diff --git a/client/container.go b/client/container.go
index 2730f749d..b9cf25e93 100644
--- a/client/container.go
+++ b/client/container.go
@@ -28,17 +28,19 @@ import (
 	"github.com/containerd/containerd/api/types"
 	"github.com/containerd/containerd/api/types/runc/options"
 	tasktypes "github.com/containerd/containerd/api/types/task"
-	"github.com/containerd/containerd/v2/core/containers"
-	"github.com/containerd/containerd/v2/core/images"
-	"github.com/containerd/containerd/v2/pkg/cio"
-	"github.com/containerd/containerd/v2/pkg/oci"
-	"github.com/containerd/containerd/v2/pkg/tracing"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/fifo"
 	"github.com/containerd/typeurl/v2"
 	ver "github.com/opencontainers/image-spec/specs-go"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"github.com/opencontainers/selinux/go-selinux/label"
+
+	"github.com/containerd/containerd/v2/core/containers"
+	"github.com/containerd/containerd/v2/core/images"
+	"github.com/containerd/containerd/v2/pkg/cio"
+	"github.com/containerd/containerd/v2/pkg/oci"
+	"github.com/containerd/containerd/v2/pkg/tracing"
 )
 
 const (
@@ -317,7 +319,7 @@ func (c *container) NewTask(ctx context.Context, ioCreate cio.Creator, opts ...N
 	)
 	response, err := c.client.TaskService().Create(ctx, request)
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	span.AddEvent("task created",
@@ -341,7 +343,7 @@ func (c *container) Update(ctx context.Context, opts ...UpdateContainerOpts) err
 		}
 	}
 	if _, err := c.client.ContainerService().Update(ctx, r); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -387,7 +389,7 @@ func (c *container) Checkpoint(ctx context.Context, ref string, opts ...Checkpoi
 	// process remaining opts
 	for _, o := range opts {
 		if err := o(ctx, c.client, &info, index, copts); err != nil {
-			err = errdefs.FromGRPC(err)
+			err = errgrpc.ToNative(err)
 			if !errdefs.IsAlreadyExists(err) {
 				return nil, err
 			}
@@ -415,7 +417,7 @@ func (c *container) loadTask(ctx context.Context, ioAttach cio.Attach) (Task, er
 		ContainerID: c.id,
 	})
 	if err != nil {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 		if errdefs.IsNotFound(err) {
 			return nil, fmt.Errorf("no running task found: %w", err)
 		}
diff --git a/client/containerstore.go b/client/containerstore.go
index 0d5661422..a908737c9 100644
--- a/client/containerstore.go
+++ b/client/containerstore.go
@@ -22,13 +22,14 @@ import (
 	"io"
 
 	containersapi "github.com/containerd/containerd/api/services/containers/v1"
-	"github.com/containerd/containerd/v2/core/containers"
-	"github.com/containerd/containerd/v2/pkg/protobuf"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	"github.com/containerd/containerd/v2/core/containers"
+	"github.com/containerd/containerd/v2/pkg/protobuf"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 )
 
 type remoteContainers struct {
@@ -49,7 +50,7 @@ func (r *remoteContainers) Get(ctx context.Context, id string) (containers.Conta
 		ID: id,
 	})
 	if err != nil {
-		return containers.Container{}, errdefs.FromGRPC(err)
+		return containers.Container{}, errgrpc.ToNative(err)
 	}
 
 	return containerFromProto(resp.Container), nil
@@ -71,7 +72,7 @@ func (r *remoteContainers) list(ctx context.Context, filters ...string) ([]conta
 		Filters: filters,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return containersFromProto(resp.Containers), nil
 }
@@ -83,7 +84,7 @@ func (r *remoteContainers) stream(ctx context.Context, filters ...string) ([]con
 		Filters: filters,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	var containers []containers.Container
 	for {
@@ -97,7 +98,7 @@ func (r *remoteContainers) stream(ctx context.Context, filters ...string) ([]con
 					return nil, errStreamNotAvailable
 				}
 			}
-			return nil, errdefs.FromGRPC(err)
+			return nil, errgrpc.ToNative(err)
 		}
 		select {
 		case <-ctx.Done():
@@ -113,7 +114,7 @@ func (r *remoteContainers) Create(ctx context.Context, container containers.Cont
 		Container: containerToProto(&container),
 	})
 	if err != nil {
-		return containers.Container{}, errdefs.FromGRPC(err)
+		return containers.Container{}, errgrpc.ToNative(err)
 	}
 
 	return containerFromProto(created.Container), nil
@@ -133,7 +134,7 @@ func (r *remoteContainers) Update(ctx context.Context, container containers.Cont
 		UpdateMask: updateMask,
 	})
 	if err != nil {
-		return containers.Container{}, errdefs.FromGRPC(err)
+		return containers.Container{}, errgrpc.ToNative(err)
 	}
 
 	return containerFromProto(updated.Container), nil
@@ -145,7 +146,7 @@ func (r *remoteContainers) Delete(ctx context.Context, id string) error {
 		ID: id,
 	})
 
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 
 }
 
diff --git a/client/events.go b/client/events.go
index afba8072b..3f6e252b3 100644
--- a/client/events.go
+++ b/client/events.go
@@ -21,10 +21,11 @@ import (
 
 	eventsapi "github.com/containerd/containerd/api/services/events/v1"
 	"github.com/containerd/containerd/api/types"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/typeurl/v2"
+
 	"github.com/containerd/containerd/v2/core/events"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/typeurl/v2"
 )
 
 // EventService handles the publish, forward and subscribe of events.
@@ -56,7 +57,7 @@ func (e *eventRemote) Publish(ctx context.Context, topic string, event events.Ev
 		Event: typeurl.MarshalProto(evt),
 	}
 	if _, err := e.client.Publish(ctx, req); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -71,7 +72,7 @@ func (e *eventRemote) Forward(ctx context.Context, envelope *events.Envelope) er
 		},
 	}
 	if _, err := e.client.Forward(ctx, req); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
diff --git a/client/image_store.go b/client/image_store.go
index 2c6a14567..c52e99ea1 100644
--- a/client/image_store.go
+++ b/client/image_store.go
@@ -20,13 +20,14 @@ import (
 	"context"
 
 	imagesapi "github.com/containerd/containerd/api/services/images/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
 	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/containerd/v2/pkg/epoch"
 	"github.com/containerd/containerd/v2/pkg/oci"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
-	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 type remoteImages struct {
@@ -45,7 +46,7 @@ func (s *remoteImages) Get(ctx context.Context, name string) (images.Image, erro
 		Name: name,
 	})
 	if err != nil {
-		return images.Image{}, errdefs.FromGRPC(err)
+		return images.Image{}, errgrpc.ToNative(err)
 	}
 
 	return imageFromProto(resp.Image), nil
@@ -56,7 +57,7 @@ func (s *remoteImages) List(ctx context.Context, filters ...string) ([]images.Im
 		Filters: filters,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	return imagesFromProto(resp.Images), nil
@@ -71,7 +72,7 @@ func (s *remoteImages) Create(ctx context.Context, image images.Image) (images.I
 	}
 	created, err := s.client.Create(ctx, req)
 	if err != nil {
-		return images.Image{}, errdefs.FromGRPC(err)
+		return images.Image{}, errgrpc.ToNative(err)
 	}
 
 	return imageFromProto(created.Image), nil
@@ -93,7 +94,7 @@ func (s *remoteImages) Update(ctx context.Context, image images.Image, fieldpath
 	}
 	updated, err := s.client.Update(ctx, req)
 	if err != nil {
-		return images.Image{}, errdefs.FromGRPC(err)
+		return images.Image{}, errgrpc.ToNative(err)
 	}
 
 	return imageFromProto(updated.Image), nil
@@ -114,7 +115,7 @@ func (s *remoteImages) Delete(ctx context.Context, name string, opts ...images.D
 		req.Target = oci.DescriptorToProto(*do.Target)
 	}
 	_, err := s.client.Delete(ctx, req)
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func imageToProto(image *images.Image) *imagesapi.Image {
diff --git a/client/namespaces.go b/client/namespaces.go
index 4a6116396..ca93e80f6 100644
--- a/client/namespaces.go
+++ b/client/namespaces.go
@@ -21,9 +21,10 @@ import (
 	"strings"
 
 	api "github.com/containerd/containerd/api/services/namespaces/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	"github.com/containerd/containerd/v2/pkg/namespaces"
 	"github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
 )
 
 // NewNamespaceStoreFromClient returns a new namespace store
@@ -45,7 +46,7 @@ func (r *remoteNamespaces) Create(ctx context.Context, namespace string, labels
 
 	_, err := r.client.Create(ctx, &req)
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
@@ -57,7 +58,7 @@ func (r *remoteNamespaces) Labels(ctx context.Context, namespace string) (map[st
 
 	resp, err := r.client.Get(ctx, &req)
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	return resp.Namespace.Labels, nil
@@ -77,7 +78,7 @@ func (r *remoteNamespaces) SetLabel(ctx context.Context, namespace, key, value s
 
 	_, err := r.client.Update(ctx, &req)
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
@@ -88,7 +89,7 @@ func (r *remoteNamespaces) List(ctx context.Context) ([]string, error) {
 
 	resp, err := r.client.List(ctx, &req)
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	var namespaces []string
@@ -114,7 +115,7 @@ func (r *remoteNamespaces) Delete(ctx context.Context, namespace string, opts ..
 	}
 	_, err := r.client.Delete(ctx, &req)
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
diff --git a/client/process.go b/client/process.go
index 59f1bbc9c..e451eaa7d 100644
--- a/client/process.go
+++ b/client/process.go
@@ -24,10 +24,12 @@ import (
 	"time"
 
 	"github.com/containerd/containerd/api/services/tasks/v1"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	"github.com/containerd/containerd/v2/pkg/cio"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
 	"github.com/containerd/containerd/v2/pkg/tracing"
-	"github.com/containerd/errdefs"
 )
 
 // Process represents a system process
@@ -134,7 +136,7 @@ func (p *process) Start(ctx context.Context) error {
 			p.io.Wait()
 			p.io.Close()
 		}
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	span.SetAttributes(tracing.Attribute("process.pid", int(r.Pid)))
 	p.pid = r.Pid
@@ -160,7 +162,7 @@ func (p *process) Kill(ctx context.Context, s syscall.Signal, opts ...KillOpts)
 		ExecID:      p.id,
 		All:         i.All,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (p *process) Wait(ctx context.Context) (<-chan ExitStatus, error) {
@@ -206,7 +208,7 @@ func (p *process) CloseIO(ctx context.Context, opts ...IOCloserOpts) error {
 	}
 	r.Stdin = i.Stdin
 	_, err := p.task.client.TaskService().CloseIO(ctx, r)
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (p *process) IO() cio.IO {
@@ -224,7 +226,7 @@ func (p *process) Resize(ctx context.Context, w, h uint32) error {
 		Height:      h,
 		ExecID:      p.id,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (p *process) Delete(ctx context.Context, opts ...ProcessDeleteOpts) (*ExitStatus, error) {
@@ -250,7 +252,7 @@ func (p *process) Delete(ctx context.Context, opts ...ProcessDeleteOpts) (*ExitS
 		ExecID:      p.id,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	if p.io != nil {
 		p.io.Cancel()
@@ -266,7 +268,7 @@ func (p *process) Status(ctx context.Context) (Status, error) {
 		ExecID:      p.id,
 	})
 	if err != nil {
-		return Status{}, errdefs.FromGRPC(err)
+		return Status{}, errgrpc.ToNative(err)
 	}
 	status := ProcessStatus(strings.ToLower(r.Process.Status.String()))
 	exitStatus := r.Process.ExitStatus
diff --git a/client/task.go b/client/task.go
index 0f6018dbb..20312a922 100644
--- a/client/task.go
+++ b/client/task.go
@@ -29,6 +29,14 @@ import (
 	"github.com/containerd/containerd/api/services/tasks/v1"
 	"github.com/containerd/containerd/api/types"
 	"github.com/containerd/containerd/api/types/runc/options"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/typeurl/v2"
+	digest "github.com/opencontainers/go-digest"
+	is "github.com/opencontainers/image-spec/specs-go"
+	v1 "github.com/opencontainers/image-spec/specs-go/v1"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+
 	"github.com/containerd/containerd/v2/core/content"
 	"github.com/containerd/containerd/v2/core/diff"
 	"github.com/containerd/containerd/v2/core/images"
@@ -40,12 +48,6 @@ import (
 	"github.com/containerd/containerd/v2/pkg/rootfs"
 	"github.com/containerd/containerd/v2/pkg/tracing"
 	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/typeurl/v2"
-	digest "github.com/opencontainers/go-digest"
-	is "github.com/opencontainers/image-spec/specs-go"
-	v1 "github.com/opencontainers/image-spec/specs-go/v1"
-	specs "github.com/opencontainers/runtime-spec/specs-go"
 )
 
