diff --git a/hack/versions b/hack/versions
index 70803338e..b51661f81 100644
--- a/hack/versions
+++ b/hack/versions
@@ -1,5 +1,5 @@
 RUNC_VERSION=74a17296470088de3805e138d3d87c62e613dfc4
 CNI_VERSION=v0.6.0
-CONTAINERD_VERSION=4af5f657526a8aa5eedef734f5f29152031b1d3a
+CONTAINERD_VERSION=70e0c8443ff15dcbd2ad8e0d07ed087fc2a83e05
 CRITOOL_VERSION=4cd2b047a26a2ef01bbd02ee55f7d70d8825ebb5
 KUBERNETES_VERSION=164317879bcd810b97e5ebf1c8df041770f2ff1b
diff --git a/vendor.conf b/vendor.conf
index e1a69e522..bb35968b5 100644
--- a/vendor.conf
+++ b/vendor.conf
@@ -2,7 +2,7 @@ github.com/blang/semver v3.1.0
 github.com/boltdb/bolt e9cf4fae01b5a8ff89d0ec6b32f0d9c9f79aefdd
 github.com/BurntSushi/toml a368813c5e648fee92e5f6c30e3944ff9d5e8895
 github.com/containerd/cgroups f7dd103d3e4e696aa67152f6b4ddd1779a3455a9
-github.com/containerd/containerd 4af5f657526a8aa5eedef734f5f29152031b1d3a
+github.com/containerd/containerd 70e0c8443ff15dcbd2ad8e0d07ed087fc2a83e05
 github.com/containerd/continuity cf279e6ac893682272b4479d4c67fd3abf878b4e
 github.com/containerd/fifo fbfb6a11ec671efbe94ad1c12c2e98773f19e1e6
 github.com/containerd/typeurl f6943554a7e7e88b3c14aad190bf05932da84788
diff --git a/vendor/github.com/containerd/containerd/client.go b/vendor/github.com/containerd/containerd/client.go
index 6c5814425..f340e9509 100644
--- a/vendor/github.com/containerd/containerd/client.go
+++ b/vendor/github.com/containerd/containerd/client.go
@@ -133,7 +133,7 @@ func (c *Client) Containers(ctx context.Context, filters ...string) ([]Container
 // NewContainer will create a new container in container with the provided id
 // the id must be unique within the namespace
 func (c *Client) NewContainer(ctx context.Context, id string, opts ...NewContainerOpts) (Container, error) {
-	ctx, done, err := c.withLease(ctx)
+	ctx, done, err := c.WithLease(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -214,7 +214,7 @@ func (c *Client) Pull(ctx context.Context, ref string, opts ...RemoteOpt) (Image
 	}
 	store := c.ContentStore()
 
-	ctx, done, err := c.withLease(ctx)
+	ctx, done, err := c.WithLease(ctx)
 	if err != nil {
 		return nil, err
 	}
@@ -587,7 +587,7 @@ func (c *Client) Import(ctx context.Context, ref string, reader io.Reader, opts
 		return nil, err
 	}
 
-	ctx, done, err := c.withLease(ctx)
+	ctx, done, err := c.WithLease(ctx)
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/github.com/containerd/containerd/image.go b/vendor/github.com/containerd/containerd/image.go
index 4f978e2ea..8eaf3d264 100644
--- a/vendor/github.com/containerd/containerd/image.go
+++ b/vendor/github.com/containerd/containerd/image.go
@@ -86,6 +86,12 @@ func (i *image) IsUnpacked(ctx context.Context, snapshotterName string) (bool, e
 }
 
 func (i *image) Unpack(ctx context.Context, snapshotterName string) error {
+	ctx, done, err := i.client.WithLease(ctx)
+	if err != nil {
+		return err
+	}
+	defer done()
+
 	layers, err := i.getLayers(ctx, platforms.Default())
 	if err != nil {
 		return err
diff --git a/vendor/github.com/containerd/containerd/lease.go b/vendor/github.com/containerd/containerd/lease.go
index 6ecc58dec..8eb3bc0fe 100644
--- a/vendor/github.com/containerd/containerd/lease.go
+++ b/vendor/github.com/containerd/containerd/lease.go
@@ -51,7 +51,8 @@ func (c *Client) ListLeases(ctx context.Context) ([]Lease, error) {
 	return leases, nil
 }
 
-func (c *Client) withLease(ctx context.Context) (context.Context, func() error, error) {
+// WithLease attaches a lease on the context
+func (c *Client) WithLease(ctx context.Context) (context.Context, func() error, error) {
 	_, ok := leases.Lease(ctx)
 	if ok {
 		return ctx, func() error {
diff --git a/vendor/github.com/containerd/containerd/task.go b/vendor/github.com/containerd/containerd/task.go
index c69579764..2cbcbaff1 100644
--- a/vendor/github.com/containerd/containerd/task.go
+++ b/vendor/github.com/containerd/containerd/task.go
@@ -356,7 +356,7 @@ func (t *task) Resize(ctx context.Context, w, h uint32) error {
 }
 
 func (t *task) Checkpoint(ctx context.Context, opts ...CheckpointTaskOpts) (Image, error) {
-	ctx, done, err := t.client.withLease(ctx)
+	ctx, done, err := t.client.WithLease(ctx)
 	if err != nil {
 		return nil, err
 	}