\x18\x01 \x01(\v2\x1f.runtime.v1.ContainerAttributesR\n" +
+	"attributes\x12-\n" +
+	"\x03cpu\x18\x02 \x01(\v2\x1b.runtime.v1.WindowsCpuUsageR\x03cpu\x126\n" +
+	"\x06memory\x18\x03 \x01(\v2\x1e.runtime.v1.WindowsMemoryUsageR\x06memory\x12I\n" +
+	"\x0ewritable_layer\x18\x04 \x01(\v2\".runtime.v1.WindowsFilesystemUsageR\rwritableLayer\"\\\n" +
+	"\bPsiStats\x12'\n" +
+	"\x04Full\x18\x01 \x01(\v2\x13.runtime.v1.PsiDataR\x04Full\x12'\n" +
+	"\x04Some\x18\x02 \x01(\v2\x13.runtime.v1.PsiDataR\x04Some\"c\n" +
+	"\aPsiData\x12\x14\n" +
+	"\x05Total\x18\x01 \x01(\x04R\x05Total\x12\x14\n" +
+	"\x05Avg10\x18\x02 \x01(\x01R\x05Avg10\x12\x14\n" +
+	"\x05Avg60\x18\x03 \x01(\x01R\x05Avg60\x12\x16\n" +
+	"\x06Avg300\x18\x04 \x01(\x01R\x06Avg300\"\xe3\x01\n" +
+	"\bCpuUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12N\n" +
+	"\x17usage_core_nano_seconds\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\x14usageCoreNanoSeconds\x12A\n" +
+	"\x10usage_nano_cores\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0eusageNanoCores\x12&\n" +
+	"\x03psi\x18\x04 \x01(\v2\x14.runtime.v1.PsiStatsR\x03psi\"\xc2\x01\n" +
+	"\x0fWindowsCpuUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12N\n" +
+	"\x17usage_core_nano_seconds\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\x14usageCoreNanoSeconds\x12A\n" +
+	"\x10usage_nano_cores\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0eusageNanoCores\"\xc9\x03\n" +
+	"\vMemoryUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12C\n" +
+	"\x11working_set_bytes\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0fworkingSetBytes\x12@\n" +
+	"\x0favailable_bytes\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0eavailableBytes\x128\n" +
+	"\vusage_bytes\x18\x04 \x01(\v2\x17.runtime.v1.UInt64ValueR\n" +
+	"usageBytes\x124\n" +
+	"\trss_bytes\x18\x05 \x01(\v2\x17.runtime.v1.UInt64ValueR\brssBytes\x128\n" +
+	"\vpage_faults\x18\x06 \x01(\v2\x17.runtime.v1.UInt64ValueR\n" +
+	"pageFaults\x12C\n" +
+	"\x11major_page_faults\x18\a \x01(\v2\x17.runtime.v1.UInt64ValueR\x0fmajorPageFaults\x12&\n" +
+	"\x03psi\x18\b \x01(\v2\x14.runtime.v1.PsiStatsR\x03psi\"O\n" +
+	"\aIoUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12&\n" +
+	"\x03psi\x18\x02 \x01(\v2\x14.runtime.v1.PsiStatsR\x03psi\"\xb7\x01\n" +
+	"\tSwapUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12I\n" +
+	"\x14swap_available_bytes\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\x12swapAvailableBytes\x12A\n" +
+	"\x10swap_usage_bytes\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0eswapUsageBytes\"\xbc\x02\n" +
+	"\x12WindowsMemoryUsage\x12\x1c\n" +
+	"\ttimestamp\x18\x01 \x01(\x03R\ttimestamp\x12C\n" +
+	"\x11working_set_bytes\x18\x02 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0fworkingSetBytes\x12@\n" +
+	"\x0favailable_bytes\x18\x03 \x01(\v2\x17.runtime.v1.UInt64ValueR\x0eavailableBytes\x128\n" +
+	"\vpage_faults\x18\x04 \x01(\v2\x17.runtime.v1.UInt64ValueR\n" +
+	"pageFaults\x12G\n" +
+	"\x13commit_memory_bytes\x18\x05 \x01(\v2\x17.runtime.v1.UInt64ValueR\x11commitMemoryBytes\">\n" +
+	"\x19ReopenContainerLogRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\"\x1c\n" +
+	"\x1aReopenContainerLogResponse\"u\n" +
+	"\x1aCheckpointContainerRequest\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12\x1a\n" +
+	"\blocation\x18\x02 \x01(\tR\blocation\x12\x18\n" +
+	"\atimeout\x18\x03 \x01(\x03R\atimeout\"\x1d\n" +
+	"\x1bCheckpointContainerResponse\"\x87\x02\n" +
+	"\x14CheckpointPodRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x12\x1f\n" +
+	"\voutput_path\x18\x02 \x01(\tR\n" +
+	"outputPath\x12#\n" +
+	"\rcontainer_ids\x18\x03 \x03(\tR\fcontainerIds\x12G\n" +
+	"\aoptions\x18\x04 \x03(\v2-.runtime.v1.CheckpointPodRequest.OptionsEntryR\aoptions\x1a:\n" +
+	"\fOptionsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"\x17\n" +
+	"\x15CheckpointPodResponse\"\xe7\x02\n" +
+	"\x11RestorePodRequest\x12'\n" +
+	"\x0fcheckpoint_path\x18\x01 \x01(\tR\x0echeckpointPath\x124\n" +
+	"\x06config\x18\x02 \x01(\v2\x1c.runtime.v1.PodSandboxConfigR\x06config\x12'\n" +
+	"\x0fruntime_handler\x18\x03 \x01(\tR\x0eruntimeHandler\x12D\n" +
+	"\aoptions\x18\x04 \x03(\v2*.runtime.v1.RestorePodRequest.OptionsEntryR\aoptions\x12H\n" +
+	"\x11container_configs\x18\x05 \x03(\v2\x1b.runtime.v1.ContainerConfigR\x10containerConfigs\x1a:\n" +
+	"\fOptionsEntry\x12\x10\n" +
+	"\x03key\x18\x01 \x01(\tR\x03key\x12\x14\n" +
+	"\x05value\x18\x02 \x01(\tR\x05value:\x028\x01\"J\n" +
+	"\x11RestoredContainer\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12!\n" +
+	"\fcontainer_id\x18\x02 \x01(\tR\vcontainerId\"\x8a\x01\n" +
+	"\x12RestorePodResponse\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x12N\n" +
+	"\x13restored_containers\x18\x02 \x03(\v2\x1d.runtime.v1.RestoredContainerR\x12restoredContainers\"\x12\n" +
+	"\x10GetEventsRequest\"\xc6\x02\n" +
+	"\x16ContainerEventResponse\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12P\n" +
+	"\x14container_event_type\x18\x02 \x01(\x0e2\x1e.runtime.v1.ContainerEventTypeR\x12containerEventType\x12\x1d\n" +
+	"\n" +
+	"created_at\x18\x03 \x01(\x03R\tcreatedAt\x12J\n" +
+	"\x12pod_sandbox_status\x18\x04 \x01(\v2\x1c.runtime.v1.PodSandboxStatusR\x10podSandboxStatus\x12L\n" +
+	"\x13containers_statuses\x18\x05 \x03(\v2\x1b.runtime.v1.ContainerStatusR\x12containersStatuses\"\x1e\n" +
+	"\x1cListMetricDescriptorsRequest\"_\n" +
+	"\x1dListMetricDescriptorsResponse\x12>\n" +
+	"\vdescriptors\x18\x01 \x03(\v2\x1c.runtime.v1.MetricDescriptorR\vdescriptors\"Y\n" +
+	"\x10MetricDescriptor\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x12\n" +
+	"\x04help\x18\x02 \x01(\tR\x04help\x12\x1d\n" +
+	"\n" +
+	"label_keys\x18\x03 \x03(\tR\tlabelKeys\"\x1e\n" +
+	"\x1cListPodSandboxMetricsRequest\"_\n" +
+	"\x1dListPodSandboxMetricsResponse\x12>\n" +
+	"\vpod_metrics\x18\x01 \x03(\v2\x1d.runtime.v1.PodSandboxMetricsR\n" +
+	"podMetrics\" \n" +
+	"\x1eStreamPodSandboxMetricsRequest\"p\n" +
+	"\x1fStreamPodSandboxMetricsResponse\x12M\n" +
+	"\x13pod_sandbox_metrics\x18\x01 \x03(\v2\x1d.runtime.v1.PodSandboxMetricsR\x11podSandboxMetrics\"\xb2\x01\n" +
+	"\x11PodSandboxMetrics\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x12,\n" +
+	"\ametrics\x18\x02 \x03(\v2\x12.runtime.v1.MetricR\ametrics\x12I\n" +
+	"\x11container_metrics\x18\x03 \x03(\v2\x1c.runtime.v1.ContainerMetricsR\x10containerMetrics\"c\n" +
+	"\x10ContainerMetrics\x12!\n" +
+	"\fcontainer_id\x18\x01 \x01(\tR\vcontainerId\x12,\n" +
+	"\ametrics\x18\x02 \x03(\v2\x12.runtime.v1.MetricR\ametrics\"\xc5\x01\n" +
+	"\x06Metric\x12\x12\n" +
+	"\x04name\x18\x01 \x01(\tR\x04name\x12\x1c\n" +
+	"\ttimestamp\x18\x02 \x01(\x03R\ttimestamp\x127\n" +
+	"\vmetric_type\x18\x03 \x01(\x0e2\x16.runtime.v1.MetricTypeR\n" +
+	"metricType\x12!\n" +
+	"\flabel_values\x18\x04 \x03(\tR\vlabelValues\x12-\n" +
+	"\x05value\x18\x05 \x01(\v2\x17.runtime.v1.UInt64ValueR\x05value\"\x16\n" +
+	"\x14RuntimeConfigRequest\"T\n" +
+	"\x15RuntimeConfigResponse\x12;\n" +
+	"\x05linux\x18\x01 \x01(\v2%.runtime.v1.LinuxRuntimeConfigurationR\x05linux\"Z\n" +
+	"\x19LinuxRuntimeConfiguration\x12=\n" +
+	"\rcgroup_driver\x18\x01 \x01(\x0e2\x18.runtime.v1.CgroupDriverR\fcgroupDriver\"\xcc\x01\n" +
+	" UpdatePodSandboxResourcesRequest\x12$\n" +
+	"\x0epod_sandbox_id\x18\x01 \x01(\tR\fpodSandboxId\x12?\n" +
+	"\boverhead\x18\x02 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\boverhead\x12A\n" +
+	"\tresources\x18\x03 \x01(\v2#.runtime.v1.LinuxContainerResourcesR\tresources\"#\n" +
+	"!UpdatePodSandboxResourcesResponse*&\n" +
+	"\bProtocol\x12\a\n" +
+	"\x03TCP\x10\x00\x12\a\n" +
+	"\x03UDP\x10\x01\x12\b\n" +
+	"\x04SCTP\x10\x02*m\n" +
+	"\x10MountPropagation\x12\x17\n" +
+	"\x13PROPAGATION_PRIVATE\x10\x00\x12!\n" +
+	"\x1dPROPAGATION_HOST_TO_CONTAINER\x10\x01\x12\x1d\n" +
+	"\x19PROPAGATION_BIDIRECTIONAL\x10\x02*=\n" +
+	"\rNamespaceMode\x12\a\n" +
+	"\x03POD\x10\x00\x12\r\n" +
+	"\tCONTAINER\x10\x01\x12\b\n" +
+	"\x04NODE\x10\x02\x12\n" +
+	"\n" +
+	"\x06TARGET\x10\x03*1\n" +
+	"\x18SupplementalGroupsPolicy\x12\t\n" +
+	"\x05Merge\x10\x00\x12\n" +
+	"\n" +
+	"\x06Strict\x10\x01*:\n" +
+	"\x0fPodSandboxState\x12\x11\n" +
+	"\rSANDBOX_READY\x10\x00\x12\x14\n" +
+	"\x10SANDBOX_NOTREADY\x10\x01*\xfa\v\n" +
+	"\x06Signal\x12\x1a\n" +
+	"\x16SIGNAL_RUNTIME_DEFAULT\x10\x00\x12\x12\n" +
+	"\x0eSIGNAL_SIGABRT\x10\x01\x12\x12\n" +
+	"\x0eSIGNAL_SIGALRM\x10\x02\x12\x11\n" +
+	"\rSIGNAL_SIGBUS\x10\x03\x12\x12\n" +
+	"\x0eSIGNAL_SIGCHLD\x10\x04\x12\x11\n" +
+	"\rSIGNAL_SIGCLD\x10\x05\x12\x12\n" +
+	"\x0eSIGNAL_SIGCONT\x10\x06\x12\x11\n" +
+	"\rSIGNAL_SIGFPE\x10\a\x12\x11\n" +
+	"\rSIGNAL_SIGHUP\x10\b\x12\x11\n" +
+	"\rSIGNAL_SIGILL\x10\t\x12\x11\n" +
+	"\rSIGNAL_SIGINT\x10\n" +
+	"\x12\x10\n" +
+	"\fSIGNAL_SIGIO\x10\v\x12\x11\n" +
+	"\rSIGNAL_SIGIOT\x10\f\x12\x12\n" +
+	"\x0eSIGNAL_SIGKILL\x10\r\x12\x12\n" +
+	"\x0eSIGNAL_SIGPIPE\x10\x0e\x12\x12\n" +
+	"\x0eSIGNAL_SIGPOLL\x10\x0f\x12\x12\n" +
+	"\x0eSIGNAL_SIGPROF\x10\x10\x12\x11\n" +
+	"\rSIGNAL_SIGPWR\x10\x11\x12\x12\n" +
+	"\x0eSIGNAL_SIGQUIT\x10\x12\x12\x12\n" +
+	"\x0eSIGNAL_SIGSEGV\x10\x13\x12\x14\n" +
+	"\x10SIGNAL_SIGSTKFLT\x10\x14\x12\x12\n" +
+	"\x0eSIGNAL_SIGSTOP\x10\x15\x12\x11\n" +
+	"\rSIGNAL_SIGSYS\x10\x16\x12\x12\n" +
+	"\x0eSIGNAL_SIGTERM\x10\x17\x12\x12\n" +
+	"\x0eSIGNAL_SIGTRAP\x10\x18\x12\x12\n" +
+	"\x0eSIGNAL_SIGTSTP\x10\x19\x12\x12\n" +
+	"\x0eSIGNAL_SIGTTIN\x10\x1a\x12\x12\n" +
+	"\x0eSIGNAL_SIGTTOU\x10\x1b\x12\x11\n" +
+	"\rSIGNAL_SIGURG\x10\x1c\x12\x12\n" +
+	"\x0eSIGNAL_SIGUSR1\x10\x1d\x12\x12\n" +
+	"\x0eSIGNAL_SIGUSR2\x10\x1e\x12\x14\n" +
+	"\x10SIGNAL_SIGVTALRM\x10\x1f\x12\x13\n" +
+	"\x0fSIGNAL_SIGWINCH\x10 \x12\x12\n" +
+	"\x0eSIGNAL_SIGXCPU\x10!\x12\x12\n" +
+	"\x0eSIGNAL_SIGXFSZ\x10\"\x12\x13\n" +
+	"\x0fSIGNAL_SIGRTMIN\x10#\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS1\x10$\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS2\x10%\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS3\x10&\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS4\x10'\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS5\x10(\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS6\x10)\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS7\x10*\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS8\x10+\x12\x18\n" +
+	"\x14SIGNAL_SIGRTMINPLUS9\x10,\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMINPLUS10\x10-\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMINPLUS11\x10.\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMINPLUS12\x10/\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMINPLUS13\x100\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMINPLUS14\x101\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMINPLUS15\x102\x12\x1a\n" +
+	"\x16SIGNAL_SIGRTMAXMINUS14\x103\x12\x1a\n" +
+	"\x16SIGNAL_SIGRTMAXMINUS13\x104\x12\x1a\n" +
+	"\x16SIGNAL_SIGRTMAXMINUS12\x105\x12\x1a\n" +
+	"\x16SIGNAL_SIGRTMAXMINUS11\x106\x12\x1a\n" +
+	"\x16SIGNAL_SIGRTMAXMINUS10\x107\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS9\x108\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS8\x109\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS7\x10:\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS6\x10;\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS5\x10<\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS4\x10=\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS3\x10>\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS2\x10?\x12\x19\n" +
+	"\x15SIGNAL_SIGRTMAXMINUS1\x10@\x12\x13\n" +
+	"\x0fSIGNAL_SIGRTMAX\x10A*k\n" +
+	"\x0eContainerState\x12\x15\n" +
+	"\x11CONTAINER_CREATED\x10\x00\x12\x15\n" +
+	"\x11CONTAINER_RUNNING\x10\x01\x12\x14\n" +
+	"\x10CONTAINER_EXITED\x10\x02\x12\x15\n" +
+	"\x11CONTAINER_UNKNOWN\x10\x03*\x88\x01\n" +
+	"\x12ContainerEventType\x12\x1b\n" +
+	"\x17CONTAINER_CREATED_EVENT\x10\x00\x12\x1b\n" +
+	"\x17CONTAINER_STARTED_EVENT\x10\x01\x12\x1b\n" +
+	"\x17CONTAINER_STOPPED_EVENT\x10\x02\x12\x1b\n" +
+	"\x17CONTAINER_DELETED_EVENT\x10\x03*$\n" +
+	"\n" +
+	"MetricType\x12\v\n" +
+	"\aCOUNTER\x10\x00\x12\t\n" +
+	"\x05GAUGE\x10\x01*)\n" +
+	"\fCgroupDriver\x12\v\n" +
+	"\aSYSTEMD\x10\x00\x12\f\n" +
+	"\bCGROUPFS\x10\x012\xc6\x1b\n" +
+	"\x0eRuntimeService\x12D\n" +
+	"\aVersion\x12\x1a.runtime.v1.VersionRequest\x1a\x1b.runtime.v1.VersionResponse\"\x00\x12V\n" +
+	"\rRunPodSandbox\x12 .runtime.v1.RunPodSandboxRequest\x1a!.runtime.v1.RunPodSandboxResponse\"\x00\x12Y\n" +
+	"\x0eStopPodSandbox\x12!.runtime.v1.StopPodSandboxRequest\x1a\".runtime.v1.StopPodSandboxResponse\"\x00\x12_\n" +
+	"\x10RemovePodSandbox\x12#.runtime.v1.RemovePodSandboxRequest\x1a$.runtime.v1.RemovePodSandboxResponse\"\x00\x12_\n" +
+	"\x10PodSandboxStatus\x12#.runtime.v1.PodSandboxStatusRequest\x1a$.runtime.v1.PodSandboxStatusResponse\"\x00\x12Y\n" +
+	"\x0eListPodSandbox\x12!.runtime.v1.ListPodSandboxRequest\x1a\".runtime.v1.ListPodSandboxResponse\"\x00\x12g\n" +
+	"\x12StreamPodSandboxes\x12%.runtime.v1.StreamPodSandboxesRequest\x1a&.runtime.v1.StreamPodSandboxesResponse\"\x000\x01\x12\\\n" +
+	"\x0fCreateContainer\x12\".runtime.v1.CreateContainerRequest\x1a#.runtime.v1.CreateContainerResponse\"\x00\x12Y\n" +
+	"\x0eStartContainer\x12!.runtime.v1.StartContainerRequest\x1a\".runtime.v1.StartContainerResponse\"\x00\x12V\n" +
+	"\rStopContainer\x12 .runtime.v1.StopContainerRequest\x1a!.runtime.v1.StopContainerResponse\"\x00\x12\\\n" +
+	"\x0fRemoveContainer\x12\".runtime.v1.RemoveContainerRequest\x1a#.runtime.v1.RemoveContainerResponse\"\x00\x12Y\n" +
+	"\x0eListContainers\x12!.runtime.v1.ListContainersRequest\x1a\".runtime.v1.ListContainersResponse\"\x00\x12a\n" +
+	"\x10StreamContainers\x12#.runtime.v1.StreamContainersRequest\x1a$.runtime.v1.StreamContainersResponse\"\x000\x01\x12\\\n" +
+	"\x0fContainerStatus\x12\".runtime.v1.ContainerStatusRequest\x1a#.runtime.v1.ContainerStatusResponse\"\x00\x12w\n" +
+	"\x18UpdateContainerResources\x12+.runtime.v1.UpdateContainerResourcesRequest\x1a,.runtime.v1.UpdateContainerResourcesResponse\"\x00\x12e\n" +
+	"\x12ReopenContainerLog\x12%.runtime.v1.ReopenContainerLogRequest\x1a&.runtime.v1.ReopenContainerLogResponse\"\x00\x12G\n" +
+	"\bExecSync\x12\x1b.runtime.v1.ExecSyncRequest\x1a\x1c.runtime.v1.ExecSyncResponse\"\x00\x12;\n" +
+	"\x04Exec\x12\x17.runtime.v1.ExecRequest\x1a\x18.runtime.v1.ExecResponse\"\x00\x12A\n" +
+	"\x06Attach\x12\x19.runtime.v1.AttachRequest\x1a\x1a.runtime.v1.AttachResponse\"\x00\x12P\n" +
+	"\vPortForward\x12\x1e.runtime.v1.PortForwardRequest\x1a\x1f.runtime.v1.PortForwardResponse\"\x00\x12Y\n" +
+	"\x0eContainerStats\x12!.runtime.v1.ContainerStatsRequest\x1a\".runtime.v1.ContainerStatsResponse\"\x00\x12e\n" +
+	"\x12ListContainerStats\x12%.runtime.v1.ListContainerStatsRequest\x1a&.runtime.v1.ListContainerStatsResponse\"\x00\x12m\n" +
+	"\x14StreamContainerStats\x12'.runtime.v1.StreamContainerStatsRequest\x1a(.runtime.v1.StreamContainerStatsResponse\"\x000\x01\x12\\\n" +
+	"\x0fPodSandboxStats\x12\".runtime.v1.PodSandboxStatsRequest\x1a#.runtime.v1.PodSandboxStatsResponse\"\x00\x12h\n" +
+	"\x13ListPodSandboxStats\x12&.runtime.v1.ListPodSandboxStatsRequest\x1a'.runtime.v1.ListPodSandboxStatsResponse\"\x00\x12p\n" +
+	"\x15StreamPodSandboxStats\x12(.runtime.v1.StreamPodSandboxStatsRequest\x1a).runtime.v1.StreamPodSandboxStatsResponse\"\x000\x01\x12h\n" +
+	"\x13UpdateRuntimeConfig\x12&.runtime.v1.UpdateRuntimeConfigRequest\x1a'.runtime.v1.UpdateRuntimeConfigResponse\"\x00\x12A\n" +
+	"\x06Status\x12\x19.runtime.v1.StatusRequest\x1a\x1a.runtime.v1.StatusResponse\"\x00\x12h\n" +
+	"\x13CheckpointContainer\x12&.runtime.v1.CheckpointContainerRequest\x1a'.runtime.v1.CheckpointContainerResponse\"\x00\x12V\n" +
+	"\rCheckpointPod\x12 .runtime.v1.CheckpointPodRequest\x1a!.runtime.v1.CheckpointPodResponse\"\x00\x12M\n" +
+	"\n" +
+	"RestorePod\x12\x1d.runtime.v1.RestorePodRequest\x1a\x1e.runtime.v1.RestorePodResponse\"\x00\x12Z\n" +
+	"\x12GetContainerEvents\x12\x1c.runtime.v1.GetEventsRequest\x1a\".runtime.v1.ContainerEventResponse\"\x000\x01\x12n\n" +
+	"\x15ListMetricDescriptors\x12(.runtime.v1.ListMetricDescriptorsRequest\x1a).runtime.v1.ListMetricDescriptorsResponse\"\x00\x12n\n" +
+	"\x15ListPodSandboxMetrics\x12(.runtime.v1.ListPodSandboxMetricsRequest\x1a).runtime.v1.ListPodSandboxMetricsResponse\"\x00\x12v\n" +
+	"\x17StreamPodSandboxMetrics\x12*.runtime.v1.StreamPodSandboxMetricsRequest\x1a+.runtime.v1.StreamPodSandboxMetricsResponse\"\x000\x01\x12V\n" +
+	"\rRuntimeConfig\x12 .runtime.v1.RuntimeConfigRequest\x1a!.runtime.v1.RuntimeConfigResponse\"\x00\x12z\n" +
+	"\x19UpdatePodSandboxResources\x12,.runtime.v1.UpdatePodSandboxResourcesRequest\x1a-.runtime.v1.UpdatePodSandboxResourcesResponse\"\x002\xf6\x03\n" +
+	"\fImageService\x12M\n" +
+	"\n" +
+	"ListImages\x12\x1d.runtime.v1.ListImagesRequest\x1a\x1e.runtime.v1.ListImagesResponse\"\x00\x12U\n" +
+	"\fStreamImages\x12\x1f.runtime.v1.StreamImagesRequest\x1a .runtime.v1.StreamImagesResponse\"\x000\x01\x12P\n" +
+	"\vImageStatus\x12\x1e.runtime.v1.ImageStatusRequest\x1a\x1f.runtime.v1.ImageStatusResponse\"\x00\x12J\n" +
+	"\tPullImage\x12\x1c.runtime.v1.PullImageRequest\x1a\x1d.runtime.v1.PullImageResponse\"\x00\x12P\n" +
+	"\vRemoveImage\x12\x1e.runtime.v1.RemoveImageRequest\x1a\x1f.runtime.v1.RemoveImageResponse\"\x00\x12P\n" +
+	"\vImageFsInfo\x12\x1e.runtime.v1.ImageFsInfoRequest\x1a\x1f.runtime.v1.ImageFsInfoResponse\"\x00B$Z\"k8s.io/cri-api/pkg/apis/runtime/v1b\x06proto3"
+
+var (
+	file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescOnce sync.Once
+	file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescData []byte
+)
+
+func file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescGZIP() []byte {
+	file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescOnce.Do(func() {
+		file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDesc), len(file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDesc)))
+	})
+	return file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDescData
+}
+
+var file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes = make([]protoimpl.EnumInfo, 11)
+var file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes = make([]protoimpl.MessageInfo, 205)
+var file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_goTypes = []any{
+	(Protocol)(0),                             // 0: runtime.v1.Protocol
+	(MountPropagation)(0),                     // 1: runtime.v1.MountPropagation
+	(NamespaceMode)(0),                        // 2: runtime.v1.NamespaceMode
+	(SupplementalGroupsPolicy)(0),             // 3: runtime.v1.SupplementalGroupsPolicy
+	(PodSandboxState)(0),                      // 4: runtime.v1.PodSandboxState
+	(Signal)(0),                               // 5: runtime.v1.Signal
+	(ContainerState)(0),                       // 6: runtime.v1.ContainerState
+	(ContainerEventType)(0),                   // 7: runtime.v1.ContainerEventType
+	(MetricType)(0),                           // 8: runtime.v1.MetricType
+	(CgroupDriver)(0),                         // 9: runtime.v1.CgroupDriver
+	(SecurityProfile_ProfileType)(0),          // 10: runtime.v1.SecurityProfile.ProfileType
+	(*VersionRequest)(nil),                    // 11: runtime.v1.VersionRequest
+	(*VersionResponse)(nil),                   // 12: runtime.v1.VersionResponse
+	(*DNSConfig)(nil),                         // 13: runtime.v1.DNSConfig
+	(*PortMapping)(nil),                       // 14: runtime.v1.PortMapping
+	(*Mount)(nil),                             // 15: runtime.v1.Mount
+	(*IDMapping)(nil),                         // 16: runtime.v1.IDMapping
+	(*UserNamespace)(nil),                     // 17: runtime.v1.UserNamespace
+	(*NamespaceOption)(nil),                   // 18: runtime.v1.NamespaceOption
+	(*Int64Value)(nil),                        // 19: runtime.v1.Int64Value
+	(*LinuxSandboxSecurityContext)(nil),       // 20: runtime.v1.LinuxSandboxSecurityContext
+	(*SecurityProfile)(nil),                   // 21: runtime.v1.SecurityProfile
+	(*LinuxPodSandboxConfig)(nil),             // 22: runtime.v1.LinuxPodSandboxConfig
+	(*PodSandboxMetadata)(nil),                // 23: runtime.v1.PodSandboxMetadata
+	(*PodSandboxConfig)(nil),                  // 24: runtime.v1.PodSandboxConfig
+	(*RunPodSandboxRequest)(nil),              // 25: runtime.v1.RunPodSandboxRequest
+	(*RunPodSandboxResponse)(nil),             // 26: runtime.v1.RunPodSandboxResponse
+	(*StopPodSandboxRequest)(nil),             // 27: runtime.v1.StopPodSandboxRequest
+	(*StopPodSandboxResponse)(nil),            // 28: runtime.v1.StopPodSandboxResponse
+	(*RemovePodSandboxRequest)(nil),           // 29: runtime.v1.RemovePodSandboxRequest
+	(*RemovePodSandboxResponse)(nil),          // 30: runtime.v1.RemovePodSandboxResponse
+	(*PodSandboxStatusRequest)(nil),           // 31: runtime.v1.PodSandboxStatusRequest
+	(*PodIP)(nil),                             // 32: runtime.v1.PodIP
+	(*PodSandboxNetworkStatus)(nil),           // 33: runtime.v1.PodSandboxNetworkStatus
+	(*Namespace)(nil),                         // 34: runtime.v1.Namespace
+	(*LinuxPodSandboxStatus)(nil),             // 35: runtime.v1.LinuxPodSandboxStatus
+	(*PodSandboxStatus)(nil),                  // 36: runtime.v1.PodSandboxStatus
+	(*PodSandboxStatusResponse)(nil),          // 37: runtime.v1.PodSandboxStatusResponse
+	(*PodSandboxStateValue)(nil),              // 38: runtime.v1.PodSandboxStateValue
+	(*PodSandboxFilter)(nil),                  // 39: runtime.v1.PodSandboxFilter
+	(*ListPodSandboxRequest)(nil),             // 40: runtime.v1.ListPodSandboxRequest
+	(*PodSandbox)(nil),                        // 41: runtime.v1.PodSandbox
+	(*ListPodSandboxResponse)(nil),            // 42: runtime.v1.ListPodSandboxResponse
+	(*StreamPodSandboxesRequest)(nil),         // 43: runtime.v1.StreamPodSandboxesRequest
+	(*StreamPodSandboxesResponse)(nil),        // 44: runtime.v1.StreamPodSandboxesResponse
+	(*PodSandboxStatsRequest)(nil),            // 45: runtime.v1.PodSandboxStatsRequest
+	(*PodSandboxStatsResponse)(nil),           // 46: runtime.v1.PodSandboxStatsResponse
+	(*PodSandboxStatsFilter)(nil),             // 47: runtime.v1.PodSandboxStatsFilter
+	(*ListPodSandboxStatsRequest)(nil),        // 48: runtime.v1.ListPodSandboxStatsRequest
+	(*ListPodSandboxStatsResponse)(nil),       // 49: runtime.v1.ListPodSandboxStatsResponse
+	(*StreamPodSandboxStatsRequest)(nil),      // 50: runtime.v1.StreamPodSandboxStatsRequest
+	(*StreamPodSandboxStatsResponse)(nil),     // 51: runtime.v1.StreamPodSandboxStatsResponse
+	(*PodSandboxAttributes)(nil),              // 52: runtime.v1.PodSandboxAttributes
+	(*PodSandboxStats)(nil),                   // 53: runtime.v1.PodSandboxStats
+	(*LinuxPodSandboxStats)(nil),              // 54: runtime.v1.LinuxPodSandboxStats
+	(*WindowsPodSandboxStats)(nil),            // 55: runtime.v1.WindowsPodSandboxStats
+	(*NetworkUsage)(nil),                      // 56: runtime.v1.NetworkUsage
+	(*WindowsNetworkUsage)(nil),               // 57: runtime.v1.WindowsNetworkUsage
+	(*NetworkInterfaceUsage)(nil),             // 58: runtime.v1.NetworkInterfaceUsage
+	(*WindowsNetworkInterfaceUsage)(nil),      // 59: runtime.v1.WindowsNetworkInterfaceUsage
+	(*ProcessUsage)(nil),                      // 60: runtime.v1.ProcessUsage
+	(*WindowsProcessUsage)(nil),               // 61: runtime.v1.WindowsProcessUsage
+	(*ImageSpec)(nil),                         // 62: runtime.v1.ImageSpec
+	(*KeyValue)(nil),                          // 63: runtime.v1.KeyValue
+	(*LinuxContainerResources)(nil),           // 64: runtime.v1.LinuxContainerResources
+	(*HugepageLimit)(nil),                     // 65: runtime.v1.HugepageLimit
+	(*SELinuxOption)(nil),                     // 66: runtime.v1.SELinuxOption
+	(*Capability)(nil),                        // 67: runtime.v1.Capability
+	(*LinuxContainerSecurityContext)(nil),     // 68: runtime.v1.LinuxContainerSecurityContext
+	(*LinuxContainerConfig)(nil),              // 69: runtime.v1.LinuxContainerConfig
+	(*LinuxContainerUser)(nil),                // 70: runtime.v1.LinuxContainerUser
+	(*WindowsNamespaceOption)(nil),            // 71: runtime.v1.WindowsNamespaceOption
+	(*WindowsSandboxSecurityContext)(nil),     // 72: runtime.v1.WindowsSandboxSecurityContext
+	(*WindowsPodSandboxConfig)(nil),           // 73: runtime.v1.WindowsPodSandboxConfig
+	(*WindowsContainerSecurityContext)(nil),   // 74: runtime.v1.WindowsContainerSecurityContext
+	(*WindowsContainerConfig)(nil),            // 75: runtime.v1.WindowsContainerConfig
+	(*WindowsContainerResources)(nil),         // 76: runtime.v1.WindowsContainerResources
+	(*WindowsCpuGroupAffinity)(nil),           // 77: runtime.v1.WindowsCpuGroupAffinity
+	(*ContainerMetadata)(nil),                 // 78: runtime.v1.ContainerMetadata
+	(*Device)(nil),                            // 79: runtime.v1.Device
+	(*CDIDevice)(nil),                         // 80: runtime.v1.CDIDevice
+	(*ContainerConfig)(nil),                   // 81: runtime.v1.ContainerConfig
+	(*CreateContainerRequest)(nil),            // 82: runtime.v1.CreateContainerRequest
+	(*CreateContainerResponse)(nil),           // 83: runtime.v1.CreateContainerResponse
+	(*StartContainerRequest)(nil),             // 84: runtime.v1.StartContainerRequest
+	(*StartContainerResponse)(nil),            // 85: runtime.v1.StartContainerResponse
+	(*StopContainerRequest)(nil),              // 86: runtime.v1.StopContainerRequest
+	(*StopContainerResponse)(nil),             // 87: runtime.v1.StopContainerResponse
+	(*RemoveContainerRequest)(nil),            // 88: runtime.v1.RemoveContainerRequest
+	(*RemoveContainerResponse)(nil),           // 89: runtime.v1.RemoveContainerResponse
+	(*ContainerStateValue)(nil),               // 90: runtime.v1.ContainerStateValue
+	(*ContainerFilter)(nil),                   // 91: runtime.v1.ContainerFilter
+	(*ListContainersRequest)(nil),             // 92: runtime.v1.ListContainersRequest
+	(*Container)(nil),                         // 93: runtime.v1.Container
+	(*ListContainersResponse)(nil),            // 94: runtime.v1.ListContainersResponse
+	(*StreamContainersRequest)(nil),           // 95: runtime.v1.StreamContainersRequest
+	(*StreamContainersResponse)(nil),          // 96: runtime.v1.StreamContainersResponse
+	(*ContainerStatusRequest)(nil),            // 97: runtime.v1.ContainerStatusRequest
+	(*ContainerStatus)(nil),                   // 98: runtime.v1.ContainerStatus
+	(*ContainerStatusResponse)(nil),           // 99: runtime.v1.ContainerStatusResponse
