Update containerd to 1.6.21

[gillarda]

What I'd like:

I'd like to update container to 1.6.21 which is built against Go 1.19.9, which itself contains fixes for several CVE.

[yeazelm]

Thanks for cutting this issue @gillarda! We aim to update these packages often and will bump to containerd 1.6.21 at some point but we did have some issues with runc versions and are watching Kubernetes upstream (#3165) to ensure we are in lockstep since getting out of sync caused some difficulties recently.

Nonetheless, we build with our SDK which has a newer version of Go than 1.19.9 (bottlerocket-os/bottlerocket-sdk@99aba43) so I don't believe the concern around CVE's holds in this specific case.

[gillarda]

Thank you a lot for your answer @yeazelm !

I was able to confirm that Bottlerocket versions >=1.13.5 and >=1.14.0 were not affected by these CVE (CVE-2023-24538 and CVE-2023-24540).

[arnaldo2792]

We are now in containerd 1.6.23, and the upcoming 1.15 release will include this version.