Dockerfile: update containerd, registry, RootlessKit, CNI

[AkihiroSuda]

• runc: 1.0.2 -> 1.1.0
• containerd: 1.6.0/1.5.9/1.4.12 -> 1.6.1/1.5.10/1.4.13
• registry: 2.7.1 -> 2.8.0
• RootlessKit: 0.14.2 -> 0.14.6
• CNI plugins: 1.0.1 -> 1.1.0

[AkihiroSuda]

🤔

 > [runc 3/3] RUN --mount=from=runc-src,src=/usr/src/runc,target=. --mount=target=/root/.cache,type=cache   CGO_ENABLED=1 xx-go build -mod=vendor -ldflags '-extldflags -static' -tags 'apparmor seccomp netgo cgo static_build osusergo' -o /usr/bin/runc ./ &&   xx-verify --static /usr/bin/runc:
#25 30.26 # github.com/seccomp/libseccomp-golang
#25 30.26 vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:619:2: duplicate case _Ciconst_C_ACT_KILL_THREAD (value 0) in switch
#25 30.26 	previous case at vendor/github.com/seccomp/libseccomp-golang/seccomp_internal.go:615:2

https://github.com/moby/buildkit/runs/5417974077?check_suite_focus=true

[tonistiigi]

@AkihiroSuda That's a libseccomp-golang issue I submitted PR for. We can't update unless we fork and patch vendor.

[AkihiroSuda]

@AkihiroSuda That's a libseccomp-golang issue I submitted PR for. We can't update unless we fork and patch vendor.

Can we just fetch the binaries from https://github.com/opencontainers/runc/releases/tag/v1.1.0 ?
Maybe we have to add riscv64 binary there first, though

[tonistiigi]

We would need to at least leave stages for source as well as this is useful for debugging(either via commit or local source with --build-context). I also think buildkit is atm built for mips unofficially.

[AkihiroSuda]

Removed runc update. Hope we can fix it in runc v1.1.1.