 // UnknownExitStatus is returned when containerd is unable to
@@ -223,7 +225,7 @@ func (t *task) Start(ctx context.Context) error {
 			t.io.Cancel()
 			t.io.Close()
 		}
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	span.SetAttributes(tracing.Attribute("task.pid", r.Pid))
 	t.pid = r.Pid
@@ -254,7 +256,7 @@ func (t *task) Kill(ctx context.Context, s syscall.Signal, opts ...KillOpts) err
 		All:         i.All,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -267,7 +269,7 @@ func (t *task) Pause(ctx context.Context) error {
 	_, err := t.client.TaskService().Pause(ctx, &tasks.PauseTaskRequest{
 		ContainerID: t.id,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (t *task) Resume(ctx context.Context) error {
@@ -278,7 +280,7 @@ func (t *task) Resume(ctx context.Context) error {
 	_, err := t.client.TaskService().Resume(ctx, &tasks.ResumeTaskRequest{
 		ContainerID: t.id,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (t *task) Status(ctx context.Context) (Status, error) {
@@ -286,7 +288,7 @@ func (t *task) Status(ctx context.Context) (Status, error) {
 		ContainerID: t.id,
 	})
 	if err != nil {
-		return Status{}, errdefs.FromGRPC(err)
+		return Status{}, errgrpc.ToNative(err)
 	}
 	status := ProcessStatus(strings.ToLower(r.Process.Status.String()))
 	exitStatus := r.Process.ExitStatus
@@ -377,7 +379,7 @@ func (t *task) Delete(ctx context.Context, opts ...ProcessDeleteOpts) (*ExitStat
 		ContainerID: t.id,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	// Only cleanup the IO after a successful Delete
 	if t.io != nil {
@@ -423,7 +425,7 @@ func (t *task) Exec(ctx context.Context, id string, spec *specs.Process, ioCreat
 		i.Cancel()
 		i.Wait()
 		i.Close()
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return &process{
 		id:   id,
@@ -437,7 +439,7 @@ func (t *task) Pids(ctx context.Context) ([]ProcessInfo, error) {
 		ContainerID: t.id,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	var processList []ProcessInfo
 	for _, p := range response.Processes {
@@ -464,7 +466,7 @@ func (t *task) CloseIO(ctx context.Context, opts ...IOCloserOpts) error {
 	r.Stdin = i.Stdin
 
 	_, err := t.client.TaskService().CloseIO(ctx, r)
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (t *task) IO() cio.IO {
@@ -481,7 +483,7 @@ func (t *task) Resize(ctx context.Context, w, h uint32) error {
 		Width:       w,
 		Height:      h,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 // NOTE: Checkpoint supports to dump task information to a directory, in this way, an empty
@@ -613,7 +615,7 @@ func (t *task) Update(ctx context.Context, opts ...UpdateTaskOpts) error {
 		request.Annotations = i.Annotations
 	}
 	_, err := t.client.TaskService().Update(ctx, request)
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (t *task) LoadProcess(ctx context.Context, id string, ioAttach cio.Attach) (Process, error) {
@@ -625,7 +627,7 @@ func (t *task) LoadProcess(ctx context.Context, id string, ioAttach cio.Attach)
 		ExecID:      id,
 	})
 	if err != nil {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 		if errdefs.IsNotFound(err) {
 			return nil, fmt.Errorf("no running process found: %w", err)
 		}
@@ -651,7 +653,7 @@ func (t *task) Metrics(ctx context.Context) (*types.Metric, error) {
 		},
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	if response.Metrics == nil {
@@ -668,7 +670,7 @@ func (t *task) Metrics(ctx context.Context) (*types.Metric, error) {
 func (t *task) checkpointTask(ctx context.Context, index *v1.Index, request *tasks.CheckpointTaskRequest) error {
 	response, err := t.client.TaskService().Checkpoint(ctx, request)
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	// NOTE: response.Descriptors can be an empty slice if checkpoint image is jumped
 	// add the checkpoint descriptors to the index
diff --git a/cmd/containerd-shim-runc-v2/runc/container.go b/cmd/containerd-shim-runc-v2/runc/container.go
index d1d35684e..d5b4a1f80 100644
--- a/cmd/containerd-shim-runc-v2/runc/container.go
+++ b/cmd/containerd-shim-runc-v2/runc/container.go
@@ -32,13 +32,15 @@ import (
 	"github.com/containerd/console"
 	"github.com/containerd/containerd/api/runtime/task/v3"
 	"github.com/containerd/containerd/api/types/runc/options"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/log"
+	"github.com/containerd/typeurl/v2"
+
 	"github.com/containerd/containerd/v2/cmd/containerd-shim-runc-v2/process"
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/containerd/containerd/v2/pkg/namespaces"
 	"github.com/containerd/containerd/v2/pkg/stdio"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/log"
-	"github.com/containerd/typeurl/v2"
 )
 
 // NewContainer returns a new runc container
@@ -130,10 +132,10 @@ func NewContainer(ctx context.Context, platform stdio.Platform, r *task.CreateTa
 		rootfs,
 	)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	if err := p.Create(ctx, config); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	container := &Container{
 		ID:              r.ID,
diff --git a/cmd/containerd-shim-runc-v2/task/service.go b/cmd/containerd-shim-runc-v2/task/service.go
index 793b813b8..373b6881e 100644
--- a/cmd/containerd-shim-runc-v2/task/service.go
+++ b/cmd/containerd-shim-runc-v2/task/service.go
@@ -33,6 +33,13 @@ import (
 	taskAPI "github.com/containerd/containerd/api/runtime/task/v3"
 	"github.com/containerd/containerd/api/types/runc/options"
 	"github.com/containerd/containerd/api/types/task"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	runcC "github.com/containerd/go-runc"
+	"github.com/containerd/log"
+	"github.com/containerd/ttrpc"
+	"github.com/containerd/typeurl/v2"
+
 	"github.com/containerd/containerd/v2/cmd/containerd-shim-runc-v2/process"
 	"github.com/containerd/containerd/v2/cmd/containerd-shim-runc-v2/runc"
 	"github.com/containerd/containerd/v2/core/runtime"
@@ -46,11 +53,6 @@ import (
 	"github.com/containerd/containerd/v2/pkg/shutdown"
 	"github.com/containerd/containerd/v2/pkg/stdio"
 	"github.com/containerd/containerd/v2/pkg/sys/reaper"
-	"github.com/containerd/errdefs"
-	runcC "github.com/containerd/go-runc"
-	"github.com/containerd/log"
-	"github.com/containerd/ttrpc"
-	"github.com/containerd/typeurl/v2"
 )
 
 var (
@@ -279,7 +281,7 @@ func (s *service) Start(ctx context.Context, r *taskAPI.StartRequest) (*taskAPI.
 	} else {
 		if _, initExited := s.containerInitExit[container]; initExited {
 			s.lifecycleMu.Unlock()
-			return nil, errdefs.ToGRPCf(errdefs.ErrFailedPrecondition, "container %s init process is not running", container.ID)
+			return nil, errgrpc.ToGRPCf(errdefs.ErrFailedPrecondition, "container %s init process is not running", container.ID)
 		}
 		s.runningExecs[container]++
 	}
@@ -301,7 +303,7 @@ func (s *service) Start(ctx context.Context, r *taskAPI.StartRequest) (*taskAPI.
 			s.lifecycleMu.Unlock()
 		}
 		handleStarted(container, p)
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	switch r.ExecID {
@@ -354,7 +356,7 @@ func (s *service) Delete(ctx context.Context, r *taskAPI.DeleteRequest) (*taskAP
 	}
 	p, err := container.Delete(ctx, r)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	// if we deleted an init task, send the task delete event
 	if r.ExecID == "" {
@@ -383,12 +385,12 @@ func (s *service) Exec(ctx context.Context, r *taskAPI.ExecProcessRequest) (*pty
 	}
 	ok, cancel := container.ReserveProcess(r.ExecID)
 	if !ok {
-		return nil, errdefs.ToGRPCf(errdefs.ErrAlreadyExists, "id %s", r.ExecID)
+		return nil, errgrpc.ToGRPCf(errdefs.ErrAlreadyExists, "id %s", r.ExecID)
 	}
 	process, err := container.Exec(ctx, r)
 	if err != nil {
 		cancel()
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	s.send(&eventstypes.TaskExecAdded{
@@ -405,7 +407,7 @@ func (s *service) ResizePty(ctx context.Context, r *taskAPI.ResizePtyRequest) (*
 		return nil, err
 	}
 	if err := container.ResizePty(ctx, r); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -418,7 +420,7 @@ func (s *service) State(ctx context.Context, r *taskAPI.StateRequest) (*taskAPI.
 	}
 	p, err := container.Process(r.ExecID)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	st, err := p.Status(ctx)
 	if err != nil {
@@ -459,7 +461,7 @@ func (s *service) Pause(ctx context.Context, r *taskAPI.PauseRequest) (*ptypes.E
 		return nil, err
 	}
 	if err := container.Pause(ctx); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	s.send(&eventstypes.TaskPaused{
 		ContainerID: container.ID,
@@ -474,7 +476,7 @@ func (s *service) Resume(ctx context.Context, r *taskAPI.ResumeRequest) (*ptypes
 		return nil, err
 	}
 	if err := container.Resume(ctx); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	s.send(&eventstypes.TaskResumed{
 		ContainerID: container.ID,
@@ -489,7 +491,7 @@ func (s *service) Kill(ctx context.Context, r *taskAPI.KillRequest) (*ptypes.Emp
 		return nil, err
 	}
 	if err := container.Kill(ctx, r); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -502,7 +504,7 @@ func (s *service) Pids(ctx context.Context, r *taskAPI.PidsRequest) (*taskAPI.Pi
 	}
 	pids, err := s.getContainerPids(ctx, container)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	var processes []*task.ProcessInfo
 	for _, pid := range pids {
@@ -548,7 +550,7 @@ func (s *service) Checkpoint(ctx context.Context, r *taskAPI.CheckpointTaskReque
 		return nil, err
 	}
 	if err := container.Checkpoint(ctx, r); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -560,7 +562,7 @@ func (s *service) Update(ctx context.Context, r *taskAPI.UpdateTaskRequest) (*pt
 		return nil, err
 	}
 	if err := container.Update(ctx, r); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -573,7 +575,7 @@ func (s *service) Wait(ctx context.Context, r *taskAPI.WaitRequest) (*taskAPI.Wa
 	}
 	p, err := container.Process(r.ExecID)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	p.Wait()
 
@@ -618,7 +620,7 @@ func (s *service) Stats(ctx context.Context, r *taskAPI.StatsRequest) (*taskAPI.
 	}
 	cgx := container.Cgroup()
 	if cgx == nil {
-		return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "cgroup does not exist")
+		return nil, errgrpc.ToGRPCf(errdefs.ErrNotFound, "cgroup does not exist")
 	}
 	var statsx interface{}
 	switch cg := cgx.(type) {
@@ -635,7 +637,7 @@ func (s *service) Stats(ctx context.Context, r *taskAPI.StatsRequest) (*taskAPI.
 		}
 		statsx = stats
 	default:
-		return nil, errdefs.ToGRPCf(errdefs.ErrNotImplemented, "unsupported cgroup type %T", cg)
+		return nil, errgrpc.ToGRPCf(errdefs.ErrNotImplemented, "unsupported cgroup type %T", cg)
 	}
 	data, err := typeurl.MarshalAny(statsx)
 	if err != nil {
@@ -764,7 +766,7 @@ func (s *service) handleProcessExit(e runcC.Exit, c *runc.Container, p process.P
 func (s *service) getContainerPids(ctx context.Context, container *runc.Container) ([]uint32, error) {
 	p, err := container.Process("")
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	ps, err := p.(*process.Init).Runtime().Ps(ctx, container.ID)
 	if err != nil {
@@ -794,7 +796,7 @@ func (s *service) getContainer(id string) (*runc.Container, error) {
 	container := s.containers[id]
 	s.mu.Unlock()
 	if container == nil {
-		return nil, errdefs.ToGRPCf(errdefs.ErrNotFound, "container not created")
+		return nil, errgrpc.ToGRPCf(errdefs.ErrNotFound, "container not created")
 	}
 	return container, nil
 }
diff --git a/cmd/containerd/command/publish.go b/cmd/containerd/command/publish.go
index 9e9679e27..ddd60e7db 100644
--- a/cmd/containerd/command/publish.go
+++ b/cmd/containerd/command/publish.go
@@ -25,15 +25,17 @@ import (
 	"time"
 
 	eventsapi "github.com/containerd/containerd/api/services/events/v1"
-	"github.com/containerd/containerd/v2/pkg/dialer"
-	"github.com/containerd/containerd/v2/pkg/namespaces"
-	"github.com/containerd/containerd/v2/pkg/protobuf/proto"
-	"github.com/containerd/containerd/v2/pkg/protobuf/types"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/urfave/cli/v2"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/backoff"
 	"google.golang.org/grpc/credentials/insecure"
+
+	"github.com/containerd/containerd/v2/pkg/dialer"
+	"github.com/containerd/containerd/v2/pkg/namespaces"
+	"github.com/containerd/containerd/v2/pkg/protobuf/proto"
+	"github.com/containerd/containerd/v2/pkg/protobuf/types"
 )
 