+	(*ContainerResources)(nil),                // 100: runtime.v1.ContainerResources
+	(*ContainerUser)(nil),                     // 101: runtime.v1.ContainerUser
+	(*UpdateContainerResourcesRequest)(nil),   // 102: runtime.v1.UpdateContainerResourcesRequest
+	(*UpdateContainerResourcesResponse)(nil),  // 103: runtime.v1.UpdateContainerResourcesResponse
+	(*ExecSyncRequest)(nil),                   // 104: runtime.v1.ExecSyncRequest
+	(*ExecSyncResponse)(nil),                  // 105: runtime.v1.ExecSyncResponse
+	(*ExecRequest)(nil),                       // 106: runtime.v1.ExecRequest
+	(*ExecResponse)(nil),                      // 107: runtime.v1.ExecResponse
+	(*AttachRequest)(nil),                     // 108: runtime.v1.AttachRequest
+	(*AttachResponse)(nil),                    // 109: runtime.v1.AttachResponse
+	(*PortForwardRequest)(nil),                // 110: runtime.v1.PortForwardRequest
+	(*PortForwardResponse)(nil),               // 111: runtime.v1.PortForwardResponse
+	(*ImageFilter)(nil),                       // 112: runtime.v1.ImageFilter
+	(*ListImagesRequest)(nil),                 // 113: runtime.v1.ListImagesRequest
+	(*Image)(nil),                             // 114: runtime.v1.Image
+	(*ListImagesResponse)(nil),                // 115: runtime.v1.ListImagesResponse
+	(*StreamImagesRequest)(nil),               // 116: runtime.v1.StreamImagesRequest
+	(*StreamImagesResponse)(nil),              // 117: runtime.v1.StreamImagesResponse
+	(*ImageStatusRequest)(nil),                // 118: runtime.v1.ImageStatusRequest
+	(*ImageStatusResponse)(nil),               // 119: runtime.v1.ImageStatusResponse
+	(*AuthConfig)(nil),                        // 120: runtime.v1.AuthConfig
+	(*PullImageRequest)(nil),                  // 121: runtime.v1.PullImageRequest
+	(*PullImageResponse)(nil),                 // 122: runtime.v1.PullImageResponse
+	(*RemoveImageRequest)(nil),                // 123: runtime.v1.RemoveImageRequest
+	(*RemoveImageResponse)(nil),               // 124: runtime.v1.RemoveImageResponse
+	(*NetworkConfig)(nil),                     // 125: runtime.v1.NetworkConfig
+	(*RuntimeConfig)(nil),                     // 126: runtime.v1.RuntimeConfig
+	(*UpdateRuntimeConfigRequest)(nil),        // 127: runtime.v1.UpdateRuntimeConfigRequest
+	(*UpdateRuntimeConfigResponse)(nil),       // 128: runtime.v1.UpdateRuntimeConfigResponse
+	(*RuntimeCondition)(nil),                  // 129: runtime.v1.RuntimeCondition
+	(*RuntimeStatus)(nil),                     // 130: runtime.v1.RuntimeStatus
+	(*StatusRequest)(nil),                     // 131: runtime.v1.StatusRequest
+	(*RuntimeHandlerFeatures)(nil),            // 132: runtime.v1.RuntimeHandlerFeatures
+	(*RuntimeHandler)(nil),                    // 133: runtime.v1.RuntimeHandler
+	(*RuntimeFeatures)(nil),                   // 134: runtime.v1.RuntimeFeatures
+	(*StatusResponse)(nil),                    // 135: runtime.v1.StatusResponse
+	(*ImageFsInfoRequest)(nil),                // 136: runtime.v1.ImageFsInfoRequest
+	(*UInt64Value)(nil),                       // 137: runtime.v1.UInt64Value
+	(*FilesystemIdentifier)(nil),              // 138: runtime.v1.FilesystemIdentifier
+	(*FilesystemUsage)(nil),                   // 139: runtime.v1.FilesystemUsage
+	(*WindowsFilesystemUsage)(nil),            // 140: runtime.v1.WindowsFilesystemUsage
+	(*ImageFsInfoResponse)(nil),               // 141: runtime.v1.ImageFsInfoResponse
+	(*ContainerStatsRequest)(nil),             // 142: runtime.v1.ContainerStatsRequest
+	(*ContainerStatsResponse)(nil),            // 143: runtime.v1.ContainerStatsResponse
+	(*ListContainerStatsRequest)(nil),         // 144: runtime.v1.ListContainerStatsRequest
+	(*ContainerStatsFilter)(nil),              // 145: runtime.v1.ContainerStatsFilter
+	(*ListContainerStatsResponse)(nil),        // 146: runtime.v1.ListContainerStatsResponse
+	(*StreamContainerStatsRequest)(nil),       // 147: runtime.v1.StreamContainerStatsRequest
+	(*StreamContainerStatsResponse)(nil),      // 148: runtime.v1.StreamContainerStatsResponse
+	(*ContainerAttributes)(nil),               // 149: runtime.v1.ContainerAttributes
+	(*ContainerStats)(nil),                    // 150: runtime.v1.ContainerStats
+	(*WindowsContainerStats)(nil),             // 151: runtime.v1.WindowsContainerStats
+	(*PsiStats)(nil),                          // 152: runtime.v1.PsiStats
+	(*PsiData)(nil),                           // 153: runtime.v1.PsiData
+	(*CpuUsage)(nil),                          // 154: runtime.v1.CpuUsage
+	(*WindowsCpuUsage)(nil),                   // 155: runtime.v1.WindowsCpuUsage
+	(*MemoryUsage)(nil),                       // 156: runtime.v1.MemoryUsage
+	(*IoUsage)(nil),                           // 157: runtime.v1.IoUsage
+	(*SwapUsage)(nil),                         // 158: runtime.v1.SwapUsage
+	(*WindowsMemoryUsage)(nil),                // 159: runtime.v1.WindowsMemoryUsage
+	(*ReopenContainerLogRequest)(nil),         // 160: runtime.v1.ReopenContainerLogRequest
+	(*ReopenContainerLogResponse)(nil),        // 161: runtime.v1.ReopenContainerLogResponse
+	(*CheckpointContainerRequest)(nil),        // 162: runtime.v1.CheckpointContainerRequest
+	(*CheckpointContainerResponse)(nil),       // 163: runtime.v1.CheckpointContainerResponse
+	(*CheckpointPodRequest)(nil),              // 164: runtime.v1.CheckpointPodRequest
+	(*CheckpointPodResponse)(nil),             // 165: runtime.v1.CheckpointPodResponse
+	(*RestorePodRequest)(nil),                 // 166: runtime.v1.RestorePodRequest
+	(*RestoredContainer)(nil),                 // 167: runtime.v1.RestoredContainer
+	(*RestorePodResponse)(nil),                // 168: runtime.v1.RestorePodResponse
+	(*GetEventsRequest)(nil),                  // 169: runtime.v1.GetEventsRequest
+	(*ContainerEventResponse)(nil),            // 170: runtime.v1.ContainerEventResponse
+	(*ListMetricDescriptorsRequest)(nil),      // 171: runtime.v1.ListMetricDescriptorsRequest
+	(*ListMetricDescriptorsResponse)(nil),     // 172: runtime.v1.ListMetricDescriptorsResponse
+	(*MetricDescriptor)(nil),                  // 173: runtime.v1.MetricDescriptor
+	(*ListPodSandboxMetricsRequest)(nil),      // 174: runtime.v1.ListPodSandboxMetricsRequest
+	(*ListPodSandboxMetricsResponse)(nil),     // 175: runtime.v1.ListPodSandboxMetricsResponse
+	(*StreamPodSandboxMetricsRequest)(nil),    // 176: runtime.v1.StreamPodSandboxMetricsRequest
+	(*StreamPodSandboxMetricsResponse)(nil),   // 177: runtime.v1.StreamPodSandboxMetricsResponse
+	(*PodSandboxMetrics)(nil),                 // 178: runtime.v1.PodSandboxMetrics
+	(*ContainerMetrics)(nil),                  // 179: runtime.v1.ContainerMetrics
+	(*Metric)(nil),                            // 180: runtime.v1.Metric
+	(*RuntimeConfigRequest)(nil),              // 181: runtime.v1.RuntimeConfigRequest
+	(*RuntimeConfigResponse)(nil),             // 182: runtime.v1.RuntimeConfigResponse
+	(*LinuxRuntimeConfiguration)(nil),         // 183: runtime.v1.LinuxRuntimeConfiguration
+	(*UpdatePodSandboxResourcesRequest)(nil),  // 184: runtime.v1.UpdatePodSandboxResourcesRequest
+	(*UpdatePodSandboxResourcesResponse)(nil), // 185: runtime.v1.UpdatePodSandboxResourcesResponse
+	nil, // 186: runtime.v1.LinuxPodSandboxConfig.SysctlsEntry
+	nil, // 187: runtime.v1.PodSandboxConfig.LabelsEntry
+	nil, // 188: runtime.v1.PodSandboxConfig.AnnotationsEntry
+	nil, // 189: runtime.v1.PodSandboxStatus.LabelsEntry
+	nil, // 190: runtime.v1.PodSandboxStatus.AnnotationsEntry
+	nil, // 191: runtime.v1.PodSandboxStatusResponse.InfoEntry
+	nil, // 192: runtime.v1.PodSandboxFilter.LabelSelectorEntry
+	nil, // 193: runtime.v1.PodSandbox.LabelsEntry
+	nil, // 194: runtime.v1.PodSandbox.AnnotationsEntry
+	nil, // 195: runtime.v1.PodSandboxStatsFilter.LabelSelectorEntry
+	nil, // 196: runtime.v1.PodSandboxAttributes.LabelsEntry
+	nil, // 197: runtime.v1.PodSandboxAttributes.AnnotationsEntry
+	nil, // 198: runtime.v1.ImageSpec.AnnotationsEntry
+	nil, // 199: runtime.v1.LinuxContainerResources.UnifiedEntry
+	nil, // 200: runtime.v1.ContainerConfig.LabelsEntry
+	nil, // 201: runtime.v1.ContainerConfig.AnnotationsEntry
+	nil, // 202: runtime.v1.ContainerFilter.LabelSelectorEntry
+	nil, // 203: runtime.v1.Container.LabelsEntry
+	nil, // 204: runtime.v1.Container.AnnotationsEntry
+	nil, // 205: runtime.v1.ContainerStatus.LabelsEntry
+	nil, // 206: runtime.v1.ContainerStatus.AnnotationsEntry
+	nil, // 207: runtime.v1.ContainerStatusResponse.InfoEntry
+	nil, // 208: runtime.v1.UpdateContainerResourcesRequest.AnnotationsEntry
+	nil, // 209: runtime.v1.ImageStatusResponse.InfoEntry
+	nil, // 210: runtime.v1.StatusResponse.InfoEntry
+	nil, // 211: runtime.v1.ContainerStatsFilter.LabelSelectorEntry
+	nil, // 212: runtime.v1.ContainerAttributes.LabelsEntry
+	nil, // 213: runtime.v1.ContainerAttributes.AnnotationsEntry
+	nil, // 214: runtime.v1.CheckpointPodRequest.OptionsEntry
+	nil, // 215: runtime.v1.RestorePodRequest.OptionsEntry
+}
+var file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_depIdxs = []int32{
+	0,   // 0: runtime.v1.PortMapping.protocol:type_name -> runtime.v1.Protocol
+	1,   // 1: runtime.v1.Mount.propagation:type_name -> runtime.v1.MountPropagation
+	16,  // 2: runtime.v1.Mount.uidMappings:type_name -> runtime.v1.IDMapping
+	16,  // 3: runtime.v1.Mount.gidMappings:type_name -> runtime.v1.IDMapping
+	62,  // 4: runtime.v1.Mount.image:type_name -> runtime.v1.ImageSpec
+	2,   // 5: runtime.v1.UserNamespace.mode:type_name -> runtime.v1.NamespaceMode
+	16,  // 6: runtime.v1.UserNamespace.uids:type_name -> runtime.v1.IDMapping
+	16,  // 7: runtime.v1.UserNamespace.gids:type_name -> runtime.v1.IDMapping
+	2,   // 8: runtime.v1.NamespaceOption.network:type_name -> runtime.v1.NamespaceMode
+	2,   // 9: runtime.v1.NamespaceOption.pid:type_name -> runtime.v1.NamespaceMode
+	2,   // 10: runtime.v1.NamespaceOption.ipc:type_name -> runtime.v1.NamespaceMode
+	17,  // 11: runtime.v1.NamespaceOption.userns_options:type_name -> runtime.v1.UserNamespace
+	18,  // 12: runtime.v1.LinuxSandboxSecurityContext.namespace_options:type_name -> runtime.v1.NamespaceOption
+	66,  // 13: runtime.v1.LinuxSandboxSecurityContext.selinux_options:type_name -> runtime.v1.SELinuxOption
+	19,  // 14: runtime.v1.LinuxSandboxSecurityContext.run_as_user:type_name -> runtime.v1.Int64Value
+	19,  // 15: runtime.v1.LinuxSandboxSecurityContext.run_as_group:type_name -> runtime.v1.Int64Value
+	3,   // 16: runtime.v1.LinuxSandboxSecurityContext.supplemental_groups_policy:type_name -> runtime.v1.SupplementalGroupsPolicy
+	21,  // 17: runtime.v1.LinuxSandboxSecurityContext.seccomp:type_name -> runtime.v1.SecurityProfile
+	21,  // 18: runtime.v1.LinuxSandboxSecurityContext.apparmor:type_name -> runtime.v1.SecurityProfile
+	10,  // 19: runtime.v1.SecurityProfile.profile_type:type_name -> runtime.v1.SecurityProfile.ProfileType
+	20,  // 20: runtime.v1.LinuxPodSandboxConfig.security_context:type_name -> runtime.v1.LinuxSandboxSecurityContext
+	186, // 21: runtime.v1.LinuxPodSandboxConfig.sysctls:type_name -> runtime.v1.LinuxPodSandboxConfig.SysctlsEntry
+	64,  // 22: runtime.v1.LinuxPodSandboxConfig.overhead:type_name -> runtime.v1.LinuxContainerResources
+	64,  // 23: runtime.v1.LinuxPodSandboxConfig.resources:type_name -> runtime.v1.LinuxContainerResources
+	23,  // 24: runtime.v1.PodSandboxConfig.metadata:type_name -> runtime.v1.PodSandboxMetadata
+	13,  // 25: runtime.v1.PodSandboxConfig.dns_config:type_name -> runtime.v1.DNSConfig
+	14,  // 26: runtime.v1.PodSandboxConfig.port_mappings:type_name -> runtime.v1.PortMapping
+	187, // 27: runtime.v1.PodSandboxConfig.labels:type_name -> runtime.v1.PodSandboxConfig.LabelsEntry
+	188, // 28: runtime.v1.PodSandboxConfig.annotations:type_name -> runtime.v1.PodSandboxConfig.AnnotationsEntry
+	22,  // 29: runtime.v1.PodSandboxConfig.linux:type_name -> runtime.v1.LinuxPodSandboxConfig
+	73,  // 30: runtime.v1.PodSandboxConfig.windows:type_name -> runtime.v1.WindowsPodSandboxConfig
+	24,  // 31: runtime.v1.RunPodSandboxRequest.config:type_name -> runtime.v1.PodSandboxConfig
+	32,  // 32: runtime.v1.PodSandboxNetworkStatus.additional_ips:type_name -> runtime.v1.PodIP
+	18,  // 33: runtime.v1.Namespace.options:type_name -> runtime.v1.NamespaceOption
+	34,  // 34: runtime.v1.LinuxPodSandboxStatus.namespaces:type_name -> runtime.v1.Namespace
+	23,  // 35: runtime.v1.PodSandboxStatus.metadata:type_name -> runtime.v1.PodSandboxMetadata
+	4,   // 36: runtime.v1.PodSandboxStatus.state:type_name -> runtime.v1.PodSandboxState
+	33,  // 37: runtime.v1.PodSandboxStatus.network:type_name -> runtime.v1.PodSandboxNetworkStatus
+	35,  // 38: runtime.v1.PodSandboxStatus.linux:type_name -> runtime.v1.LinuxPodSandboxStatus
+	189, // 39: runtime.v1.PodSandboxStatus.labels:type_name -> runtime.v1.PodSandboxStatus.LabelsEntry
+	190, // 40: runtime.v1.PodSandboxStatus.annotations:type_name -> runtime.v1.PodSandboxStatus.AnnotationsEntry
+	36,  // 41: runtime.v1.PodSandboxStatusResponse.status:type_name -> runtime.v1.PodSandboxStatus
+	191, // 42: runtime.v1.PodSandboxStatusResponse.info:type_name -> runtime.v1.PodSandboxStatusResponse.InfoEntry
+	98,  // 43: runtime.v1.PodSandboxStatusResponse.containers_statuses:type_name -> runtime.v1.ContainerStatus
+	4,   // 44: runtime.v1.PodSandboxStateValue.state:type_name -> runtime.v1.PodSandboxState
+	38,  // 45: runtime.v1.PodSandboxFilter.state:type_name -> runtime.v1.PodSandboxStateValue
+	192, // 46: runtime.v1.PodSandboxFilter.label_selector:type_name -> runtime.v1.PodSandboxFilter.LabelSelectorEntry
+	39,  // 47: runtime.v1.ListPodSandboxRequest.filter:type_name -> runtime.v1.PodSandboxFilter
+	23,  // 48: runtime.v1.PodSandbox.metadata:type_name -> runtime.v1.PodSandboxMetadata
+	4,   // 49: runtime.v1.PodSandbox.state:type_name -> runtime.v1.PodSandboxState
+	193, // 50: runtime.v1.PodSandbox.labels:type_name -> runtime.v1.PodSandbox.LabelsEntry
+	194, // 51: runtime.v1.PodSandbox.annotations:type_name -> runtime.v1.PodSandbox.AnnotationsEntry
+	41,  // 52: runtime.v1.ListPodSandboxResponse.items:type_name -> runtime.v1.PodSandbox
+	39,  // 53: runtime.v1.StreamPodSandboxesRequest.filter:type_name -> runtime.v1.PodSandboxFilter
+	41,  // 54: runtime.v1.StreamPodSandboxesResponse.pod_sandboxes:type_name -> runtime.v1.PodSandbox
+	53,  // 55: runtime.v1.PodSandboxStatsResponse.stats:type_name -> runtime.v1.PodSandboxStats
+	195, // 56: runtime.v1.PodSandboxStatsFilter.label_selector:type_name -> runtime.v1.PodSandboxStatsFilter.LabelSelectorEntry
+	47,  // 57: runtime.v1.ListPodSandboxStatsRequest.filter:type_name -> runtime.v1.PodSandboxStatsFilter
+	53,  // 58: runtime.v1.ListPodSandboxStatsResponse.stats:type_name -> runtime.v1.PodSandboxStats
+	47,  // 59: runtime.v1.StreamPodSandboxStatsRequest.filter:type_name -> runtime.v1.PodSandboxStatsFilter
+	53,  // 60: runtime.v1.StreamPodSandboxStatsResponse.pod_sandbox_stats:type_name -> runtime.v1.PodSandboxStats
+	23,  // 61: runtime.v1.PodSandboxAttributes.metadata:type_name -> runtime.v1.PodSandboxMetadata
+	196, // 62: runtime.v1.PodSandboxAttributes.labels:type_name -> runtime.v1.PodSandboxAttributes.LabelsEntry
+	197, // 63: runtime.v1.PodSandboxAttributes.annotations:type_name -> runtime.v1.PodSandboxAttributes.AnnotationsEntry
+	52,  // 64: runtime.v1.PodSandboxStats.attributes:type_name -> runtime.v1.PodSandboxAttributes
+	54,  // 65: runtime.v1.PodSandboxStats.linux:type_name -> runtime.v1.LinuxPodSandboxStats
+	55,  // 66: runtime.v1.PodSandboxStats.windows:type_name -> runtime.v1.WindowsPodSandboxStats
+	154, // 67: runtime.v1.LinuxPodSandboxStats.cpu:type_name -> runtime.v1.CpuUsage
+	156, // 68: runtime.v1.LinuxPodSandboxStats.memory:type_name -> runtime.v1.MemoryUsage
+	56,  // 69: runtime.v1.LinuxPodSandboxStats.network:type_name -> runtime.v1.NetworkUsage
+	60,  // 70: runtime.v1.LinuxPodSandboxStats.process:type_name -> runtime.v1.ProcessUsage
+	150, // 71: runtime.v1.LinuxPodSandboxStats.containers:type_name -> runtime.v1.ContainerStats
+	157, // 72: runtime.v1.LinuxPodSandboxStats.io:type_name -> runtime.v1.IoUsage
+	155, // 73: runtime.v1.WindowsPodSandboxStats.cpu:type_name -> runtime.v1.WindowsCpuUsage
+	159, // 74: runtime.v1.WindowsPodSandboxStats.memory:type_name -> runtime.v1.WindowsMemoryUsage
+	57,  // 75: runtime.v1.WindowsPodSandboxStats.network:type_name -> runtime.v1.WindowsNetworkUsage
+	61,  // 76: runtime.v1.WindowsPodSandboxStats.process:type_name -> runtime.v1.WindowsProcessUsage
+	151, // 77: runtime.v1.WindowsPodSandboxStats.containers:type_name -> runtime.v1.WindowsContainerStats
+	58,  // 78: runtime.v1.NetworkUsage.default_interface:type_name -> runtime.v1.NetworkInterfaceUsage
+	58,  // 79: runtime.v1.NetworkUsage.interfaces:type_name -> runtime.v1.NetworkInterfaceUsage
+	59,  // 80: runtime.v1.WindowsNetworkUsage.default_interface:type_name -> runtime.v1.WindowsNetworkInterfaceUsage
+	59,  // 81: runtime.v1.WindowsNetworkUsage.interfaces:type_name -> runtime.v1.WindowsNetworkInterfaceUsage
+	137, // 82: runtime.v1.NetworkInterfaceUsage.rx_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 83: runtime.v1.NetworkInterfaceUsage.rx_errors:type_name -> runtime.v1.UInt64Value
+	137, // 84: runtime.v1.NetworkInterfaceUsage.tx_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 85: runtime.v1.NetworkInterfaceUsage.tx_errors:type_name -> runtime.v1.UInt64Value
+	137, // 86: runtime.v1.WindowsNetworkInterfaceUsage.rx_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 87: runtime.v1.WindowsNetworkInterfaceUsage.rx_packets_dropped:type_name -> runtime.v1.UInt64Value
+	137, // 88: runtime.v1.WindowsNetworkInterfaceUsage.tx_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 89: runtime.v1.WindowsNetworkInterfaceUsage.tx_packets_dropped:type_name -> runtime.v1.UInt64Value
+	137, // 90: runtime.v1.ProcessUsage.process_count:type_name -> runtime.v1.UInt64Value
+	137, // 91: runtime.v1.WindowsProcessUsage.process_count:type_name -> runtime.v1.UInt64Value
+	198, // 92: runtime.v1.ImageSpec.annotations:type_name -> runtime.v1.ImageSpec.AnnotationsEntry
+	65,  // 93: runtime.v1.LinuxContainerResources.hugepage_limits:type_name -> runtime.v1.HugepageLimit
+	199, // 94: runtime.v1.LinuxContainerResources.unified:type_name -> runtime.v1.LinuxContainerResources.UnifiedEntry
+	67,  // 95: runtime.v1.LinuxContainerSecurityContext.capabilities:type_name -> runtime.v1.Capability
+	18,  // 96: runtime.v1.LinuxContainerSecurityContext.namespace_options:type_name -> runtime.v1.NamespaceOption
+	66,  // 97: runtime.v1.LinuxContainerSecurityContext.selinux_options:type_name -> runtime.v1.SELinuxOption
+	19,  // 98: runtime.v1.LinuxContainerSecurityContext.run_as_user:type_name -> runtime.v1.Int64Value
+	19,  // 99: runtime.v1.LinuxContainerSecurityContext.run_as_group:type_name -> runtime.v1.Int64Value
+	3,   // 100: runtime.v1.LinuxContainerSecurityContext.supplemental_groups_policy:type_name -> runtime.v1.SupplementalGroupsPolicy
+	21,  // 101: runtime.v1.LinuxContainerSecurityContext.seccomp:type_name -> runtime.v1.SecurityProfile
+	21,  // 102: runtime.v1.LinuxContainerSecurityContext.apparmor:type_name -> runtime.v1.SecurityProfile
+	64,  // 103: runtime.v1.LinuxContainerConfig.resources:type_name -> runtime.v1.LinuxContainerResources
+	68,  // 104: runtime.v1.LinuxContainerConfig.security_context:type_name -> runtime.v1.LinuxContainerSecurityContext
+	2,   // 105: runtime.v1.WindowsNamespaceOption.network:type_name -> runtime.v1.NamespaceMode
+	71,  // 106: runtime.v1.WindowsSandboxSecurityContext.namespace_options:type_name -> runtime.v1.WindowsNamespaceOption
+	72,  // 107: runtime.v1.WindowsPodSandboxConfig.security_context:type_name -> runtime.v1.WindowsSandboxSecurityContext
+	76,  // 108: runtime.v1.WindowsContainerConfig.resources:type_name -> runtime.v1.WindowsContainerResources
+	74,  // 109: runtime.v1.WindowsContainerConfig.security_context:type_name -> runtime.v1.WindowsContainerSecurityContext
+	77,  // 110: runtime.v1.WindowsContainerResources.affinity_cpus:type_name -> runtime.v1.WindowsCpuGroupAffinity
+	78,  // 111: runtime.v1.ContainerConfig.metadata:type_name -> runtime.v1.ContainerMetadata
+	62,  // 112: runtime.v1.ContainerConfig.image:type_name -> runtime.v1.ImageSpec
+	63,  // 113: runtime.v1.ContainerConfig.envs:type_name -> runtime.v1.KeyValue
+	15,  // 114: runtime.v1.ContainerConfig.mounts:type_name -> runtime.v1.Mount
+	79,  // 115: runtime.v1.ContainerConfig.devices:type_name -> runtime.v1.Device
+	200, // 116: runtime.v1.ContainerConfig.labels:type_name -> runtime.v1.ContainerConfig.LabelsEntry
+	201, // 117: runtime.v1.ContainerConfig.annotations:type_name -> runtime.v1.ContainerConfig.AnnotationsEntry
+	69,  // 118: runtime.v1.ContainerConfig.linux:type_name -> runtime.v1.LinuxContainerConfig
+	75,  // 119: runtime.v1.ContainerConfig.windows:type_name -> runtime.v1.WindowsContainerConfig
+	80,  // 120: runtime.v1.ContainerConfig.CDI_devices:type_name -> runtime.v1.CDIDevice
+	5,   // 121: runtime.v1.ContainerConfig.stop_signal:type_name -> runtime.v1.Signal
+	81,  // 122: runtime.v1.CreateContainerRequest.config:type_name -> runtime.v1.ContainerConfig
+	24,  // 123: runtime.v1.CreateContainerRequest.sandbox_config:type_name -> runtime.v1.PodSandboxConfig
+	6,   // 124: runtime.v1.ContainerStateValue.state:type_name -> runtime.v1.ContainerState
+	90,  // 125: runtime.v1.ContainerFilter.state:type_name -> runtime.v1.ContainerStateValue
+	202, // 126: runtime.v1.ContainerFilter.label_selector:type_name -> runtime.v1.ContainerFilter.LabelSelectorEntry
+	91,  // 127: runtime.v1.ListContainersRequest.filter:type_name -> runtime.v1.ContainerFilter
+	78,  // 128: runtime.v1.Container.metadata:type_name -> runtime.v1.ContainerMetadata
+	62,  // 129: runtime.v1.Container.image:type_name -> runtime.v1.ImageSpec
+	6,   // 130: runtime.v1.Container.state:type_name -> runtime.v1.ContainerState
+	203, // 131: runtime.v1.Container.labels:type_name -> runtime.v1.Container.LabelsEntry
+	204, // 132: runtime.v1.Container.annotations:type_name -> runtime.v1.Container.AnnotationsEntry
+	93,  // 133: runtime.v1.ListContainersResponse.containers:type_name -> runtime.v1.Container
+	91,  // 134: runtime.v1.StreamContainersRequest.filter:type_name -> runtime.v1.ContainerFilter
+	93,  // 135: runtime.v1.StreamContainersResponse.containers:type_name -> runtime.v1.Container
+	78,  // 136: runtime.v1.ContainerStatus.metadata:type_name -> runtime.v1.ContainerMetadata
+	6,   // 137: runtime.v1.ContainerStatus.state:type_name -> runtime.v1.ContainerState
+	62,  // 138: runtime.v1.ContainerStatus.image:type_name -> runtime.v1.ImageSpec
+	205, // 139: runtime.v1.ContainerStatus.labels:type_name -> runtime.v1.ContainerStatus.LabelsEntry
+	206, // 140: runtime.v1.ContainerStatus.annotations:type_name -> runtime.v1.ContainerStatus.AnnotationsEntry
+	15,  // 141: runtime.v1.ContainerStatus.mounts:type_name -> runtime.v1.Mount
+	100, // 142: runtime.v1.ContainerStatus.resources:type_name -> runtime.v1.ContainerResources
+	101, // 143: runtime.v1.ContainerStatus.user:type_name -> runtime.v1.ContainerUser
+	5,   // 144: runtime.v1.ContainerStatus.stop_signal:type_name -> runtime.v1.Signal
+	98,  // 145: runtime.v1.ContainerStatusResponse.status:type_name -> runtime.v1.ContainerStatus
+	207, // 146: runtime.v1.ContainerStatusResponse.info:type_name -> runtime.v1.ContainerStatusResponse.InfoEntry
+	64,  // 147: runtime.v1.ContainerResources.linux:type_name -> runtime.v1.LinuxContainerResources
+	76,  // 148: runtime.v1.ContainerResources.windows:type_name -> runtime.v1.WindowsContainerResources
+	70,  // 149: runtime.v1.ContainerUser.linux:type_name -> runtime.v1.LinuxContainerUser
+	64,  // 150: runtime.v1.UpdateContainerResourcesRequest.linux:type_name -> runtime.v1.LinuxContainerResources
+	76,  // 151: runtime.v1.UpdateContainerResourcesRequest.windows:type_name -> runtime.v1.WindowsContainerResources
+	208, // 152: runtime.v1.UpdateContainerResourcesRequest.annotations:type_name -> runtime.v1.UpdateContainerResourcesRequest.AnnotationsEntry
+	62,  // 153: runtime.v1.ImageFilter.image:type_name -> runtime.v1.ImageSpec
+	112, // 154: runtime.v1.ListImagesRequest.filter:type_name -> runtime.v1.ImageFilter
+	19,  // 155: runtime.v1.Image.uid:type_name -> runtime.v1.Int64Value
+	62,  // 156: runtime.v1.Image.spec:type_name -> runtime.v1.ImageSpec
+	114, // 157: runtime.v1.ListImagesResponse.images:type_name -> runtime.v1.Image
+	112, // 158: runtime.v1.StreamImagesRequest.filter:type_name -> runtime.v1.ImageFilter
+	114, // 159: runtime.v1.StreamImagesResponse.images:type_name -> runtime.v1.Image
+	62,  // 160: runtime.v1.ImageStatusRequest.image:type_name -> runtime.v1.ImageSpec
+	114, // 161: runtime.v1.ImageStatusResponse.image:type_name -> runtime.v1.Image
+	209, // 162: runtime.v1.ImageStatusResponse.info:type_name -> runtime.v1.ImageStatusResponse.InfoEntry
+	62,  // 163: runtime.v1.PullImageRequest.image:type_name -> runtime.v1.ImageSpec
+	120, // 164: runtime.v1.PullImageRequest.auth:type_name -> runtime.v1.AuthConfig
+	24,  // 165: runtime.v1.PullImageRequest.sandbox_config:type_name -> runtime.v1.PodSandboxConfig
+	62,  // 166: runtime.v1.RemoveImageRequest.image:type_name -> runtime.v1.ImageSpec
+	125, // 167: runtime.v1.RuntimeConfig.network_config:type_name -> runtime.v1.NetworkConfig
+	126, // 168: runtime.v1.UpdateRuntimeConfigRequest.runtime_config:type_name -> runtime.v1.RuntimeConfig
+	129, // 169: runtime.v1.RuntimeStatus.conditions:type_name -> runtime.v1.RuntimeCondition
+	132, // 170: runtime.v1.RuntimeHandler.features:type_name -> runtime.v1.RuntimeHandlerFeatures
+	130, // 171: runtime.v1.StatusResponse.status:type_name -> runtime.v1.RuntimeStatus
+	210, // 172: runtime.v1.StatusResponse.info:type_name -> runtime.v1.StatusResponse.InfoEntry
+	133, // 173: runtime.v1.StatusResponse.runtime_handlers:type_name -> runtime.v1.RuntimeHandler
+	134, // 174: runtime.v1.StatusResponse.features:type_name -> runtime.v1.RuntimeFeatures
+	138, // 175: runtime.v1.FilesystemUsage.fs_id:type_name -> runtime.v1.FilesystemIdentifier
+	137, // 176: runtime.v1.FilesystemUsage.used_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 177: runtime.v1.FilesystemUsage.inodes_used:type_name -> runtime.v1.UInt64Value
+	138, // 178: runtime.v1.WindowsFilesystemUsage.fs_id:type_name -> runtime.v1.FilesystemIdentifier
