containerd 2.0.1

Welcome to the v2.0.1 release of containerd!

The first patch release for containerd 2.0 includes a number of bug fixes and improvements.

* Fix apply IoOwner options when not in user namespace ([#11151](containerd/containerd#11151))
* Fix cri grpc plugin config migration ([#11140](containerd/containerd#11140))
* Support CNI STATUS Verb ([containerd/go-cni#123](containerd/go-cni#123))

* Update differ to handle zstd media types ([#11068](containerd/containerd#11068))

* Update runc binary to v1.2.3 ([#11142](containerd/containerd#11142))
* Fix panic due to nil dereference cgroups v2 ([#11098](containerd/containerd#11098))

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

* Derek McGowan
* Wei Fu
* Archit Kulkarni
* Jin Dong
* Phil Estes
* Akhil Mohan
* Akihiro Suda
* Alexey Lunev
* Austin Vazquez
* Maksym Pavlenko
* Mike Brown
* Michael Zappa
* Samuel Karp
* Sebastiaan van Stijn
* Andrey Smirnov
* Davanum Srinivas
<details><summary>50 commits</summary>
<p>

* Prepare release notes for v2.0.1 ([#11158](containerd/containerd#11158))
  * [`b0ece5dc5`](containerd/containerd@b0ece5d) Prepare release notes for v2.0.1
* build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0 ([#11154](containerd/containerd#11154))
  * [`fe6957084`](containerd/containerd@fe69570) build(deps): bump actions/attest-build-provenance from 1.4.4 to 2.1.0
* update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+ ([#11153](containerd/containerd#11153))
  * [`eb2ce6882`](containerd/containerd@eb2ce68) update xx to v1.6.1 for compatibility with alpine 3.21 and file 5.46+
* ctr pull should unpack for default platform when transfer service is used ([#11139](containerd/containerd#11139))
  * [`44cdca68b`](containerd/containerd@44cdca6) ctr pull unpack for default platform using transfer service
* Fix apply IoOwner options when not in user namespace ([#11151](containerd/containerd#11151))
  * [`018d83650`](containerd/containerd@018d836) internal/cri: should not apply IoOwner options
* Update go-cni for CNI STATUS ([#11146](containerd/containerd#11146))
  * [`5eb7995a9`](containerd/containerd@5eb7995) feat: update go-cni version for CNI STATUS
* Fix cri grpc plugin config migration ([#11140](containerd/containerd#11140))
  * [`a2302ea89`](containerd/containerd@a2302ea) Add integration test for custom configuration
  * [`be5eda069`](containerd/containerd@be5eda0) complete cri grpc config migration
* Update runc binary to v1.2.3 ([#11142](containerd/containerd#11142))
  * [`a53eff53d`](containerd/containerd@a53eff5) update runc binary to v1.2.3
* Update differ to handle zstd media types ([#11068](containerd/containerd#11068))
  * [`73f57acb0`](containerd/containerd@73f57ac) Update differ to handle zstd media types
* update to go1.23.4 / go1.22.10 ([#11109](containerd/containerd#11109))
  * [`290e8bc70`](containerd/containerd@290e8bc) update to go1.23.4 / go1.22.10
* CI: update Fedora to 41 ([#11110](containerd/containerd#11110))
  * [`62b790bfa`](containerd/containerd@62b790b) CI: update Fedora to 41
* Fix panic due to nil dereference cgroups v2 ([#11098](containerd/containerd#11098))
  * [`3ba2df924`](containerd/containerd@3ba2df9) fix panic due to nil dereference cgroups v2
* Publish attestation as release artifact ([#11067](containerd/containerd#11067))
  * [`34a45cab2`](containerd/containerd@34a45ca) Publish attestation as release artifact
* Move rockylinux 9.4 to almalinux/9 in CI ([#11053](containerd/containerd#11053))
  * [`7dec6b460`](containerd/containerd@7dec6b4) move rocky 9.4 to almalinux/9 in CI
* *: should align pipe's owner with init process ([#11035](containerd/containerd#11035))
  * [`cf07f28ee`](containerd/containerd@cf07f28) *: should align pipe's owner with init process
* fix: set the credentials even if not provided ([#11031](containerd/containerd#11031))
  * [`986088866`](containerd/containerd@9860888) fix: set the credentials even if not provided
* fsverity_test.go: fix nil pointer derefence, fix test fail, fix minor/major device numbers resolving ([#10978](containerd/containerd#10978))
  * [`30b929ece`](containerd/containerd@30b929e) fsverity_test.go: fix major/minor device number resolving
  * [`10996a334`](containerd/containerd@10996a3) fsverity_test.go: fix nil pointer dereference, fix test fail
* update runc binary to 1.2.2 ([#11023](containerd/containerd#11023))
  * [`9081e979f`](containerd/containerd@9081e97) update runc binary to 1.2.2
* Revert "Disable vagrant strict dependency checking" ([#11009](containerd/containerd#11009))
  * [`6399c936f`](containerd/containerd@6399c93) Revert "Disable vagrant strict dependency checking"
* fsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems ([#11005](containerd/containerd#11005))
  * [`a7f2b562f`](containerd/containerd@a7f2b56) fsverity_linux.go: Fix fsverity.IsEnabled() for big endian systems
* bump github.com/containerd/typeurl/v2 from 2.2.2 to 2.2.3 ([#10997](containerd/containerd#10997))
  * [`389e781ea`](containerd/containerd@389e781) build(deps): bump github.com/containerd/typeurl/v2 from 2.2.2 to 2.2.3
* update to go1.23.3 / go1.22.9 ([#10973](containerd/containerd#10973))
  * [`5b879f30c`](containerd/containerd@5b879f3) update to go1.23.3 / go1.22.9
* ci: enable marking 2.0 releases as latest ([#10963](containerd/containerd#10963))
  * [`458215f6c`](containerd/containerd@458215f) ci: enable marking 2.0 releases as latest
* Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz ([#10968](containerd/containerd#10968))
  * [`e99c2b55c`](containerd/containerd@e99c2b5) Avoid arch info in the sed/replace when building cri-cni-containerd.tar.gz
</p>
</details>
<details><summary>7 commits</summary>
<p>