 var publishCommand = &cli.Command{
@@ -67,7 +69,7 @@ var publishCommand = &cli.Command{
 			Topic: topic,
 			Event: payload,
 		}); err != nil {
-			return errdefs.FromGRPC(err)
+			return errgrpc.ToNative(err)
 		}
 		return nil
 	},
diff --git a/contrib/diffservice/service.go b/contrib/diffservice/service.go
index 61f388340..1868ce132 100644
--- a/contrib/diffservice/service.go
+++ b/contrib/diffservice/service.go
@@ -20,12 +20,14 @@ import (
 	"context"
 
 	diffapi "github.com/containerd/containerd/api/services/diff/v1"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/typeurl/v2"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+
 	"github.com/containerd/containerd/v2/core/diff"
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/containerd/containerd/v2/pkg/oci"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/typeurl/v2"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
 
 type service struct {
@@ -42,7 +44,7 @@ func FromApplierAndComparer(a diff.Applier, c diff.Comparer) diffapi.DiffServer
 }
 func (s *service) Apply(ctx context.Context, er *diffapi.ApplyRequest) (*diffapi.ApplyResponse, error) {
 	if s.applier == nil {
-		return nil, errdefs.ToGRPC(errdefs.ErrNotImplemented)
+		return nil, errgrpc.ToGRPC(errdefs.ErrNotImplemented)
 	}
 
 	var (
@@ -64,7 +66,7 @@ func (s *service) Apply(ctx context.Context, er *diffapi.ApplyRequest) (*diffapi
 
 	ocidesc, err = s.applier.Apply(ctx, desc, mounts, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &diffapi.ApplyResponse{
@@ -74,7 +76,7 @@ func (s *service) Apply(ctx context.Context, er *diffapi.ApplyRequest) (*diffapi
 
 func (s *service) Diff(ctx context.Context, dr *diffapi.DiffRequest) (*diffapi.DiffResponse, error) {
 	if s.comparer == nil {
-		return nil, errdefs.ToGRPC(errdefs.ErrNotImplemented)
+		return nil, errgrpc.ToGRPC(errdefs.ErrNotImplemented)
 	}
 	var (
 		ocidesc ocispec.Descriptor
@@ -100,7 +102,7 @@ func (s *service) Diff(ctx context.Context, dr *diffapi.DiffRequest) (*diffapi.D
 
 	ocidesc, err = s.comparer.Compare(ctx, aMounts, bMounts, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &diffapi.DiffResponse{
diff --git a/contrib/snapshotservice/service.go b/contrib/snapshotservice/service.go
index 6ae66bfdf..17bda7a63 100644
--- a/contrib/snapshotservice/service.go
+++ b/contrib/snapshotservice/service.go
@@ -20,11 +20,13 @@ import (
 	"context"
 
 	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/containerd/containerd/v2/core/snapshots"
 	"github.com/containerd/containerd/v2/core/snapshots/proxy"
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
 )
 
 var empty = &ptypes.Empty{}
@@ -46,7 +48,7 @@ func (s service) Prepare(ctx context.Context, pr *snapshotsapi.PrepareSnapshotRe
 	}
 	mounts, err := s.sn.Prepare(ctx, pr.Key, pr.Parent, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.PrepareSnapshotResponse{
@@ -61,7 +63,7 @@ func (s service) View(ctx context.Context, pr *snapshotsapi.ViewSnapshotRequest)
 	}
 	mounts, err := s.sn.View(ctx, pr.Key, pr.Parent, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &snapshotsapi.ViewSnapshotResponse{
 		Mounts: mount.ToProto(mounts),
@@ -71,7 +73,7 @@ func (s service) View(ctx context.Context, pr *snapshotsapi.ViewSnapshotRequest)
 func (s service) Mounts(ctx context.Context, mr *snapshotsapi.MountsRequest) (*snapshotsapi.MountsResponse, error) {
 	mounts, err := s.sn.Mounts(ctx, mr.Key)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &snapshotsapi.MountsResponse{
 		Mounts: mount.ToProto(mounts),
@@ -84,7 +86,7 @@ func (s service) Commit(ctx context.Context, cr *snapshotsapi.CommitSnapshotRequ
 		opts = append(opts, snapshots.WithLabels(cr.Labels))
 	}
 	if err := s.sn.Commit(ctx, cr.Name, cr.Key, opts...); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
@@ -92,7 +94,7 @@ func (s service) Commit(ctx context.Context, cr *snapshotsapi.CommitSnapshotRequ
 
 func (s service) Remove(ctx context.Context, rr *snapshotsapi.RemoveSnapshotRequest) (*ptypes.Empty, error) {
 	if err := s.sn.Remove(ctx, rr.Key); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
@@ -101,7 +103,7 @@ func (s service) Remove(ctx context.Context, rr *snapshotsapi.RemoveSnapshotRequ
 func (s service) Stat(ctx context.Context, sr *snapshotsapi.StatSnapshotRequest) (*snapshotsapi.StatSnapshotResponse, error) {
 	info, err := s.sn.Stat(ctx, sr.Key)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.StatSnapshotResponse{Info: proxy.InfoToProto(info)}, nil
@@ -110,7 +112,7 @@ func (s service) Stat(ctx context.Context, sr *snapshotsapi.StatSnapshotRequest)
 func (s service) Update(ctx context.Context, sr *snapshotsapi.UpdateSnapshotRequest) (*snapshotsapi.UpdateSnapshotResponse, error) {
 	info, err := s.sn.Update(ctx, proxy.InfoFromProto(sr.Info), sr.UpdateMask.GetPaths()...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.UpdateSnapshotResponse{Info: proxy.InfoToProto(info)}, nil
@@ -155,7 +157,7 @@ func (s service) List(sr *snapshotsapi.ListSnapshotsRequest, ss snapshotsapi.Sna
 func (s service) Usage(ctx context.Context, ur *snapshotsapi.UsageRequest) (*snapshotsapi.UsageResponse, error) {
 	usage, err := s.sn.Usage(ctx, ur.Key)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.UsageResponse{
@@ -167,11 +169,11 @@ func (s service) Usage(ctx context.Context, ur *snapshotsapi.UsageRequest) (*sna
 func (s service) Cleanup(ctx context.Context, cr *snapshotsapi.CleanupRequest) (*ptypes.Empty, error) {
 	c, ok := s.sn.(snapshots.Cleaner)
 	if !ok {
-		return nil, errdefs.ToGRPCf(errdefs.ErrNotImplemented, "snapshotter does not implement Cleanup method")
+		return nil, errgrpc.ToGRPCf(errdefs.ErrNotImplemented, "snapshotter does not implement Cleanup method")
 	}
 
 	if err := c.Cleanup(ctx); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
diff --git a/core/content/proxy/content_store.go b/core/content/proxy/content_store.go
index 2314b736d..1c1c1cfc8 100644
--- a/core/content/proxy/content_store.go
+++ b/core/content/proxy/content_store.go
@@ -22,15 +22,17 @@ import (
 	"io"
 
 	contentapi "github.com/containerd/containerd/api/services/content/v1"
-	"github.com/containerd/containerd/v2/core/content"
-	"github.com/containerd/containerd/v2/pkg/protobuf"
-	protobuftypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/ttrpc"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/containerd/containerd/v2/core/content"
+	"github.com/containerd/containerd/v2/pkg/protobuf"
+	protobuftypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 )
 
 type proxyContentStore struct {
@@ -69,7 +71,7 @@ func (pcs *proxyContentStore) Info(ctx context.Context, dgst digest.Digest) (con
 		Digest: dgst.String(),
 	})
 	if err != nil {
-		return content.Info{}, errdefs.FromGRPC(err)
+		return content.Info{}, errgrpc.ToNative(err)
 	}
 
 	return infoFromGRPC(resp.Info), nil
@@ -80,14 +82,14 @@ func (pcs *proxyContentStore) Walk(ctx context.Context, fn content.WalkFunc, fil
 		Filters: filters,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	for {
 		msg, err := session.Recv()
 		if err != nil {
 			if err != io.EOF {
-				return errdefs.FromGRPC(err)
+				return errgrpc.ToNative(err)
 			}
 
 			break
@@ -107,7 +109,7 @@ func (pcs *proxyContentStore) Delete(ctx context.Context, dgst digest.Digest) er
 	if _, err := pcs.client.Delete(ctx, &contentapi.DeleteContentRequest{
 		Digest: dgst.String(),
 	}); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
@@ -133,7 +135,7 @@ func (pcs *proxyContentStore) Status(ctx context.Context, ref string) (content.S
 		Ref: ref,
 	})
 	if err != nil {
-		return content.Status{}, errdefs.FromGRPC(err)
+		return content.Status{}, errgrpc.ToNative(err)
 	}
 
 	status := resp.Status
@@ -155,7 +157,7 @@ func (pcs *proxyContentStore) Update(ctx context.Context, info content.Info, fie
 		},
 	})
 	if err != nil {
-		return content.Info{}, errdefs.FromGRPC(err)
+		return content.Info{}, errgrpc.ToNative(err)
 	}
 	return infoFromGRPC(resp.Info), nil
 }
@@ -165,7 +167,7 @@ func (pcs *proxyContentStore) ListStatuses(ctx context.Context, filters ...strin
 		Filters: filters,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	var statuses []content.Status
@@ -193,7 +195,7 @@ func (pcs *proxyContentStore) Writer(ctx context.Context, opts ...content.Writer
 	}
 	wrclient, offset, err := pcs.negotiate(ctx, wOpts.Ref, wOpts.Desc.Size, wOpts.Desc.Digest)
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	return &remoteWriter{
@@ -208,7 +210,7 @@ func (pcs *proxyContentStore) Abort(ctx context.Context, ref string) error {
 	if _, err := pcs.client.Abort(ctx, &contentapi.AbortRequest{
 		Ref: ref,
 	}); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
diff --git a/core/content/proxy/content_writer.go b/core/content/proxy/content_writer.go
index 3387f12b7..214a0a335 100644
--- a/core/content/proxy/content_writer.go
+++ b/core/content/proxy/content_writer.go
@@ -22,10 +22,11 @@ import (
 	"io"
 
 	contentapi "github.com/containerd/containerd/api/services/content/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	digest "github.com/opencontainers/go-digest"
+
 	"github.com/containerd/containerd/v2/core/content"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
-	"github.com/containerd/errdefs"
-	digest "github.com/opencontainers/go-digest"
 )
 
 type remoteWriter struct {
@@ -58,7 +59,7 @@ func (rw *remoteWriter) Status() (content.Status, error) {
 		Action: contentapi.WriteAction_STAT,
 	})
 	if err != nil {
-		return content.Status{}, fmt.Errorf("error getting writer status: %w", errdefs.FromGRPC(err))
+		return content.Status{}, fmt.Errorf("error getting writer status: %w", errgrpc.ToNative(err))
 	}
 
 	return content.Status{
@@ -83,7 +84,7 @@ func (rw *remoteWriter) Write(p []byte) (n int, err error) {
 		Data:   p,
 	})
 	if err != nil {
-		return 0, fmt.Errorf("failed to send write: %w", errdefs.FromGRPC(err))
+		return 0, fmt.Errorf("failed to send write: %w", errgrpc.ToNative(err))
 	}
 
 	n = int(resp.Offset - offset)
@@ -120,7 +121,7 @@ func (rw *remoteWriter) Commit(ctx context.Context, size int64, expected digest.
 		Labels:   base.Labels,
 	})
 	if err != nil {
-		return fmt.Errorf("commit failed: %w", errdefs.FromGRPC(err))
+		return fmt.Errorf("commit failed: %w", errgrpc.ToNative(err))
 	}
 
 	if size != 0 && resp.Offset != size {
diff --git a/core/diff/proxy/differ.go b/core/diff/proxy/differ.go
index ceb631eda..8a5a4abd1 100644
--- a/core/diff/proxy/differ.go
+++ b/core/diff/proxy/differ.go
@@ -20,15 +20,16 @@ import (
 	"context"
 
 	diffapi "github.com/containerd/containerd/api/services/diff/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/typeurl/v2"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"google.golang.org/protobuf/types/known/timestamppb"
+
 	"github.com/containerd/containerd/v2/core/diff"
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/containerd/containerd/v2/pkg/epoch"
 	"github.com/containerd/containerd/v2/pkg/oci"
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/typeurl/v2"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"google.golang.org/protobuf/types/known/timestamppb"
 )
 
