engine: 29.8.2, containerd 2.3.6, runc 1.5.2, buildkit 0.33.1 (security)

[zcsizmadia]

Engine 29.8.2 for 0.9.0, with containerd, runc and BuildKit moved to the versions moby 29.8.2 itself builds against (its go.mod: containerd v2.3.6, BuildKit v0.33.1; its Dockerfile: runc v1.5.2).This PR is red until its rootfs is released, by design. It is the same procedure as #477: the new default engine has empty checksums, which fails TestTheDefaultEngineShipsBothArchitectures and TestTheDefaultEngineResolvesOnThisHost. Once rootfs.yml is green on both architectures, rootfs-v29.8.2-1 is tagged on this PR's head. The checksums are then verified against the downloaded tarballs and committed here, and the PR merges green. docs/bumping-upstream.md still described the older "merge with an empty checksum, fill it in later" flow that those two tests made impossible. It's corrected here.## Pins| | tag | commit ||---|---|---|| moby | docker-v29.8.2 | 8af9fe3a36bab3e039862a2ab1cef1880c9b4d03 || containerd | v2.1.4 → v2.3.6 | ee2735368117d2eb259779949d5e75cdafec9761 || runc | v1.3.0 → v1.5.2 | 29dd3dc2b13b4123162e5fe132504bb4b15569f1 || buildkit | v0.27.0 → v0.33.1 | 8c91502cf280bd70a0c50912ce251c46a8881d9f || Go | 1.26.7 → 1.26.8 | floor of moby 29.8.2, containerd v2.3.6 and buildkit v0.33.1 (runc's is 1.25) |Commits are the tags' dereferenced commits (refs/tags/<tag>^{}). The same query reproduces all four current pins exactly. ROOTFS_REVISION resets to 1.## Why containerd, runc and BuildKit move: the stated reason versions.env asks for- containerd: CVE-2026-53493 (GHSA-pg57-6jwg-q645) affects >= 2.1.0, < 2.2.9. 2.1.4 is inside that range, and the 2.1 line has no fixed release.- runc: 1.3.0 is affected by GHSA-qw9x-cqr3-wc7r, GHSA-cgrx-mc8f-2prm and GHSA-9493-h29p-rfm2, all high-severity container escapes from 2025-11, fixed in 1.3.3.- buildkitd: the ten BuildKit CVEs in moby 29.8.2's release notes are fixed in v0.33.1. dockerd's embedded builder gets them through moby's go.mod; the standalone buildkitd Skrog ships does not.## Before merge- [x] rootfs.yml green on amd64 and arm64: build, smoke test, boot test and reference diff- [x] rootfs-v29.8.2-1 tagged on this PR's head and published- [x] checksums verified against the downloaded bytes and committed here; PR green- [x] skrog engine upgrade 29.8.1-3 → 29.8.2-1 and skrog engine rollback back, with images, a volume and a stopped container surviving both. Rollback is the real risk here: containerd moves two minor versions, and a newer containerd's metadata is not guaranteed to be readable by an older one. If rollback doesn't hold, that has to be documented, or 29.8.1 dropped as a rollback target, before 0.9.0.

Results (2026-10-05, WSL 3.0.1, the maintainer's machine)

• rootfs.yml, both architectures: build, smoke test, boot test, reference diff and emulation all pass. The built binaries report Docker 29.8.2 build 8af9fe3, containerd v2.3.6 ee27353, runc 1.5.2.
• rootfs-v29.8.2-1 was published from 2c7582a, the commit those jobs built. Both tarballs were downloaded and hashed, and match their .sha256 files: amd64 f28009cf…, arm64 33782e13…. gh attestation verify passes on both; a copy with one byte appended fails.
• Upgrade 29.8.1-3 → 29.8.2-1 through skrog engine upgrade (it downloaded and verified the released rootfs) took 27 s. Afterwards: dockerd 29.8.2, containerd 2.3.6, runc 1.5.2, buildkitd 0.33.1. All images (containerd image store), a marker volume and a stopped container survived; a fresh pull worked.
• Rollback to 29.8.1-3 took 24 s. containerd 2.1.4 read the 2.3.6 metadata. An image pulled under 2.3.6 is listed and runs, the volume holds the lines written under both versions, and the stopped container starts. No errors in dockerd.log; the warnings present all predate the upgrade.