* Support CNI STATUS Verb ([containerd/go-cni#123](containerd/go-cni#123))
  * [`208eca9`](containerd/go-cni@208eca9) support CNI status verb
* Bump github actions dependencies to match containerd CI repo and fix lint ([containerd/go-cni#122](containerd/go-cni#122))
  * [`386f475`](containerd/go-cni@386f475) Fix ci.yml indent
  * [`a9b0675`](containerd/go-cni@a9b0675) Another doc commit to trigger lint?
  * [`14af454`](containerd/go-cni@14af454) Bump github actions dependency versions
  * [`9e0d096`](containerd/go-cni@9e0d096) Trivial doc commit to trigger lint
</p>
</details>

* **github.com/containerd/go-cni**      v1.1.10 -> v1.1.11
* **github.com/containerd/typeurl/v2**  v2.2.2 -> v2.2.3

Previous release can be found at [v2.0.0](https://github.com/containerd/containerd/releases/tag/v2.0.0)
* `containerd-<VERSION>-<OS>-<ARCH>.tar.gz`:         ✅Recommended. Dynamically linked with glibc 2.31 (Ubuntu 20.04).
* `containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz`:  Statically linked. Expected to be used on non-glibc Linux distributions. Not position-independent.

In addition to containerd, typically you will have to install [runc](https://github.com/opencontainers/runc/releases)
and [CNI plugins](https://github.com/containernetworking/plugins/releases) from their official sites too.

See also the [Getting Started](https://github.com/containerd/containerd/blob/main/docs/getting-started.md) documentation.