 // NewDiffApplier returns a new comparer and applier which communicates
@@ -64,7 +65,7 @@ func (r *diffRemote) Apply(ctx context.Context, desc ocispec.Descriptor, mounts
 	}
 	resp, err := r.client.Apply(ctx, req)
 	if err != nil {
-		return ocispec.Descriptor{}, errdefs.FromGRPC(err)
+		return ocispec.Descriptor{}, errgrpc.ToNative(err)
 	}
 	return oci.DescriptorFromProto(resp.Applied), nil
 }
@@ -93,7 +94,7 @@ func (r *diffRemote) Compare(ctx context.Context, a, b []mount.Mount, opts ...di
 	}
 	resp, err := r.client.Diff(ctx, req)
 	if err != nil {
-		return ocispec.Descriptor{}, errdefs.FromGRPC(err)
+		return ocispec.Descriptor{}, errgrpc.ToNative(err)
 	}
 	return oci.DescriptorFromProto(resp.Diff), nil
 }
diff --git a/core/events/proxy/remote_events.go b/core/events/proxy/remote_events.go
index eb8a01271..db989230d 100644
--- a/core/events/proxy/remote_events.go
+++ b/core/events/proxy/remote_events.go
@@ -22,12 +22,14 @@ import (
 
 	api "github.com/containerd/containerd/api/services/events/v1"
 	"github.com/containerd/containerd/api/types"
-	"github.com/containerd/containerd/v2/core/events"
-	"github.com/containerd/containerd/v2/pkg/protobuf"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/ttrpc"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc"
+
+	"github.com/containerd/containerd/v2/core/events"
+	"github.com/containerd/containerd/v2/pkg/protobuf"
 )
 
 type EventService interface {
@@ -73,7 +75,7 @@ func (p *grpcEventsProxy) Publish(ctx context.Context, topic string, event event
 		Event: typeurl.MarshalProto(evt),
 	}
 	if _, err := p.client.Publish(ctx, req); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -88,7 +90,7 @@ func (p *grpcEventsProxy) Forward(ctx context.Context, envelope *events.Envelope
 		},
 	}
 	if _, err := p.client.Forward(ctx, req); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -154,7 +156,7 @@ func (p *ttrpcEventsProxy) Publish(ctx context.Context, topic string, event even
 		Event: typeurl.MarshalProto(evt),
 	}
 	if _, err := p.client.Publish(ctx, req); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -169,7 +171,7 @@ func (p *ttrpcEventsProxy) Forward(ctx context.Context, envelope *events.Envelop
 		},
 	}
 	if _, err := p.client.Forward(ctx, req); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
diff --git a/core/introspection/proxy/remote.go b/core/introspection/proxy/remote.go
index ad26c6cb6..9e9b9b5d4 100644
--- a/core/introspection/proxy/remote.go
+++ b/core/introspection/proxy/remote.go
@@ -21,14 +21,16 @@ import (
 	"fmt"
 
 	api "github.com/containerd/containerd/api/services/introspection/v1"
-	"github.com/containerd/containerd/v2/core/introspection"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	"github.com/containerd/ttrpc"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc"
 	"google.golang.org/protobuf/types/known/anypb"
 	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/containerd/containerd/v2/core/introspection"
 )
 
 var _ = (introspection.Service)(&introspectionRemote{})
@@ -60,7 +62,7 @@ func (i *introspectionRemote) Plugins(ctx context.Context, filters ...string) (*
 	})
 
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	return resp, nil
@@ -70,7 +72,7 @@ func (i *introspectionRemote) Server(ctx context.Context) (*api.ServerResponse,
 	resp, err := i.client.Server(ctx, &emptypb.Empty{})
 
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	return resp, nil
@@ -90,7 +92,7 @@ func (i *introspectionRemote) PluginInfo(ctx context.Context, pluginType, id str
 		Options: optionsPB,
 	})
 
-	return resp, errdefs.FromGRPC(err)
+	return resp, errgrpc.ToNative(err)
 }
 
 type convertIntrospection struct {
diff --git a/core/leases/proxy/manager.go b/core/leases/proxy/manager.go
index d85a4b4ad..1b5da798f 100644
--- a/core/leases/proxy/manager.go
+++ b/core/leases/proxy/manager.go
@@ -20,9 +20,10 @@ import (
 	"context"
 
 	leasesapi "github.com/containerd/containerd/api/services/leases/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	"github.com/containerd/containerd/v2/core/leases"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
-	"github.com/containerd/errdefs"
 )
 
 type proxyManager struct {
@@ -49,7 +50,7 @@ func (pm *proxyManager) Create(ctx context.Context, opts ...leases.Opt) (leases.
 		Labels: l.Labels,
 	})
 	if err != nil {
-		return leases.Lease{}, errdefs.FromGRPC(err)
+		return leases.Lease{}, errgrpc.ToNative(err)
 	}
 
 	return leases.Lease{
@@ -71,7 +72,7 @@ func (pm *proxyManager) Delete(ctx context.Context, l leases.Lease, opts ...leas
 		ID:   l.ID,
 		Sync: do.Synchronous,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (pm *proxyManager) List(ctx context.Context, filters ...string) ([]leases.Lease, error) {
@@ -79,7 +80,7 @@ func (pm *proxyManager) List(ctx context.Context, filters ...string) ([]leases.L
 		Filters: filters,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	l := make([]leases.Lease, len(resp.Leases))
 	for i := range resp.Leases {
@@ -101,7 +102,7 @@ func (pm *proxyManager) AddResource(ctx context.Context, lease leases.Lease, r l
 			Type: r.Type,
 		},
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (pm *proxyManager) DeleteResource(ctx context.Context, lease leases.Lease, r leases.Resource) error {
@@ -112,7 +113,7 @@ func (pm *proxyManager) DeleteResource(ctx context.Context, lease leases.Lease,
 			Type: r.Type,
 		},
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (pm *proxyManager) ListResources(ctx context.Context, lease leases.Lease) ([]leases.Resource, error) {
@@ -120,7 +121,7 @@ func (pm *proxyManager) ListResources(ctx context.Context, lease leases.Lease) (
 		ID: lease.ID,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	rs := make([]leases.Resource, 0, len(resp.Resources))
diff --git a/core/runtime/v2/process.go b/core/runtime/v2/process.go
index f4eef4673..bf3afc085 100644
--- a/core/runtime/v2/process.go
+++ b/core/runtime/v2/process.go
@@ -22,10 +22,12 @@ import (
 
 	task "github.com/containerd/containerd/api/runtime/task/v3"
 	tasktypes "github.com/containerd/containerd/api/types/task"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/ttrpc"
+
 	"github.com/containerd/containerd/v2/core/runtime"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/ttrpc"
 )
 
 type process struct {
@@ -44,7 +46,7 @@ func (p *process) Kill(ctx context.Context, signal uint32, _ bool) error {
 		ExecID: p.id,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -73,7 +75,7 @@ func (p *process) State(ctx context.Context) (runtime.State, error) {
 	})
 	if err != nil {
 		if !errors.Is(err, ttrpc.ErrClosed) {
-			return runtime.State{}, errdefs.FromGRPC(err)
+			return runtime.State{}, errgrpc.ToNative(err)
 		}
 		return runtime.State{}, errdefs.ErrNotFound
 	}
@@ -98,7 +100,7 @@ func (p *process) ResizePty(ctx context.Context, size runtime.ConsoleSize) error
 		Height: size.Height,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -111,7 +113,7 @@ func (p *process) CloseIO(ctx context.Context) error {
 		Stdin:  true,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -123,7 +125,7 @@ func (p *process) Start(ctx context.Context) error {
 		ExecID: p.id,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -135,7 +137,7 @@ func (p *process) Wait(ctx context.Context) (*runtime.Exit, error) {
 		ExecID: p.id,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return &runtime.Exit{
 		Timestamp: protobuf.FromTimestamp(response.ExitedAt),
@@ -149,7 +151,7 @@ func (p *process) Delete(ctx context.Context) (*runtime.Exit, error) {
 		ExecID: p.id,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return &runtime.Exit{
 		Status:    response.ExitStatus,
diff --git a/core/runtime/v2/shim.go b/core/runtime/v2/shim.go
index ad10b1b24..db7307bc0 100644
--- a/core/runtime/v2/shim.go
+++ b/core/runtime/v2/shim.go
@@ -36,6 +36,13 @@ import (
 	eventstypes "github.com/containerd/containerd/api/events"
 	task "github.com/containerd/containerd/api/runtime/task/v3"
 	"github.com/containerd/containerd/api/types"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/log"
+	"github.com/containerd/otelttrpc"
+	"github.com/containerd/ttrpc"
+	"github.com/containerd/typeurl/v2"
+
 	"github.com/containerd/containerd/v2/core/events/exchange"
 	"github.com/containerd/containerd/v2/core/runtime"
 	"github.com/containerd/containerd/v2/pkg/atomicfile"
@@ -45,11 +52,6 @@ import (
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 	client "github.com/containerd/containerd/v2/pkg/shim"
 	"github.com/containerd/containerd/v2/pkg/timeout"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/log"
-	"github.com/containerd/otelttrpc"
-	"github.com/containerd/ttrpc"
-	"github.com/containerd/typeurl/v2"
 )
 
 const (
@@ -467,7 +469,7 @@ func (s *shimTask) Shutdown(ctx context.Context) error {
 		ID: s.ID(),
 	})
 	if err != nil && !errors.Is(err, ttrpc.ErrClosed) {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -484,7 +486,7 @@ func (s *shimTask) PID(ctx context.Context) (uint32, error) {
 		ID: s.ID(),
 	})
 	if err != nil {
-		return 0, errdefs.FromGRPC(err)
+		return 0, errgrpc.ToNative(err)
 	}
 
 	return response.TaskPid, nil
@@ -497,7 +499,7 @@ func (s *shimTask) delete(ctx context.Context, sandboxed bool, removeTask func(c
 	if shimErr != nil {
 		log.G(ctx).WithField("id", s.ID()).WithError(shimErr).Debug("failed to delete task")
 		if !errors.Is(shimErr, ttrpc.ErrClosed) {
-			shimErr = errdefs.FromGRPC(shimErr)
+			shimErr = errgrpc.ToNative(shimErr)
 			if !errdefs.IsNotFound(shimErr) {
 				return nil, shimErr
 			}
@@ -581,7 +583,7 @@ func (s *shimTask) Create(ctx context.Context, opts runtime.CreateOpts) (runtime
 
 	_, err := s.task.Create(ctx, request)
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	return s, nil
@@ -591,7 +593,7 @@ func (s *shimTask) Pause(ctx context.Context) error {
 	if _, err := s.task.Pause(ctx, &task.PauseRequest{
 		ID: s.ID(),
 	}); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -600,7 +602,7 @@ func (s *shimTask) Resume(ctx context.Context) error {
 	if _, err := s.task.Resume(ctx, &task.ResumeRequest{
 		ID: s.ID(),
 	}); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -610,7 +612,7 @@ func (s *shimTask) Start(ctx context.Context) error {
 		ID: s.ID(),
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -621,7 +623,7 @@ func (s *shimTask) Kill(ctx context.Context, signal uint32, all bool) error {
 		Signal: signal,
 		All:    all,
 	}); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -640,7 +642,7 @@ func (s *shimTask) Exec(ctx context.Context, id string, opts runtime.ExecOpts) (
 		Spec:     opts.Spec,
 	}
 	if _, err := s.task.Exec(ctx, request); err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return &process{
 		id:   id,
@@ -653,7 +655,7 @@ func (s *shimTask) Pids(ctx context.Context) ([]runtime.ProcessInfo, error) {
 		ID: s.ID(),
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	var processList []runtime.ProcessInfo
 	for _, p := range resp.Processes {
@@ -672,7 +674,7 @@ func (s *shimTask) ResizePty(ctx context.Context, size runtime.ConsoleSize) erro
 		Height: size.Height,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -683,7 +685,7 @@ func (s *shimTask) CloseIO(ctx context.Context) error {
 		Stdin: true,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -697,7 +699,7 @@ func (s *shimTask) Wait(ctx context.Context) (*runtime.Exit, error) {
 		ID: s.ID(),
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return &runtime.Exit{
 		Pid:       taskPid,
@@ -713,7 +715,7 @@ func (s *shimTask) Checkpoint(ctx context.Context, path string, options *ptypes.
 		Options: options,
 	}
 	if _, err := s.task.Checkpoint(ctx, request); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -724,7 +726,7 @@ func (s *shimTask) Update(ctx context.Context, resources *ptypes.Any, annotation
 		Resources:   resources,
 		Annotations: annotations,
 	}); err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
@@ -734,7 +736,7 @@ func (s *shimTask) Stats(ctx context.Context) (*ptypes.Any, error) {
 		ID: s.ID(),
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return response.Stats, nil
 }
@@ -756,7 +758,7 @@ func (s *shimTask) State(ctx context.Context) (runtime.State, error) {
 	})
 	if err != nil {
 		if !errors.Is(err, ttrpc.ErrClosed) {
-			return runtime.State{}, errdefs.FromGRPC(err)
+			return runtime.State{}, errgrpc.ToNative(err)
 		}
 		return runtime.State{}, errdefs.ErrNotFound
 	}
diff --git a/core/sandbox/proxy/controller.go b/core/sandbox/proxy/controller.go
index 782df814f..121785f61 100644
--- a/core/sandbox/proxy/controller.go
+++ b/core/sandbox/proxy/controller.go
@@ -22,11 +22,13 @@ import (
 
 	api "github.com/containerd/containerd/api/services/sandbox/v1"
 	"github.com/containerd/containerd/api/types"
-	"github.com/containerd/containerd/v2/core/mount"
-	"github.com/containerd/containerd/v2/core/sandbox"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/typeurl/v2"
 	imagespec "github.com/opencontainers/image-spec/specs-go/v1"
+
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/core/sandbox"
 )
 