+	137, // 179: runtime.v1.WindowsFilesystemUsage.used_bytes:type_name -> runtime.v1.UInt64Value
+	139, // 180: runtime.v1.ImageFsInfoResponse.image_filesystems:type_name -> runtime.v1.FilesystemUsage
+	139, // 181: runtime.v1.ImageFsInfoResponse.container_filesystems:type_name -> runtime.v1.FilesystemUsage
+	150, // 182: runtime.v1.ContainerStatsResponse.stats:type_name -> runtime.v1.ContainerStats
+	145, // 183: runtime.v1.ListContainerStatsRequest.filter:type_name -> runtime.v1.ContainerStatsFilter
+	211, // 184: runtime.v1.ContainerStatsFilter.label_selector:type_name -> runtime.v1.ContainerStatsFilter.LabelSelectorEntry
+	150, // 185: runtime.v1.ListContainerStatsResponse.stats:type_name -> runtime.v1.ContainerStats
+	145, // 186: runtime.v1.StreamContainerStatsRequest.filter:type_name -> runtime.v1.ContainerStatsFilter
+	150, // 187: runtime.v1.StreamContainerStatsResponse.container_stats:type_name -> runtime.v1.ContainerStats
+	78,  // 188: runtime.v1.ContainerAttributes.metadata:type_name -> runtime.v1.ContainerMetadata
+	212, // 189: runtime.v1.ContainerAttributes.labels:type_name -> runtime.v1.ContainerAttributes.LabelsEntry
+	213, // 190: runtime.v1.ContainerAttributes.annotations:type_name -> runtime.v1.ContainerAttributes.AnnotationsEntry
+	149, // 191: runtime.v1.ContainerStats.attributes:type_name -> runtime.v1.ContainerAttributes
+	154, // 192: runtime.v1.ContainerStats.cpu:type_name -> runtime.v1.CpuUsage
+	156, // 193: runtime.v1.ContainerStats.memory:type_name -> runtime.v1.MemoryUsage
+	139, // 194: runtime.v1.ContainerStats.writable_layer:type_name -> runtime.v1.FilesystemUsage
+	158, // 195: runtime.v1.ContainerStats.swap:type_name -> runtime.v1.SwapUsage
+	157, // 196: runtime.v1.ContainerStats.io:type_name -> runtime.v1.IoUsage
+	149, // 197: runtime.v1.WindowsContainerStats.attributes:type_name -> runtime.v1.ContainerAttributes
+	155, // 198: runtime.v1.WindowsContainerStats.cpu:type_name -> runtime.v1.WindowsCpuUsage
+	159, // 199: runtime.v1.WindowsContainerStats.memory:type_name -> runtime.v1.WindowsMemoryUsage
+	140, // 200: runtime.v1.WindowsContainerStats.writable_layer:type_name -> runtime.v1.WindowsFilesystemUsage
+	153, // 201: runtime.v1.PsiStats.Full:type_name -> runtime.v1.PsiData
+	153, // 202: runtime.v1.PsiStats.Some:type_name -> runtime.v1.PsiData
+	137, // 203: runtime.v1.CpuUsage.usage_core_nano_seconds:type_name -> runtime.v1.UInt64Value
+	137, // 204: runtime.v1.CpuUsage.usage_nano_cores:type_name -> runtime.v1.UInt64Value
+	152, // 205: runtime.v1.CpuUsage.psi:type_name -> runtime.v1.PsiStats
+	137, // 206: runtime.v1.WindowsCpuUsage.usage_core_nano_seconds:type_name -> runtime.v1.UInt64Value
+	137, // 207: runtime.v1.WindowsCpuUsage.usage_nano_cores:type_name -> runtime.v1.UInt64Value
+	137, // 208: runtime.v1.MemoryUsage.working_set_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 209: runtime.v1.MemoryUsage.available_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 210: runtime.v1.MemoryUsage.usage_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 211: runtime.v1.MemoryUsage.rss_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 212: runtime.v1.MemoryUsage.page_faults:type_name -> runtime.v1.UInt64Value
+	137, // 213: runtime.v1.MemoryUsage.major_page_faults:type_name -> runtime.v1.UInt64Value
+	152, // 214: runtime.v1.MemoryUsage.psi:type_name -> runtime.v1.PsiStats
+	152, // 215: runtime.v1.IoUsage.psi:type_name -> runtime.v1.PsiStats
+	137, // 216: runtime.v1.SwapUsage.swap_available_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 217: runtime.v1.SwapUsage.swap_usage_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 218: runtime.v1.WindowsMemoryUsage.working_set_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 219: runtime.v1.WindowsMemoryUsage.available_bytes:type_name -> runtime.v1.UInt64Value
+	137, // 220: runtime.v1.WindowsMemoryUsage.page_faults:type_name -> runtime.v1.UInt64Value
+	137, // 221: runtime.v1.WindowsMemoryUsage.commit_memory_bytes:type_name -> runtime.v1.UInt64Value
+	214, // 222: runtime.v1.CheckpointPodRequest.options:type_name -> runtime.v1.CheckpointPodRequest.OptionsEntry
+	24,  // 223: runtime.v1.RestorePodRequest.config:type_name -> runtime.v1.PodSandboxConfig
+	215, // 224: runtime.v1.RestorePodRequest.options:type_name -> runtime.v1.RestorePodRequest.OptionsEntry
+	81,  // 225: runtime.v1.RestorePodRequest.container_configs:type_name -> runtime.v1.ContainerConfig
+	167, // 226: runtime.v1.RestorePodResponse.restored_containers:type_name -> runtime.v1.RestoredContainer
+	7,   // 227: runtime.v1.ContainerEventResponse.container_event_type:type_name -> runtime.v1.ContainerEventType
+	36,  // 228: runtime.v1.ContainerEventResponse.pod_sandbox_status:type_name -> runtime.v1.PodSandboxStatus
+	98,  // 229: runtime.v1.ContainerEventResponse.containers_statuses:type_name -> runtime.v1.ContainerStatus
+	173, // 230: runtime.v1.ListMetricDescriptorsResponse.descriptors:type_name -> runtime.v1.MetricDescriptor
+	178, // 231: runtime.v1.ListPodSandboxMetricsResponse.pod_metrics:type_name -> runtime.v1.PodSandboxMetrics
+	178, // 232: runtime.v1.StreamPodSandboxMetricsResponse.pod_sandbox_metrics:type_name -> runtime.v1.PodSandboxMetrics
+	180, // 233: runtime.v1.PodSandboxMetrics.metrics:type_name -> runtime.v1.Metric
+	179, // 234: runtime.v1.PodSandboxMetrics.container_metrics:type_name -> runtime.v1.ContainerMetrics
+	180, // 235: runtime.v1.ContainerMetrics.metrics:type_name -> runtime.v1.Metric
+	8,   // 236: runtime.v1.Metric.metric_type:type_name -> runtime.v1.MetricType
+	137, // 237: runtime.v1.Metric.value:type_name -> runtime.v1.UInt64Value
+	183, // 238: runtime.v1.RuntimeConfigResponse.linux:type_name -> runtime.v1.LinuxRuntimeConfiguration
+	9,   // 239: runtime.v1.LinuxRuntimeConfiguration.cgroup_driver:type_name -> runtime.v1.CgroupDriver
+	64,  // 240: runtime.v1.UpdatePodSandboxResourcesRequest.overhead:type_name -> runtime.v1.LinuxContainerResources
+	64,  // 241: runtime.v1.UpdatePodSandboxResourcesRequest.resources:type_name -> runtime.v1.LinuxContainerResources
+	11,  // 242: runtime.v1.RuntimeService.Version:input_type -> runtime.v1.VersionRequest
+	25,  // 243: runtime.v1.RuntimeService.RunPodSandbox:input_type -> runtime.v1.RunPodSandboxRequest
+	27,  // 244: runtime.v1.RuntimeService.StopPodSandbox:input_type -> runtime.v1.StopPodSandboxRequest
+	29,  // 245: runtime.v1.RuntimeService.RemovePodSandbox:input_type -> runtime.v1.RemovePodSandboxRequest
+	31,  // 246: runtime.v1.RuntimeService.PodSandboxStatus:input_type -> runtime.v1.PodSandboxStatusRequest
+	40,  // 247: runtime.v1.RuntimeService.ListPodSandbox:input_type -> runtime.v1.ListPodSandboxRequest
+	43,  // 248: runtime.v1.RuntimeService.StreamPodSandboxes:input_type -> runtime.v1.StreamPodSandboxesRequest
+	82,  // 249: runtime.v1.RuntimeService.CreateContainer:input_type -> runtime.v1.CreateContainerRequest
+	84,  // 250: runtime.v1.RuntimeService.StartContainer:input_type -> runtime.v1.StartContainerRequest
+	86,  // 251: runtime.v1.RuntimeService.StopContainer:input_type -> runtime.v1.StopContainerRequest
+	88,  // 252: runtime.v1.RuntimeService.RemoveContainer:input_type -> runtime.v1.RemoveContainerRequest
+	92,  // 253: runtime.v1.RuntimeService.ListContainers:input_type -> runtime.v1.ListContainersRequest
+	95,  // 254: runtime.v1.RuntimeService.StreamContainers:input_type -> runtime.v1.StreamContainersRequest
+	97,  // 255: runtime.v1.RuntimeService.ContainerStatus:input_type -> runtime.v1.ContainerStatusRequest
+	102, // 256: runtime.v1.RuntimeService.UpdateContainerResources:input_type -> runtime.v1.UpdateContainerResourcesRequest
+	160, // 257: runtime.v1.RuntimeService.ReopenContainerLog:input_type -> runtime.v1.ReopenContainerLogRequest
+	104, // 258: runtime.v1.RuntimeService.ExecSync:input_type -> runtime.v1.ExecSyncRequest
+	106, // 259: runtime.v1.RuntimeService.Exec:input_type -> runtime.v1.ExecRequest
+	108, // 260: runtime.v1.RuntimeService.Attach:input_type -> runtime.v1.AttachRequest
+	110, // 261: runtime.v1.RuntimeService.PortForward:input_type -> runtime.v1.PortForwardRequest
+	142, // 262: runtime.v1.RuntimeService.ContainerStats:input_type -> runtime.v1.ContainerStatsRequest
+	144, // 263: runtime.v1.RuntimeService.ListContainerStats:input_type -> runtime.v1.ListContainerStatsRequest
+	147, // 264: runtime.v1.RuntimeService.StreamContainerStats:input_type -> runtime.v1.StreamContainerStatsRequest
+	45,  // 265: runtime.v1.RuntimeService.PodSandboxStats:input_type -> runtime.v1.PodSandboxStatsRequest
+	48,  // 266: runtime.v1.RuntimeService.ListPodSandboxStats:input_type -> runtime.v1.ListPodSandboxStatsRequest
+	50,  // 267: runtime.v1.RuntimeService.StreamPodSandboxStats:input_type -> runtime.v1.StreamPodSandboxStatsRequest
+	127, // 268: runtime.v1.RuntimeService.UpdateRuntimeConfig:input_type -> runtime.v1.UpdateRuntimeConfigRequest
+	131, // 269: runtime.v1.RuntimeService.Status:input_type -> runtime.v1.StatusRequest
+	162, // 270: runtime.v1.RuntimeService.CheckpointContainer:input_type -> runtime.v1.CheckpointContainerRequest
+	164, // 271: runtime.v1.RuntimeService.CheckpointPod:input_type -> runtime.v1.CheckpointPodRequest
+	166, // 272: runtime.v1.RuntimeService.RestorePod:input_type -> runtime.v1.RestorePodRequest
+	169, // 273: runtime.v1.RuntimeService.GetContainerEvents:input_type -> runtime.v1.GetEventsRequest
+	171, // 274: runtime.v1.RuntimeService.ListMetricDescriptors:input_type -> runtime.v1.ListMetricDescriptorsRequest
+	174, // 275: runtime.v1.RuntimeService.ListPodSandboxMetrics:input_type -> runtime.v1.ListPodSandboxMetricsRequest
+	176, // 276: runtime.v1.RuntimeService.StreamPodSandboxMetrics:input_type -> runtime.v1.StreamPodSandboxMetricsRequest
+	181, // 277: runtime.v1.RuntimeService.RuntimeConfig:input_type -> runtime.v1.RuntimeConfigRequest
+	184, // 278: runtime.v1.RuntimeService.UpdatePodSandboxResources:input_type -> runtime.v1.UpdatePodSandboxResourcesRequest
+	113, // 279: runtime.v1.ImageService.ListImages:input_type -> runtime.v1.ListImagesRequest
+	116, // 280: runtime.v1.ImageService.StreamImages:input_type -> runtime.v1.StreamImagesRequest
+	118, // 281: runtime.v1.ImageService.ImageStatus:input_type -> runtime.v1.ImageStatusRequest
+	121, // 282: runtime.v1.ImageService.PullImage:input_type -> runtime.v1.PullImageRequest
+	123, // 283: runtime.v1.ImageService.RemoveImage:input_type -> runtime.v1.RemoveImageRequest
+	136, // 284: runtime.v1.ImageService.ImageFsInfo:input_type -> runtime.v1.ImageFsInfoRequest
+	12,  // 285: runtime.v1.RuntimeService.Version:output_type -> runtime.v1.VersionResponse
+	26,  // 286: runtime.v1.RuntimeService.RunPodSandbox:output_type -> runtime.v1.RunPodSandboxResponse
+	28,  // 287: runtime.v1.RuntimeService.StopPodSandbox:output_type -> runtime.v1.StopPodSandboxResponse
+	30,  // 288: runtime.v1.RuntimeService.RemovePodSandbox:output_type -> runtime.v1.RemovePodSandboxResponse
+	37,  // 289: runtime.v1.RuntimeService.PodSandboxStatus:output_type -> runtime.v1.PodSandboxStatusResponse
+	42,  // 290: runtime.v1.RuntimeService.ListPodSandbox:output_type -> runtime.v1.ListPodSandboxResponse
+	44,  // 291: runtime.v1.RuntimeService.StreamPodSandboxes:output_type -> runtime.v1.StreamPodSandboxesResponse
+	83,  // 292: runtime.v1.RuntimeService.CreateContainer:output_type -> runtime.v1.CreateContainerResponse
+	85,  // 293: runtime.v1.RuntimeService.StartContainer:output_type -> runtime.v1.StartContainerResponse
+	87,  // 294: runtime.v1.RuntimeService.StopContainer:output_type -> runtime.v1.StopContainerResponse
+	89,  // 295: runtime.v1.RuntimeService.RemoveContainer:output_type -> runtime.v1.RemoveContainerResponse
+	94,  // 296: runtime.v1.RuntimeService.ListContainers:output_type -> runtime.v1.ListContainersResponse
+	96,  // 297: runtime.v1.RuntimeService.StreamContainers:output_type -> runtime.v1.StreamContainersResponse
+	99,  // 298: runtime.v1.RuntimeService.ContainerStatus:output_type -> runtime.v1.ContainerStatusResponse
+	103, // 299: runtime.v1.RuntimeService.UpdateContainerResources:output_type -> runtime.v1.UpdateContainerResourcesResponse
+	161, // 300: runtime.v1.RuntimeService.ReopenContainerLog:output_type -> runtime.v1.ReopenContainerLogResponse
+	105, // 301: runtime.v1.RuntimeService.ExecSync:output_type -> runtime.v1.ExecSyncResponse
+	107, // 302: runtime.v1.RuntimeService.Exec:output_type -> runtime.v1.ExecResponse
+	109, // 303: runtime.v1.RuntimeService.Attach:output_type -> runtime.v1.AttachResponse
+	111, // 304: runtime.v1.RuntimeService.PortForward:output_type -> runtime.v1.PortForwardResponse
+	143, // 305: runtime.v1.RuntimeService.ContainerStats:output_type -> runtime.v1.ContainerStatsResponse
+	146, // 306: runtime.v1.RuntimeService.ListContainerStats:output_type -> runtime.v1.ListContainerStatsResponse
+	148, // 307: runtime.v1.RuntimeService.StreamContainerStats:output_type -> runtime.v1.StreamContainerStatsResponse
+	46,  // 308: runtime.v1.RuntimeService.PodSandboxStats:output_type -> runtime.v1.PodSandboxStatsResponse
+	49,  // 309: runtime.v1.RuntimeService.ListPodSandboxStats:output_type -> runtime.v1.ListPodSandboxStatsResponse
+	51,  // 310: runtime.v1.RuntimeService.StreamPodSandboxStats:output_type -> runtime.v1.StreamPodSandboxStatsResponse
+	128, // 311: runtime.v1.RuntimeService.UpdateRuntimeConfig:output_type -> runtime.v1.UpdateRuntimeConfigResponse
+	135, // 312: runtime.v1.RuntimeService.Status:output_type -> runtime.v1.StatusResponse
+	163, // 313: runtime.v1.RuntimeService.CheckpointContainer:output_type -> runtime.v1.CheckpointContainerResponse
+	165, // 314: runtime.v1.RuntimeService.CheckpointPod:output_type -> runtime.v1.CheckpointPodResponse
+	168, // 315: runtime.v1.RuntimeService.RestorePod:output_type -> runtime.v1.RestorePodResponse
+	170, // 316: runtime.v1.RuntimeService.GetContainerEvents:output_type -> runtime.v1.ContainerEventResponse
+	172, // 317: runtime.v1.RuntimeService.ListMetricDescriptors:output_type -> runtime.v1.ListMetricDescriptorsResponse
+	175, // 318: runtime.v1.RuntimeService.ListPodSandboxMetrics:output_type -> runtime.v1.ListPodSandboxMetricsResponse
+	177, // 319: runtime.v1.RuntimeService.StreamPodSandboxMetrics:output_type -> runtime.v1.StreamPodSandboxMetricsResponse
+	182, // 320: runtime.v1.RuntimeService.RuntimeConfig:output_type -> runtime.v1.RuntimeConfigResponse
+	185, // 321: runtime.v1.RuntimeService.UpdatePodSandboxResources:output_type -> runtime.v1.UpdatePodSandboxResourcesResponse
+	115, // 322: runtime.v1.ImageService.ListImages:output_type -> runtime.v1.ListImagesResponse
+	117, // 323: runtime.v1.ImageService.StreamImages:output_type -> runtime.v1.StreamImagesResponse
+	119, // 324: runtime.v1.ImageService.ImageStatus:output_type -> runtime.v1.ImageStatusResponse
+	122, // 325: runtime.v1.ImageService.PullImage:output_type -> runtime.v1.PullImageResponse
+	124, // 326: runtime.v1.ImageService.RemoveImage:output_type -> runtime.v1.RemoveImageResponse
+	141, // 327: runtime.v1.ImageService.ImageFsInfo:output_type -> runtime.v1.ImageFsInfoResponse
+	285, // [285:328] is the sub-list for method output_type
+	242, // [242:285] is the sub-list for method input_type
+	242, // [242:242] is the sub-list for extension type_name
+	242, // [242:242] is the sub-list for extension extendee
+	0,   // [0:242] is the sub-list for field type_name
+}
+
+func init() { file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_init() }
+func file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_init() {
+	if File_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto != nil {
+		return
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: unsafe.Slice(unsafe.StringData(file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDesc), len(file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_rawDesc)),
+			NumEnums:      11,
+			NumMessages:   205,
+			NumExtensions: 0,
+			NumServices:   2,
+		},
+		GoTypes:           file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_goTypes,
+		DependencyIndexes: file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_depIdxs,
+		EnumInfos:         file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_enumTypes,
+		MessageInfos:      file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_msgTypes,
+	}.Build()
+	File_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto = out.File
+	file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_goTypes = nil
+	file_staging_src_k8s_io_cri_api_pkg_apis_runtime_v1_api_proto_depIdxs = nil
+}
diff --git a/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto
new file mode 100644
index 0000000000..f0a2cbd661
--- /dev/null
+++ b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto
@@ -0,0 +1,2395 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// To regenerate api.pb.go run `hack/update-codegen.sh protobindings`
+syntax = "proto3";
+
+package runtime.v1;
+option go_package = "k8s.io/cri-api/pkg/apis/runtime/v1";
+
+// Runtime service defines the public APIs for remote container runtimes
+service RuntimeService {
+    // Version returns the runtime name, runtime version, and runtime API version.
+    rpc Version(VersionRequest) returns (VersionResponse) {}
+
+    // RunPodSandbox creates and starts a pod-level sandbox. Runtimes must ensure
+    // the sandbox is in the ready state on success.
+    rpc RunPodSandbox(RunPodSandboxRequest) returns (RunPodSandboxResponse) {}
+    // StopPodSandbox stops any running process that is part of the sandbox and
+    // reclaims network resources (e.g., IP addresses) allocated to the sandbox.
+    // If there are any running containers in the sandbox, they must be forcibly
+    // terminated.
+    // This call is idempotent, and must not return an error if all relevant
+    // resources have already been reclaimed. kubelet will call StopPodSandbox
+    // at least once before calling RemovePodSandbox. It will also attempt to
+    // reclaim resources eagerly, as soon as a sandbox is not needed. Hence,
+    // multiple StopPodSandbox calls are expected.
+    rpc StopPodSandbox(StopPodSandboxRequest) returns (StopPodSandboxResponse) {}
+    // RemovePodSandbox removes the sandbox. If there are any running containers
+    // in the sandbox, they must be forcibly terminated and removed.
+    // This call is idempotent, and must not return an error if the sandbox has
+    // already been removed.
+    rpc RemovePodSandbox(RemovePodSandboxRequest) returns (RemovePodSandboxResponse) {}
+    // PodSandboxStatus returns the status of the PodSandbox. If the PodSandbox is not
+    // present, returns an error.
+    rpc PodSandboxStatus(PodSandboxStatusRequest) returns (PodSandboxStatusResponse) {}
+    // ListPodSandbox returns a list of PodSandboxes.
+    rpc ListPodSandbox(ListPodSandboxRequest) returns (ListPodSandboxResponse) {}
+    // StreamPodSandboxes returns a stream of PodSandboxes.
+    // This is an alternative to ListPodSandbox that streams results in lists
+    // of at least one item, avoiding the gRPC message size limit for nodes with
+    // many pods. The number of items per list may vary depending on the
+    // container runtime. Each item must appear in exactly one response and must
+    // not be duplicated across responses in the same stream. The server must
+    // close the stream with EOF after all items have been sent. The kubelet
+    // collects all items from the stream and processes them all at once after
+    // the stream completes. The kubelet enforces a timeout on the entire stream
+    // and will discard partial results if the stream is not completed in time.
+    // Feature gate: CRIListStreaming
+    // See https://kep.k8s.io/5825 for more details.
+    rpc StreamPodSandboxes(StreamPodSandboxesRequest) returns (stream StreamPodSandboxesResponse) {}
+
+    // CreateContainer creates a new container in specified PodSandbox
+    rpc CreateContainer(CreateContainerRequest) returns (CreateContainerResponse) {}
+    // StartContainer starts the container.
+    rpc StartContainer(StartContainerRequest) returns (StartContainerResponse) {}
+    // StopContainer stops a running container with a grace period (i.e., timeout).
+    // This call is idempotent, and must not return an error if the container has
+    // already been stopped.
+    // The runtime must forcibly kill the container after the grace period is
+    // reached.
+    rpc StopContainer(StopContainerRequest) returns (StopContainerResponse) {}
+    // RemoveContainer removes the container. If the container is running, the
+    // container must be forcibly removed.
+    // This call is idempotent, and must not return an error if the container has
+    // already been removed.
+    rpc RemoveContainer(RemoveContainerRequest) returns (RemoveContainerResponse) {}
+    // ListContainers lists all containers by filters.
+    rpc ListContainers(ListContainersRequest) returns (ListContainersResponse) {}
+    // StreamContainers returns a stream of containers.
+    // This is an alternative to ListContainers that streams results in lists
+    // of at least one item, avoiding the gRPC message size limit for nodes with
+    // many containers. The number of items per list may vary depending on the
+    // container runtime. Each item must appear in exactly one response and must
+    // not be duplicated across responses in the same stream. The server must
+    // close the stream with EOF after all items have been sent. The kubelet
+    // collects all items from the stream and processes them all at once after
+    // the stream completes. The kubelet enforces a timeout on the entire stream
+    // and will discard partial results if the stream is not completed in time.
+    // Feature gate: CRIListStreaming
+    // See https://kep.k8s.io/5825 for more details.
+    rpc StreamContainers(StreamContainersRequest) returns (stream StreamContainersResponse) {}
+    // ContainerStatus returns status of the container. If the container is not
+    // present, returns an error.
+    rpc ContainerStatus(ContainerStatusRequest) returns (ContainerStatusResponse) {}
+    // UpdateContainerResources updates ContainerConfig of the container synchronously.
+    // If runtime fails to transactionally update the requested resources, an error is returned.
+    rpc UpdateContainerResources(UpdateContainerResourcesRequest) returns (UpdateContainerResourcesResponse) {}
+    // ReopenContainerLog asks runtime to reopen the stdout/stderr log file
+    // for the container. This is often called after the log file has been
+    // rotated. If the container is not running, container runtime can choose
+    // to either create a new log file and return nil, or return an error.
+    // Once it returns error, new container log file MUST NOT be created.
+    rpc ReopenContainerLog(ReopenContainerLogRequest) returns (ReopenContainerLogResponse) {}
+
+    // ExecSync runs a command in a container synchronously.
+    rpc ExecSync(ExecSyncRequest) returns (ExecSyncResponse) {}
+    // Exec prepares a streaming endpoint to execute a command in the container.
+    rpc Exec(ExecRequest) returns (ExecResponse) {}
+    // Attach prepares a streaming endpoint to attach to a running container.
+    rpc Attach(AttachRequest) returns (AttachResponse) {}
+    // PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
+    rpc PortForward(PortForwardRequest) returns (PortForwardResponse) {}
+
+    // ContainerStats returns stats of the container. If the container does not
+    // exist, the call returns an error.
+    rpc ContainerStats(ContainerStatsRequest) returns (ContainerStatsResponse) {}
+    // ListContainerStats returns stats of all running containers.
+    rpc ListContainerStats(ListContainerStatsRequest) returns (ListContainerStatsResponse) {}
+    // StreamContainerStats returns a stream of container stats.
+    // This is an alternative to ListContainerStats that streams results in
+    // lists of at least one item, avoiding the gRPC message size limit for
+    // nodes with many containers. The number of items per list may vary
+    // depending on the container runtime. Each item must appear in exactly one
+    // response and must not be duplicated across responses in the same stream.
+    // The server must close the stream with EOF after all items have been sent.
+    // The kubelet collects all items from the stream and processes them all at
+    // once after the stream completes. The kubelet enforces a timeout on the
+    // entire stream and will discard partial results if the stream is not
+    // completed in time.
+    // Feature gate: CRIListStreaming
+    // See https://kep.k8s.io/5825 for more details.
+    rpc StreamContainerStats(StreamContainerStatsRequest) returns (stream StreamContainerStatsResponse) {}
+
+    // PodSandboxStats returns stats of the pod sandbox. If the pod sandbox does not
+    // exist, the call returns an error.
+    rpc PodSandboxStats(PodSandboxStatsRequest) returns (PodSandboxStatsResponse) {}
+    // ListPodSandboxStats returns stats of the pod sandboxes matching a filter.
+    rpc ListPodSandboxStats(ListPodSandboxStatsRequest) returns (ListPodSandboxStatsResponse) {}
+    // StreamPodSandboxStats returns a stream of pod sandbox stats.
+    // This is an alternative to ListPodSandboxStats that streams results in
+    // lists of at least one item, avoiding the gRPC message size limit for
+    // nodes with many pods. The number of items per list may vary depending on
+    // the container runtime. Each item must appear in exactly one response and
+    // must not be duplicated across responses in the same stream. The server
+    // must close the stream with EOF after all items have been sent. The
+    // kubelet collects all items from the stream and processes them all at once
+    // after the stream completes. The kubelet enforces a timeout on the entire
+    // stream and will discard partial results if the stream is not completed
+    // in time.
+    // Feature gate: CRIListStreaming
+    // See https://kep.k8s.io/5825 for more details.
+    rpc StreamPodSandboxStats(StreamPodSandboxStatsRequest) returns (stream StreamPodSandboxStatsResponse) {}
+
+    // UpdateRuntimeConfig updates the runtime configuration based on the given request.
+    rpc UpdateRuntimeConfig(UpdateRuntimeConfigRequest) returns (UpdateRuntimeConfigResponse) {}
+
+    // Status returns the status of the runtime.