 // remoteSandboxController is a low level GRPC client for containerd's sandbox controller service
@@ -58,7 +60,7 @@ func (s *remoteSandboxController) Create(ctx context.Context, sandboxInfo sandbo
 		Sandboxer:   s.sandboxerName,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
@@ -70,7 +72,7 @@ func (s *remoteSandboxController) Start(ctx context.Context, sandboxID string) (
 		Sandboxer: s.sandboxerName,
 	})
 	if err != nil {
-		return sandbox.ControllerInstance{}, errdefs.FromGRPC(err)
+		return sandbox.ControllerInstance{}, errgrpc.ToNative(err)
 	}
 
 	return sandbox.ControllerInstance{
@@ -89,7 +91,7 @@ func (s *remoteSandboxController) Platform(ctx context.Context, sandboxID string
 		Sandboxer: s.sandboxerName,
 	})
 	if err != nil {
-		return imagespec.Platform{}, errdefs.FromGRPC(err)
+		return imagespec.Platform{}, errgrpc.ToNative(err)
 	}
 
 	platform := resp.GetPlatform()
@@ -114,7 +116,7 @@ func (s *remoteSandboxController) Stop(ctx context.Context, sandboxID string, op
 	}
 	_, err := s.client.Stop(ctx, req)
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
@@ -126,7 +128,7 @@ func (s *remoteSandboxController) Shutdown(ctx context.Context, sandboxID string
 		Sandboxer: s.sandboxerName,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 
 	return nil
@@ -146,7 +148,7 @@ func (s *remoteSandboxController) Wait(ctx context.Context, sandboxID string) (s
 			Sandboxer: s.sandboxerName,
 		})
 		if err != nil {
-			grpcErr := errdefs.FromGRPC(err)
+			grpcErr := errgrpc.ToNative(err)
 			if !errdefs.IsUnavailable(grpcErr) {
 				return sandbox.ExitStatus{}, grpcErr
 			}
@@ -176,7 +178,7 @@ func (s *remoteSandboxController) Status(ctx context.Context, sandboxID string,
 		Sandboxer: s.sandboxerName,
 	})
 	if err != nil {
-		return sandbox.ControllerStatus{}, errdefs.FromGRPC(err)
+		return sandbox.ControllerStatus{}, errgrpc.ToNative(err)
 	}
 	return sandbox.ControllerStatus{
 		SandboxID: sandboxID,
@@ -197,7 +199,7 @@ func (s *remoteSandboxController) Metrics(ctx context.Context, sandboxID string)
 		Sandboxer: s.sandboxerName,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return resp.Metrics, nil
 }
@@ -214,7 +216,7 @@ func (s *remoteSandboxController) Update(
 		Fields:    fields,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	return nil
 }
diff --git a/core/sandbox/proxy/store.go b/core/sandbox/proxy/store.go
index a97ce6d67..09fdce108 100644
--- a/core/sandbox/proxy/store.go
+++ b/core/sandbox/proxy/store.go
@@ -20,8 +20,9 @@ import (
 	"context"
 
 	api "github.com/containerd/containerd/api/services/sandbox/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	sb "github.com/containerd/containerd/v2/core/sandbox"
-	"github.com/containerd/errdefs"
 )
 
 // remoteSandboxStore is a low-level containerd client to manage sandbox environments metadata
@@ -41,7 +42,7 @@ func (s *remoteSandboxStore) Create(ctx context.Context, sandbox sb.Sandbox) (sb
 		Sandbox: sb.ToProto(&sandbox),
 	})
 	if err != nil {
-		return sb.Sandbox{}, errdefs.FromGRPC(err)
+		return sb.Sandbox{}, errgrpc.ToNative(err)
 	}
 
 	return sb.FromProto(resp.Sandbox), nil
@@ -53,7 +54,7 @@ func (s *remoteSandboxStore) Update(ctx context.Context, sandbox sb.Sandbox, fie
 		Fields:  fieldpaths,
 	})
 	if err != nil {
-		return sb.Sandbox{}, errdefs.FromGRPC(err)
+		return sb.Sandbox{}, errgrpc.ToNative(err)
 	}
 
 	return sb.FromProto(resp.Sandbox), nil
@@ -64,7 +65,7 @@ func (s *remoteSandboxStore) Get(ctx context.Context, id string) (sb.Sandbox, er
 		SandboxID: id,
 	})
 	if err != nil {
-		return sb.Sandbox{}, errdefs.FromGRPC(err)
+		return sb.Sandbox{}, errgrpc.ToNative(err)
 	}
 
 	return sb.FromProto(resp.Sandbox), nil
@@ -75,7 +76,7 @@ func (s *remoteSandboxStore) List(ctx context.Context, filters ...string) ([]sb.
 		Filters: filters,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 
 	out := make([]sb.Sandbox, len(resp.List))
@@ -91,5 +92,5 @@ func (s *remoteSandboxStore) Delete(ctx context.Context, id string) error {
 		SandboxID: id,
 	})
 
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
diff --git a/core/snapshots/proxy/proxy.go b/core/snapshots/proxy/proxy.go
index f2c1ba3e4..3e4aef983 100644
--- a/core/snapshots/proxy/proxy.go
+++ b/core/snapshots/proxy/proxy.go
@@ -21,10 +21,11 @@ import (
 	"io"
 
 	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/containerd/containerd/v2/core/snapshots"
 	protobuftypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
 )
 
 // NewSnapshotter returns a new Snapshotter which communicates over a GRPC
@@ -48,7 +49,7 @@ func (p *proxySnapshotter) Stat(ctx context.Context, key string) (snapshots.Info
 			Key:         key,
 		})
 	if err != nil {
-		return snapshots.Info{}, errdefs.FromGRPC(err)
+		return snapshots.Info{}, errgrpc.ToNative(err)
 	}
 	return InfoFromProto(resp.Info), nil
 }
@@ -63,7 +64,7 @@ func (p *proxySnapshotter) Update(ctx context.Context, info snapshots.Info, fiel
 			},
 		})
 	if err != nil {
-		return snapshots.Info{}, errdefs.FromGRPC(err)
+		return snapshots.Info{}, errgrpc.ToNative(err)
 	}
 	return InfoFromProto(resp.Info), nil
 }
@@ -74,7 +75,7 @@ func (p *proxySnapshotter) Usage(ctx context.Context, key string) (snapshots.Usa
 		Key:         key,
 	})
 	if err != nil {
-		return snapshots.Usage{}, errdefs.FromGRPC(err)
+		return snapshots.Usage{}, errgrpc.ToNative(err)
 	}
 	return UsageFromProto(resp), nil
 }
@@ -85,7 +86,7 @@ func (p *proxySnapshotter) Mounts(ctx context.Context, key string) ([]mount.Moun
 		Key:         key,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return mount.FromProto(resp.Mounts), nil
 }
@@ -104,7 +105,7 @@ func (p *proxySnapshotter) Prepare(ctx context.Context, key, parent string, opts
 		Labels:      local.Labels,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return mount.FromProto(resp.Mounts), nil
 }
@@ -123,7 +124,7 @@ func (p *proxySnapshotter) View(ctx context.Context, key, parent string, opts ..
 		Labels:      local.Labels,
 	})
 	if err != nil {
-		return nil, errdefs.FromGRPC(err)
+		return nil, errgrpc.ToNative(err)
 	}
 	return mount.FromProto(resp.Mounts), nil
 }
@@ -141,7 +142,7 @@ func (p *proxySnapshotter) Commit(ctx context.Context, name, key string, opts ..
 		Key:         key,
 		Labels:      local.Labels,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (p *proxySnapshotter) Remove(ctx context.Context, key string) error {
@@ -149,7 +150,7 @@ func (p *proxySnapshotter) Remove(ctx context.Context, key string) error {
 		Snapshotter: p.snapshotterName,
 		Key:         key,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
 
 func (p *proxySnapshotter) Walk(ctx context.Context, fn snapshots.WalkFunc, fs ...string) error {
@@ -158,7 +159,7 @@ func (p *proxySnapshotter) Walk(ctx context.Context, fn snapshots.WalkFunc, fs .
 		Filters:     fs,
 	})
 	if err != nil {
-		return errdefs.FromGRPC(err)
+		return errgrpc.ToNative(err)
 	}
 	for {
 		resp, err := sc.Recv()
@@ -166,7 +167,7 @@ func (p *proxySnapshotter) Walk(ctx context.Context, fn snapshots.WalkFunc, fs .
 			if err == io.EOF {
 				return nil
 			}
-			return errdefs.FromGRPC(err)
+			return errgrpc.ToNative(err)
 		}
 		if resp == nil {
 			return nil
@@ -187,5 +188,5 @@ func (p *proxySnapshotter) Cleanup(ctx context.Context) error {
 	_, err := p.client.Cleanup(ctx, &snapshotsapi.CleanupRequest{
 		Snapshotter: p.snapshotterName,
 	})
-	return errdefs.FromGRPC(err)
+	return errgrpc.ToNative(err)
 }
diff --git a/core/streaming/proxy/streaming.go b/core/streaming/proxy/streaming.go
index 30b3acf05..fa47fc5d6 100644
--- a/core/streaming/proxy/streaming.go
+++ b/core/streaming/proxy/streaming.go
@@ -23,11 +23,13 @@ import (
 	"io"
 
 	streamingapi "github.com/containerd/containerd/api/services/streaming/v1"
-	"github.com/containerd/containerd/v2/core/streaming"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/ttrpc"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc"
+
+	"github.com/containerd/containerd/v2/core/streaming"
 )
 
 // NewStreamCreator returns a new stream creator which can communicate over a GRPC
@@ -84,7 +86,7 @@ func (sc *streamCreator) Create(ctx context.Context, id string) (streaming.Strea
 	err = stream.Send(typeurl.MarshalProto(a))
 	if err != nil {
 		if !errors.Is(err, io.EOF) {
-			err = errdefs.FromGRPC(err)
+			err = errgrpc.ToNative(err)
 		}
 		return nil, err
 	}
@@ -92,7 +94,7 @@ func (sc *streamCreator) Create(ctx context.Context, id string) (streaming.Strea
 	// Receive an ack that stream is init and ready
 	if _, err = stream.Recv(); err != nil {
 		if !errors.Is(err, io.EOF) {
-			err = errdefs.FromGRPC(err)
+			err = errgrpc.ToNative(err)
 		}
 		return nil, err
 	}
@@ -109,7 +111,7 @@ type clientStream struct {
 func (cs *clientStream) Send(a typeurl.Any) (err error) {
 	err = cs.s.Send(typeurl.MarshalProto(a))
 	if !errors.Is(err, io.EOF) {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 	}
 	return
 }
@@ -117,7 +119,7 @@ func (cs *clientStream) Send(a typeurl.Any) (err error) {
 func (cs *clientStream) Recv() (a typeurl.Any, err error) {
 	a, err = cs.s.Recv()
 	if !errors.Is(err, io.EOF) {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 	}
 	return
 }
diff --git a/go.mod b/go.mod
index 647022936..4bcc6f815 100644
--- a/go.mod
+++ b/go.mod
@@ -15,7 +15,8 @@ require (
 	github.com/containerd/console v1.0.4
 	github.com/containerd/containerd/api v1.8.0-rc.3
 	github.com/containerd/continuity v0.4.3
-	github.com/containerd/errdefs v0.1.0
+	github.com/containerd/errdefs v0.3.0
+	github.com/containerd/errdefs/pkg v0.3.0
 	github.com/containerd/fifo v1.1.0
 	github.com/containerd/go-cni v1.1.10
 	github.com/containerd/go-runc v1.1.0
@@ -91,6 +92,7 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cilium/ebpf v0.11.0 // indirect
+	github.com/containerd/containerd v1.7.23 // indirect
 	github.com/containers/ocicrypt v1.2.0 // indirect
 	github.com/cpuguy83/go-md2man/v2 v2.0.5 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
@@ -107,7 +109,6 @@ require (
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.22.0 // indirect
-	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mdlayher/socket v0.4.1 // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
@@ -122,7 +123,7 @@ require (
 	github.com/prometheus/common v0.55.0 // indirect
 	github.com/prometheus/procfs v0.15.1 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 // indirect
+	github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/vishvananda/netns v0.0.4 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
@@ -151,3 +152,5 @@ require (
 )
 