+    rpc Status(StatusRequest) returns (StatusResponse) {}
+
+    // CheckpointContainer checkpoints a container
+    rpc CheckpointContainer(CheckpointContainerRequest) returns (CheckpointContainerResponse) {}
+
+    // CheckpointPod creates a Pod-level checkpoint. The caller must set a
+    // deadline on the call. If the pod sandbox does not exist, the deadline is
+    // exceeded, or the checkpoint operation fails, the call returns an error.
+    // The pod sandbox and containers must be running when the call starts. The
+    // runtime must pause every selected container before capturing any of
+    // them, keep all selected containers paused until every selected
+    // container has been captured, and resume all of them before returning on
+    // success, error, or deadline expiry. This produces one consistent
+    // pod-wide cut while ensuring the runtime never returns a frozen pod.
+    rpc CheckpointPod(CheckpointPodRequest) returns (CheckpointPodResponse) {}
+
+    // RestorePod prepares a pod sandbox and containers from a checkpoint. The
+    // caller must set a deadline on the call. On success, every returned
+    // container must be in the CREATED state and must not have executed the
+    // restored process; the caller invokes its pre-start hooks and then calls
+    // StartContainer for each returned ID. On error, the runtime must remove
+    // any sandbox and containers created by the call before returning.
+    rpc RestorePod(RestorePodRequest) returns (RestorePodResponse) {}
+
+    // GetContainerEvents gets container events from the CRI runtime
+    rpc GetContainerEvents(GetEventsRequest) returns (stream ContainerEventResponse) {}
+
+    // ListMetricDescriptors gets the descriptors for the metrics that will be returned in ListPodSandboxMetrics.
+    // This list should be static at startup: either the client and server restart together when
+    // adding or removing metrics descriptors, or they should not change.
+    // Put differently, if ListPodSandboxMetrics references a name that is not described in the initial
+    // ListMetricDescriptors call, then the metric will not be broadcasted.
+    rpc ListMetricDescriptors(ListMetricDescriptorsRequest) returns (ListMetricDescriptorsResponse) {}
+
+    // ListPodSandboxMetrics gets pod sandbox metrics from CRI Runtime
+    rpc ListPodSandboxMetrics(ListPodSandboxMetricsRequest) returns (ListPodSandboxMetricsResponse) {}
+    // StreamPodSandboxMetrics returns a stream of pod sandbox metrics.
+    // This is an alternative to ListPodSandboxMetrics that streams results in
+    // lists of at least one item, avoiding the gRPC message size limit for
+    // nodes with many pods. The number of items per list may vary depending on
+    // the container runtime. Each item must appear in exactly one response and
+    // must not be duplicated across responses in the same stream. The server
+    // must close the stream with EOF after all items have been sent. The
+    // kubelet collects all items from the stream and processes them all at once
+    // after the stream completes. The kubelet enforces a timeout on the entire
+    // stream and will discard partial results if the stream is not completed
+    // in time.
+    // Feature gate: CRIListStreaming
+    // See https://kep.k8s.io/5825 for more details.
+    rpc StreamPodSandboxMetrics(StreamPodSandboxMetricsRequest) returns (stream StreamPodSandboxMetricsResponse) {}
+
+    // RuntimeConfig returns configuration information of the runtime.
+    // A couple of notes:
+    // - The RuntimeConfigRequest object is not to be confused with the contents of UpdateRuntimeConfigRequest.
+    //   The former is for having runtime tell Kubelet what to do, the latter vice versa.
+    // - It is the expectation of the Kubelet that these fields are static for the lifecycle of the Kubelet.
+    //   The Kubelet will not re-request the RuntimeConfiguration after startup, and CRI implementations should
+    //   avoid updating them without a full node reboot.
+    rpc RuntimeConfig(RuntimeConfigRequest) returns (RuntimeConfigResponse) {}
+
+    // UpdatePodSandboxResources synchronously updates the PodSandboxConfig with
+    // the pod-level resource configuration. This method is called _after_ the
+    // Kubelet reconfigures the pod-level cgroups.
+    // This request is treated as best effort, and failure will not block the
+    // Kubelet with proceeding with a resize.
+    rpc UpdatePodSandboxResources(UpdatePodSandboxResourcesRequest) returns (UpdatePodSandboxResourcesResponse) {}
+}
+
+// ImageService defines the public APIs for managing images.
+service ImageService {
+    // ListImages lists existing images.
+    rpc ListImages(ListImagesRequest) returns (ListImagesResponse) {}
+    // StreamImages returns a stream of images.
+    // This is an alternative to ListImages that streams results in lists of at
+    // least one item, avoiding the gRPC message size limit for nodes with many
+    // images. The number of items per list may vary depending on the container
+    // runtime. Each item must appear in exactly one response and must not be
+    // duplicated across responses in the same stream. The server must close the
+    // stream with EOF after all items have been sent. The kubelet collects all
+    // items from the stream and processes them all at once after the stream
+    // completes. The kubelet enforces a timeout on the entire stream and will
+    // discard partial results if the stream is not completed in time.
+    // Feature gate: CRIListStreaming
+    // See https://kep.k8s.io/5825 for more details.
+    rpc StreamImages(StreamImagesRequest) returns (stream StreamImagesResponse) {}
+    // ImageStatus returns the status of the image. If the image is not
+    // present, returns a response with ImageStatusResponse.Image set to
+    // nil.
+    rpc ImageStatus(ImageStatusRequest) returns (ImageStatusResponse) {}
+    // PullImage pulls an image with authentication config.
+    rpc PullImage(PullImageRequest) returns (PullImageResponse) {}
+    // RemoveImage removes the image.
+    // This call is idempotent, and must not return an error if the image has
+    // already been removed.
+    // Note that if the image is referenced by multiple tags (even across different repositories
+    // if they resolve to the same image digest), removing the image by a single tag
+    // will remove all of its tags. For example, if `repo/image:v1` and `another_repo/image:latest`
+    // point to the same image, removing `repo/image:v1` will also remove `another_repo/image:latest`.
+    // The next call to ListImages, ImageStatus, ImageFsInfo will not return this image.
+    // The resources (e.g. disk space) may be cleaned asynchronously
+    // and not guaranteed to be cleaned up by the time this method returns.
+    rpc RemoveImage(RemoveImageRequest) returns (RemoveImageResponse) {}
+    // ImageFSInfo returns information of the filesystem that is used to store images.
+    // Usage information may include images that were removed, but are still being cleaned up.
+    rpc ImageFsInfo(ImageFsInfoRequest) returns (ImageFsInfoResponse) {}
+}
+
+message VersionRequest {
+    // Version of the kubelet runtime API.
+    string version = 1;
+}
+
+message VersionResponse {
+    // Version of the kubelet runtime API.
+    string version = 1;
+    // Name of the container runtime.
+    string runtime_name = 2;
+    // Version of the container runtime. The string must be
+    // semver-compatible.
+    string runtime_version = 3;
+    // API version of the container runtime. The string must be
+    // semver-compatible.
+    string runtime_api_version = 4;
+}
+
+// DNSConfig specifies the DNS servers and search domains of a sandbox.
+message DNSConfig {
+    // List of DNS servers of the cluster.
+    repeated string servers = 1;
+    // List of DNS search domains of the cluster.
+    repeated string searches = 2;
+    // List of DNS options. See https://linux.die.net/man/5/resolv.conf
+    // for all available options.
+    repeated string options = 3;
+}
+
+enum Protocol {
+    TCP = 0;
+    UDP = 1;
+    SCTP = 2;
+}
+
+// PortMapping specifies the port mapping configurations of a sandbox.
+message PortMapping {
+    // Protocol of the port mapping.
+    Protocol protocol = 1;
+    // Port number within the container. Default: 0 (not specified).
+    int32 container_port = 2;
+    // Port number on the host to map the container port to.
+    //
+    // * Valid host port range is 1-65535.
+    // * The value 0 has explicit semantic meaning: it indicates NO host port should be allocated.
+    // * The value 0 does NOT indicate dynamic port allocation. Future implementations
+    //   of dynamic allocation will use different values/semantics.
+    // * Implementations MUST handle the case where this field is explicitly set to 0,
+    //   This field SHOULD be omitted when no port is required.
+    //
+    // Default: If omitted, container port will not be exposed on the host.
+    int32 host_port = 3;
+    // Host IP.
+    string host_ip = 4;
+}
+
+enum MountPropagation {
+    // No mount propagation ("rprivate" in Linux terminology).
+    PROPAGATION_PRIVATE = 0;
+    // Mounts get propagated from the host to the container ("rslave" in Linux).
+    PROPAGATION_HOST_TO_CONTAINER = 1;
+    // Mounts get propagated from the host to the container and from the
+    // container to the host ("rshared" in Linux).
+    PROPAGATION_BIDIRECTIONAL = 2;
+}
+
+// Mount specifies a host volume to mount into a container.
+message Mount {
+    // Path of the mount within the container.
+    string container_path = 1;
+    // Path of the mount on the host. Has to be empty if the image field below
+    // is provided, because those fields are mutually exclusive. If the image
+    // field below is nil and the host path doesn't exist, then runtimes should
+    // report an error. If the hostpath is a symbolic link, runtimes should
+    // follow the symlink and mount the real destination to container.
+    string host_path = 2;
+    // If set, the mount is read-only.
+    bool readonly = 3;
+    // If set, the mount needs SELinux relabeling.
+    bool selinux_relabel = 4;
+    // Requested propagation mode.
+    MountPropagation propagation = 5;
+    // UidMappings specifies the runtime UID mappings for the mount.
+    repeated IDMapping uidMappings = 6;
+    // GidMappings specifies the runtime GID mappings for the mount.
+    repeated IDMapping gidMappings = 7;
+    // If set to true, the mount is made recursive read-only.
+    // In this CRI API, recursive_read_only is a plain true/false boolean, although its equivalent
+    // in the Kubernetes core API is a quaternary that can be nil, "Enabled", "IfPossible", or "Disabled".
+    // kubelet translates that quaternary value in the core API into a boolean in this CRI API.
+    // Remarks:
+    // - nil is just treated as false
+    // - when set to true, readonly must be explicitly set to true, and propagation must be PRIVATE (0).
+    // - (readonly == false && recursive_read_only == false) does not make the mount read-only.
+    bool recursive_read_only = 8;
+    // Mount an image reference (image ID, with or without digest), which is a
+    // special use case for image volume mounts. If this field is set, then
+    // host_path should be unset. All image mounts are per feature definition
+    // readonly. The kubelet does an PullImage RPC and evaluates the returned
+    // PullImageResponse.image_ref value, which is then set to the
+    // ImageSpec.image field. Runtimes are expected to mount the image as
+    // required.
+    // Introduced in the Image Volume Source KEP: https://kep.k8s.io/4639
+    ImageSpec image = 9;
+    // Specific image sub path to be used from inside the image instead of its
+    // root, only necessary if the above image field is set. If the sub path is
+    // not empty and does not exist in the image, then runtimes should fail and
+    // return an error.
+    // Introduced in the Image Volume Source KEP beta graduation: https://kep.k8s.io/4639
+    string image_sub_path = 10;
+    // mount_options specifies additional bind mount options (e.g., noexec,
+    // nodev, nosuid) that the runtime must apply when mounting this volume
+    // into the container. These are passed as OCI mount options.
+    repeated string mount_options = 11;
+}
+
+// IDMapping describes host to container ID mappings for a pod sandbox.
+message IDMapping {
+    // HostId is the id on the host.
+    uint32 host_id = 1;
+    // ContainerId is the id in the container.
+    uint32 container_id = 2;
+    // Length is the size of the range to map.
+    uint32 length = 3;
+}
+
+// A NamespaceMode describes the intended namespace configuration for each
+// of the namespaces (Network, PID, IPC) in NamespaceOption. Runtimes should
+// map these modes as appropriate for the technology underlying the runtime.
+enum NamespaceMode {
+    // A POD namespace is common to all containers in a pod.
+    // For example, a container with a PID namespace of POD expects to view
+    // all of the processes in all of the containers in the pod.
+    POD       = 0;
+    // A CONTAINER namespace is restricted to a single container.
+    // For example, a container with a PID namespace of CONTAINER expects to
+    // view only the processes in that container.
+    CONTAINER = 1;
+    // A NODE namespace is the namespace of the Kubernetes node.
+    // For example, a container with a PID namespace of NODE expects to view
+    // all of the processes on the host running the kubelet.
+    NODE      = 2;
+    // TARGET targets the namespace of another container. When this is specified,
+    // a target_id must be specified in NamespaceOption and refer to a container
+    // previously created with NamespaceMode CONTAINER. This containers namespace
+    // will be made to match that of container target_id.
+    // For example, a container with a PID namespace of TARGET expects to view
+    // all of the processes that container target_id can view.
+    TARGET    = 3;
+}
+
+// UserNamespace describes the intended user namespace configuration for a pod sandbox.
+message UserNamespace {
+    // Mode is the NamespaceMode for this UserNamespace.
+    // Note: NamespaceMode for UserNamespace currently supports only POD and NODE, not CONTAINER OR TARGET.
+    NamespaceMode mode = 1;
+
+    // Uids specifies the UID mappings for the user namespace.
+    repeated IDMapping uids = 2;
+
+    // Gids specifies the GID mappings for the user namespace.
+    repeated IDMapping gids = 3;
+}
+
+// NamespaceOption provides options for Linux namespaces.
+message NamespaceOption {
+    // Network namespace for this container/sandbox.
+    // Note: There is currently no way to set CONTAINER scoped network in the Kubernetes API.
+    // Namespaces currently set by the kubelet: POD, NODE
+    NamespaceMode network = 1;
+    // PID namespace for this container/sandbox.
+    // Note: The CRI default is POD, but the v1.PodSpec default is CONTAINER.
+    // The kubelet's runtime manager will set this to CONTAINER explicitly for v1 pods.
+    // Namespaces currently set by the kubelet: POD, CONTAINER, NODE, TARGET
+    NamespaceMode pid = 2;
+    // IPC namespace for this container/sandbox.
+    // Note: There is currently no way to set CONTAINER scoped IPC in the Kubernetes API.
+    // Namespaces currently set by the kubelet: POD, NODE
+    NamespaceMode ipc = 3;
+    // Target Container ID for NamespaceMode of TARGET. This container must have been
+    // previously created in the same pod. It is not possible to specify different targets
+    // for each namespace.
+    string target_id = 4;
+    // UsernsOptions for this pod sandbox.
+    // The Kubelet picks the user namespace configuration to use for the pod sandbox.  The mappings
+    // are specified as part of the UserNamespace struct.  If the struct is nil, then the POD mode
+    // must be assumed.  This is done for backward compatibility with older Kubelet versions that
+    // do not set a user namespace.
+    UserNamespace userns_options = 5;
+}
+
+// SupplementalGroupsPolicy defines how supplemental groups 
+// of the first container processes are calculated.
+enum SupplementalGroupsPolicy {
+    // Merge means that the container's provided SupplementalGroups 
+    // and FsGroup (specified in SecurityContext) will be merged with 
+    // the primary user's groups as defined in the container image
+    // (in /etc/group).
+    Merge = 0;
+    // Strict means that the container's provided SupplementalGroups
+    // and FsGroup (specified in SecurityContext) will be used instead of 
+    // any groups defined in the container image.
+    Strict = 1;
+}
+
+// Int64Value is the wrapper of int64.
+message Int64Value {
+    // The value.
+    int64 value = 1;
+}
+
+// LinuxSandboxSecurityContext holds linux security configuration that will be
+// applied to a sandbox. Note that:
+// 1) It does not apply to containers in the pods.
+// 2) It may not be applicable to a PodSandbox which does not contain any running
+//    process.
+message LinuxSandboxSecurityContext {
+    // Configurations for the sandbox's namespaces.
+    // This will be used only if the PodSandbox uses namespace for isolation.
+    NamespaceOption namespace_options = 1;
+    // Optional SELinux context to be applied.
+    SELinuxOption selinux_options = 2;
+    // UID to run sandbox processes as, when applicable.
+    Int64Value run_as_user = 3;
+    // GID to run sandbox processes as, when applicable. run_as_group should only
+    // be specified when run_as_user is specified; otherwise, the runtime MUST error.
+    Int64Value run_as_group = 8;
+    // If set, the root filesystem of the sandbox is read-only.
+    bool readonly_rootfs = 4;
+    // List of groups applied to the first process run in each container.
+    // supplemental_groups_policy can control how groups will be calculated.
+    repeated int64 supplemental_groups = 5;
+    // supplemental_groups_policy defines how supplemental groups of the first 
+    // container processes are calculated.
+    // Valid values are "Merge" and "Strict".
+    // If not specified, "Merge" is used.
+    SupplementalGroupsPolicy supplemental_groups_policy = 11;
+    // Indicates whether the sandbox will be asked to run a privileged
+    // container. If a privileged container is to be executed within it, this
+    // MUST be true.
+    // This allows a sandbox to take additional security precautions if no
+    // privileged containers are expected to be run.
+    bool privileged = 6;
+    // Seccomp profile for the sandbox.
+    SecurityProfile seccomp = 9;
+    // AppArmor profile for the sandbox.
+    SecurityProfile apparmor = 10;
+    // Seccomp profile for the sandbox, candidate values are:
+    // * runtime/default: the default profile for the container runtime
+    // * unconfined: unconfined profile, ie, no seccomp sandboxing
+    // * localhost/<full-path-to-profile>: the profile installed on the node.
+    //   <full-path-to-profile> is the full path of the profile.
+    // Default: "", which is identical with unconfined.
+    string seccomp_profile_path = 7 [deprecated=true];
+}
+
+// A security profile which can be used for sandboxes and containers.
+message SecurityProfile {
+    // Available profile types.
+    enum ProfileType {
+        // The container runtime default profile should be used.
+        RuntimeDefault = 0;
+        // Disable the feature for the sandbox or the container.
+        Unconfined = 1;
+        // A pre-defined profile on the node should be used.
+        Localhost = 2;
+    }
+    // Indicator which `ProfileType` should be applied.
+    ProfileType profile_type = 1;
+    // Indicates that a pre-defined profile on the node should be used.
+    // Must only be set if `ProfileType` is `Localhost`.
+    // For seccomp, it must be an absolute path to the seccomp profile.
+    // For AppArmor, this field is the AppArmor `<profile name>/`
+    string localhost_ref = 2;
+}
+
+// LinuxPodSandboxConfig holds platform-specific configurations for Linux
+// host platforms and Linux-based containers.
+message LinuxPodSandboxConfig {
+    // Parent cgroup of the PodSandbox.
+    // The cgroupfs style syntax will be used, but the container runtime can
+    // convert it to systemd semantics if needed.
+    string cgroup_parent = 1;
+    // LinuxSandboxSecurityContext holds sandbox security attributes.
+    LinuxSandboxSecurityContext security_context = 2;
+    // Sysctls holds linux sysctls config for the sandbox.
+    map<string, string> sysctls = 3;
+    // Optional overhead represents the overheads associated with this sandbox
+    LinuxContainerResources overhead = 4;
+    // Optional resources represents the sum of container resources for this sandbox
+    LinuxContainerResources resources = 5;
+}
+
+// PodSandboxMetadata holds all necessary information for building the sandbox name.
+// The container runtime is encouraged to expose the metadata associated with the
+// PodSandbox in its user interface for better user experience. For example,
+// the runtime can construct a unique PodSandboxName based on the metadata.
+message PodSandboxMetadata {
+    // Pod name of the sandbox. Same as the pod name in the Pod ObjectMeta.
+    string name = 1;
+    // Pod UID of the sandbox. Same as the pod UID in the Pod ObjectMeta.
+    string uid = 2;
+    // Pod namespace of the sandbox. Same as the pod namespace in the Pod ObjectMeta.
+    string namespace = 3;
+    // Attempt number of creating the sandbox. Default: 0.
+    uint32 attempt = 4;
+}
+
+// PodSandboxConfig holds all the required and optional fields for creating a
+// sandbox.
+message PodSandboxConfig {
+    // Metadata of the sandbox. This information will uniquely identify the
+    // sandbox, and the runtime should leverage this to ensure correct
+    // operation. The runtime may also use this information to improve UX, such
+    // as by constructing a readable name.
+    PodSandboxMetadata metadata = 1;
+    // Hostname of the sandbox. Hostname could only be empty when the pod
+    // network namespace is NODE.
+    string hostname = 2;
+    // Path to the directory on the host in which container log files are
+    // stored.
+    // By default the log of a container going into the LogDirectory will be
+    // hooked up to STDOUT and STDERR. However, the LogDirectory may contain
+    // binary log files with structured logging data from the individual
+    // containers. For example, the files might be newline separated JSON
+    // structured logs, systemd-journald journal files, gRPC trace files, etc.
+    // E.g.,
+    //     PodSandboxConfig.LogDirectory = `/var/log/pods/<NAMESPACE>_<NAME>_<UID>/`
+    //     ContainerConfig.LogPath = `containerName/Instance#.log`
+    string log_directory = 3;
+    // DNS config for the sandbox.
+    DNSConfig dns_config = 4;
+    // Port mappings for the sandbox.
+    repeated PortMapping port_mappings = 5;
+    // Key-value pairs that may be used to scope and select individual resources.
+    map<string, string> labels = 6;
+    // Unstructured key-value map that may be set by the kubelet to store and
+    // retrieve arbitrary metadata. This will include any annotations set on a
+    // pod through the Kubernetes API.
+    //
+    // Annotations MUST NOT be altered by the runtime; the annotations stored
+    // here MUST be returned in the PodSandboxStatus associated with the pod
+    // this PodSandboxConfig creates.
+    //
+    // In general, in order to preserve a well-defined interface between the
+    // kubelet and the container runtime, annotations SHOULD NOT influence
+    // runtime behaviour.
+    //
+    // Annotations can also be useful for runtime authors to experiment with
+    // new features that are opaque to the Kubernetes APIs (both user-facing
+    // and the CRI). Whenever possible, however, runtime authors SHOULD
+    // consider proposing new typed fields for any new features instead.
+    map<string, string> annotations = 7;
+    // Optional configurations specific to Linux hosts.
+    LinuxPodSandboxConfig linux = 8;
+    // Optional configurations specific to Windows hosts.
+    WindowsPodSandboxConfig windows = 9;
+}
+
+message RunPodSandboxRequest {
+    // Configuration for creating a PodSandbox.
+    PodSandboxConfig config = 1;
+    // Named runtime configuration to use for this PodSandbox.
+    // If the runtime handler is unknown, this request should be rejected.  An
+    // empty string should select the default handler, equivalent to the
+    // behavior before this feature was added.
+    // See https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
+    string runtime_handler = 2;
+}
+
+message RunPodSandboxResponse {
+    // ID of the PodSandbox to run.
+    string pod_sandbox_id = 1;
+}
+
+message StopPodSandboxRequest {
+    // ID of the PodSandbox to stop.
+    string pod_sandbox_id = 1;
+}
+
+message StopPodSandboxResponse {}
+
+message RemovePodSandboxRequest {
+    // ID of the PodSandbox to remove.
+    string pod_sandbox_id = 1;
+}
+
+message RemovePodSandboxResponse {}
+
+message PodSandboxStatusRequest {
+    // ID of the PodSandbox for which to retrieve status.
+    string pod_sandbox_id = 1;
+    // Verbose indicates whether to return extra information about the pod sandbox.
+    bool verbose = 2;
+}
+
+// PodIP represents an ip of a Pod
+message PodIP{
+    // an ip is a string representation of an IPv4 or an IPv6
+    string ip = 1;
+}
+// PodSandboxNetworkStatus is the status of the network for a PodSandbox.
+// Currently ignored for pods sharing the host networking namespace.
+message PodSandboxNetworkStatus {
+    // IP address of the PodSandbox.
+    string ip = 1;
+    // list of additional ips (not inclusive of PodSandboxNetworkStatus.Ip) of the PodSandBoxNetworkStatus
+    repeated PodIP additional_ips  = 2;
+}
+
+// Namespace contains paths to the namespaces.
+message Namespace {
+    // Namespace options for Linux namespaces.
+    NamespaceOption options = 2;
+}
+
+// LinuxSandboxStatus contains status specific to Linux sandboxes.
+message LinuxPodSandboxStatus {
+    // Paths to the sandbox's namespaces.
+    Namespace namespaces = 1;
+}
+
+enum PodSandboxState {
+    SANDBOX_READY    = 0;
+    SANDBOX_NOTREADY = 1;
+}
+
+// PodSandboxStatus contains the status of the PodSandbox.
+message PodSandboxStatus {
+    // ID of the sandbox.
+    string id = 1;
+    // Metadata of the sandbox.
+    PodSandboxMetadata metadata = 2;
+    // State of the sandbox.
+    PodSandboxState state = 3;
+    // Creation timestamp of the sandbox in nanoseconds. Must be > 0.
+    int64 created_at = 4;
+    // Network contains network status if network is handled by the runtime.
+    PodSandboxNetworkStatus network = 5;
+    // Linux-specific status to a pod sandbox.
+    LinuxPodSandboxStatus linux = 6;
+    // Labels are key-value pairs that may be used to scope and select individual resources.
+    map<string, string> labels = 7;
+    // Unstructured key-value map holding arbitrary metadata.
+    // Annotations MUST NOT be altered by the runtime; the value of this field
+    // MUST be identical to that of the corresponding PodSandboxConfig used to
+    // instantiate the pod sandbox this status represents.
+    map<string, string> annotations = 8;
+    // runtime configuration used for this PodSandbox.
+    string runtime_handler = 9;
+}
+
+message PodSandboxStatusResponse {
+    // Status of the PodSandbox.
+    PodSandboxStatus status = 1;
+    // Info is extra information of the PodSandbox. The key could be arbitrary string, and
+    // value should be in json format. The information could include anything useful for
+    // debug, e.g. network namespace for linux container based container runtime.
+    // It should only be returned non-empty when Verbose is true.
+    map<string, string> info = 2;
+    // Container statuses
+    repeated ContainerStatus containers_statuses = 3;
+    // Timestamp in nanoseconds at which container and pod statuses were recorded
+    int64 timestamp = 4;
+}
+
+// PodSandboxStateValue is the wrapper of PodSandboxState.
+message PodSandboxStateValue {
+    // State of the sandbox.
+    PodSandboxState state = 1;
+}
+
+// PodSandboxFilter is used to filter a list of PodSandboxes.
+// All those fields are combined with 'AND'
+message PodSandboxFilter {
+    // ID of the sandbox.
+    string id = 1;
+    // State of the sandbox.
+    PodSandboxStateValue state = 2;
+    // LabelSelector to select matches.
+    // Only api.MatchLabels is supported for now and the requirements
+    // are ANDed. MatchExpressions is not supported yet.
+    map<string, string> label_selector = 3;
+}
+
+message ListPodSandboxRequest {
+    // PodSandboxFilter to filter a list of PodSandboxes.
+    PodSandboxFilter filter = 1;
+}
+
+
+// PodSandbox contains minimal information about a sandbox.
+message PodSandbox {
+    // ID of the PodSandbox.
+    string id = 1;
+    // Metadata of the PodSandbox.
+    PodSandboxMetadata metadata = 2;
+    // State of the PodSandbox.
+    PodSandboxState state = 3;
+    // Creation timestamps of the PodSandbox in nanoseconds. Must be > 0.
+    int64 created_at = 4;
+    // Labels of the PodSandbox.
+    map<string, string> labels = 5;
+    // Unstructured key-value map holding arbitrary metadata.
+    // Annotations MUST NOT be altered by the runtime; the value of this field
+    // MUST be identical to that of the corresponding PodSandboxConfig used to
+    // instantiate this PodSandbox.
+    map<string, string> annotations = 6;
+    // runtime configuration used for this PodSandbox.
+    string runtime_handler = 7;
+}
+
+message ListPodSandboxResponse {
+    // List of PodSandboxes.
+    repeated PodSandbox items = 1;
+}
+
+message StreamPodSandboxesRequest {
+    // Filter for the list request.
+    PodSandboxFilter filter = 1;
+}
+
+message StreamPodSandboxesResponse {
+    // List of PodSandboxes.
+    repeated PodSandbox pod_sandboxes = 1;
+}
+
+message PodSandboxStatsRequest {
+    // ID of the pod sandbox for which to retrieve stats.
+    string pod_sandbox_id = 1;
+}
+
+message PodSandboxStatsResponse {
+    PodSandboxStats stats = 1;
+}
+
+// PodSandboxStatsFilter is used to filter the list of pod sandboxes to retrieve stats for.
+// All those fields are combined with 'AND'.
+message PodSandboxStatsFilter {
+    // ID of the pod sandbox.
+    string id = 1;
+    // LabelSelector to select matches.
+    // Only api.MatchLabels is supported for now and the requirements
+    // are ANDed. MatchExpressions is not supported yet.
+    map<string, string> label_selector = 2;
+}
+
+message ListPodSandboxStatsRequest {
+    // Filter for the list request.
+    PodSandboxStatsFilter filter = 1;
+}
+
+message ListPodSandboxStatsResponse {
+    // Stats of the pod sandbox.
+    repeated PodSandboxStats stats = 1;
+}
+
+message StreamPodSandboxStatsRequest {
+    // Filter for the list request.
+    PodSandboxStatsFilter filter = 1;
+}
+
+message StreamPodSandboxStatsResponse {
+    // List of pod sandbox stats.
+    repeated PodSandboxStats pod_sandbox_stats = 1;
+}
+
+// PodSandboxAttributes provides basic information of the pod sandbox.
+message PodSandboxAttributes {
+    // ID of the pod sandbox.
+    string id = 1;
+    // Metadata of the pod sandbox.
+    PodSandboxMetadata metadata = 2;
+    // Key-value pairs that may be used to scope and select individual resources.
+    map<string,string> labels = 3;
+    // Unstructured key-value map holding arbitrary metadata.
+    // Annotations MUST NOT be altered by the runtime; the value of this field
+    // MUST be identical to that of the corresponding PodSandboxStatus used to
+    // instantiate the PodSandbox this status represents.
+    map<string,string> annotations = 4;
+}
+
+// PodSandboxStats provides the resource usage statistics for a pod.
+// The linux or windows field will be populated depending on the platform.
+message PodSandboxStats {
+    // Information of the pod.
+    PodSandboxAttributes attributes = 1;
+    // Stats from linux.
+    LinuxPodSandboxStats linux = 2;
+    // Stats from windows.
+    WindowsPodSandboxStats windows = 3;
+}
+
+// LinuxPodSandboxStats provides the resource usage statistics for a pod sandbox on linux.
+message LinuxPodSandboxStats {
+    // CPU usage gathered for the pod sandbox.
+    CpuUsage cpu = 1;
+    // Memory usage gathered for the pod sandbox.
+    MemoryUsage memory = 2;
+    // Network usage gathered for the pod sandbox
+    NetworkUsage network = 3;
+    // Stats pertaining to processes in the pod sandbox.
+    ProcessUsage process = 4;
+    // Stats of containers in the measured pod sandbox.
+    repeated ContainerStats containers = 5;
+    // IO usage gathered for the pod sandbox.
+    IoUsage io = 6;
+}
+
+// WindowsPodSandboxStats provides the resource usage statistics for a pod sandbox on windows
+message WindowsPodSandboxStats {
+    // CPU usage gathered for the pod sandbox.
+    WindowsCpuUsage cpu = 1;
+    // Memory usage gathered for the pod sandbox.
+    WindowsMemoryUsage memory = 2;
+    // Network usage gathered for the pod sandbox
+    WindowsNetworkUsage network = 3;
+    // Stats pertaining to processes in the pod sandbox.
+    WindowsProcessUsage process = 4;
+    // Stats of containers in the measured pod sandbox.
+    repeated WindowsContainerStats containers = 5;
+}
+
+// NetworkUsage contains data about network resources.
+message NetworkUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Stats for the default network interface.
+    NetworkInterfaceUsage default_interface = 2;
+    // Stats for all found network interfaces, excluding the default.
+    repeated NetworkInterfaceUsage interfaces = 3;
+}
+
+// WindowsNetworkUsage contains data about network resources specific to Windows.
+message WindowsNetworkUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Stats for the default network interface.
+    WindowsNetworkInterfaceUsage default_interface = 2;
+    // Stats for all found network interfaces, excluding the default.
+    repeated WindowsNetworkInterfaceUsage interfaces = 3;
+}
+
+// NetworkInterfaceUsage contains resource value data about a network interface.
+message NetworkInterfaceUsage {
+    // The name of the network interface.
+    string name = 1;
+    // Cumulative count of bytes received.
+    UInt64Value rx_bytes = 2;
+    // Cumulative count of receive errors encountered.
+    UInt64Value rx_errors = 3;
+    // Cumulative count of bytes transmitted.