 replace github.com/containerd/containerd/api => ./api
+
+replace github.com/Microsoft/hcsshim => github.com/dmcgowan/hcsshim v0.12.8-dev.0
diff --git a/go.sum b/go.sum
index 2d2466239..938045431 100644
--- a/go.sum
+++ b/go.sum
@@ -606,8 +606,6 @@ github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802/go.mod h1:IVnqGOEym
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
-github.com/Microsoft/hcsshim v0.12.7 h1:MP6R1spmjxTE4EU4J3YsrTxn8CjvN9qwjTKJXldFaRg=
-github.com/Microsoft/hcsshim v0.12.7/go.mod h1:HPbAuJ9BvQYYZbB4yEQcyGIsTP5L4yHKeO9XO149AEM=
 github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
 github.com/ajstarks/deck v0.0.0-20200831202436-30c9fc6549a9/go.mod h1:JynElWSGnm/4RlzPXRlREEwqTHAN3T56Bv2ITsFT3gY=
 github.com/ajstarks/deck/generate v0.0.0-20210309230005-c3f852c02e19/go.mod h1:T13YZdzov6OU0A1+RfKZiZN9ca6VeKdBdyDV+BY97Tk=
@@ -669,10 +667,14 @@ github.com/containerd/cgroups/v3 v3.0.3 h1:S5ByHZ/h9PMe5IOQoN7E+nMc2UcLEM/V48DGD
 github.com/containerd/cgroups/v3 v3.0.3/go.mod h1:8HBe7V3aWGLFPd/k03swSIsGjZhHI2WzJmticMgVuz0=
 github.com/containerd/console v1.0.4 h1:F2g4+oChYvBTsASRTz8NP6iIAi97J3TtSAsLbIFn4ro=
 github.com/containerd/console v1.0.4/go.mod h1:YynlIjWYF8myEu6sdkwKIvGQq+cOckRm6So2avqoYAk=
+github.com/containerd/containerd v1.7.23 h1:H2CClyUkmpKAGlhQp95g2WXHfLYc7whAuvZGBNYOOwQ=
+github.com/containerd/containerd v1.7.23/go.mod h1:7QUzfURqZWCZV7RLNEn1XjUCQLEf0bkaK4GjUaZehxw=
 github.com/containerd/continuity v0.4.3 h1:6HVkalIp+2u1ZLH1J/pYX2oBVXlJZvh1X1A7bEZ9Su8=
 github.com/containerd/continuity v0.4.3/go.mod h1:F6PTNCKepoxEaXLQp3wDAjygEnImnZ/7o4JzpodfroQ=
-github.com/containerd/errdefs v0.1.0 h1:m0wCRBiu1WJT/Fr+iOoQHMQS/eP5myQ8lCv4Dz5ZURM=
-github.com/containerd/errdefs v0.1.0/go.mod h1:YgWiiHtLmSeBrvpw+UfPijzbLaB77mEG1WwJTDETIV0=
+github.com/containerd/errdefs v0.3.0 h1:FSZgGOeK4yuT/+DnF07/Olde/q4KBoMsaamhXxIMDp4=
+github.com/containerd/errdefs v0.3.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
 github.com/containerd/fifo v1.1.0/go.mod h1:bmC4NWMbXlt2EZ0Hc7Fx7QzTFxgPID13eH0Qu+MAb2o=
 github.com/containerd/go-cni v1.1.10 h1:c2U73nld7spSWfiJwSh/8W9DK+/qQwYM2rngIhCyhyg=
@@ -713,6 +715,8 @@ github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1
 github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
+github.com/dmcgowan/hcsshim v0.12.8-dev.0 h1:bbXqB6pRpEpywEhmJZlG1YZOndcVyONS7jVbidhHpxQ=
+github.com/dmcgowan/hcsshim v0.12.8-dev.0/go.mod h1:cibQ4BqhJ32FXDwPdQhKhwrwophnh3FuT4nwQZF907w=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c h1:+pKlWGMw7gf6bQ+oDZB4KHQFypsfjYlq/C4rfL7D3g8=
 github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA=
 github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8=
@@ -1076,8 +1080,8 @@ github.com/spf13/afero v1.6.0/go.mod h1:Ai8FlHk4v/PARR026UzYexafAt9roJ7LcLMAmO6Z
 github.com/spf13/afero v1.9.2/go.mod h1:iUV7ddyEEZPO5gA3zD4fJt6iStLlL+Lg4m2cihcDf8Y=
 github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980 h1:lIOOHPEbXzO3vnmx2gok1Tfs31Q8GQqKLc8vVqyQq/I=
-github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980/go.mod h1:AO3tvPzVZ/ayst6UlUKUv6rcPQInYe3IknH3jYhAKu8=
+github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
+github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6/go.mod h1:39R/xuhNgVhi+K0/zst4TLrJrVmbm6LVgl4A0+ZFS5M=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.1.1/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
diff --git a/internal/cri/instrument/instrumented_service.go b/internal/cri/instrument/instrumented_service.go
index c32513862..c2f5c8de9 100644
--- a/internal/cri/instrument/instrumented_service.go
+++ b/internal/cri/instrument/instrumented_service.go
@@ -19,11 +19,13 @@ package instrument
 import (
 	"context"
 
-	"github.com/containerd/containerd/v2/pkg/tracing"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
 
+	"github.com/containerd/containerd/v2/pkg/tracing"
+
 	ctrdutil "github.com/containerd/containerd/v2/internal/cri/util"
 )
 
@@ -57,7 +59,7 @@ func (in *instrumentedService) checkInitialized() error {
 	if in.c.IsInitialized() {
 		return nil
 	}
-	return errdefs.ToGRPCf(errdefs.ErrUnavailable, "server is not initialized yet")
+	return errgrpc.ToGRPCf(errdefs.ErrUnavailable, "server is not initialized yet")
 }
 
 func (in *instrumentedService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandboxRequest) (res *runtime.RunPodSandboxResponse, err error) {
@@ -75,7 +77,7 @@ func (in *instrumentedService) RunPodSandbox(ctx context.Context, r *runtime.Run
 		span.RecordError(err)
 	}()
 	res, err = in.c.RunPodSandbox(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListPodSandbox(ctx context.Context, r *runtime.ListPodSandboxRequest) (res *runtime.ListPodSandboxResponse, err error) {
@@ -91,7 +93,7 @@ func (in *instrumentedService) ListPodSandbox(ctx context.Context, r *runtime.Li
 		}
 	}()
 	res, err = in.c.ListPodSandbox(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) PodSandboxStatus(ctx context.Context, r *runtime.PodSandboxStatusRequest) (res *runtime.PodSandboxStatusResponse, err error) {
@@ -107,7 +109,7 @@ func (in *instrumentedService) PodSandboxStatus(ctx context.Context, r *runtime.
 		}
 	}()
 	res, err = in.c.PodSandboxStatus(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) StopPodSandbox(ctx context.Context, r *runtime.StopPodSandboxRequest) (_ *runtime.StopPodSandboxResponse, err error) {
@@ -125,7 +127,7 @@ func (in *instrumentedService) StopPodSandbox(ctx context.Context, r *runtime.St
 		span.RecordError(err)
 	}()
 	res, err := in.c.StopPodSandbox(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) RemovePodSandbox(ctx context.Context, r *runtime.RemovePodSandboxRequest) (_ *runtime.RemovePodSandboxResponse, err error) {
@@ -143,7 +145,7 @@ func (in *instrumentedService) RemovePodSandbox(ctx context.Context, r *runtime.
 		span.RecordError(err)
 	}()
 	res, err := in.c.RemovePodSandbox(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) PortForward(ctx context.Context, r *runtime.PortForwardRequest) (res *runtime.PortForwardResponse, err error) {
@@ -159,7 +161,7 @@ func (in *instrumentedService) PortForward(ctx context.Context, r *runtime.PortF
 		}
 	}()
 	res, err = in.c.PortForward(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) CreateContainer(ctx context.Context, r *runtime.CreateContainerRequest) (res *runtime.CreateContainerResponse, err error) {
@@ -180,7 +182,7 @@ func (in *instrumentedService) CreateContainer(ctx context.Context, r *runtime.C
 		span.RecordError(err)
 	}()
 	res, err = in.c.CreateContainer(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) StartContainer(ctx context.Context, r *runtime.StartContainerRequest) (_ *runtime.StartContainerResponse, err error) {
@@ -198,7 +200,7 @@ func (in *instrumentedService) StartContainer(ctx context.Context, r *runtime.St
 		span.RecordError(err)
 	}()
 	res, err := in.c.StartContainer(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListContainers(ctx context.Context, r *runtime.ListContainersRequest) (res *runtime.ListContainersResponse, err error) {
@@ -215,7 +217,7 @@ func (in *instrumentedService) ListContainers(ctx context.Context, r *runtime.Li
 		}
 	}()
 	res, err = in.c.ListContainers(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ContainerStatus(ctx context.Context, r *runtime.ContainerStatusRequest) (res *runtime.ContainerStatusResponse, err error) {
@@ -231,7 +233,7 @@ func (in *instrumentedService) ContainerStatus(ctx context.Context, r *runtime.C
 		}
 	}()
 	res, err = in.c.ContainerStatus(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) StopContainer(ctx context.Context, r *runtime.StopContainerRequest) (res *runtime.StopContainerResponse, err error) {
@@ -249,7 +251,7 @@ func (in *instrumentedService) StopContainer(ctx context.Context, r *runtime.Sto
 		span.RecordError(err)
 	}()
 	res, err = in.c.StopContainer(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) RemoveContainer(ctx context.Context, r *runtime.RemoveContainerRequest) (res *runtime.RemoveContainerResponse, err error) {
@@ -267,7 +269,7 @@ func (in *instrumentedService) RemoveContainer(ctx context.Context, r *runtime.R
 		span.RecordError(err)
 	}()
 	res, err = in.c.RemoveContainer(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ExecSync(ctx context.Context, r *runtime.ExecSyncRequest) (res *runtime.ExecSyncResponse, err error) {
@@ -285,7 +287,7 @@ func (in *instrumentedService) ExecSync(ctx context.Context, r *runtime.ExecSync
 		span.RecordError(err)
 	}()
 	res, err = in.c.ExecSync(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) Exec(ctx context.Context, r *runtime.ExecRequest) (res *runtime.ExecResponse, err error) {
@@ -304,7 +306,7 @@ func (in *instrumentedService) Exec(ctx context.Context, r *runtime.ExecRequest)
 		span.RecordError(err)
 	}()
 	res, err = in.c.Exec(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) Attach(ctx context.Context, r *runtime.AttachRequest) (res *runtime.AttachResponse, err error) {
@@ -322,7 +324,7 @@ func (in *instrumentedService) Attach(ctx context.Context, r *runtime.AttachRequ
 		span.RecordError(err)
 	}()
 	res, err = in.c.Attach(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) UpdateContainerResources(ctx context.Context, r *runtime.UpdateContainerResourcesRequest) (res *runtime.UpdateContainerResourcesResponse, err error) {
@@ -338,7 +340,7 @@ func (in *instrumentedService) UpdateContainerResources(ctx context.Context, r *
 		}
 	}()
 	res, err = in.c.UpdateContainerResources(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) PullImage(ctx context.Context, r *runtime.PullImageRequest) (res *runtime.PullImageResponse, err error) {
@@ -357,7 +359,7 @@ func (in *instrumentedService) PullImage(ctx context.Context, r *runtime.PullIma
 		span.RecordError(err)
 	}()
 	res, err = in.c.PullImage(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListImages(ctx context.Context, r *runtime.ListImagesRequest) (res *runtime.ListImagesResponse, err error) {
@@ -374,7 +376,7 @@ func (in *instrumentedService) ListImages(ctx context.Context, r *runtime.ListIm
 		}
 	}()
 	res, err = in.c.ListImages(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ImageStatus(ctx context.Context, r *runtime.ImageStatusRequest) (res *runtime.ImageStatusResponse, err error) {
@@ -391,7 +393,7 @@ func (in *instrumentedService) ImageStatus(ctx context.Context, r *runtime.Image
 		}
 	}()
 	res, err = in.c.ImageStatus(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) RemoveImage(ctx context.Context, r *runtime.RemoveImageRequest) (_ *runtime.RemoveImageResponse, err error) {
@@ -409,7 +411,7 @@ func (in *instrumentedService) RemoveImage(ctx context.Context, r *runtime.Remov
 		span.RecordError(err)
 	}()
 	res, err := in.c.RemoveImage(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ImageFsInfo(ctx context.Context, r *runtime.ImageFsInfoRequest) (res *runtime.ImageFsInfoResponse, err error) {
@@ -425,7 +427,7 @@ func (in *instrumentedService) ImageFsInfo(ctx context.Context, r *runtime.Image
 		}
 	}()
 	res, err = in.c.ImageFsInfo(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) PodSandboxStats(ctx context.Context, r *runtime.PodSandboxStatsRequest) (res *runtime.PodSandboxStatsResponse, err error) {
@@ -441,7 +443,7 @@ func (in *instrumentedService) PodSandboxStats(ctx context.Context, r *runtime.P
 		}
 	}()
 	res, err = in.c.PodSandboxStats(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ContainerStats(ctx context.Context, r *runtime.ContainerStatsRequest) (res *runtime.ContainerStatsResponse, err error) {
@@ -457,7 +459,7 @@ func (in *instrumentedService) ContainerStats(ctx context.Context, r *runtime.Co
 		}
 	}()
 	res, err = in.c.ContainerStats(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListPodSandboxStats(ctx context.Context, r *runtime.ListPodSandboxStatsRequest) (res *runtime.ListPodSandboxStatsResponse, err error) {
@@ -473,7 +475,7 @@ func (in *instrumentedService) ListPodSandboxStats(ctx context.Context, r *runti
 		}
 	}()
 	res, err = in.c.ListPodSandboxStats(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListContainerStats(ctx context.Context, r *runtime.ListContainerStatsRequest) (res *runtime.ListContainerStatsResponse, err error) {
@@ -489,7 +491,7 @@ func (in *instrumentedService) ListContainerStats(ctx context.Context, r *runtim
 		}
 	}()
 	res, err = in.c.ListContainerStats(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) Status(ctx context.Context, r *runtime.StatusRequest) (res *runtime.StatusResponse, err error) {
@@ -505,7 +507,7 @@ func (in *instrumentedService) Status(ctx context.Context, r *runtime.StatusRequ
 		}
 	}()
 	res, err = in.c.Status(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) Version(ctx context.Context, r *runtime.VersionRequest) (res *runtime.VersionResponse, err error) {
@@ -521,7 +523,7 @@ func (in *instrumentedService) Version(ctx context.Context, r *runtime.VersionRe
 		}
 	}()
 	res, err = in.c.Version(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) UpdateRuntimeConfig(ctx context.Context, r *runtime.UpdateRuntimeConfigRequest) (res *runtime.UpdateRuntimeConfigResponse, err error) {
@@ -537,7 +539,7 @@ func (in *instrumentedService) UpdateRuntimeConfig(ctx context.Context, r *runti
 		}
 	}()
 	res, err = in.c.UpdateRuntimeConfig(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ReopenContainerLog(ctx context.Context, r *runtime.ReopenContainerLogRequest) (res *runtime.ReopenContainerLogResponse, err error) {
@@ -553,7 +555,7 @@ func (in *instrumentedService) ReopenContainerLog(ctx context.Context, r *runtim
 		}
 	}()
 	res, err = in.c.ReopenContainerLog(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) CheckpointContainer(ctx context.Context, r *runtime.CheckpointContainerRequest) (res *runtime.CheckpointContainerResponse, err error) {
@@ -570,7 +572,7 @@ func (in *instrumentedService) CheckpointContainer(ctx context.Context, r *runti
 	}()
 