+    UInt64Value tx_bytes = 4;
+    // Cumulative count of transmit errors encountered.
+    UInt64Value tx_errors = 5;
+}
+
+// WindowsNetworkInterfaceUsage contains resource value data about a network interface specific for Windows.
+message WindowsNetworkInterfaceUsage {
+    // The name of the network interface.
+    string name = 1;
+    // Cumulative count of bytes received.
+    UInt64Value rx_bytes = 2;
+    // Cumulative count of receive errors encountered.
+    UInt64Value rx_packets_dropped = 3;
+    // Cumulative count of bytes transmitted.
+    UInt64Value tx_bytes = 4;
+    // Cumulative count of transmit errors encountered.
+    UInt64Value tx_packets_dropped = 5;
+}
+
+// ProcessUsage are stats pertaining to processes.
+message ProcessUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Number of processes.
+    UInt64Value process_count = 2;
+}
+
+// WindowsProcessUsage are stats pertaining to processes specific to Windows.
+message WindowsProcessUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Number of processes.
+    UInt64Value process_count = 2;
+}
+
+// ImageSpec is an internal representation of an image.
+message ImageSpec {
+    // Container's Image field (e.g. imageID or imageDigest).
+    string image = 1;
+    // Unstructured key-value map holding arbitrary metadata.
+    // ImageSpec Annotations can be used to help the runtime target specific
+    // images in multi-arch images.
+    map<string, string> annotations = 2;
+    // The container image reference specified by the user (e.g. image[:tag] or digest).
+    // Only set if available within the RPC context.
+    string user_specified_image = 18;
+    // Runtime handler to use for pulling the image.
+    // If the runtime handler is unknown, the request should be rejected.
+    // An empty string would select the default runtime handler.
+    string runtime_handler = 19;
+    // The digest of the image used for this volume.
+    // It should have a value that's similar to the pod's status.containerStatuses[i].imageID.
+    string image_ref = 20;
+}
+
+message KeyValue {
+    string key = 1;
+    bytes value = 2;
+}
+
+// LinuxContainerResources specifies Linux specific configuration for
+// resources.
+message LinuxContainerResources {
+    // CPU CFS (Completely Fair Scheduler) period. Default: 0 (not specified).
+    int64 cpu_period = 1;
+    // CPU CFS (Completely Fair Scheduler) quota. Default: 0 (not specified).
+    int64 cpu_quota = 2;
+    // CPU shares (relative weight vs. other containers). Default: 0 (not specified).
+    int64 cpu_shares = 3;
+    // Memory limit in bytes. Default: 0 (not specified).
+    int64 memory_limit_in_bytes = 4;
+    // OOMScoreAdj adjusts the oom-killer score. Default: 0 (not specified).
+    int64 oom_score_adj = 5;
+    // CpusetCpus constrains the allowed set of logical CPUs. Default: "" (not specified).
+    string cpuset_cpus = 6;
+    // CpusetMems constrains the allowed set of memory nodes. Default: "" (not specified).
+    string cpuset_mems = 7;
+    // List of HugepageLimits to limit the HugeTLB usage of container per page size. Default: nil (not specified).
+    repeated HugepageLimit hugepage_limits = 8;
+    // Unified resources for cgroup v2. Default: nil (not specified).
+    // Each key/value in the map refers to the cgroup v2.
+    // e.g. "memory.max": "6937202688" or "io.weight": "default 100".
+    map<string, string> unified = 9;
+    // Memory swap limit in bytes. Default 0 (not specified).
+    int64 memory_swap_limit_in_bytes = 10;
+}
+
+// HugepageLimit corresponds to the file`hugetlb.<hugepagesize>.limit_in_byte` in container level cgroup.
+// For example, `PageSize=1GB`, `Limit=1073741824` means setting `1073741824` bytes to hugetlb.1GB.limit_in_bytes.
+message HugepageLimit {
+    // The value of PageSize has the format <size><unit-prefix>B (2MB, 1GB),
+    // and must match the <hugepagesize> of the corresponding control file found in `hugetlb.<hugepagesize>.limit_in_bytes`.
+    // The values of <unit-prefix> are intended to be parsed using base 1024("1KB" = 1024, "1MB" = 1048576, etc).
+    string page_size = 1;
+    // limit in bytes of hugepagesize HugeTLB usage.
+    uint64 limit = 2;
+}
+
+// SELinuxOption are the labels to be applied to the container.
+message SELinuxOption {
+    string user = 1;
+    string role = 2;
+    string type = 3;
+    string level = 4;
+}
+
+// Capability contains the container capabilities to add or drop
+// Dropping a capability will drop it from all sets.
+// If a capability is added to only the add_capabilities list then it gets added to permitted,
+// inheritable, effective and bounding sets, i.e. all sets except the ambient set.
+// If a capability is added to only the add_ambient_capabilities list then it gets added to all sets, i.e permitted
+// inheritable, effective, bounding and ambient sets.
+// If a capability is added to add_capabilities and add_ambient_capabilities lists then it gets added to all sets, i.e.
+// permitted, inheritable, effective, bounding and ambient sets.
+message Capability {
+    // List of capabilities to add.
+    repeated string add_capabilities = 1;
+    // List of capabilities to drop.
+    repeated string drop_capabilities = 2;
+    // List of ambient capabilities to add.
+    repeated string add_ambient_capabilities = 3;
+}
+
+// LinuxContainerSecurityContext holds linux security configuration that will be applied to a container.
+message LinuxContainerSecurityContext {
+    // Capabilities to add or drop.
+    Capability capabilities = 1;
+    // If set, run container in privileged mode.
+    // Privileged mode is incompatible with the following options. If
+    // privileged is set, the following features MAY have no effect:
+    // 1. capabilities
+    // 2. selinux_options
+    // 4. seccomp
+    // 5. apparmor
+    //
+    // Privileged mode implies the following specific options are applied:
+    // 1. All capabilities are added.
+    // 2. Sensitive paths, such as kernel module paths within sysfs, are not masked.
+    // 3. Any sysfs and procfs mounts are mounted RW.
+    // 4. AppArmor confinement is not applied.
+    // 5. Seccomp restrictions are not applied.
+    // 6. The device cgroup does not restrict access to any devices.
+    // 7. All devices from the host's /dev are available within the container.
+    // 8. SELinux restrictions are not applied (e.g. label=disabled).
+    bool privileged = 2;
+    // Configurations for the container's namespaces.
+    // Only used if the container uses namespace for isolation.
+    NamespaceOption namespace_options = 3;
+    // SELinux context to be optionally applied.
+    SELinuxOption selinux_options = 4;
+    // UID to run the container process as. Only one of run_as_user and
+    // run_as_username can be specified at a time.
+    Int64Value run_as_user = 5;
+    // GID to run the container process as. run_as_group should only be specified
+    // when run_as_user or run_as_username is specified; otherwise, the runtime
+    // MUST error.
+    Int64Value run_as_group = 12;
+    // User name to run the container process as. If specified, the user MUST
+    // exist in the container image (i.e. in the /etc/passwd inside the image),
+    // and be resolved there by the runtime; otherwise, the runtime MUST error.
+    string run_as_username = 6;
+    // If set, the root filesystem of the container is read-only.
+    bool readonly_rootfs = 7;
+    // List of groups applied to the first process run in each container.
+    // supplemental_groups_policy can control how groups will be calculated.
+    repeated int64 supplemental_groups = 8;
+    // supplemental_groups_policy defines how supplemental groups of the first 
+    // container processes are calculated.
+    // Valid values are "Merge" and "Strict".
+    // If not specified, "Merge" is used.
+    SupplementalGroupsPolicy supplemental_groups_policy = 17;
+    // no_new_privs defines if the flag for no_new_privs should be set on the
+    // container.
+    bool no_new_privs = 11;
+    // masked_paths is a slice of paths that should be masked by the container
+    // runtime, this can be passed directly to the OCI spec.
+    repeated string masked_paths = 13;
+    // readonly_paths is a slice of paths that should be set as readonly by the
+    // container runtime, this can be passed directly to the OCI spec.
+    repeated string readonly_paths = 14;
+    // Seccomp profile for the container.
+    SecurityProfile seccomp = 15;
+    // AppArmor profile for the container.
+    SecurityProfile apparmor = 16;
+    // AppArmor profile for the container, candidate values are:
+    // * runtime/default: equivalent to not specifying a profile.
+    // * unconfined: no profiles are loaded
+    // * localhost/<profile_name>: profile loaded on the node
+    //    (localhost) by name. The possible profile names are detailed at
+    //    https://gitlab.com/apparmor/apparmor/-/wikis/AppArmor_Core_Policy_Reference
+    string apparmor_profile = 9 [deprecated=true];
+    // Seccomp profile for the container, candidate values are:
+    // * runtime/default: the default profile for the container runtime
+    // * unconfined: unconfined profile, ie, no seccomp sandboxing
+    // * localhost/<full-path-to-profile>: the profile installed on the node.
+    //   <full-path-to-profile> is the full path of the profile.
+    // Default: "", which is identical with unconfined.
+    string seccomp_profile_path = 10 [deprecated=true];
+}
+
+// LinuxContainerConfig contains platform-specific configuration for
+// Linux-based containers.
+message LinuxContainerConfig {
+    // Resources specification for the container.
+    LinuxContainerResources resources = 1;
+    // LinuxContainerSecurityContext configuration for the container.
+    LinuxContainerSecurityContext security_context = 2;
+}
+
+message LinuxContainerUser {
+    // uid is the primary uid initially attached to the first process in the container
+    int64 uid = 1;
+    // gid is the primary gid initially attached to the first process in the container
+    int64 gid = 2;
+    // supplemental_groups are the supplemental groups initially attached to the first process in the container
+    repeated int64 supplemental_groups = 3;
+}
+
+// WindowsNamespaceOption provides options for Windows namespaces.
+message WindowsNamespaceOption {
+    // Network namespace for this container/sandbox.
+    // This is currently never set by the kubelet
+    NamespaceMode network = 1;
+}
+
+// WindowsSandboxSecurityContext holds platform-specific configurations that will be
+// applied to a sandbox.
+// These settings will only apply to the sandbox container.
+message WindowsSandboxSecurityContext {
+    // User name to run the container process as. If specified, the user MUST
+    // exist in the container image and be resolved there by the runtime;
+    // otherwise, the runtime MUST return error.
+    string run_as_username = 1;
+
+    // The contents of the GMSA credential spec to use to run this container.
+    string credential_spec = 2;
+
+    // Indicates whether the container requested to run as a HostProcess container.
+    bool host_process = 3;
+
+    // Configuration for the sandbox's namespaces
+    WindowsNamespaceOption namespace_options = 4;
+}
+
+// WindowsPodSandboxConfig holds platform-specific configurations for Windows
+// host platforms and Windows-based containers.
+message WindowsPodSandboxConfig {
+    // WindowsSandboxSecurityContext holds sandbox security attributes.
+    WindowsSandboxSecurityContext security_context = 1;
+}
+
+// WindowsContainerSecurityContext holds windows security configuration that will be applied to a container.
+message WindowsContainerSecurityContext {
+    // User name to run the container process as. If specified, the user MUST
+    // exist in the container image and be resolved there by the runtime;
+    // otherwise, the runtime MUST return error.
+    string run_as_username = 1;
+
+    // The contents of the GMSA credential spec to use to run this container.
+    string credential_spec = 2;
+
+    // Indicates whether a container is to be run as a HostProcess container.
+    bool host_process = 3;
+}
+
+// WindowsContainerConfig contains platform-specific configuration for
+// Windows-based containers.
+message WindowsContainerConfig {
+    // Resources specification for the container.
+    WindowsContainerResources resources = 1;
+    // WindowsContainerSecurityContext configuration for the container.
+    WindowsContainerSecurityContext security_context = 2;
+}
+
+// WindowsContainerResources specifies Windows specific configuration for
+// resources.
+message WindowsContainerResources {
+    // CPU shares (relative weight vs. other containers). Default: 0 (not specified).
+    int64 cpu_shares = 1;
+    // Number of CPUs available to the container. Default: 0 (not specified).
+    int64 cpu_count = 2;
+    // Specifies the portion of processor cycles that this container can use as a percentage times 100.
+    int64 cpu_maximum = 3;
+    // Memory limit in bytes. Default: 0 (not specified).
+    int64 memory_limit_in_bytes = 4;
+    // Specifies the size of the rootfs / scratch space in bytes to be configured for this container. Default: 0 (not specified).
+    int64 rootfs_size_in_bytes = 5;
+    // Optionally specifies the set of CPUs to affinitize for this container.
+    repeated WindowsCpuGroupAffinity affinity_cpus = 6;
+}
+
+// WindowsCpuGroupAffinity specifies the CPU mask and group to affinitize.
+// This is similar to the following _GROUP_AFFINITY structure:
+// https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/miniport/ns-miniport-_group_affinity
+message WindowsCpuGroupAffinity {
+    // CPU mask relative to this CPU group.
+    uint64 cpu_mask = 1;
+    // Processor group the mask refers to, as returned by
+    // GetLogicalProcessorInformationEx.
+    uint32 cpu_group = 2;
+}
+
+// ContainerMetadata holds all necessary information for building the container
+// name. The container runtime is encouraged to expose the metadata in its user
+// interface for better user experience. E.g., runtime can construct a unique
+// container name based on the metadata. Note that (name, attempt) is unique
+// within a sandbox for the entire lifetime of the sandbox.
+message ContainerMetadata {
+    // Name of the container. Same as the container name in the PodSpec.
+    string name = 1;
+    // Attempt number of creating the container. Default: 0.
+    uint32 attempt = 2;
+}
+
+// Device specifies a host device to mount into a container.
+message Device {
+    // Path of the device within the container.
+    string container_path = 1;
+    // Path of the device on the host.
+    string host_path = 2;
+    // Cgroups permissions of the device, candidates are one or more of
+    // * r - allows container to read from the specified device.
+    // * w - allows container to write to the specified device.
+    // * m - allows container to create device files that do not yet exist.
+    string permissions = 3;
+}
+
+// CDIDevice specifies a CDI device information.
+message CDIDevice {
+    // Fully qualified CDI device name
+    // for example: vendor.com/gpu=gpudevice1
+    // see more details in the CDI specification:
+    // https://github.com/container-orchestrated-devices/container-device-interface/blob/main/SPEC.md
+    string name = 1;
+}
+
+// ContainerConfig holds all the required and optional fields for creating a
+// container.
+message ContainerConfig {
+    // Metadata of the container. This information will uniquely identify the
+    // container, and the runtime should leverage this to ensure correct
+    // operation. The runtime may also use this information to improve UX, such
+    // as by constructing a readable name.
+    ContainerMetadata metadata = 1 ;
+    // Image to use.
+    ImageSpec image = 2;
+    // Command to execute (i.e., entrypoint for docker)
+    repeated string command = 3;
+    // Args for the Command (i.e., command for docker)
+    repeated string args = 4;
+    // Current working directory of the command.
+    string working_dir = 5;
+    // List of environment variable to set in the container.
+    repeated KeyValue envs = 6;
+    // Mounts for the container.
+    repeated Mount mounts = 7;
+    // Devices for the container.
+    repeated Device devices = 8;
+    // Key-value pairs that may be used to scope and select individual resources.
+    // Label keys are of the form:
+    //     label-key ::= prefixed-name | name
+    //     prefixed-name ::= prefix '/' name
+    //     prefix ::= DNS_SUBDOMAIN
+    //     name ::= DNS_LABEL
+    map<string, string> labels = 9;
+    // Unstructured key-value map that may be used by the kubelet to store and
+    // retrieve arbitrary metadata.
+    //
+    // Annotations MUST NOT be altered by the runtime; the annotations stored
+    // here MUST be returned in the ContainerStatus associated with the container
+    // this ContainerConfig creates.
+    //
+    // In general, in order to preserve a well-defined interface between the
+    // kubelet and the container runtime, annotations SHOULD NOT influence
+    // runtime behaviour.
+    map<string, string> annotations = 10;
+    // Path relative to PodSandboxConfig.LogDirectory for container to store
+    // the log (STDOUT and STDERR) on the host.
+    // E.g.,
+    //     PodSandboxConfig.LogDirectory = `/var/log/pods/<NAMESPACE>_<NAME>_<UID>/`
+    //     ContainerConfig.LogPath = `containerName/Instance#.log`
+    string log_path = 11;
+
+    // Variables for interactive containers, these have very specialized
+    // use-cases (e.g. debugging).
+    bool stdin = 12;
+    bool stdin_once = 13;
+    bool tty = 14;
+
+    // Configuration specific to Linux containers.
+    LinuxContainerConfig linux = 15;
+    // Configuration specific to Windows containers.
+    WindowsContainerConfig windows = 16;
+
+    // CDI devices for the container.
+    repeated CDIDevice CDI_devices = 17;
+
+    // The custom stop signal for the container
+    Signal stop_signal = 18;
+}
+
+enum Signal {
+    SIGNAL_RUNTIME_DEFAULT   = 0;
+    SIGNAL_SIGABRT           = 1;
+    SIGNAL_SIGALRM           = 2;
+    SIGNAL_SIGBUS            = 3;
+    SIGNAL_SIGCHLD           = 4;
+    SIGNAL_SIGCLD            = 5;
+    SIGNAL_SIGCONT           = 6;
+    SIGNAL_SIGFPE            = 7;
+    SIGNAL_SIGHUP            = 8;
+    SIGNAL_SIGILL            = 9;
+    SIGNAL_SIGINT            = 10;
+    SIGNAL_SIGIO             = 11;
+    SIGNAL_SIGIOT            = 12;
+    SIGNAL_SIGKILL           = 13;
+    SIGNAL_SIGPIPE           = 14;
+    SIGNAL_SIGPOLL           = 15;
+    SIGNAL_SIGPROF           = 16;
+    SIGNAL_SIGPWR            = 17;
+    SIGNAL_SIGQUIT           = 18;
+    SIGNAL_SIGSEGV           = 19;
+    SIGNAL_SIGSTKFLT         = 20;
+    SIGNAL_SIGSTOP           = 21;
+    SIGNAL_SIGSYS            = 22;
+    SIGNAL_SIGTERM           = 23;
+    SIGNAL_SIGTRAP           = 24;
+    SIGNAL_SIGTSTP           = 25;
+    SIGNAL_SIGTTIN           = 26;
+    SIGNAL_SIGTTOU           = 27;
+    SIGNAL_SIGURG            = 28;
+    SIGNAL_SIGUSR1           = 29;
+    SIGNAL_SIGUSR2           = 30;
+    SIGNAL_SIGVTALRM         = 31;
+    SIGNAL_SIGWINCH          = 32;
+    SIGNAL_SIGXCPU           = 33;
+    SIGNAL_SIGXFSZ           = 34;
+    SIGNAL_SIGRTMIN          = 35;
+    SIGNAL_SIGRTMINPLUS1     = 36;
+    SIGNAL_SIGRTMINPLUS2     = 37;
+    SIGNAL_SIGRTMINPLUS3     = 38;
+    SIGNAL_SIGRTMINPLUS4     = 39;
+    SIGNAL_SIGRTMINPLUS5     = 40;
+    SIGNAL_SIGRTMINPLUS6     = 41;
+    SIGNAL_SIGRTMINPLUS7     = 42;
+    SIGNAL_SIGRTMINPLUS8     = 43;
+    SIGNAL_SIGRTMINPLUS9     = 44;
+    SIGNAL_SIGRTMINPLUS10    = 45;
+    SIGNAL_SIGRTMINPLUS11    = 46;
+    SIGNAL_SIGRTMINPLUS12    = 47;
+    SIGNAL_SIGRTMINPLUS13    = 48;
+    SIGNAL_SIGRTMINPLUS14    = 49;
+    SIGNAL_SIGRTMINPLUS15    = 50;
+    SIGNAL_SIGRTMAXMINUS14   = 51;
+    SIGNAL_SIGRTMAXMINUS13   = 52;
+    SIGNAL_SIGRTMAXMINUS12   = 53;
+    SIGNAL_SIGRTMAXMINUS11   = 54;
+    SIGNAL_SIGRTMAXMINUS10   = 55;
+    SIGNAL_SIGRTMAXMINUS9    = 56;
+    SIGNAL_SIGRTMAXMINUS8    = 57;
+    SIGNAL_SIGRTMAXMINUS7    = 58;
+    SIGNAL_SIGRTMAXMINUS6    = 59;
+    SIGNAL_SIGRTMAXMINUS5    = 60;
+    SIGNAL_SIGRTMAXMINUS4    = 61;
+    SIGNAL_SIGRTMAXMINUS3    = 62;
+    SIGNAL_SIGRTMAXMINUS2    = 63;
+    SIGNAL_SIGRTMAXMINUS1    = 64;
+    SIGNAL_SIGRTMAX          = 65;
+}
+
+message CreateContainerRequest {
+    // ID of the PodSandbox in which the container should be created.
+    string pod_sandbox_id = 1;
+    // Config of the container.
+    ContainerConfig config = 2;
+    // Config of the PodSandbox. This is the same config that was passed
+    // to RunPodSandboxRequest to create the PodSandbox. It is passed again
+    // here just for easy reference. The PodSandboxConfig is immutable and
+    // remains the same throughout the lifetime of the pod.
+    PodSandboxConfig sandbox_config = 3;
+}
+
+message CreateContainerResponse {
+    // ID of the created container.
+    string container_id = 1;
+}
+
+message StartContainerRequest {
+    // ID of the container to start.
+    string container_id = 1;
+}
+
+message StartContainerResponse {}
+
+message StopContainerRequest {
+    // ID of the container to stop.
+    string container_id = 1;
+    // Timeout in seconds to wait for the container to stop before forcibly
+    // terminating it. Default: 0 (forcibly terminate the container immediately)
+    int64 timeout = 2;
+}
+
+message StopContainerResponse {}
+
+message RemoveContainerRequest {
+    // ID of the container to remove.
+    string container_id = 1;
+}
+
+message RemoveContainerResponse {}
+
+enum ContainerState {
+    CONTAINER_CREATED = 0;
+    CONTAINER_RUNNING = 1;
+    CONTAINER_EXITED  = 2;
+    CONTAINER_UNKNOWN = 3;
+}
+
+// ContainerStateValue is the wrapper of ContainerState.
+message ContainerStateValue {
+    // State of the container.
+    ContainerState state = 1;
+}
+
+// ContainerFilter is used to filter containers.
+// All those fields are combined with 'AND'
+message ContainerFilter {
+    // ID of the container.
+    string id = 1;
+    // State of the container.
+    ContainerStateValue state = 2;
+    // ID of the PodSandbox.
+    string pod_sandbox_id = 3;
+    // LabelSelector to select matches.
+    // Only api.MatchLabels is supported for now and the requirements
+    // are ANDed. MatchExpressions is not supported yet.
+    map<string, string> label_selector = 4;
+}
+
+message ListContainersRequest {
+    ContainerFilter filter = 1;
+}
+
+// Container provides the runtime information for a container, such as ID, hash,
+// state of the container.
+message Container {
+    // ID of the container, used by the container runtime to identify
+    // a container.
+    string id = 1;
+    // ID of the sandbox to which this container belongs.
+    string pod_sandbox_id = 2;
+    // Metadata of the container.
+    ContainerMetadata metadata = 3;
+    // Spec of the image.
+    ImageSpec image = 4;
+    // Digested reference to the image in use.
+    string image_ref = 5;
+    // State of the container.
+    ContainerState state = 6;
+    // Creation time of the container in nanoseconds.
+    int64 created_at = 7;
+    // Key-value pairs that may be used to scope and select individual resources.
+    map<string, string> labels = 8;
+    // Unstructured key-value map holding arbitrary metadata.
+    // Annotations MUST NOT be altered by the runtime; the value of this field
+    // MUST be identical to that of the corresponding ContainerConfig used to
+    // instantiate this Container.
+    map<string, string> annotations = 9;
+    // Reference to the unique identifier of the image on the node, as
+    // returned in the image and runtime service apis.
+    //
+    // This value MUST always match `PullImageResponse.image_ref` when referring
+    // to the same image.
+    string image_id = 10;
+}
+
+message ListContainersResponse {
+    // List of containers.
+    repeated Container containers = 1;
+}
+
+message StreamContainersRequest {
+    // Filter for the list request.
+    ContainerFilter filter = 1;
+}
+
+message StreamContainersResponse {
+    // List of containers.
+    repeated Container containers = 1;
+}
+
+message ContainerStatusRequest {
+    // ID of the container for which to retrieve status.
+    string container_id = 1;
+    // Verbose indicates whether to return extra information about the container.
+    bool verbose = 2;
+}
+
+// ContainerStatus represents the status of a container.
+message ContainerStatus {
+    // ID of the container.
+    string id = 1;
+    // Metadata of the container.
+    ContainerMetadata metadata = 2;
+    // Status of the container.
+    ContainerState state = 3;
+    // Creation time of the container in nanoseconds.
+    int64 created_at = 4;
+    // Start time of the container in nanoseconds. Default: 0 (not specified).
+    int64 started_at = 5;
+    // Finish time of the container in nanoseconds. Default: 0 (not specified).
+    int64 finished_at = 6;
+    // Exit code of the container. Only required when finished_at != 0. Default: 0.
+    int32 exit_code = 7;
+    // Spec of the image.
+    ImageSpec image = 8;
+    // Digested reference to the image in use.
+    string image_ref = 9;
+    // Brief CamelCase string explaining why container is in its current state.
+    // Must be set to "OOMKilled" for containers terminated by cgroup-based Out-of-Memory killer.
+    string reason = 10;
+    // Human-readable message indicating details about why container is in its
+    // current state.
+    string message = 11;
+    // Key-value pairs that may be used to scope and select individual resources.
+    map<string,string> labels = 12;
+    // Unstructured key-value map holding arbitrary metadata.
+    // Annotations MUST NOT be altered by the runtime; the value of this field
+    // MUST be identical to that of the corresponding ContainerConfig used to
+    // instantiate the Container this status represents.
+    map<string,string> annotations = 13;
+    // Mounts for the container.
+    repeated Mount mounts = 14;
+    // Log path of container.
+    string log_path = 15;
+    // Resource limits configuration of the container.
+    ContainerResources resources = 16;
+    // Reference to the unique identifier of the image on the node, as
+    // returned in the image and runtime service apis.
+    //
+    // This value MUST always match `PullImageResponse.image_ref` when referring
+    // to the same image.
+    string image_id = 17;
+    // User identities initially attached to the container
+    ContainerUser user = 18;
+
+    // Returns the stop signal used by the container runtime to terminate the container 
+    Signal stop_signal = 19;
+}
+
+message ContainerStatusResponse {
+    // Status of the container.
+    ContainerStatus status = 1;
+    // Info is extra information of the Container. The key could be arbitrary string, and
+    // value should be in json format. The information could include anything useful for
+    // debug, e.g. pid for linux container based container runtime.
+    // It should only be returned non-empty when Verbose is true.
+    map<string, string> info = 2;
+}
+
+// ContainerResources holds resource limits configuration for a container.
+message ContainerResources {
+    // Resource limits configuration specific to Linux container.
+    LinuxContainerResources linux = 1;
+    // Resource limits configuration specific to Windows container.
+    WindowsContainerResources windows = 2;
+}
+
+message ContainerUser {
+    // User identities initially attached to first process in the Linux container.
+    // Note that the actual running identity can be changed if the process has enough privilege to do so.
+    LinuxContainerUser linux = 1;
+
+    // User identities initially attached to first process in the Windows container
+    // This is just reserved for future use.
+    // WindowsContainerUser windows = 2;
+}
+
+
+message UpdateContainerResourcesRequest {
+    // ID of the container to update.
+    string container_id = 1;
+    // Resource configuration specific to Linux containers.
+    LinuxContainerResources linux = 2;
+    // Resource configuration specific to Windows containers.
+    WindowsContainerResources windows = 3;
+    // Unstructured key-value map holding arbitrary additional information for
+    // container resources updating. This can be used for specifying experimental
+    // resources to update or other options to use when updating the container.
+    map<string, string> annotations = 4;
+}
+
+message UpdateContainerResourcesResponse {}
+
+message ExecSyncRequest {
+    // ID of the container.
+    string container_id = 1;
+    // Command to execute.
+    repeated string cmd = 2;
+    // Timeout in seconds to stop the command. Default: 0 (run forever).
+    int64 timeout = 3;
+}
+
+message ExecSyncResponse {
+    // Captured command stdout output.
+	// The runtime should cap the output of this response to 16MB.
+	// If the stdout of the command produces more than 16MB, the remaining output
+	// should be discarded, and the command should proceed with no error.
+	// See CVE-2022-1708 and CVE-2022-31030 for more information.
+    bytes stdout = 1;
+    // Captured command stderr output.
+	// The runtime should cap the output of this response to 16MB.
+	// If the stderr of the command produces more than 16MB, the remaining output
+	// should be discarded, and the command should proceed with no error.
+	// See CVE-2022-1708 and CVE-2022-31030 for more information.
+    bytes stderr = 2;
+    // Exit code the command finished with. Default: 0 (success).
+    int32 exit_code = 3;
+}
+
+message ExecRequest {
+    // ID of the container in which to execute the command.
+    string container_id = 1;
+    // Command to execute.
+    repeated string cmd = 2;
+    // Whether to exec the command in a TTY.
+    bool tty = 3;
+    // Whether to stream stdin.
+    // One of `stdin`, `stdout`, and `stderr` MUST be true.
+    bool stdin = 4;
+    // Whether to stream stdout.
+    // One of `stdin`, `stdout`, and `stderr` MUST be true.
+    bool stdout = 5;
+    // Whether to stream stderr.
+    // One of `stdin`, `stdout`, and `stderr` MUST be true.
+    // If `tty` is true, `stderr` MUST be false. Multiplexing is not supported
+    // in this case. The output of stdout and stderr will be combined to a
+    // single stream.
+    bool stderr = 6;
+}
+
+message ExecResponse {
+    // Fully qualified URL of the exec streaming server.
+    string url = 1;
+}
+
+message AttachRequest {
+    // ID of the container to which to attach.
+    string container_id = 1;
+    // Whether to stream stdin.
+    // One of `stdin`, `stdout`, and `stderr` MUST be true.
+    bool stdin = 2;
+    // Whether the process being attached is running in a TTY.
+    // This must match the TTY setting in the ContainerConfig.
+    bool tty = 3;
+    // Whether to stream stdout.
+    // One of `stdin`, `stdout`, and `stderr` MUST be true.
+    bool stdout = 4;
+    // Whether to stream stderr.
+    // One of `stdin`, `stdout`, and `stderr` MUST be true.
+    // If `tty` is true, `stderr` MUST be false. Multiplexing is not supported
+    // in this case. The output of stdout and stderr will be combined to a
+    // single stream.
+    bool stderr = 5;
+}
+
+message AttachResponse {
+    // Fully qualified URL of the attach streaming server.
+    string url = 1;
+}
+
+message PortForwardRequest {
+    // ID of the container to which to forward the port.
+    string pod_sandbox_id = 1;
+    // Port to forward.
+    repeated int32 port = 2;
+}
+
+message PortForwardResponse {
+    // Fully qualified URL of the port-forward streaming server.
+    string url = 1;
+}
+
+message ImageFilter {
+    // Spec of the image.
+    ImageSpec image = 1;
+}
+
+message ListImagesRequest {
+    // Filter to list images.
+    ImageFilter filter = 1;
+}
+
+// Basic information about a container image.
+message Image {
+    // Reference to the unique identifier of the image on the node, as
+    // returned in the image and runtime service apis.
+    //
+    // This value MUST always match `PullImageResponse.image_ref` when referring
+    // to the same image.
+    string id = 1;
+    // Other names by which this image is known.
+    repeated string repo_tags = 2;
+    // Digests by which this image is known.
+    repeated string repo_digests = 3;
+    // Size of the image in bytes. Must be > 0.
+    uint64 size = 4;
+    // UID that will run the command(s). This is used as a default if no user is
+    // specified when creating the container. UID and the following user name
+    // are mutually exclusive.
+    Int64Value uid = 5;
+    // User name that will run the command(s). This is used if UID is not set
+    // and no user is specified when creating container.
+    string username = 6;
+    // ImageSpec for image which includes annotations
+    ImageSpec spec = 7;
+    // Recommendation on whether this image should be exempt from garbage collection.
+    // It must only be treated as a recommendation -- the client can still request that the image be deleted,
+    // and the runtime must oblige.
+    bool pinned = 8;
+}
+
+message ListImagesResponse {
+    // List of images.
+    repeated Image images = 1;
+}
+
+message StreamImagesRequest {
+    // Filter to list images.
+    ImageFilter filter = 1;
+}
+
+message StreamImagesResponse {
+    // List of images.
+    repeated Image images = 1;
+}
+
+message ImageStatusRequest {
+    // Spec of the image.
+    ImageSpec image = 1;
+    // Verbose indicates whether to return extra information about the image.
+    bool verbose = 2;
+}
+
+message ImageStatusResponse {
+    // Status of the image.
+    Image image = 1;
+    // Info is extra information of the Image. The key could be arbitrary string, and
+    // value should be in json format. The information could include anything useful
+    // for debug, e.g. image config for oci image based container runtime.
+    // It should only be returned non-empty when Verbose is true.
+    map<string, string> info = 2;
+}
+
+// AuthConfig contains authorization information for connecting to a registry.
+message AuthConfig {
+    string username = 1;
+    string password = 2 [debug_redact = true];
+    string auth = 3 [debug_redact = true];
+    string server_address = 4;
+    // IdentityToken is used to authenticate the user and get
+    // an access token for the registry.
+    string identity_token = 5 [debug_redact = true];
+    // RegistryToken is a bearer token to be sent to a registry
+    string registry_token = 6 [debug_redact = true];
+}
+
+message PullImageRequest {
+    // Spec of the image.
+    ImageSpec image = 1;
+    // Authentication configuration for pulling the image.
+    AuthConfig auth = 2;
+    // Config of the PodSandbox, which is used to pull image in PodSandbox context.
+    PodSandboxConfig sandbox_config = 3;
+}
+
+message PullImageResponse {
+    // Reference to the unique identifier of the image on the node, as
+    // returned in the image and runtime service apis.
+    //
+    // When referring to the same image, the container runtime MUST always return
+    // the same value for:
+    //     - Image.id
+    //     - Container.image_id
+    //     - ContainerStatus.image_id
+    //     - PullImageResponse.image_ref
+    // Note: this field has a stricter meaning starting with v1.36.
+    // It used to be image ID OR digest, which are different values,
+    // and would not necessarily match other ID fields in the Container,
+    // ContainerStatus, and Image messages
+    string image_ref = 1;
+}
+
+message RemoveImageRequest {
+    // Spec of the image to remove.
+    ImageSpec image = 1;
+}
+
+message RemoveImageResponse {}
+
+message NetworkConfig {
+    // CIDR to use for pod IP addresses. If the CIDR is empty, runtimes
+    // should omit it.
+    string pod_cidr = 1;
+}
+
+message RuntimeConfig {
+    NetworkConfig network_config = 1;
+}
+
+message UpdateRuntimeConfigRequest {
+    RuntimeConfig runtime_config = 1;
+}
+
+message UpdateRuntimeConfigResponse {}
+
+// RuntimeCondition contains condition information for the runtime.
+// There are 2 kinds of runtime conditions:
+// 1. Required conditions: Conditions are required for kubelet to work
+// properly. If any required condition is unmet, the node will be not ready.
+// The required conditions include:
+//   * RuntimeReady: RuntimeReady means the runtime is up and ready to accept
+//   basic containers e.g. container only needs host network.
+//   * NetworkReady: NetworkReady means the runtime network is up and ready to
+//   accept containers which require container network.
+// 2. Optional conditions: Conditions are informative to the user, but kubelet
+// will not rely on. Since condition type is an arbitrary string, all conditions
+// not required are optional. These conditions will be exposed to users to help
+// them understand the status of the system.
+message RuntimeCondition {
+    // Type of runtime condition.
+    string type = 1;
+    // Status of the condition, one of true/false. Default: false.
+    bool status = 2;
+    // Brief CamelCase string containing reason for the condition's last transition.
+    string reason = 3;
+    // Human-readable message indicating details about last transition.
+    string message = 4;
+}
+
+// RuntimeStatus is information about the current status of the runtime.
+message RuntimeStatus {
+    // List of current observed runtime conditions.
+    repeated RuntimeCondition conditions = 1;
+}
+
+message StatusRequest {
+    // Verbose indicates whether to return extra information about the runtime.
+    bool verbose = 1;
+}
+
+// RuntimeHandlerFeatures is a set of features implemented by the runtime handler.
+message RuntimeHandlerFeatures {
+    // recursive_read_only_mounts is set to true if the runtime handler supports
+    // recursive read-only mounts.
+    // For runc-compatible runtimes, availability of this feature can be detected by checking whether
+    // the Linux kernel version is >= 5.12, and,  `runc features | jq .mountOptions` contains "rro".
+    bool recursive_read_only_mounts = 1;
+
+    // user_namespaces is set to true if the runtime handler supports user namespaces as implemented
+    // in Kubernetes. This means support for both, user namespaces and idmap mounts.
+    bool user_namespaces = 2;
+}
+
+message RuntimeHandler {
+    // Name must be unique in StatusResponse.
+    // An empty string denotes the default handler.
+    string name = 1;
+    // Supported features.
+    RuntimeHandlerFeatures features = 2;
+}
+
+// RuntimeFeatures describes the set of features implemented by the CRI implementation.
+// The features contained in the RuntimeFeatures should depend only on the cri implementation
+// independent of runtime handlers.
+message RuntimeFeatures {
+    // supplemental_groups_policy is set to true if the runtime supports SupplementalGroupsPolicy and ContainerUser.
+    bool supplemental_groups_policy = 1;
+    // user_namespaces_host_network is set to true if the runtime supports containers using both
+    // host network and user namespace simultaneously.
+    bool user_namespaces_host_network = 2;
+    // mount_options is set to true if the runtime supports additional bind
+    // mount options (noexec, nodev, nosuid) on container mounts.
+    bool mount_options = 3;
+}
+
+message StatusResponse {
+    // Status of the Runtime.
+    RuntimeStatus status = 1;
+    // Info is extra information of the Runtime. The key could be arbitrary string, and
+    // value should be in json format. The information could include anything useful for
+    // debug, e.g. plugins used by the container runtime.
+    // It should only be returned non-empty when Verbose is true.
+    map<string, string> info = 2;
+    // Runtime handlers.
+    repeated RuntimeHandler runtime_handlers = 3;
+    // features describes the set of features implemented by the CRI implementation.
+    // This field is supposed to propagate to NodeFeatures in Kubernetes API.
+    RuntimeFeatures features = 4;
+}
+
+message ImageFsInfoRequest {}
+
+// UInt64Value is the wrapper of uint64.
+message UInt64Value {
+    // The value.
+    uint64 value = 1;
+}
+
+// FilesystemIdentifier uniquely identify the filesystem.
+message FilesystemIdentifier{
+    // Mountpoint of a filesystem.
+    string mountpoint = 1;
+}
+
+// FilesystemUsage provides the filesystem usage information.
+message FilesystemUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // The unique identifier of the filesystem.
+    FilesystemIdentifier fs_id = 2;
+    // UsedBytes represents the bytes used for images on the filesystem.
+    // This may differ from the total bytes used on the filesystem and may not
+    // equal CapacityBytes - AvailableBytes.
+    UInt64Value used_bytes = 3;
+    // InodesUsed represents the inodes used by the images.
+    // This may not equal InodesCapacity - InodesAvailable because the underlying
+    // filesystem may also be used for purposes other than storing images.
+    UInt64Value inodes_used = 4;
+}
+
+// WindowsFilesystemUsage provides the filesystem usage information specific to Windows.
+message WindowsFilesystemUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // The unique identifier of the filesystem.
+    FilesystemIdentifier fs_id = 2;
+    // UsedBytes represents the bytes used for images on the filesystem.
+    // This may differ from the total bytes used on the filesystem and may not
+    // equal CapacityBytes - AvailableBytes.
+    UInt64Value used_bytes = 3;
+}
+
+message ImageFsInfoResponse {
+    // Information of image filesystem(s).
+    repeated FilesystemUsage image_filesystems = 1;
+    // Information of container filesystem(s).
+    // This is an optional field, may be used for example if container and image
+    // storage are separated.
+    // Default will be to return this as empty.
+    repeated FilesystemUsage container_filesystems = 2;
+}
+
+message ContainerStatsRequest{
+    // ID of the container for which to retrieve stats.
+    string container_id = 1;
+}
+
+message ContainerStatsResponse {
+    // Stats of the container.
+    ContainerStats stats = 1;
+}
+
+message ListContainerStatsRequest{
+    // Filter for the list request.
+    ContainerStatsFilter filter = 1;
+}
+
+// ContainerStatsFilter is used to filter containers.
+// All those fields are combined with 'AND'
+message ContainerStatsFilter {
+    // ID of the container.
+    string id = 1;
+    // ID of the PodSandbox.
+    string pod_sandbox_id = 2;
+    // LabelSelector to select matches.
+    // Only api.MatchLabels is supported for now and the requirements
+    // are ANDed. MatchExpressions is not supported yet.
+    map<string, string> label_selector = 3;
+}
+
+message ListContainerStatsResponse {
+    // Stats of the container.
+    repeated ContainerStats stats = 1;
+}
+
+message StreamContainerStatsRequest {
+    // Filter for the list request.
+    ContainerStatsFilter filter = 1;
+}
+
+message StreamContainerStatsResponse {
+    // List of container stats.
+    repeated ContainerStats container_stats = 1;
+}
+
+// ContainerAttributes provides basic information of the container.
+message ContainerAttributes {
+    // ID of the container.
+    string id = 1;
+    // Metadata of the container.
+    ContainerMetadata metadata = 2;
+    // Key-value pairs that may be used to scope and select individual resources.
+    map<string,string> labels = 3;
+    // Unstructured key-value map holding arbitrary metadata.
+    // Annotations MUST NOT be altered by the runtime; the value of this field
+    // MUST be identical to that of the corresponding ContainerConfig used to
+    // instantiate the Container this status represents.
+    map<string,string> annotations = 4;
+}
+
+// ContainerStats provides the resource usage statistics for a container.
+message ContainerStats {
+    // Information of the container.
+    ContainerAttributes attributes = 1;
+    // CPU usage gathered from the container.
+    CpuUsage cpu = 2;
+    // Memory usage gathered from the container.
+    MemoryUsage memory = 3;
+    // Usage of the writable layer.
+    FilesystemUsage writable_layer = 4;
+    // Swap usage gathered from the container.
+    SwapUsage swap = 5;
+    // IO usage gathered from the container.
+    IoUsage io = 6;
+}
+
+// WindowsContainerStats provides the resource usage statistics for a container specific for Windows
+message WindowsContainerStats {
+    // Information of the container.
+    ContainerAttributes attributes = 1;
+    // CPU usage gathered from the container.
+    WindowsCpuUsage cpu = 2;
+    // Memory usage gathered from the container.
+    WindowsMemoryUsage memory = 3;
+    // Usage of the writable layer.
+    WindowsFilesystemUsage writable_layer = 4;
+}
+
+// PSI statistics for an individual resource.
+message PsiStats {
+	// PSI data for all tasks in the cgroup.
+	PsiData Full = 1;
+	// PSI data for some tasks in the cgroup.
+	PsiData Some = 2;
+}
+
+// PSI data for an individual resource.
+message PsiData {
+	// Total time duration for tasks in the cgroup have waited due to congestion.
+	// Unit: nanoseconds.
+	uint64 Total = 1;
+	// The average (in %) tasks have waited due to congestion over a 10 second window.
+	double Avg10 = 2;
+	// The average (in %) tasks have waited due to congestion over a 60 second window.
+	double Avg60 = 3;
+	// The average (in %) tasks have waited due to congestion over a 300 second window.
+	double Avg300 = 4;
+}
+
+// CpuUsage provides the CPU usage information.
+message CpuUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Cumulative CPU usage (sum across all cores) since object creation.
+    UInt64Value usage_core_nano_seconds = 2;
+    // Total CPU usage (sum of all cores) averaged over the sample window.
+    // The "core" unit can be interpreted as CPU core-nanoseconds per second.
+    UInt64Value usage_nano_cores = 3;
+    // CPU PSI statistics.
+    PsiStats psi = 4;
+}
+
+// WindowsCpuUsage provides the CPU usage information specific to Windows
+message WindowsCpuUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Cumulative CPU usage (sum across all cores) since object creation.
+    UInt64Value usage_core_nano_seconds = 2;
+    // Total CPU usage (sum of all cores) averaged over the sample window.
+    // The "core" unit can be interpreted as CPU core-nanoseconds per second.
+    UInt64Value usage_nano_cores = 3;
+}
+
+// MemoryUsage provides the memory usage information.
+message MemoryUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // The amount of working set memory in bytes.
+    UInt64Value working_set_bytes = 2;
+    // Available memory for use. This is defined as the memory limit - workingSetBytes.
+    UInt64Value available_bytes = 3;
+    // Total memory in use. This includes all memory regardless of when it was accessed.
+    UInt64Value usage_bytes = 4;
+    // The amount of anonymous and swap cache memory (includes transparent hugepages).
+    UInt64Value rss_bytes = 5;
+    // Cumulative number of minor page faults.
+    UInt64Value page_faults = 6;
+    // Cumulative number of major page faults.
+    UInt64Value major_page_faults = 7;
+    // Memory PSI statistics.
+    PsiStats psi = 8;
+}
+
+message IoUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // IO PSI statistics.
+    PsiStats psi = 2;
+}
+
+message SwapUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // Available swap for use. This is defined as the swap limit - swapUsageBytes.
+    UInt64Value swap_available_bytes = 2;
+    // Total memory in use. This includes all memory regardless of when it was accessed.
+    UInt64Value swap_usage_bytes = 3;
+}
+
+// WindowsMemoryUsage provides the memory usage information specific to Windows
+message WindowsMemoryUsage {
+    // Timestamp in nanoseconds at which the information were collected. Must be > 0.
+    int64 timestamp = 1;
+    // The amount of working set memory in bytes.
+    UInt64Value working_set_bytes = 2;
+    // Available memory for use. This is defined as the memory limit - commit_memory_bytes.
+    UInt64Value available_bytes = 3;
+    // Cumulative number of page faults.
+    UInt64Value page_faults = 4;
+    // Total commit memory in use. Commit memory is total of physical and virtual memory in use.
+    UInt64Value commit_memory_bytes = 5;
+}
+
+message ReopenContainerLogRequest {
+    // ID of the container for which to reopen the log.
+    string container_id = 1;
+}
+
+message ReopenContainerLogResponse{
+}
+
+message CheckpointContainerRequest {
+    // ID of the container to be checkpointed.
+    string container_id = 1;
+    // Location of the checkpoint archive used for export
+    string location = 2;
+    // Timeout in seconds for the checkpoint to complete.
+    // Timeout of zero means to use the CRI default.
+    // Timeout > 0 means to use the user specified timeout.
+    int64 timeout = 3;
+}
+
+message CheckpointContainerResponse {}
+
+message CheckpointPodRequest {
+    // ID of the pod sandbox to be checkpointed.
+    string pod_sandbox_id = 1;
+    // Absolute path to an existing, empty directory where the runtime must
+    // write the checkpoint. The caller owns the directory, makes it writable by
+    // the runtime, and should restrict access to the caller and runtime. The
+    // runtime must not remove the directory. A Pod checkpoint is a collection
+    // of runtime-defined files; their layout and format are opaque to the
+    // caller. The runtime must not write outside this directory and must remove
+    // partial artifacts before returning an error.
+    string output_path = 2;
+    // IDs of the containers to include in the checkpoint. The list must be
+    // non-empty, must not contain duplicates, and must contain exactly the
+    // running containers selected by the caller. Every container must belong to
+    // `pod_sandbox_id` and be running; otherwise the runtime must fail the
+    // request without producing a checkpoint.
+    repeated string container_ids = 3;
+    // Optional opaque runtime-specific checkpoint options supplied by the CRI
+    // caller. Keys are interpreted in the scope of the pod sandbox's runtime
+    // handler. Kubernetes does not expose these options in its alpha API and
+    // kubelet sends an empty map. Direct CRI callers may set keys documented by
+    // the selected runtime. The runtime must reject unsupported or invalid keys
+    // and values rather than silently ignore them. Options must not contain
+    // secrets.
+    map<string, string> options = 4;
+}
+
+// Empty: the checkpoint is written under the request's `output_path` directory,
+// which the caller provided and already knows, so there is no separate location
+// or object name to return.
+message CheckpointPodResponse {}
+
+message RestorePodRequest {
+    // Absolute path to the directory containing the checkpoint data to restore.
+    // The runtime must not modify the checkpoint data. The data format and
+    // layout are runtime-defined.
+    string checkpoint_path = 1;
+    // Pod sandbox configuration supplied by the kubelet, with node-local restore-time
+    // updates (new Pod UID, cgroup parent path, log directory). Pod-spec equality between
+    // the live Pod and status.checkpointedPodTemplate of the referenced PodCheckpoint is
+    // enforced at API-server admission (and re-checked by the kubelet before this call);
+    // arbitrary user overrides are not permitted.
+    PodSandboxConfig config = 2;
+    // Runtime handler to use for restoring the pod sandbox and its containers.
+    // The handler selects the configured runtime implementation that interprets
+    // the runtime-specific checkpoint data. The selected handler must be
+    // compatible with the checkpoint; the runtime must reject a checkpoint it
+    // cannot restore. An empty value selects the default handler, as for
+    // RunPodSandboxRequest. The runtime must reject an unknown non-empty handler.
+    string runtime_handler = 3;
+    // Optional opaque runtime-specific restore options supplied by the CRI
+    // caller. Keys are interpreted in the scope of `runtime_handler`.
+    // Kubernetes does not expose these options in its alpha API and kubelet
+    // sends an empty map. Direct CRI callers may set keys documented by the
+    // selected runtime. The runtime must reject unsupported or invalid keys and
+    // values rather than silently ignore them. Options must not contain secrets.
+    map<string, string> options = 4;
+    // Complete restore-time configurations for all containers represented by
+    // the checkpoint. The list must be non-empty. Every entry must have a
+    // non-empty, unique metadata name, and those names must be the exact set of
+    // container names in the checkpoint. The runtime must match containers by
+    // metadata name. The checkpoint is authoritative for filesystem and
+    // process state. Image, command, args, working directory, environment, and
+    // process credentials describe the expected checkpointed process; they
+    // must not start or mutate it, and any mismatch the runtime can validate
+    // must fail the restore. The runtime applies restore-time settings outside
+    // checkpoint-owned process state, including labels, annotations, mounts,
+    // devices, Linux resources, logging, and security constraints, and must
+    // fail settings incompatible with the checkpoint.
+    repeated ContainerConfig container_configs = 5;
+}
+
+message RestoredContainer {
+    // Name from the restored container's ContainerMetadata. This identifies
+    // which requested container configuration produced the runtime ID.
+    string name = 1;
+    // Non-empty runtime ID of the restored container.
+    string container_id = 2;
+}
+
+message RestorePodResponse {
+    // Non-empty ID of the restored pod sandbox.
+    string pod_sandbox_id = 1;
+    // Restored containers in CREATED state, without having executed the
+    // restored process (see RestorePod). This must contain exactly one entry
+    // for every request.container_configs entry. Names and container IDs
+    // must each be non-empty and unique.
+    repeated RestoredContainer restored_containers = 2;
+}
+
+message GetEventsRequest {}
+
+message ContainerEventResponse {
+    // ID of the container
+    string container_id = 1;
+
+    // Type of the container event
+    ContainerEventType container_event_type = 2;
+
+    // Creation timestamp in nanoseconds of this event
+    int64 created_at = 3;
+
+    // Sandbox status
+    PodSandboxStatus pod_sandbox_status = 4;
+
+    // Container statuses
+    repeated ContainerStatus containers_statuses = 5;
+}
+
+enum ContainerEventType {
+    // Container created
+    CONTAINER_CREATED_EVENT = 0;
+
+    // Container started
+    CONTAINER_STARTED_EVENT = 1;
+
+    // Container stopped
+    CONTAINER_STOPPED_EVENT = 2;
+
+    // Container deleted
+    CONTAINER_DELETED_EVENT = 3;
+}
+
+message ListMetricDescriptorsRequest {}
+
+message ListMetricDescriptorsResponse {
+    repeated MetricDescriptor descriptors = 1;
+}
+
+message MetricDescriptor {
+    // The name field will be used as a unique identifier of this MetricDescriptor,
+    // and be used in conjunction with the Metric structure to populate the full Metric.
+    string name = 1;
+    string help = 2;
+    // When a metric uses this metric descriptor, it should only define
+    // labels that have previously been declared in label_keys.
+    // It is the responsibility of the runtime to correctly keep sorted the keys and values.
+    // If the two slices have different length, the behavior is undefined.
+    repeated string label_keys = 3;
+}
+
+message ListPodSandboxMetricsRequest {}
+
+message ListPodSandboxMetricsResponse {
+    repeated PodSandboxMetrics pod_metrics = 1;
+}
+
+message StreamPodSandboxMetricsRequest {}
+
+message StreamPodSandboxMetricsResponse {
+    // List of pod sandbox metrics.
+    repeated PodSandboxMetrics pod_sandbox_metrics = 1;
+}
+
+message PodSandboxMetrics {
+    string pod_sandbox_id = 1;
+    repeated Metric metrics = 2;
+    repeated ContainerMetrics container_metrics = 3;
+}
+
+message ContainerMetrics {
+    string container_id = 1;
+    repeated Metric metrics = 2;
+}
+
+message Metric {
+    // Name must match a name previously returned in a MetricDescriptors call,
+    // otherwise, it will be ignored.
+    string name = 1;
+    // Timestamp should be 0 if the metric was gathered live.
+    // If it was cached, the Timestamp should reflect the time in nanoseconds it was collected.
+    int64 timestamp = 2;
+    MetricType metric_type = 3;
+    // The corresponding LabelValues to the LabelKeys defined in the MetricDescriptor.
+    // It is the responsibility of the runtime to correctly keep sorted the keys and values.
+    // If the two slices have different length, the behavior is undefined.
+    repeated string label_values = 4;
+    UInt64Value value = 5;
+}
+
+enum MetricType {
+    COUNTER = 0;
+    GAUGE = 1;
+}
+
+message RuntimeConfigRequest {}
+
+message RuntimeConfigResponse {
+    // Configuration information for Linux-based runtimes. This field contains
+    // global runtime configuration options that are not specific to runtime
+    // handlers.
+    LinuxRuntimeConfiguration linux = 1;
+}
+
+message LinuxRuntimeConfiguration {
+    // Cgroup driver to use
+    // Note: this field should not change for the lifecycle of the Kubelet,
+    // or while there are running containers.
+    // The Kubelet will not re-request this after startup, and will construct the cgroup
+    // hierarchy assuming it is static.
+    // If the runtime wishes to change this value, it must be accompanied by removal of
+    // all pods, and a restart of the Kubelet. The easiest way to do this is with a full node reboot.
+    CgroupDriver cgroup_driver = 1;
+}
+
+enum CgroupDriver {
+    SYSTEMD = 0;
+    CGROUPFS = 1;
+}
+
+message UpdatePodSandboxResourcesRequest {
+    // ID of the PodSandbox to update.
+    string pod_sandbox_id = 1;
+
+    // Optional overhead represents the overheads associated with this sandbox
+    LinuxContainerResources overhead = 2;
+    // Optional resources represents the sum of container resources for this sandbox
+    LinuxContainerResources resources = 3;
+}
+
+message UpdatePodSandboxResourcesResponse {}
diff --git a/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api_grpc.pb.go b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api_grpc.pb.go
new file mode 100644
index 0000000000..1975e4f4f2
--- /dev/null
+++ b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api_grpc.pb.go
@@ -0,0 +1,2203 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+//
+//Copyright 2020 The Kubernetes Authors.
+//
+//Licensed under the Apache License, Version 2.0 (the "License");
+//you may not use this file except in compliance with the License.
+//You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing, software
+//distributed under the License is distributed on an "AS IS" BASIS,
+//WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//See the License for the specific language governing permissions and
+//limitations under the License.
+
+// To regenerate api.pb.go run `hack/update-codegen.sh protobindings`
+
+// Code generated by protoc-gen-go-grpc. DO NOT EDIT.
+// versions:
+// - protoc-gen-go-grpc v1.6.2
+// - protoc             v4.23.4
+// source: staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto
+
+package v1
+
+import (
+	context "context"
+	grpc "google.golang.org/grpc"
+	codes "google.golang.org/grpc/codes"
+	status "google.golang.org/grpc/status"
+)
+
+// This is a compile-time assertion to ensure that this generated file
+// is compatible with the grpc package it is being compiled against.
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
+
+const (
+	RuntimeService_Version_FullMethodName                   = "/runtime.v1.RuntimeService/Version"
+	RuntimeService_RunPodSandbox_FullMethodName             = "/runtime.v1.RuntimeService/RunPodSandbox"
+	RuntimeService_StopPodSandbox_FullMethodName            = "/runtime.v1.RuntimeService/StopPodSandbox"
+	RuntimeService_RemovePodSandbox_FullMethodName          = "/runtime.v1.RuntimeService/RemovePodSandbox"
+	RuntimeService_PodSandboxStatus_FullMethodName          = "/runtime.v1.RuntimeService/PodSandboxStatus"
+	RuntimeService_ListPodSandbox_FullMethodName            = "/runtime.v1.RuntimeService/ListPodSandbox"
+	RuntimeService_StreamPodSandboxes_FullMethodName        = "/runtime.v1.RuntimeService/StreamPodSandboxes"
+	RuntimeService_CreateContainer_FullMethodName           = "/runtime.v1.RuntimeService/CreateContainer"
+	RuntimeService_StartContainer_FullMethodName            = "/runtime.v1.RuntimeService/StartContainer"
+	RuntimeService_StopContainer_FullMethodName             = "/runtime.v1.RuntimeService/StopContainer"
+	RuntimeService_RemoveContainer_FullMethodName           = "/runtime.v1.RuntimeService/RemoveContainer"
+	RuntimeService_ListContainers_FullMethodName            = "/runtime.v1.RuntimeService/ListContainers"
+	RuntimeService_StreamContainers_FullMethodName          = "/runtime.v1.RuntimeService/StreamContainers"
+	RuntimeService_ContainerStatus_FullMethodName           = "/runtime.v1.RuntimeService/ContainerStatus"
+	RuntimeService_UpdateContainerResources_FullMethodName  = "/runtime.v1.RuntimeService/UpdateContainerResources"
+	RuntimeService_ReopenContainerLog_FullMethodName        = "/runtime.v1.RuntimeService/ReopenContainerLog"
+	RuntimeService_ExecSync_FullMethodName                  = "/runtime.v1.RuntimeService/ExecSync"
+	RuntimeService_Exec_FullMethodName                      = "/runtime.v1.RuntimeService/Exec"
+	RuntimeService_Attach_FullMethodName                    = "/runtime.v1.RuntimeService/Attach"
+	RuntimeService_PortForward_FullMethodName               = "/runtime.v1.RuntimeService/PortForward"
+	RuntimeService_ContainerStats_FullMethodName            = "/runtime.v1.RuntimeService/ContainerStats"
+	RuntimeService_ListContainerStats_FullMethodName        = "/runtime.v1.RuntimeService/ListContainerStats"
+	RuntimeService_StreamContainerStats_FullMethodName      = "/runtime.v1.RuntimeService/StreamContainerStats"
+	RuntimeService_PodSandboxStats_FullMethodName           = "/runtime.v1.RuntimeService/PodSandboxStats"
+	RuntimeService_ListPodSandboxStats_FullMethodName       = "/runtime.v1.RuntimeService/ListPodSandboxStats"
+	RuntimeService_StreamPodSandboxStats_FullMethodName     = "/runtime.v1.RuntimeService/StreamPodSandboxStats"
+	RuntimeService_UpdateRuntimeConfig_FullMethodName       = "/runtime.v1.RuntimeService/UpdateRuntimeConfig"
+	RuntimeService_Status_FullMethodName                    = "/runtime.v1.RuntimeService/Status"
+	RuntimeService_CheckpointContainer_FullMethodName       = "/runtime.v1.RuntimeService/CheckpointContainer"
+	RuntimeService_CheckpointPod_FullMethodName             = "/runtime.v1.RuntimeService/CheckpointPod"
+	RuntimeService_RestorePod_FullMethodName                = "/runtime.v1.RuntimeService/RestorePod"
+	RuntimeService_GetContainerEvents_FullMethodName        = "/runtime.v1.RuntimeService/GetContainerEvents"
+	RuntimeService_ListMetricDescriptors_FullMethodName     = "/runtime.v1.RuntimeService/ListMetricDescriptors"
+	RuntimeService_ListPodSandboxMetrics_FullMethodName     = "/runtime.v1.RuntimeService/ListPodSandboxMetrics"
+	RuntimeService_StreamPodSandboxMetrics_FullMethodName   = "/runtime.v1.RuntimeService/StreamPodSandboxMetrics"
+	RuntimeService_RuntimeConfig_FullMethodName             = "/runtime.v1.RuntimeService/RuntimeConfig"
+	RuntimeService_UpdatePodSandboxResources_FullMethodName = "/runtime.v1.RuntimeService/UpdatePodSandboxResources"
+)
+
+// RuntimeServiceClient is the client API for RuntimeService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// Runtime service defines the public APIs for remote container runtimes
+type RuntimeServiceClient interface {
+	// Version returns the runtime name, runtime version, and runtime API version.
+	Version(ctx context.Context, in *VersionRequest, opts ...grpc.CallOption) (*VersionResponse, error)
+	// RunPodSandbox creates and starts a pod-level sandbox. Runtimes must ensure
+	// the sandbox is in the ready state on success.
+	RunPodSandbox(ctx context.Context, in *RunPodSandboxRequest, opts ...grpc.CallOption) (*RunPodSandboxResponse, error)
+	// StopPodSandbox stops any running process that is part of the sandbox and
+	// reclaims network resources (e.g., IP addresses) allocated to the sandbox.
+	// If there are any running containers in the sandbox, they must be forcibly
+	// terminated.
+	// This call is idempotent, and must not return an error if all relevant
+	// resources have already been reclaimed. kubelet will call StopPodSandbox
+	// at least once before calling RemovePodSandbox. It will also attempt to
+	// reclaim resources eagerly, as soon as a sandbox is not needed. Hence,
+	// multiple StopPodSandbox calls are expected.
+	StopPodSandbox(ctx context.Context, in *StopPodSandboxRequest, opts ...grpc.CallOption) (*StopPodSandboxResponse, error)
+	// RemovePodSandbox removes the sandbox. If there are any running containers
+	// in the sandbox, they must be forcibly terminated and removed.
+	// This call is idempotent, and must not return an error if the sandbox has
+	// already been removed.
+	RemovePodSandbox(ctx context.Context, in *RemovePodSandboxRequest, opts ...grpc.CallOption) (*RemovePodSandboxResponse, error)
+	// PodSandboxStatus returns the status of the PodSandbox. If the PodSandbox is not
+	// present, returns an error.
+	PodSandboxStatus(ctx context.Context, in *PodSandboxStatusRequest, opts ...grpc.CallOption) (*PodSandboxStatusResponse, error)
+	// ListPodSandbox returns a list of PodSandboxes.
+	ListPodSandbox(ctx context.Context, in *ListPodSandboxRequest, opts ...grpc.CallOption) (*ListPodSandboxResponse, error)
+	// StreamPodSandboxes returns a stream of PodSandboxes.
+	// This is an alternative to ListPodSandbox that streams results in lists
+	// of at least one item, avoiding the gRPC message size limit for nodes with
+	// many pods. The number of items per list may vary depending on the
+	// container runtime. Each item must appear in exactly one response and must
+	// not be duplicated across responses in the same stream. The server must
+	// close the stream with EOF after all items have been sent. The kubelet
+	// collects all items from the stream and processes them all at once after
+	// the stream completes. The kubelet enforces a timeout on the entire stream
+	// and will discard partial results if the stream is not completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamPodSandboxes(ctx context.Context, in *StreamPodSandboxesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamPodSandboxesResponse], error)
+	// CreateContainer creates a new container in specified PodSandbox
+	CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error)
+	// StartContainer starts the container.
+	StartContainer(ctx context.Context, in *StartContainerRequest, opts ...grpc.CallOption) (*StartContainerResponse, error)
+	// StopContainer stops a running container with a grace period (i.e., timeout).
+	// This call is idempotent, and must not return an error if the container has
+	// already been stopped.
+	// The runtime must forcibly kill the container after the grace period is
+	// reached.
+	StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*StopContainerResponse, error)
+	// RemoveContainer removes the container. If the container is running, the
+	// container must be forcibly removed.
+	// This call is idempotent, and must not return an error if the container has
+	// already been removed.
+	RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*RemoveContainerResponse, error)
+	// ListContainers lists all containers by filters.