 	res, err = in.c.CheckpointContainer(ctrdutil.WithNamespace(ctx), r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) GetContainerEvents(r *runtime.GetEventsRequest, s runtime.RuntimeService_GetContainerEventsServer) (err error) {
@@ -588,7 +590,7 @@ func (in *instrumentedService) GetContainerEvents(r *runtime.GetEventsRequest, s
 	}()
 
 	err = in.c.GetContainerEvents(r, s)
-	return errdefs.ToGRPC(err)
+	return errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListMetricDescriptors(ctx context.Context, r *runtime.ListMetricDescriptorsRequest) (res *runtime.ListMetricDescriptorsResponse, err error) {
@@ -605,7 +607,7 @@ func (in *instrumentedService) ListMetricDescriptors(ctx context.Context, r *run
 	}()
 
 	res, err = in.c.ListMetricDescriptors(ctx, r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) ListPodSandboxMetrics(ctx context.Context, r *runtime.ListPodSandboxMetricsRequest) (res *runtime.ListPodSandboxMetricsResponse, err error) {
@@ -622,7 +624,7 @@ func (in *instrumentedService) ListPodSandboxMetrics(ctx context.Context, r *run
 	}()
 
 	res, err = in.c.ListPodSandboxMetrics(ctx, r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
 
 func (in *instrumentedService) RuntimeConfig(ctx context.Context, r *runtime.RuntimeConfigRequest) (res *runtime.RuntimeConfigResponse, err error) {
@@ -638,5 +640,5 @@ func (in *instrumentedService) RuntimeConfig(ctx context.Context, r *runtime.Run
 		}
 	}()
 	res, err = in.c.RuntimeConfig(ctx, r)
-	return res, errdefs.ToGRPC(err)
+	return res, errgrpc.ToGRPC(err)
 }
diff --git a/internal/cri/server/events.go b/internal/cri/server/events.go
index d78249823..90d3eeb63 100644
--- a/internal/cri/server/events.go
+++ b/internal/cri/server/events.go
@@ -22,11 +22,13 @@ import (
 	"time"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	runtime "k8s.io/cri-api/pkg/apis/runtime/v1"
 
 	eventtypes "github.com/containerd/containerd/api/events"
 	apitasks "github.com/containerd/containerd/api/services/tasks/v1"
+
 	containerd "github.com/containerd/containerd/v2/client"
 	containerstore "github.com/containerd/containerd/v2/internal/cri/store/container"
 	sandboxstore "github.com/containerd/containerd/v2/internal/cri/store/sandbox"
@@ -229,7 +231,7 @@ func (c *criService) handleContainerExit(ctx context.Context, e *eventtypes.Task
 	if errdefs.IsNotFound(err) {
 		_, err = c.client.TaskService().Delete(ctx, &apitasks.DeleteTaskRequest{ContainerID: cntr.Container.ID()})
 		if err != nil {
-			err = errdefs.FromGRPC(err)
+			err = errgrpc.ToNative(err)
 			if !errdefs.IsNotFound(err) {
 				return fmt.Errorf("failed to cleanup container %s in task-service: %w", cntr.Container.ID(), err)
 			}
diff --git a/internal/cri/server/podsandbox/sandbox_delete.go b/internal/cri/server/podsandbox/sandbox_delete.go
index a23092617..132c11222 100644
--- a/internal/cri/server/podsandbox/sandbox_delete.go
+++ b/internal/cri/server/podsandbox/sandbox_delete.go
@@ -21,9 +21,11 @@ import (
 	"fmt"
 
 	apitasks "github.com/containerd/containerd/api/services/tasks/v1"
-	containerd "github.com/containerd/containerd/v2/client"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
+
+	containerd "github.com/containerd/containerd/v2/client"
 )
 
 func (c *Controller) Shutdown(ctx context.Context, sandboxID string) error {
@@ -114,7 +116,7 @@ func (c *Controller) cleanupSandboxTask(ctx context.Context, sbCntr containerd.C
 	if errdefs.IsNotFound(err) {
 		_, err = c.client.TaskService().Delete(ctx, &apitasks.DeleteTaskRequest{ContainerID: sbCntr.ID()})
 		if err != nil {
-			err = errdefs.FromGRPC(err)
+			err = errgrpc.ToNative(err)
 			if !errdefs.IsNotFound(err) {
 				return fmt.Errorf("failed to cleanup sandbox %s in task-service: %w", sbCntr.ID(), err)
 			}
diff --git a/plugins/sandbox/controller.go b/plugins/sandbox/controller.go
index c855d0865..aec9cc346 100644
--- a/plugins/sandbox/controller.go
+++ b/plugins/sandbox/controller.go
@@ -23,6 +23,7 @@ import (
 	"time"
 
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
@@ -31,6 +32,7 @@ import (
 
 	runtimeAPI "github.com/containerd/containerd/api/runtime/sandbox/v1"
 	"github.com/containerd/containerd/api/types"
+
 	"github.com/containerd/containerd/v2/core/events"
 	"github.com/containerd/containerd/v2/core/events/exchange"
 	"github.com/containerd/containerd/v2/core/mount"
@@ -158,7 +160,7 @@ func (c *controllerLocal) Create(ctx context.Context, info sandbox.Sandbox, opts
 		NetnsPath:  coptions.NetNSPath,
 	}); err != nil {
 		c.cleanupShim(ctx, sandboxID, svc)
-		return fmt.Errorf("failed to create sandbox %s: %w", sandboxID, errdefs.FromGRPC(err))
+		return fmt.Errorf("failed to create sandbox %s: %w", sandboxID, errgrpc.ToNative(err))
 	}
 
 	return nil
@@ -178,7 +180,7 @@ func (c *controllerLocal) Start(ctx context.Context, sandboxID string) (sandbox.
 	resp, err := svc.StartSandbox(ctx, &runtimeAPI.StartSandboxRequest{SandboxID: sandboxID})
 	if err != nil {
 		c.cleanupShim(ctx, sandboxID, svc)
-		return sandbox.ControllerInstance{}, fmt.Errorf("failed to start sandbox %s: %w", sandboxID, errdefs.FromGRPC(err))
+		return sandbox.ControllerInstance{}, fmt.Errorf("failed to start sandbox %s: %w", sandboxID, errgrpc.ToNative(err))
 	}
 	address, version := shim.Endpoint()
 	return sandbox.ControllerInstance{
@@ -198,7 +200,7 @@ func (c *controllerLocal) Platform(ctx context.Context, sandboxID string) (image
 
 	response, err := svc.Platform(ctx, &runtimeAPI.PlatformRequest{SandboxID: sandboxID})
 	if err != nil {
-		return imagespec.Platform{}, fmt.Errorf("failed to get sandbox platform: %w", errdefs.FromGRPC(err))
+		return imagespec.Platform{}, fmt.Errorf("failed to get sandbox platform: %w", errgrpc.ToNative(err))
 	}
 
 	var platform imagespec.Platform
@@ -229,7 +231,7 @@ func (c *controllerLocal) Stop(ctx context.Context, sandboxID string, opts ...sa
 	}
 
 	if _, err := svc.StopSandbox(ctx, req); err != nil {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 		if !errdefs.IsNotFound(err) && !errdefs.IsUnavailable(err) {
 			return fmt.Errorf("failed to stop sandbox: %w", err)
 		}
@@ -246,7 +248,7 @@ func (c *controllerLocal) Shutdown(ctx context.Context, sandboxID string) error
 
 	_, err = svc.ShutdownSandbox(ctx, &runtimeAPI.ShutdownSandboxRequest{SandboxID: sandboxID})
 	if err != nil {
-		return fmt.Errorf("failed to shutdown sandbox: %w", errdefs.FromGRPC(err))
+		return fmt.Errorf("failed to shutdown sandbox: %w", errgrpc.ToNative(err))
 	}
 
 	if err := c.shims.Delete(ctx, sandboxID); err != nil {
@@ -267,7 +269,7 @@ func (c *controllerLocal) Wait(ctx context.Context, sandboxID string) (sandbox.E
 	})
 
 	if err != nil {
-		return sandbox.ExitStatus{}, fmt.Errorf("failed to wait sandbox %s: %w", sandboxID, errdefs.FromGRPC(err))
+		return sandbox.ExitStatus{}, fmt.Errorf("failed to wait sandbox %s: %w", sandboxID, errgrpc.ToNative(err))
 	}
 
 	return sandbox.ExitStatus{
diff --git a/plugins/services/containers/local.go b/plugins/services/containers/local.go
index 33f172938..9a494391a 100644
--- a/plugins/services/containers/local.go
+++ b/plugins/services/containers/local.go
@@ -22,13 +22,7 @@ import (
 
 	eventstypes "github.com/containerd/containerd/api/events"
 	api "github.com/containerd/containerd/api/services/containers/v1"
-	"github.com/containerd/containerd/v2/core/containers"
-	"github.com/containerd/containerd/v2/core/events"
-	"github.com/containerd/containerd/v2/core/metadata"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/containerd/v2/plugins/services"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
 	bolt "go.etcd.io/bbolt"
@@ -36,6 +30,13 @@ import (
 	"google.golang.org/grpc/codes"
 	grpcm "google.golang.org/grpc/metadata"
 	"google.golang.org/grpc/status"
+
+	"github.com/containerd/containerd/v2/core/containers"
+	"github.com/containerd/containerd/v2/core/events"
+	"github.com/containerd/containerd/v2/core/metadata"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/plugins/services"
 )
 
 var empty = &ptypes.Empty{}
@@ -79,7 +80,7 @@ var _ api.ContainersClient = &local{}
 func (l *local) Get(ctx context.Context, req *api.GetContainerRequest, _ ...grpc.CallOption) (*api.GetContainerResponse, error) {
 	var resp api.GetContainerResponse
 