+	ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error)
+	// StreamContainers returns a stream of containers.
+	// This is an alternative to ListContainers that streams results in lists
+	// of at least one item, avoiding the gRPC message size limit for nodes with
+	// many containers. The number of items per list may vary depending on the
+	// container runtime. Each item must appear in exactly one response and must
+	// not be duplicated across responses in the same stream. The server must
+	// close the stream with EOF after all items have been sent. The kubelet
+	// collects all items from the stream and processes them all at once after
+	// the stream completes. The kubelet enforces a timeout on the entire stream
+	// and will discard partial results if the stream is not completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamContainers(ctx context.Context, in *StreamContainersRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamContainersResponse], error)
+	// ContainerStatus returns status of the container. If the container is not
+	// present, returns an error.
+	ContainerStatus(ctx context.Context, in *ContainerStatusRequest, opts ...grpc.CallOption) (*ContainerStatusResponse, error)
+	// UpdateContainerResources updates ContainerConfig of the container synchronously.
+	// If runtime fails to transactionally update the requested resources, an error is returned.
+	UpdateContainerResources(ctx context.Context, in *UpdateContainerResourcesRequest, opts ...grpc.CallOption) (*UpdateContainerResourcesResponse, error)
+	// ReopenContainerLog asks runtime to reopen the stdout/stderr log file
+	// for the container. This is often called after the log file has been
+	// rotated. If the container is not running, container runtime can choose
+	// to either create a new log file and return nil, or return an error.
+	// Once it returns error, new container log file MUST NOT be created.
+	ReopenContainerLog(ctx context.Context, in *ReopenContainerLogRequest, opts ...grpc.CallOption) (*ReopenContainerLogResponse, error)
+	// ExecSync runs a command in a container synchronously.
+	ExecSync(ctx context.Context, in *ExecSyncRequest, opts ...grpc.CallOption) (*ExecSyncResponse, error)
+	// Exec prepares a streaming endpoint to execute a command in the container.
+	Exec(ctx context.Context, in *ExecRequest, opts ...grpc.CallOption) (*ExecResponse, error)
+	// Attach prepares a streaming endpoint to attach to a running container.
+	Attach(ctx context.Context, in *AttachRequest, opts ...grpc.CallOption) (*AttachResponse, error)
+	// PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
+	PortForward(ctx context.Context, in *PortForwardRequest, opts ...grpc.CallOption) (*PortForwardResponse, error)
+	// ContainerStats returns stats of the container. If the container does not
+	// exist, the call returns an error.
+	ContainerStats(ctx context.Context, in *ContainerStatsRequest, opts ...grpc.CallOption) (*ContainerStatsResponse, error)
+	// ListContainerStats returns stats of all running containers.
+	ListContainerStats(ctx context.Context, in *ListContainerStatsRequest, opts ...grpc.CallOption) (*ListContainerStatsResponse, error)
+	// StreamContainerStats returns a stream of container stats.
+	// This is an alternative to ListContainerStats that streams results in
+	// lists of at least one item, avoiding the gRPC message size limit for
+	// nodes with many containers. The number of items per list may vary
+	// depending on the container runtime. Each item must appear in exactly one
+	// response and must not be duplicated across responses in the same stream.
+	// The server must close the stream with EOF after all items have been sent.
+	// The kubelet collects all items from the stream and processes them all at
+	// once after the stream completes. The kubelet enforces a timeout on the
+	// entire stream and will discard partial results if the stream is not
+	// completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamContainerStats(ctx context.Context, in *StreamContainerStatsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamContainerStatsResponse], error)
+	// PodSandboxStats returns stats of the pod sandbox. If the pod sandbox does not
+	// exist, the call returns an error.
+	PodSandboxStats(ctx context.Context, in *PodSandboxStatsRequest, opts ...grpc.CallOption) (*PodSandboxStatsResponse, error)
+	// ListPodSandboxStats returns stats of the pod sandboxes matching a filter.
+	ListPodSandboxStats(ctx context.Context, in *ListPodSandboxStatsRequest, opts ...grpc.CallOption) (*ListPodSandboxStatsResponse, error)
+	// StreamPodSandboxStats returns a stream of pod sandbox stats.
+	// This is an alternative to ListPodSandboxStats that streams results in
+	// lists of at least one item, avoiding the gRPC message size limit for
+	// nodes with many pods. The number of items per list may vary depending on
+	// the container runtime. Each item must appear in exactly one response and
+	// must not be duplicated across responses in the same stream. The server
+	// must close the stream with EOF after all items have been sent. The
+	// kubelet collects all items from the stream and processes them all at once
+	// after the stream completes. The kubelet enforces a timeout on the entire
+	// stream and will discard partial results if the stream is not completed
+	// in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamPodSandboxStats(ctx context.Context, in *StreamPodSandboxStatsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamPodSandboxStatsResponse], error)
+	// UpdateRuntimeConfig updates the runtime configuration based on the given request.
+	UpdateRuntimeConfig(ctx context.Context, in *UpdateRuntimeConfigRequest, opts ...grpc.CallOption) (*UpdateRuntimeConfigResponse, error)
+	// Status returns the status of the runtime.
+	Status(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (*StatusResponse, error)
+	// CheckpointContainer checkpoints a container
+	CheckpointContainer(ctx context.Context, in *CheckpointContainerRequest, opts ...grpc.CallOption) (*CheckpointContainerResponse, error)
+	// CheckpointPod creates a Pod-level checkpoint. The caller must set a
+	// deadline on the call. If the pod sandbox does not exist, the deadline is
+	// exceeded, or the checkpoint operation fails, the call returns an error.
+	// The pod sandbox and containers must be running when the call starts. The
+	// runtime must pause every selected container before capturing any of
+	// them, keep all selected containers paused until every selected
+	// container has been captured, and resume all of them before returning on
+	// success, error, or deadline expiry. This produces one consistent
+	// pod-wide cut while ensuring the runtime never returns a frozen pod.
+	CheckpointPod(ctx context.Context, in *CheckpointPodRequest, opts ...grpc.CallOption) (*CheckpointPodResponse, error)
+	// RestorePod prepares a pod sandbox and containers from a checkpoint. The
+	// caller must set a deadline on the call. On success, every returned
+	// container must be in the CREATED state and must not have executed the
+	// restored process; the caller invokes its pre-start hooks and then calls
+	// StartContainer for each returned ID. On error, the runtime must remove
+	// any sandbox and containers created by the call before returning.
+	RestorePod(ctx context.Context, in *RestorePodRequest, opts ...grpc.CallOption) (*RestorePodResponse, error)
+	// GetContainerEvents gets container events from the CRI runtime
+	GetContainerEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ContainerEventResponse], error)
+	// ListMetricDescriptors gets the descriptors for the metrics that will be returned in ListPodSandboxMetrics.
+	// This list should be static at startup: either the client and server restart together when
+	// adding or removing metrics descriptors, or they should not change.
+	// Put differently, if ListPodSandboxMetrics references a name that is not described in the initial
+	// ListMetricDescriptors call, then the metric will not be broadcasted.
+	ListMetricDescriptors(ctx context.Context, in *ListMetricDescriptorsRequest, opts ...grpc.CallOption) (*ListMetricDescriptorsResponse, error)
+	// ListPodSandboxMetrics gets pod sandbox metrics from CRI Runtime
+	ListPodSandboxMetrics(ctx context.Context, in *ListPodSandboxMetricsRequest, opts ...grpc.CallOption) (*ListPodSandboxMetricsResponse, error)
+	// StreamPodSandboxMetrics returns a stream of pod sandbox metrics.
+	// This is an alternative to ListPodSandboxMetrics that streams results in
+	// lists of at least one item, avoiding the gRPC message size limit for
+	// nodes with many pods. The number of items per list may vary depending on
+	// the container runtime. Each item must appear in exactly one response and
+	// must not be duplicated across responses in the same stream. The server
+	// must close the stream with EOF after all items have been sent. The
+	// kubelet collects all items from the stream and processes them all at once
+	// after the stream completes. The kubelet enforces a timeout on the entire
+	// stream and will discard partial results if the stream is not completed
+	// in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamPodSandboxMetrics(ctx context.Context, in *StreamPodSandboxMetricsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamPodSandboxMetricsResponse], error)
+	// RuntimeConfig returns configuration information of the runtime.
+	// A couple of notes:
+	//   - The RuntimeConfigRequest object is not to be confused with the contents of UpdateRuntimeConfigRequest.
+	//     The former is for having runtime tell Kubelet what to do, the latter vice versa.
+	//   - It is the expectation of the Kubelet that these fields are static for the lifecycle of the Kubelet.
+	//     The Kubelet will not re-request the RuntimeConfiguration after startup, and CRI implementations should
+	//     avoid updating them without a full node reboot.
+	RuntimeConfig(ctx context.Context, in *RuntimeConfigRequest, opts ...grpc.CallOption) (*RuntimeConfigResponse, error)
+	// UpdatePodSandboxResources synchronously updates the PodSandboxConfig with
+	// the pod-level resource configuration. This method is called _after_ the
+	// Kubelet reconfigures the pod-level cgroups.
+	// This request is treated as best effort, and failure will not block the
+	// Kubelet with proceeding with a resize.
+	UpdatePodSandboxResources(ctx context.Context, in *UpdatePodSandboxResourcesRequest, opts ...grpc.CallOption) (*UpdatePodSandboxResourcesResponse, error)
+}
+
+type runtimeServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewRuntimeServiceClient(cc grpc.ClientConnInterface) RuntimeServiceClient {
+	return &runtimeServiceClient{cc}
+}
+
+func (c *runtimeServiceClient) Version(ctx context.Context, in *VersionRequest, opts ...grpc.CallOption) (*VersionResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(VersionResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_Version_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) RunPodSandbox(ctx context.Context, in *RunPodSandboxRequest, opts ...grpc.CallOption) (*RunPodSandboxResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RunPodSandboxResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_RunPodSandbox_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StopPodSandbox(ctx context.Context, in *StopPodSandboxRequest, opts ...grpc.CallOption) (*StopPodSandboxResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StopPodSandboxResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_StopPodSandbox_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) RemovePodSandbox(ctx context.Context, in *RemovePodSandboxRequest, opts ...grpc.CallOption) (*RemovePodSandboxResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RemovePodSandboxResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_RemovePodSandbox_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) PodSandboxStatus(ctx context.Context, in *PodSandboxStatusRequest, opts ...grpc.CallOption) (*PodSandboxStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PodSandboxStatusResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_PodSandboxStatus_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListPodSandbox(ctx context.Context, in *ListPodSandboxRequest, opts ...grpc.CallOption) (*ListPodSandboxResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListPodSandboxResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ListPodSandbox_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StreamPodSandboxes(ctx context.Context, in *StreamPodSandboxesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamPodSandboxesResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RuntimeService_ServiceDesc.Streams[0], RuntimeService_StreamPodSandboxes_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StreamPodSandboxesRequest, StreamPodSandboxesResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamPodSandboxesClient = grpc.ServerStreamingClient[StreamPodSandboxesResponse]
+
+func (c *runtimeServiceClient) CreateContainer(ctx context.Context, in *CreateContainerRequest, opts ...grpc.CallOption) (*CreateContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CreateContainerResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_CreateContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StartContainer(ctx context.Context, in *StartContainerRequest, opts ...grpc.CallOption) (*StartContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StartContainerResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_StartContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StopContainer(ctx context.Context, in *StopContainerRequest, opts ...grpc.CallOption) (*StopContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StopContainerResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_StopContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) RemoveContainer(ctx context.Context, in *RemoveContainerRequest, opts ...grpc.CallOption) (*RemoveContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RemoveContainerResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_RemoveContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListContainers(ctx context.Context, in *ListContainersRequest, opts ...grpc.CallOption) (*ListContainersResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListContainersResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ListContainers_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StreamContainers(ctx context.Context, in *StreamContainersRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamContainersResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RuntimeService_ServiceDesc.Streams[1], RuntimeService_StreamContainers_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StreamContainersRequest, StreamContainersResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamContainersClient = grpc.ServerStreamingClient[StreamContainersResponse]
+
+func (c *runtimeServiceClient) ContainerStatus(ctx context.Context, in *ContainerStatusRequest, opts ...grpc.CallOption) (*ContainerStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ContainerStatusResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ContainerStatus_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) UpdateContainerResources(ctx context.Context, in *UpdateContainerResourcesRequest, opts ...grpc.CallOption) (*UpdateContainerResourcesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateContainerResourcesResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_UpdateContainerResources_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ReopenContainerLog(ctx context.Context, in *ReopenContainerLogRequest, opts ...grpc.CallOption) (*ReopenContainerLogResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ReopenContainerLogResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ReopenContainerLog_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ExecSync(ctx context.Context, in *ExecSyncRequest, opts ...grpc.CallOption) (*ExecSyncResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ExecSyncResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ExecSync_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) Exec(ctx context.Context, in *ExecRequest, opts ...grpc.CallOption) (*ExecResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ExecResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_Exec_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) Attach(ctx context.Context, in *AttachRequest, opts ...grpc.CallOption) (*AttachResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(AttachResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_Attach_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) PortForward(ctx context.Context, in *PortForwardRequest, opts ...grpc.CallOption) (*PortForwardResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PortForwardResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_PortForward_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ContainerStats(ctx context.Context, in *ContainerStatsRequest, opts ...grpc.CallOption) (*ContainerStatsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ContainerStatsResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ContainerStats_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListContainerStats(ctx context.Context, in *ListContainerStatsRequest, opts ...grpc.CallOption) (*ListContainerStatsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListContainerStatsResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ListContainerStats_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StreamContainerStats(ctx context.Context, in *StreamContainerStatsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamContainerStatsResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RuntimeService_ServiceDesc.Streams[2], RuntimeService_StreamContainerStats_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StreamContainerStatsRequest, StreamContainerStatsResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamContainerStatsClient = grpc.ServerStreamingClient[StreamContainerStatsResponse]
+
+func (c *runtimeServiceClient) PodSandboxStats(ctx context.Context, in *PodSandboxStatsRequest, opts ...grpc.CallOption) (*PodSandboxStatsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PodSandboxStatsResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_PodSandboxStats_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListPodSandboxStats(ctx context.Context, in *ListPodSandboxStatsRequest, opts ...grpc.CallOption) (*ListPodSandboxStatsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListPodSandboxStatsResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ListPodSandboxStats_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StreamPodSandboxStats(ctx context.Context, in *StreamPodSandboxStatsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamPodSandboxStatsResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RuntimeService_ServiceDesc.Streams[3], RuntimeService_StreamPodSandboxStats_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StreamPodSandboxStatsRequest, StreamPodSandboxStatsResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamPodSandboxStatsClient = grpc.ServerStreamingClient[StreamPodSandboxStatsResponse]
+
+func (c *runtimeServiceClient) UpdateRuntimeConfig(ctx context.Context, in *UpdateRuntimeConfigRequest, opts ...grpc.CallOption) (*UpdateRuntimeConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdateRuntimeConfigResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_UpdateRuntimeConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) Status(ctx context.Context, in *StatusRequest, opts ...grpc.CallOption) (*StatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(StatusResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_Status_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) CheckpointContainer(ctx context.Context, in *CheckpointContainerRequest, opts ...grpc.CallOption) (*CheckpointContainerResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CheckpointContainerResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_CheckpointContainer_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) CheckpointPod(ctx context.Context, in *CheckpointPodRequest, opts ...grpc.CallOption) (*CheckpointPodResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(CheckpointPodResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_CheckpointPod_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) RestorePod(ctx context.Context, in *RestorePodRequest, opts ...grpc.CallOption) (*RestorePodResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RestorePodResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_RestorePod_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) GetContainerEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[ContainerEventResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RuntimeService_ServiceDesc.Streams[4], RuntimeService_GetContainerEvents_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[GetEventsRequest, ContainerEventResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_GetContainerEventsClient = grpc.ServerStreamingClient[ContainerEventResponse]
+
+func (c *runtimeServiceClient) ListMetricDescriptors(ctx context.Context, in *ListMetricDescriptorsRequest, opts ...grpc.CallOption) (*ListMetricDescriptorsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListMetricDescriptorsResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ListMetricDescriptors_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) ListPodSandboxMetrics(ctx context.Context, in *ListPodSandboxMetricsRequest, opts ...grpc.CallOption) (*ListPodSandboxMetricsResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListPodSandboxMetricsResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_ListPodSandboxMetrics_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) StreamPodSandboxMetrics(ctx context.Context, in *StreamPodSandboxMetricsRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamPodSandboxMetricsResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &RuntimeService_ServiceDesc.Streams[5], RuntimeService_StreamPodSandboxMetrics_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StreamPodSandboxMetricsRequest, StreamPodSandboxMetricsResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamPodSandboxMetricsClient = grpc.ServerStreamingClient[StreamPodSandboxMetricsResponse]
+
+func (c *runtimeServiceClient) RuntimeConfig(ctx context.Context, in *RuntimeConfigRequest, opts ...grpc.CallOption) (*RuntimeConfigResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RuntimeConfigResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_RuntimeConfig_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *runtimeServiceClient) UpdatePodSandboxResources(ctx context.Context, in *UpdatePodSandboxResourcesRequest, opts ...grpc.CallOption) (*UpdatePodSandboxResourcesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(UpdatePodSandboxResourcesResponse)
+	err := c.cc.Invoke(ctx, RuntimeService_UpdatePodSandboxResources_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// RuntimeServiceServer is the server API for RuntimeService service.
+// All implementations must embed UnimplementedRuntimeServiceServer
+// for forward compatibility.
+//
+// Runtime service defines the public APIs for remote container runtimes
+type RuntimeServiceServer interface {
+	// Version returns the runtime name, runtime version, and runtime API version.
+	Version(context.Context, *VersionRequest) (*VersionResponse, error)
+	// RunPodSandbox creates and starts a pod-level sandbox. Runtimes must ensure
+	// the sandbox is in the ready state on success.
+	RunPodSandbox(context.Context, *RunPodSandboxRequest) (*RunPodSandboxResponse, error)
+	// StopPodSandbox stops any running process that is part of the sandbox and
+	// reclaims network resources (e.g., IP addresses) allocated to the sandbox.
+	// If there are any running containers in the sandbox, they must be forcibly
+	// terminated.
+	// This call is idempotent, and must not return an error if all relevant
+	// resources have already been reclaimed. kubelet will call StopPodSandbox
+	// at least once before calling RemovePodSandbox. It will also attempt to
+	// reclaim resources eagerly, as soon as a sandbox is not needed. Hence,
+	// multiple StopPodSandbox calls are expected.
+	StopPodSandbox(context.Context, *StopPodSandboxRequest) (*StopPodSandboxResponse, error)
+	// RemovePodSandbox removes the sandbox. If there are any running containers
+	// in the sandbox, they must be forcibly terminated and removed.
+	// This call is idempotent, and must not return an error if the sandbox has
+	// already been removed.
+	RemovePodSandbox(context.Context, *RemovePodSandboxRequest) (*RemovePodSandboxResponse, error)
+	// PodSandboxStatus returns the status of the PodSandbox. If the PodSandbox is not
+	// present, returns an error.
+	PodSandboxStatus(context.Context, *PodSandboxStatusRequest) (*PodSandboxStatusResponse, error)
+	// ListPodSandbox returns a list of PodSandboxes.
+	ListPodSandbox(context.Context, *ListPodSandboxRequest) (*ListPodSandboxResponse, error)
+	// StreamPodSandboxes returns a stream of PodSandboxes.
+	// This is an alternative to ListPodSandbox that streams results in lists
+	// of at least one item, avoiding the gRPC message size limit for nodes with
+	// many pods. The number of items per list may vary depending on the
+	// container runtime. Each item must appear in exactly one response and must
+	// not be duplicated across responses in the same stream. The server must
+	// close the stream with EOF after all items have been sent. The kubelet
+	// collects all items from the stream and processes them all at once after
+	// the stream completes. The kubelet enforces a timeout on the entire stream
+	// and will discard partial results if the stream is not completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamPodSandboxes(*StreamPodSandboxesRequest, grpc.ServerStreamingServer[StreamPodSandboxesResponse]) error
+	// CreateContainer creates a new container in specified PodSandbox
+	CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error)
+	// StartContainer starts the container.
+	StartContainer(context.Context, *StartContainerRequest) (*StartContainerResponse, error)
+	// StopContainer stops a running container with a grace period (i.e., timeout).
+	// This call is idempotent, and must not return an error if the container has
+	// already been stopped.
+	// The runtime must forcibly kill the container after the grace period is
+	// reached.
+	StopContainer(context.Context, *StopContainerRequest) (*StopContainerResponse, error)
+	// RemoveContainer removes the container. If the container is running, the
+	// container must be forcibly removed.
+	// This call is idempotent, and must not return an error if the container has
+	// already been removed.
+	RemoveContainer(context.Context, *RemoveContainerRequest) (*RemoveContainerResponse, error)
+	// ListContainers lists all containers by filters.
+	ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error)
+	// StreamContainers returns a stream of containers.
+	// This is an alternative to ListContainers that streams results in lists
+	// of at least one item, avoiding the gRPC message size limit for nodes with
+	// many containers. The number of items per list may vary depending on the
+	// container runtime. Each item must appear in exactly one response and must
+	// not be duplicated across responses in the same stream. The server must
+	// close the stream with EOF after all items have been sent. The kubelet
+	// collects all items from the stream and processes them all at once after
+	// the stream completes. The kubelet enforces a timeout on the entire stream
+	// and will discard partial results if the stream is not completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamContainers(*StreamContainersRequest, grpc.ServerStreamingServer[StreamContainersResponse]) error
+	// ContainerStatus returns status of the container. If the container is not
+	// present, returns an error.
+	ContainerStatus(context.Context, *ContainerStatusRequest) (*ContainerStatusResponse, error)
+	// UpdateContainerResources updates ContainerConfig of the container synchronously.
+	// If runtime fails to transactionally update the requested resources, an error is returned.
+	UpdateContainerResources(context.Context, *UpdateContainerResourcesRequest) (*UpdateContainerResourcesResponse, error)
+	// ReopenContainerLog asks runtime to reopen the stdout/stderr log file
+	// for the container. This is often called after the log file has been
+	// rotated. If the container is not running, container runtime can choose
+	// to either create a new log file and return nil, or return an error.
+	// Once it returns error, new container log file MUST NOT be created.
+	ReopenContainerLog(context.Context, *ReopenContainerLogRequest) (*ReopenContainerLogResponse, error)
+	// ExecSync runs a command in a container synchronously.
+	ExecSync(context.Context, *ExecSyncRequest) (*ExecSyncResponse, error)
+	// Exec prepares a streaming endpoint to execute a command in the container.
+	Exec(context.Context, *ExecRequest) (*ExecResponse, error)
+	// Attach prepares a streaming endpoint to attach to a running container.
+	Attach(context.Context, *AttachRequest) (*AttachResponse, error)
+	// PortForward prepares a streaming endpoint to forward ports from a PodSandbox.
+	PortForward(context.Context, *PortForwardRequest) (*PortForwardResponse, error)
+	// ContainerStats returns stats of the container. If the container does not
+	// exist, the call returns an error.
+	ContainerStats(context.Context, *ContainerStatsRequest) (*ContainerStatsResponse, error)
+	// ListContainerStats returns stats of all running containers.
+	ListContainerStats(context.Context, *ListContainerStatsRequest) (*ListContainerStatsResponse, error)
+	// StreamContainerStats returns a stream of container stats.
+	// This is an alternative to ListContainerStats that streams results in
+	// lists of at least one item, avoiding the gRPC message size limit for
+	// nodes with many containers. The number of items per list may vary
+	// depending on the container runtime. Each item must appear in exactly one
+	// response and must not be duplicated across responses in the same stream.
+	// The server must close the stream with EOF after all items have been sent.
+	// The kubelet collects all items from the stream and processes them all at
+	// once after the stream completes. The kubelet enforces a timeout on the
+	// entire stream and will discard partial results if the stream is not
+	// completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamContainerStats(*StreamContainerStatsRequest, grpc.ServerStreamingServer[StreamContainerStatsResponse]) error
+	// PodSandboxStats returns stats of the pod sandbox. If the pod sandbox does not
+	// exist, the call returns an error.
+	PodSandboxStats(context.Context, *PodSandboxStatsRequest) (*PodSandboxStatsResponse, error)
+	// ListPodSandboxStats returns stats of the pod sandboxes matching a filter.
+	ListPodSandboxStats(context.Context, *ListPodSandboxStatsRequest) (*ListPodSandboxStatsResponse, error)
+	// StreamPodSandboxStats returns a stream of pod sandbox stats.
+	// This is an alternative to ListPodSandboxStats that streams results in
+	// lists of at least one item, avoiding the gRPC message size limit for
+	// nodes with many pods. The number of items per list may vary depending on
+	// the container runtime. Each item must appear in exactly one response and
+	// must not be duplicated across responses in the same stream. The server
+	// must close the stream with EOF after all items have been sent. The
+	// kubelet collects all items from the stream and processes them all at once
+	// after the stream completes. The kubelet enforces a timeout on the entire
+	// stream and will discard partial results if the stream is not completed
+	// in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamPodSandboxStats(*StreamPodSandboxStatsRequest, grpc.ServerStreamingServer[StreamPodSandboxStatsResponse]) error
+	// UpdateRuntimeConfig updates the runtime configuration based on the given request.
+	UpdateRuntimeConfig(context.Context, *UpdateRuntimeConfigRequest) (*UpdateRuntimeConfigResponse, error)
+	// Status returns the status of the runtime.
+	Status(context.Context, *StatusRequest) (*StatusResponse, error)
+	// CheckpointContainer checkpoints a container
+	CheckpointContainer(context.Context, *CheckpointContainerRequest) (*CheckpointContainerResponse, error)
+	// CheckpointPod creates a Pod-level checkpoint. The caller must set a
+	// deadline on the call. If the pod sandbox does not exist, the deadline is
+	// exceeded, or the checkpoint operation fails, the call returns an error.
+	// The pod sandbox and containers must be running when the call starts. The
+	// runtime must pause every selected container before capturing any of
+	// them, keep all selected containers paused until every selected
+	// container has been captured, and resume all of them before returning on
+	// success, error, or deadline expiry. This produces one consistent
+	// pod-wide cut while ensuring the runtime never returns a frozen pod.
+	CheckpointPod(context.Context, *CheckpointPodRequest) (*CheckpointPodResponse, error)
+	// RestorePod prepares a pod sandbox and containers from a checkpoint. The
+	// caller must set a deadline on the call. On success, every returned
+	// container must be in the CREATED state and must not have executed the
+	// restored process; the caller invokes its pre-start hooks and then calls
+	// StartContainer for each returned ID. On error, the runtime must remove
+	// any sandbox and containers created by the call before returning.
+	RestorePod(context.Context, *RestorePodRequest) (*RestorePodResponse, error)
+	// GetContainerEvents gets container events from the CRI runtime
+	GetContainerEvents(*GetEventsRequest, grpc.ServerStreamingServer[ContainerEventResponse]) error
+	// ListMetricDescriptors gets the descriptors for the metrics that will be returned in ListPodSandboxMetrics.
+	// This list should be static at startup: either the client and server restart together when
+	// adding or removing metrics descriptors, or they should not change.
+	// Put differently, if ListPodSandboxMetrics references a name that is not described in the initial
+	// ListMetricDescriptors call, then the metric will not be broadcasted.
+	ListMetricDescriptors(context.Context, *ListMetricDescriptorsRequest) (*ListMetricDescriptorsResponse, error)
+	// ListPodSandboxMetrics gets pod sandbox metrics from CRI Runtime
+	ListPodSandboxMetrics(context.Context, *ListPodSandboxMetricsRequest) (*ListPodSandboxMetricsResponse, error)
+	// StreamPodSandboxMetrics returns a stream of pod sandbox metrics.
+	// This is an alternative to ListPodSandboxMetrics that streams results in
+	// lists of at least one item, avoiding the gRPC message size limit for
+	// nodes with many pods. The number of items per list may vary depending on
+	// the container runtime. Each item must appear in exactly one response and
+	// must not be duplicated across responses in the same stream. The server
+	// must close the stream with EOF after all items have been sent. The
+	// kubelet collects all items from the stream and processes them all at once
+	// after the stream completes. The kubelet enforces a timeout on the entire
+	// stream and will discard partial results if the stream is not completed
+	// in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamPodSandboxMetrics(*StreamPodSandboxMetricsRequest, grpc.ServerStreamingServer[StreamPodSandboxMetricsResponse]) error
+	// RuntimeConfig returns configuration information of the runtime.
+	// A couple of notes:
+	//   - The RuntimeConfigRequest object is not to be confused with the contents of UpdateRuntimeConfigRequest.
+	//     The former is for having runtime tell Kubelet what to do, the latter vice versa.
+	//   - It is the expectation of the Kubelet that these fields are static for the lifecycle of the Kubelet.
+	//     The Kubelet will not re-request the RuntimeConfiguration after startup, and CRI implementations should
+	//     avoid updating them without a full node reboot.
+	RuntimeConfig(context.Context, *RuntimeConfigRequest) (*RuntimeConfigResponse, error)
+	// UpdatePodSandboxResources synchronously updates the PodSandboxConfig with
+	// the pod-level resource configuration. This method is called _after_ the
+	// Kubelet reconfigures the pod-level cgroups.
+	// This request is treated as best effort, and failure will not block the
+	// Kubelet with proceeding with a resize.
+	UpdatePodSandboxResources(context.Context, *UpdatePodSandboxResourcesRequest) (*UpdatePodSandboxResourcesResponse, error)
+	mustEmbedUnimplementedRuntimeServiceServer()
+}
+
+// UnimplementedRuntimeServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedRuntimeServiceServer struct{}
+
+func (UnimplementedRuntimeServiceServer) Version(context.Context, *VersionRequest) (*VersionResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Version not implemented")
+}
+func (UnimplementedRuntimeServiceServer) RunPodSandbox(context.Context, *RunPodSandboxRequest) (*RunPodSandboxResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RunPodSandbox not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StopPodSandbox(context.Context, *StopPodSandboxRequest) (*StopPodSandboxResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method StopPodSandbox not implemented")
+}
+func (UnimplementedRuntimeServiceServer) RemovePodSandbox(context.Context, *RemovePodSandboxRequest) (*RemovePodSandboxResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RemovePodSandbox not implemented")
+}
+func (UnimplementedRuntimeServiceServer) PodSandboxStatus(context.Context, *PodSandboxStatusRequest) (*PodSandboxStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method PodSandboxStatus not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ListPodSandbox(context.Context, *ListPodSandboxRequest) (*ListPodSandboxResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPodSandbox not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StreamPodSandboxes(*StreamPodSandboxesRequest, grpc.ServerStreamingServer[StreamPodSandboxesResponse]) error {
+	return status.Error(codes.Unimplemented, "method StreamPodSandboxes not implemented")
+}
+func (UnimplementedRuntimeServiceServer) CreateContainer(context.Context, *CreateContainerRequest) (*CreateContainerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method CreateContainer not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StartContainer(context.Context, *StartContainerRequest) (*StartContainerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method StartContainer not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StopContainer(context.Context, *StopContainerRequest) (*StopContainerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method StopContainer not implemented")
+}
+func (UnimplementedRuntimeServiceServer) RemoveContainer(context.Context, *RemoveContainerRequest) (*RemoveContainerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RemoveContainer not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ListContainers(context.Context, *ListContainersRequest) (*ListContainersResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListContainers not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StreamContainers(*StreamContainersRequest, grpc.ServerStreamingServer[StreamContainersResponse]) error {
+	return status.Error(codes.Unimplemented, "method StreamContainers not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ContainerStatus(context.Context, *ContainerStatusRequest) (*ContainerStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ContainerStatus not implemented")
+}
+func (UnimplementedRuntimeServiceServer) UpdateContainerResources(context.Context, *UpdateContainerResourcesRequest) (*UpdateContainerResourcesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateContainerResources not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ReopenContainerLog(context.Context, *ReopenContainerLogRequest) (*ReopenContainerLogResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ReopenContainerLog not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ExecSync(context.Context, *ExecSyncRequest) (*ExecSyncResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ExecSync not implemented")
+}
+func (UnimplementedRuntimeServiceServer) Exec(context.Context, *ExecRequest) (*ExecResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Exec not implemented")
+}
+func (UnimplementedRuntimeServiceServer) Attach(context.Context, *AttachRequest) (*AttachResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Attach not implemented")
+}
+func (UnimplementedRuntimeServiceServer) PortForward(context.Context, *PortForwardRequest) (*PortForwardResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method PortForward not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ContainerStats(context.Context, *ContainerStatsRequest) (*ContainerStatsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ContainerStats not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ListContainerStats(context.Context, *ListContainerStatsRequest) (*ListContainerStatsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListContainerStats not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StreamContainerStats(*StreamContainerStatsRequest, grpc.ServerStreamingServer[StreamContainerStatsResponse]) error {
+	return status.Error(codes.Unimplemented, "method StreamContainerStats not implemented")
+}
+func (UnimplementedRuntimeServiceServer) PodSandboxStats(context.Context, *PodSandboxStatsRequest) (*PodSandboxStatsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method PodSandboxStats not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ListPodSandboxStats(context.Context, *ListPodSandboxStatsRequest) (*ListPodSandboxStatsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPodSandboxStats not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StreamPodSandboxStats(*StreamPodSandboxStatsRequest, grpc.ServerStreamingServer[StreamPodSandboxStatsResponse]) error {
+	return status.Error(codes.Unimplemented, "method StreamPodSandboxStats not implemented")
+}
+func (UnimplementedRuntimeServiceServer) UpdateRuntimeConfig(context.Context, *UpdateRuntimeConfigRequest) (*UpdateRuntimeConfigResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdateRuntimeConfig not implemented")
+}
+func (UnimplementedRuntimeServiceServer) Status(context.Context, *StatusRequest) (*StatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method Status not implemented")
+}
+func (UnimplementedRuntimeServiceServer) CheckpointContainer(context.Context, *CheckpointContainerRequest) (*CheckpointContainerResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method CheckpointContainer not implemented")
+}
+func (UnimplementedRuntimeServiceServer) CheckpointPod(context.Context, *CheckpointPodRequest) (*CheckpointPodResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method CheckpointPod not implemented")
+}
+func (UnimplementedRuntimeServiceServer) RestorePod(context.Context, *RestorePodRequest) (*RestorePodResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RestorePod not implemented")
+}
+func (UnimplementedRuntimeServiceServer) GetContainerEvents(*GetEventsRequest, grpc.ServerStreamingServer[ContainerEventResponse]) error {
+	return status.Error(codes.Unimplemented, "method GetContainerEvents not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ListMetricDescriptors(context.Context, *ListMetricDescriptorsRequest) (*ListMetricDescriptorsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListMetricDescriptors not implemented")
+}
+func (UnimplementedRuntimeServiceServer) ListPodSandboxMetrics(context.Context, *ListPodSandboxMetricsRequest) (*ListPodSandboxMetricsResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListPodSandboxMetrics not implemented")
+}
+func (UnimplementedRuntimeServiceServer) StreamPodSandboxMetrics(*StreamPodSandboxMetricsRequest, grpc.ServerStreamingServer[StreamPodSandboxMetricsResponse]) error {
+	return status.Error(codes.Unimplemented, "method StreamPodSandboxMetrics not implemented")
+}
+func (UnimplementedRuntimeServiceServer) RuntimeConfig(context.Context, *RuntimeConfigRequest) (*RuntimeConfigResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RuntimeConfig not implemented")
+}
+func (UnimplementedRuntimeServiceServer) UpdatePodSandboxResources(context.Context, *UpdatePodSandboxResourcesRequest) (*UpdatePodSandboxResourcesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method UpdatePodSandboxResources not implemented")
+}
+func (UnimplementedRuntimeServiceServer) mustEmbedUnimplementedRuntimeServiceServer() {}
+func (UnimplementedRuntimeServiceServer) testEmbeddedByValue()                        {}
+
+// UnsafeRuntimeServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to RuntimeServiceServer will
+// result in compilation errors.
+type UnsafeRuntimeServiceServer interface {
+	mustEmbedUnimplementedRuntimeServiceServer()
+}
+
+func RegisterRuntimeServiceServer(s grpc.ServiceRegistrar, srv RuntimeServiceServer) {
+	// If the following call panics, it indicates UnimplementedRuntimeServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&RuntimeService_ServiceDesc, srv)
+}
+
+func _RuntimeService_Version_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(VersionRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).Version(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_Version_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).Version(ctx, req.(*VersionRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_RunPodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RunPodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).RunPodSandbox(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_RunPodSandbox_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).RunPodSandbox(ctx, req.(*RunPodSandboxRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StopPodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StopPodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).StopPodSandbox(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_StopPodSandbox_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).StopPodSandbox(ctx, req.(*StopPodSandboxRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_RemovePodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemovePodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).RemovePodSandbox(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_RemovePodSandbox_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).RemovePodSandbox(ctx, req.(*RemovePodSandboxRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_PodSandboxStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PodSandboxStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).PodSandboxStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_PodSandboxStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).PodSandboxStatus(ctx, req.(*PodSandboxStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ListPodSandbox_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPodSandboxRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ListPodSandbox(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ListPodSandbox_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ListPodSandbox(ctx, req.(*ListPodSandboxRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StreamPodSandboxes_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamPodSandboxesRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RuntimeServiceServer).StreamPodSandboxes(m, &grpc.GenericServerStream[StreamPodSandboxesRequest, StreamPodSandboxesResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamPodSandboxesServer = grpc.ServerStreamingServer[StreamPodSandboxesResponse]
+
+func _RuntimeService_CreateContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CreateContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).CreateContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_CreateContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).CreateContainer(ctx, req.(*CreateContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StartContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StartContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).StartContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_StartContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).StartContainer(ctx, req.(*StartContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StopContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StopContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).StopContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_StopContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).StopContainer(ctx, req.(*StopContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_RemoveContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).RemoveContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_RemoveContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).RemoveContainer(ctx, req.(*RemoveContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ListContainers_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListContainersRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ListContainers(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ListContainers_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ListContainers(ctx, req.(*ListContainersRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StreamContainers_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamContainersRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RuntimeServiceServer).StreamContainers(m, &grpc.GenericServerStream[StreamContainersRequest, StreamContainersResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamContainersServer = grpc.ServerStreamingServer[StreamContainersResponse]
+
+func _RuntimeService_ContainerStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ContainerStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ContainerStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ContainerStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ContainerStatus(ctx, req.(*ContainerStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_UpdateContainerResources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateContainerResourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).UpdateContainerResources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_UpdateContainerResources_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).UpdateContainerResources(ctx, req.(*UpdateContainerResourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ReopenContainerLog_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ReopenContainerLogRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ReopenContainerLog(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ReopenContainerLog_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ReopenContainerLog(ctx, req.(*ReopenContainerLogRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ExecSync_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExecSyncRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ExecSync(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ExecSync_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ExecSync(ctx, req.(*ExecSyncRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_Exec_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExecRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).Exec(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_Exec_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).Exec(ctx, req.(*ExecRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_Attach_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(AttachRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).Attach(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_Attach_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).Attach(ctx, req.(*AttachRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_PortForward_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PortForwardRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).PortForward(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_PortForward_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).PortForward(ctx, req.(*PortForwardRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ContainerStats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ContainerStatsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ContainerStats(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ContainerStats_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ContainerStats(ctx, req.(*ContainerStatsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ListContainerStats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListContainerStatsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ListContainerStats(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ListContainerStats_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ListContainerStats(ctx, req.(*ListContainerStatsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StreamContainerStats_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamContainerStatsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RuntimeServiceServer).StreamContainerStats(m, &grpc.GenericServerStream[StreamContainerStatsRequest, StreamContainerStatsResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamContainerStatsServer = grpc.ServerStreamingServer[StreamContainerStatsResponse]
+
+func _RuntimeService_PodSandboxStats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PodSandboxStatsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).PodSandboxStats(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_PodSandboxStats_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).PodSandboxStats(ctx, req.(*PodSandboxStatsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ListPodSandboxStats_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPodSandboxStatsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ListPodSandboxStats(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ListPodSandboxStats_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ListPodSandboxStats(ctx, req.(*ListPodSandboxStatsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StreamPodSandboxStats_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamPodSandboxStatsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RuntimeServiceServer).StreamPodSandboxStats(m, &grpc.GenericServerStream[StreamPodSandboxStatsRequest, StreamPodSandboxStatsResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamPodSandboxStatsServer = grpc.ServerStreamingServer[StreamPodSandboxStatsResponse]
+
+func _RuntimeService_UpdateRuntimeConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdateRuntimeConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).UpdateRuntimeConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_UpdateRuntimeConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).UpdateRuntimeConfig(ctx, req.(*UpdateRuntimeConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_Status_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(StatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).Status(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_Status_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).Status(ctx, req.(*StatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_CheckpointContainer_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckpointContainerRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).CheckpointContainer(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_CheckpointContainer_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).CheckpointContainer(ctx, req.(*CheckpointContainerRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_CheckpointPod_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckpointPodRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).CheckpointPod(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_CheckpointPod_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).CheckpointPod(ctx, req.(*CheckpointPodRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_RestorePod_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RestorePodRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).RestorePod(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_RestorePod_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).RestorePod(ctx, req.(*RestorePodRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_GetContainerEvents_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(GetEventsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RuntimeServiceServer).GetContainerEvents(m, &grpc.GenericServerStream[GetEventsRequest, ContainerEventResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_GetContainerEventsServer = grpc.ServerStreamingServer[ContainerEventResponse]
+
+func _RuntimeService_ListMetricDescriptors_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListMetricDescriptorsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ListMetricDescriptors(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ListMetricDescriptors_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ListMetricDescriptors(ctx, req.(*ListMetricDescriptorsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_ListPodSandboxMetrics_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListPodSandboxMetricsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).ListPodSandboxMetrics(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_ListPodSandboxMetrics_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).ListPodSandboxMetrics(ctx, req.(*ListPodSandboxMetricsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_StreamPodSandboxMetrics_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamPodSandboxMetricsRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(RuntimeServiceServer).StreamPodSandboxMetrics(m, &grpc.GenericServerStream[StreamPodSandboxMetricsRequest, StreamPodSandboxMetricsResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type RuntimeService_StreamPodSandboxMetricsServer = grpc.ServerStreamingServer[StreamPodSandboxMetricsResponse]
+
+func _RuntimeService_RuntimeConfig_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RuntimeConfigRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).RuntimeConfig(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_RuntimeConfig_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).RuntimeConfig(ctx, req.(*RuntimeConfigRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _RuntimeService_UpdatePodSandboxResources_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UpdatePodSandboxResourcesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(RuntimeServiceServer).UpdatePodSandboxResources(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: RuntimeService_UpdatePodSandboxResources_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(RuntimeServiceServer).UpdatePodSandboxResources(ctx, req.(*UpdatePodSandboxResourcesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// RuntimeService_ServiceDesc is the grpc.ServiceDesc for RuntimeService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var RuntimeService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "runtime.v1.RuntimeService",
+	HandlerType: (*RuntimeServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "Version",
+			Handler:    _RuntimeService_Version_Handler,
+		},
+		{
+			MethodName: "RunPodSandbox",
+			Handler:    _RuntimeService_RunPodSandbox_Handler,
+		},
+		{
+			MethodName: "StopPodSandbox",
+			Handler:    _RuntimeService_StopPodSandbox_Handler,
+		},
+		{
+			MethodName: "RemovePodSandbox",
+			Handler:    _RuntimeService_RemovePodSandbox_Handler,
+		},
+		{
+			MethodName: "PodSandboxStatus",
+			Handler:    _RuntimeService_PodSandboxStatus_Handler,
+		},
+		{
+			MethodName: "ListPodSandbox",
+			Handler:    _RuntimeService_ListPodSandbox_Handler,
+		},
+		{
+			MethodName: "CreateContainer",
+			Handler:    _RuntimeService_CreateContainer_Handler,
+		},
+		{
+			MethodName: "StartContainer",
+			Handler:    _RuntimeService_StartContainer_Handler,
+		},
+		{
+			MethodName: "StopContainer",
+			Handler:    _RuntimeService_StopContainer_Handler,
+		},
+		{
+			MethodName: "RemoveContainer",
+			Handler:    _RuntimeService_RemoveContainer_Handler,
+		},
+		{
+			MethodName: "ListContainers",
+			Handler:    _RuntimeService_ListContainers_Handler,
+		},
+		{
+			MethodName: "ContainerStatus",
+			Handler:    _RuntimeService_ContainerStatus_Handler,
+		},
+		{
+			MethodName: "UpdateContainerResources",
+			Handler:    _RuntimeService_UpdateContainerResources_Handler,
+		},
+		{
+			MethodName: "ReopenContainerLog",
+			Handler:    _RuntimeService_ReopenContainerLog_Handler,
+		},
+		{
+			MethodName: "ExecSync",
+			Handler:    _RuntimeService_ExecSync_Handler,
+		},
+		{
+			MethodName: "Exec",
+			Handler:    _RuntimeService_Exec_Handler,
+		},
+		{
+			MethodName: "Attach",
+			Handler:    _RuntimeService_Attach_Handler,
+		},
+		{
+			MethodName: "PortForward",
+			Handler:    _RuntimeService_PortForward_Handler,
+		},
+		{
+			MethodName: "ContainerStats",
+			Handler:    _RuntimeService_ContainerStats_Handler,
+		},
+		{
+			MethodName: "ListContainerStats",
+			Handler:    _RuntimeService_ListContainerStats_Handler,
+		},
+		{
+			MethodName: "PodSandboxStats",
+			Handler:    _RuntimeService_PodSandboxStats_Handler,
+		},
+		{
+			MethodName: "ListPodSandboxStats",
+			Handler:    _RuntimeService_ListPodSandboxStats_Handler,
+		},
+		{
+			MethodName: "UpdateRuntimeConfig",
+			Handler:    _RuntimeService_UpdateRuntimeConfig_Handler,
+		},
+		{
+			MethodName: "Status",
+			Handler:    _RuntimeService_Status_Handler,
+		},
+		{
+			MethodName: "CheckpointContainer",
+			Handler:    _RuntimeService_CheckpointContainer_Handler,
+		},
+		{
+			MethodName: "CheckpointPod",
+			Handler:    _RuntimeService_CheckpointPod_Handler,
+		},
+		{
+			MethodName: "RestorePod",
+			Handler:    _RuntimeService_RestorePod_Handler,
+		},
+		{
+			MethodName: "ListMetricDescriptors",
+			Handler:    _RuntimeService_ListMetricDescriptors_Handler,
+		},
+		{
+			MethodName: "ListPodSandboxMetrics",
+			Handler:    _RuntimeService_ListPodSandboxMetrics_Handler,
+		},
+		{
+			MethodName: "RuntimeConfig",
+			Handler:    _RuntimeService_RuntimeConfig_Handler,
+		},
+		{
+			MethodName: "UpdatePodSandboxResources",
+			Handler:    _RuntimeService_UpdatePodSandboxResources_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "StreamPodSandboxes",
+			Handler:       _RuntimeService_StreamPodSandboxes_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "StreamContainers",
+			Handler:       _RuntimeService_StreamContainers_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "StreamContainerStats",
+			Handler:       _RuntimeService_StreamContainerStats_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "StreamPodSandboxStats",
+			Handler:       _RuntimeService_StreamPodSandboxStats_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "GetContainerEvents",
+			Handler:       _RuntimeService_GetContainerEvents_Handler,
+			ServerStreams: true,
+		},
+		{
+			StreamName:    "StreamPodSandboxMetrics",
+			Handler:       _RuntimeService_StreamPodSandboxMetrics_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto",
+}
+
+const (
+	ImageService_ListImages_FullMethodName   = "/runtime.v1.ImageService/ListImages"
+	ImageService_StreamImages_FullMethodName = "/runtime.v1.ImageService/StreamImages"
+	ImageService_ImageStatus_FullMethodName  = "/runtime.v1.ImageService/ImageStatus"
+	ImageService_PullImage_FullMethodName    = "/runtime.v1.ImageService/PullImage"
+	ImageService_RemoveImage_FullMethodName  = "/runtime.v1.ImageService/RemoveImage"
+	ImageService_ImageFsInfo_FullMethodName  = "/runtime.v1.ImageService/ImageFsInfo"
+)
+
+// ImageServiceClient is the client API for ImageService service.
+//
+// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream.
+//
+// ImageService defines the public APIs for managing images.
+type ImageServiceClient interface {
+	// ListImages lists existing images.
+	ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error)
+	// StreamImages returns a stream of images.
+	// This is an alternative to ListImages that streams results in lists of at
+	// least one item, avoiding the gRPC message size limit for nodes with many
+	// images. The number of items per list may vary depending on the container
+	// runtime. Each item must appear in exactly one response and must not be
+	// duplicated across responses in the same stream. The server must close the
+	// stream with EOF after all items have been sent. The kubelet collects all
+	// items from the stream and processes them all at once after the stream
+	// completes. The kubelet enforces a timeout on the entire stream and will
+	// discard partial results if the stream is not completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamImages(ctx context.Context, in *StreamImagesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamImagesResponse], error)
+	// ImageStatus returns the status of the image. If the image is not
+	// present, returns a response with ImageStatusResponse.Image set to
+	// nil.
+	ImageStatus(ctx context.Context, in *ImageStatusRequest, opts ...grpc.CallOption) (*ImageStatusResponse, error)
+	// PullImage pulls an image with authentication config.
+	PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (*PullImageResponse, error)
+	// RemoveImage removes the image.
+	// This call is idempotent, and must not return an error if the image has
+	// already been removed.
+	// Note that if the image is referenced by multiple tags (even across different repositories
+	// if they resolve to the same image digest), removing the image by a single tag
+	// will remove all of its tags. For example, if `repo/image:v1` and `another_repo/image:latest`
+	// point to the same image, removing `repo/image:v1` will also remove `another_repo/image:latest`.
+	// The next call to ListImages, ImageStatus, ImageFsInfo will not return this image.
+	// The resources (e.g. disk space) may be cleaned asynchronously
+	// and not guaranteed to be cleaned up by the time this method returns.
+	RemoveImage(ctx context.Context, in *RemoveImageRequest, opts ...grpc.CallOption) (*RemoveImageResponse, error)
+	// ImageFSInfo returns information of the filesystem that is used to store images.
+	// Usage information may include images that were removed, but are still being cleaned up.
+	ImageFsInfo(ctx context.Context, in *ImageFsInfoRequest, opts ...grpc.CallOption) (*ImageFsInfoResponse, error)
+}
+
+type imageServiceClient struct {
+	cc grpc.ClientConnInterface
+}
+
+func NewImageServiceClient(cc grpc.ClientConnInterface) ImageServiceClient {
+	return &imageServiceClient{cc}
+}
+
+func (c *imageServiceClient) ListImages(ctx context.Context, in *ListImagesRequest, opts ...grpc.CallOption) (*ListImagesResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ListImagesResponse)
+	err := c.cc.Invoke(ctx, ImageService_ListImages_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) StreamImages(ctx context.Context, in *StreamImagesRequest, opts ...grpc.CallOption) (grpc.ServerStreamingClient[StreamImagesResponse], error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	stream, err := c.cc.NewStream(ctx, &ImageService_ServiceDesc.Streams[0], ImageService_StreamImages_FullMethodName, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	x := &grpc.GenericClientStream[StreamImagesRequest, StreamImagesResponse]{ClientStream: stream}
+	if err := x.ClientStream.SendMsg(in); err != nil {
+		return nil, err
+	}
+	if err := x.ClientStream.CloseSend(); err != nil {
+		return nil, err
+	}
+	return x, nil
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type ImageService_StreamImagesClient = grpc.ServerStreamingClient[StreamImagesResponse]
+
+func (c *imageServiceClient) ImageStatus(ctx context.Context, in *ImageStatusRequest, opts ...grpc.CallOption) (*ImageStatusResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ImageStatusResponse)
+	err := c.cc.Invoke(ctx, ImageService_ImageStatus_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) PullImage(ctx context.Context, in *PullImageRequest, opts ...grpc.CallOption) (*PullImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(PullImageResponse)
+	err := c.cc.Invoke(ctx, ImageService_PullImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) RemoveImage(ctx context.Context, in *RemoveImageRequest, opts ...grpc.CallOption) (*RemoveImageResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(RemoveImageResponse)
+	err := c.cc.Invoke(ctx, ImageService_RemoveImage_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *imageServiceClient) ImageFsInfo(ctx context.Context, in *ImageFsInfoRequest, opts ...grpc.CallOption) (*ImageFsInfoResponse, error) {
+	cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...)
+	out := new(ImageFsInfoResponse)
+	err := c.cc.Invoke(ctx, ImageService_ImageFsInfo_FullMethodName, in, out, cOpts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+// ImageServiceServer is the server API for ImageService service.
+// All implementations must embed UnimplementedImageServiceServer
+// for forward compatibility.
+//
+// ImageService defines the public APIs for managing images.
+type ImageServiceServer interface {
+	// ListImages lists existing images.
+	ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error)
+	// StreamImages returns a stream of images.
+	// This is an alternative to ListImages that streams results in lists of at
+	// least one item, avoiding the gRPC message size limit for nodes with many
+	// images. The number of items per list may vary depending on the container
+	// runtime. Each item must appear in exactly one response and must not be
+	// duplicated across responses in the same stream. The server must close the
+	// stream with EOF after all items have been sent. The kubelet collects all
+	// items from the stream and processes them all at once after the stream
+	// completes. The kubelet enforces a timeout on the entire stream and will
+	// discard partial results if the stream is not completed in time.
+	// Feature gate: CRIListStreaming
+	// See https://kep.k8s.io/5825 for more details.
+	StreamImages(*StreamImagesRequest, grpc.ServerStreamingServer[StreamImagesResponse]) error
+	// ImageStatus returns the status of the image. If the image is not
+	// present, returns a response with ImageStatusResponse.Image set to
+	// nil.
+	ImageStatus(context.Context, *ImageStatusRequest) (*ImageStatusResponse, error)
+	// PullImage pulls an image with authentication config.
+	PullImage(context.Context, *PullImageRequest) (*PullImageResponse, error)
+	// RemoveImage removes the image.
+	// This call is idempotent, and must not return an error if the image has
+	// already been removed.
+	// Note that if the image is referenced by multiple tags (even across different repositories
+	// if they resolve to the same image digest), removing the image by a single tag
+	// will remove all of its tags. For example, if `repo/image:v1` and `another_repo/image:latest`
+	// point to the same image, removing `repo/image:v1` will also remove `another_repo/image:latest`.
+	// The next call to ListImages, ImageStatus, ImageFsInfo will not return this image.
+	// The resources (e.g. disk space) may be cleaned asynchronously
+	// and not guaranteed to be cleaned up by the time this method returns.
+	RemoveImage(context.Context, *RemoveImageRequest) (*RemoveImageResponse, error)
+	// ImageFSInfo returns information of the filesystem that is used to store images.
+	// Usage information may include images that were removed, but are still being cleaned up.
+	ImageFsInfo(context.Context, *ImageFsInfoRequest) (*ImageFsInfoResponse, error)
+	mustEmbedUnimplementedImageServiceServer()
+}
+
+// UnimplementedImageServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedImageServiceServer struct{}
+
+func (UnimplementedImageServiceServer) ListImages(context.Context, *ListImagesRequest) (*ListImagesResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ListImages not implemented")
+}
+func (UnimplementedImageServiceServer) StreamImages(*StreamImagesRequest, grpc.ServerStreamingServer[StreamImagesResponse]) error {
+	return status.Error(codes.Unimplemented, "method StreamImages not implemented")
+}
+func (UnimplementedImageServiceServer) ImageStatus(context.Context, *ImageStatusRequest) (*ImageStatusResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ImageStatus not implemented")
+}
+func (UnimplementedImageServiceServer) PullImage(context.Context, *PullImageRequest) (*PullImageResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method PullImage not implemented")
+}
+func (UnimplementedImageServiceServer) RemoveImage(context.Context, *RemoveImageRequest) (*RemoveImageResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method RemoveImage not implemented")
+}
+func (UnimplementedImageServiceServer) ImageFsInfo(context.Context, *ImageFsInfoRequest) (*ImageFsInfoResponse, error) {
+	return nil, status.Error(codes.Unimplemented, "method ImageFsInfo not implemented")
+}
+func (UnimplementedImageServiceServer) mustEmbedUnimplementedImageServiceServer() {}
+func (UnimplementedImageServiceServer) testEmbeddedByValue()                      {}
+
+// UnsafeImageServiceServer may be embedded to opt out of forward compatibility for this service.
+// Use of this interface is not recommended, as added methods to ImageServiceServer will
+// result in compilation errors.
+type UnsafeImageServiceServer interface {
+	mustEmbedUnimplementedImageServiceServer()
+}
+
+func RegisterImageServiceServer(s grpc.ServiceRegistrar, srv ImageServiceServer) {
+	// If the following call panics, it indicates UnimplementedImageServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
+	s.RegisterService(&ImageService_ServiceDesc, srv)
+}
+
+func _ImageService_ListImages_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ListImagesRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ImageServiceServer).ListImages(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ImageService_ListImages_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ImageServiceServer).ListImages(ctx, req.(*ListImagesRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ImageService_StreamImages_Handler(srv interface{}, stream grpc.ServerStream) error {
+	m := new(StreamImagesRequest)
+	if err := stream.RecvMsg(m); err != nil {
+		return err
+	}
+	return srv.(ImageServiceServer).StreamImages(m, &grpc.GenericServerStream[StreamImagesRequest, StreamImagesResponse]{ServerStream: stream})
+}
+
+// This type alias is provided for backwards compatibility with existing code that references the prior non-generic stream type by name.
+type ImageService_StreamImagesServer = grpc.ServerStreamingServer[StreamImagesResponse]
+
+func _ImageService_ImageStatus_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ImageStatusRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ImageServiceServer).ImageStatus(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ImageService_ImageStatus_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ImageServiceServer).ImageStatus(ctx, req.(*ImageStatusRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ImageService_PullImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(PullImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ImageServiceServer).PullImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ImageService_PullImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ImageServiceServer).PullImage(ctx, req.(*PullImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ImageService_RemoveImage_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RemoveImageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ImageServiceServer).RemoveImage(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ImageService_RemoveImage_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ImageServiceServer).RemoveImage(ctx, req.(*RemoveImageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _ImageService_ImageFsInfo_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ImageFsInfoRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ImageServiceServer).ImageFsInfo(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: ImageService_ImageFsInfo_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ImageServiceServer).ImageFsInfo(ctx, req.(*ImageFsInfoRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+// ImageService_ServiceDesc is the grpc.ServiceDesc for ImageService service.
+// It's only intended for direct use with grpc.RegisterService,
+// and not to be introspected or modified (even as a copy)
+var ImageService_ServiceDesc = grpc.ServiceDesc{
+	ServiceName: "runtime.v1.ImageService",
+	HandlerType: (*ImageServiceServer)(nil),
+	Methods: []grpc.MethodDesc{
+		{
+			MethodName: "ListImages",
+			Handler:    _ImageService_ListImages_Handler,
+		},
+		{
+			MethodName: "ImageStatus",
+			Handler:    _ImageService_ImageStatus_Handler,
+		},
+		{
+			MethodName: "PullImage",
+			Handler:    _ImageService_PullImage_Handler,
+		},
+		{
+			MethodName: "RemoveImage",
+			Handler:    _ImageService_RemoveImage_Handler,
+		},
+		{
+			MethodName: "ImageFsInfo",
+			Handler:    _ImageService_ImageFsInfo_Handler,
+		},
+	},
+	Streams: []grpc.StreamDesc{
+		{
+			StreamName:    "StreamImages",
+			Handler:       _ImageService_StreamImages_Handler,
+			ServerStreams: true,
+		},
+	},
+	Metadata: "staging/src/k8s.io/cri-api/pkg/apis/runtime/v1/api.proto",
+}
diff --git a/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api_json.go b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api_json.go
new file mode 100644
index 0000000000..2e0b6dc2fd
--- /dev/null
+++ b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/api_json.go
@@ -0,0 +1,47 @@
+/*
+Copyright The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+import "encoding/json"
+
+// MarshalJSON() preserves pre-1.34 JSON encoding of value as a string (not base64),
+// stomping non-utf-8 data with the utf8 replacement character.
+func (k *KeyValue) MarshalJSON() ([]byte, error) {
+	return json.Marshal(stringKeyValue{
+		Key:   k.GetKey(),
+		Value: string(k.GetValue()),
+	})
+}
+
+// UnmarshalJSON preserves pre-1.34 JSON decoding of value as a string (not base64),
+// stomping non-utf-8 data with the utf8 replacement character.
+func (k *KeyValue) UnmarshalJSON(data []byte) error {
+	v := stringKeyValue{}
+	if err := json.Unmarshal(data, &v); err != nil {
+		return err
+	}
+	k.Key = v.Key
+	k.Value = []byte(v.Value)
+	return nil
+}
+
+// stringKeyValue matches the structure used to json-encode pre-1.34.
+// Non-UTF-8 characters in Value are coerced to the replacement character on encode/decode.
+type stringKeyValue struct {
+	Key   string `json:"key,omitempty"`
+	Value string `json:"value,omitempty"`
+}
diff --git a/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/constants.go b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/constants.go
new file mode 100644
index 0000000000..6f9ad59eb5
--- /dev/null
+++ b/vendor/k8s.io/cri-api/pkg/apis/runtime/v1/constants.go
@@ -0,0 +1,55 @@
+/*
+Copyright 2020 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1
+
+// This file contains all constants defined in CRI.
+
+// Required runtime condition type.
+const (
+	// RuntimeReady means the runtime is up and ready to accept basic containers.
+	RuntimeReady = "RuntimeReady"
+	// NetworkReady means the runtime network is up and ready to accept containers which require network.
+	NetworkReady = "NetworkReady"
+)
+
+// LogStreamType is the type of the stream in CRI container log.
+type LogStreamType string
+
+const (
+	// Stdout is the stream type for stdout.
+	Stdout LogStreamType = "stdout"
+	// Stderr is the stream type for stderr.
+	Stderr LogStreamType = "stderr"
+)
+
+// LogTag is the tag of a log line in CRI container log.
+// Currently defined log tags:
+// * First tag: Partial/Full - P/F.
+// The field in the container log format can be extended to include multiple
+// tags by using a delimiter, but changes should be rare. If it becomes clear
+// that better extensibility is desired, a more extensible format (e.g., json)
+// should be adopted as a replacement and/or addition.
+type LogTag string
+
+const (
+	// LogTagPartial means the line is part of multiple lines.
+	LogTagPartial LogTag = "P"
+	// LogTagFull means the line is a single full line or the end of multiple lines.
+	LogTagFull LogTag = "F"
+	// LogTagDelimiter is the delimiter for different log tags.
+	LogTagDelimiter = ":"
+)
diff --git a/vendor/modules.txt b/vendor/modules.txt
index b50ea91b42..e156b09b8e 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -265,6 +265,15 @@ github.com/cncf/xds/go/xds/type/v3
 # github.com/container-storage-interface/spec v1.12.0
 ## explicit; go 1.23.0
 github.com/container-storage-interface/spec/lib/go/csi
+# github.com/containerd/cgroups/v3 v3.0.5
+## explicit; go 1.22.0
+github.com/containerd/cgroups/v3/cgroup1/stats
+github.com/containerd/cgroups/v3/cgroup2/stats
+# github.com/containerd/containerd/api v1.12.0-beta.0
+## explicit; go 1.25.0
+github.com/containerd/containerd/api/runtime/task/v3
+github.com/containerd/containerd/api/types
+github.com/containerd/containerd/api/types/task
 # github.com/containerd/errdefs v1.0.0
 ## explicit; go 1.20
 github.com/containerd/errdefs
@@ -278,8 +287,8 @@ github.com/containerd/log
 # github.com/containerd/platforms v0.2.1
 ## explicit; go 1.20
 github.com/containerd/platforms
-# github.com/containerd/ttrpc v1.2.8
-## explicit; go 1.22
+# github.com/containerd/ttrpc v1.2.9
+## explicit; go 1.25.0
 github.com/containerd/ttrpc
 # github.com/cpuguy83/dockercfg v0.3.2
 ## explicit; go 1.13
@@ -1854,6 +1863,9 @@ k8s.io/client-go/util/keyutil
 k8s.io/client-go/util/retry
 k8s.io/client-go/util/watchlist
 k8s.io/client-go/util/workqueue
+# k8s.io/cri-api v0.37.0
+## explicit; go 1.26.0
+k8s.io/cri-api/pkg/apis/runtime/v1
 # k8s.io/klog/v2 v2.140.0
 ## explicit; go 1.21
 k8s.io/klog/v2