-	return &resp, errdefs.ToGRPC(l.withStoreView(ctx, func(ctx context.Context) error {
+	return &resp, errgrpc.ToGRPC(l.withStoreView(ctx, func(ctx context.Context) error {
 		container, err := l.Store.Get(ctx, req.ID)
 		if err != nil {
 			return err
@@ -93,7 +94,7 @@ func (l *local) Get(ctx context.Context, req *api.GetContainerRequest, _ ...grpc
 
 func (l *local) List(ctx context.Context, req *api.ListContainersRequest, _ ...grpc.CallOption) (*api.ListContainersResponse, error) {
 	var resp api.ListContainersResponse
-	return &resp, errdefs.ToGRPC(l.withStoreView(ctx, func(ctx context.Context) error {
+	return &resp, errgrpc.ToGRPC(l.withStoreView(ctx, func(ctx context.Context) error {
 		containers, err := l.Store.List(ctx, req.Filters...)
 		if err != nil {
 			return err
@@ -107,7 +108,7 @@ func (l *local) ListStream(ctx context.Context, req *api.ListContainersRequest,
 	stream := &localStream{
 		ctx: ctx,
 	}
-	return stream, errdefs.ToGRPC(l.withStoreView(ctx, func(ctx context.Context) error {
+	return stream, errgrpc.ToGRPC(l.withStoreView(ctx, func(ctx context.Context) error {
 		containers, err := l.Store.List(ctx, req.Filters...)
 		if err != nil {
 			return err
@@ -132,7 +133,7 @@ func (l *local) Create(ctx context.Context, req *api.CreateContainerRequest, _ .
 
 		return nil
 	}); err != nil {
-		return &resp, errdefs.ToGRPC(err)
+		return &resp, errgrpc.ToGRPC(err)
 	}
 	if err := l.publisher.Publish(ctx, "/containers/create", &eventstypes.ContainerCreate{
 		ID:    resp.Container.ID,
@@ -171,7 +172,7 @@ func (l *local) Update(ctx context.Context, req *api.UpdateContainerRequest, _ .
 		resp.Container = containerToProto(&updated)
 		return nil
 	}); err != nil {
-		return &resp, errdefs.ToGRPC(err)
+		return &resp, errgrpc.ToGRPC(err)
 	}
 
 	if err := l.publisher.Publish(ctx, "/containers/update", &eventstypes.ContainerUpdate{
@@ -190,7 +191,7 @@ func (l *local) Delete(ctx context.Context, req *api.DeleteContainerRequest, _ .
 	if err := l.withStoreUpdate(ctx, func(ctx context.Context) error {
 		return l.Store.Delete(ctx, req.ID)
 	}); err != nil {
-		return empty, errdefs.ToGRPC(err)
+		return empty, errgrpc.ToGRPC(err)
 	}
 
 	if err := l.publisher.Publish(ctx, "/containers/delete", &eventstypes.ContainerDelete{
diff --git a/plugins/services/content/contentserver/contentserver.go b/plugins/services/content/contentserver/contentserver.go
index b212070d6..cfa00bf4b 100644
--- a/plugins/services/content/contentserver/contentserver.go
+++ b/plugins/services/content/contentserver/contentserver.go
@@ -23,16 +23,17 @@ import (
 	"sync"
 
 	api "github.com/containerd/containerd/api/services/content/v1"
-	"github.com/containerd/containerd/v2/core/content"
-	"github.com/containerd/containerd/v2/pkg/protobuf"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	digest "github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	"github.com/containerd/containerd/v2/core/content"
+	"github.com/containerd/containerd/v2/pkg/protobuf"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 )
 
 type service struct {
@@ -68,7 +69,7 @@ func (s *service) Info(ctx context.Context, req *api.InfoRequest) (*api.InfoResp
 
 	bi, err := s.store.Info(ctx, dg)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.InfoResponse{
@@ -84,7 +85,7 @@ func (s *service) Update(ctx context.Context, req *api.UpdateRequest) (*api.Upda
 
 	info, err := s.store.Update(ctx, infoFromGRPC(req.Info), req.UpdateMask.GetPaths()...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.UpdateResponse{
@@ -116,7 +117,7 @@ func (s *service) List(req *api.ListContentRequest, session api.Content_ListServ
 
 		return nil
 	}, req.Filters...); err != nil {
-		return errdefs.ToGRPC(err)
+		return errgrpc.ToGRPC(err)
 	}
 
 	if len(buffer) > 0 {
@@ -137,7 +138,7 @@ func (s *service) Delete(ctx context.Context, req *api.DeleteContentRequest) (*p
 	}
 
 	if err := s.store.Delete(ctx, dg); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
@@ -151,12 +152,12 @@ func (s *service) Read(req *api.ReadContentRequest, session api.Content_ReadServ
 
 	oi, err := s.store.Info(session.Context(), dg)
 	if err != nil {
-		return errdefs.ToGRPC(err)
+		return errgrpc.ToGRPC(err)
 	}
 
 	ra, err := s.store.ReaderAt(session.Context(), ocispec.Descriptor{Digest: dg})
 	if err != nil {
-		return errdefs.ToGRPC(err)
+		return errgrpc.ToGRPC(err)
 	}
 	defer ra.Close()
 
@@ -187,7 +188,7 @@ func (s *service) Read(req *api.ReadContentRequest, session api.Content_ReadServ
 	_, err = io.CopyBuffer(
 		&readResponseWriter{session: session},
 		io.NewSectionReader(ra, offset, size), *p)
-	return errdefs.ToGRPC(err)
+	return errgrpc.ToGRPC(err)
 }
 
 // readResponseWriter is a writer that places the output into ReadContentRequest messages.
@@ -214,7 +215,7 @@ func (rw *readResponseWriter) Write(p []byte) (n int, err error) {
 func (s *service) Status(ctx context.Context, req *api.StatusRequest) (*api.StatusResponse, error) {
 	status, err := s.store.Status(ctx, req.Ref)
 	if err != nil {
-		return nil, errdefs.ToGRPCf(err, "could not get status for ref %q", req.Ref)
+		return nil, errgrpc.ToGRPCf(err, "could not get status for ref %q", req.Ref)
 	}
 
 	var resp api.StatusResponse
@@ -233,7 +234,7 @@ func (s *service) Status(ctx context.Context, req *api.StatusRequest) (*api.Stat
 func (s *service) ListStatuses(ctx context.Context, req *api.ListStatusesRequest) (*api.ListStatusesResponse, error) {
 	statuses, err := s.store.ListStatuses(ctx, req.Filters...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	var resp api.ListStatusesResponse
@@ -313,7 +314,7 @@ func (s *service) Write(session api.Content_WriteServer) (err error) {
 		content.WithRef(ref),
 		content.WithDescriptor(ocispec.Descriptor{Size: total, Digest: expected}))
 	if err != nil {
-		return errdefs.ToGRPC(err)
+		return errgrpc.ToGRPC(err)
 	}
 	defer wr.Close()
 
@@ -321,7 +322,7 @@ func (s *service) Write(session api.Content_WriteServer) (err error) {
 		msg.Action = req.Action
 		ws, err := wr.Status()
 		if err != nil {
-			return errdefs.ToGRPC(err)
+			return errgrpc.ToGRPC(err)
 		}
 
 		msg.Offset = ws.Offset // always set the offset.
@@ -398,7 +399,7 @@ func (s *service) Write(session api.Content_WriteServer) (err error) {
 				// maintain the offset as append only, we just issue the write.
 				n, err := wr.Write(req.Data)
 				if err != nil {
-					return errdefs.ToGRPC(err)
+					return errgrpc.ToGRPC(err)
 				}
 
 				if n != len(req.Data) {
@@ -416,7 +417,7 @@ func (s *service) Write(session api.Content_WriteServer) (err error) {
 					opts = append(opts, content.WithLabels(req.Labels))
 				}
 				if err := wr.Commit(ctx, total, expected, opts...); err != nil {
-					return errdefs.ToGRPC(err)
+					return errgrpc.ToGRPC(err)
 				}
 			}
 
@@ -444,7 +445,7 @@ func (s *service) Write(session api.Content_WriteServer) (err error) {
 
 func (s *service) Abort(ctx context.Context, req *api.AbortRequest) (*ptypes.Empty, error) {
 	if err := s.store.Abort(ctx, req.Ref); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
diff --git a/plugins/services/diff/local.go b/plugins/services/diff/local.go
index 64aa5eae1..1b2c9f2dc 100644
--- a/plugins/services/diff/local.go
+++ b/plugins/services/diff/local.go
@@ -21,17 +21,19 @@ import (
 	"fmt"
 
 	diffapi "github.com/containerd/containerd/api/services/diff/v1"
-	"github.com/containerd/containerd/v2/core/diff"
-	"github.com/containerd/containerd/v2/core/mount"
-	"github.com/containerd/containerd/v2/pkg/oci"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/containerd/v2/plugins/services"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
 	"github.com/containerd/typeurl/v2"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 	"google.golang.org/grpc"
+
+	"github.com/containerd/containerd/v2/core/diff"
+	"github.com/containerd/containerd/v2/core/mount"
+	"github.com/containerd/containerd/v2/pkg/oci"
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/plugins/services"
 )
 
 type config struct {
@@ -125,7 +127,7 @@ func (l *local) Apply(ctx context.Context, er *diffapi.ApplyRequest, _ ...grpc.C
 	}
 
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &diffapi.ApplyResponse{
@@ -164,7 +166,7 @@ func (l *local) Diff(ctx context.Context, dr *diffapi.DiffRequest, _ ...grpc.Cal
 		}
 	}
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &diffapi.DiffResponse{
diff --git a/plugins/services/events/service.go b/plugins/services/events/service.go
index 3b779b6ec..ec3be3da4 100644
--- a/plugins/services/events/service.go
+++ b/plugins/services/events/service.go
@@ -23,17 +23,18 @@ import (
 	api "github.com/containerd/containerd/api/services/events/v1"
 	apittrpc "github.com/containerd/containerd/api/services/ttrpc/events/v1"
 	"github.com/containerd/containerd/api/types"
-	"github.com/containerd/containerd/v2/core/events"
-	"github.com/containerd/containerd/v2/core/events/exchange"
-	"github.com/containerd/containerd/v2/pkg/protobuf"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
 	"github.com/containerd/ttrpc"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc"
+
+	"github.com/containerd/containerd/v2/core/events"
+	"github.com/containerd/containerd/v2/core/events/exchange"
+	"github.com/containerd/containerd/v2/pkg/protobuf"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
+	"github.com/containerd/containerd/v2/plugins"
 )
 
 var empty = &ptypes.Empty{}
@@ -83,7 +84,7 @@ func (s *service) RegisterTTRPC(server *ttrpc.Server) error {
 
 func (s *service) Publish(ctx context.Context, r *api.PublishRequest) (*ptypes.Empty, error) {
 	if err := s.events.Publish(ctx, r.Topic, r.Event); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
@@ -91,7 +92,7 @@ func (s *service) Publish(ctx context.Context, r *api.PublishRequest) (*ptypes.E
 
 func (s *service) Forward(ctx context.Context, r *api.ForwardRequest) (*ptypes.Empty, error) {
 	if err := s.events.Forward(ctx, fromProto(r.Envelope)); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
diff --git a/plugins/services/events/ttrpc.go b/plugins/services/events/ttrpc.go
index a5bab3f7d..cfcca189d 100644
--- a/plugins/services/events/ttrpc.go
+++ b/plugins/services/events/ttrpc.go
@@ -21,11 +21,12 @@ import (
 
 	api "github.com/containerd/containerd/api/services/ttrpc/events/v1"
 	"github.com/containerd/containerd/api/types"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+
 	"github.com/containerd/containerd/v2/core/events"
 	"github.com/containerd/containerd/v2/core/events/exchange"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/errdefs"
 )
 
 type ttrpcService struct {
@@ -34,7 +35,7 @@ type ttrpcService struct {
 
 func (s *ttrpcService) Forward(ctx context.Context, r *api.ForwardRequest) (*ptypes.Empty, error) {
 	if err := s.events.Forward(ctx, fromTProto(r.Envelope)); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
diff --git a/plugins/services/images/local.go b/plugins/services/images/local.go
index 1e0e81617..6ef4cac6c 100644
--- a/plugins/services/images/local.go
+++ b/plugins/services/images/local.go
@@ -19,12 +19,16 @@ package images
 import (
 	"context"
 
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 
 	imagesapi "github.com/containerd/containerd/api/services/images/v1"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+
 	"github.com/containerd/containerd/v2/core/images"
 	"github.com/containerd/containerd/v2/core/metadata"
 	"github.com/containerd/containerd/v2/pkg/deprecation"
@@ -35,9 +39,6 @@ import (
 	"github.com/containerd/containerd/v2/plugins"
 	"github.com/containerd/containerd/v2/plugins/services"
 	"github.com/containerd/containerd/v2/plugins/services/warning"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/plugin"
-	"github.com/containerd/plugin/registry"
 )
 
 var empty = &ptypes.Empty{}
@@ -89,7 +90,7 @@ var _ imagesapi.ImagesClient = &local{}
 func (l *local) Get(ctx context.Context, req *imagesapi.GetImageRequest, _ ...grpc.CallOption) (*imagesapi.GetImageResponse, error) {
 	image, err := l.store.Get(ctx, req.Name)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	imagepb := imageToProto(&image)
@@ -101,7 +102,7 @@ func (l *local) Get(ctx context.Context, req *imagesapi.GetImageRequest, _ ...gr
 func (l *local) List(ctx context.Context, req *imagesapi.ListImagesRequest, _ ...grpc.CallOption) (*imagesapi.ListImagesResponse, error) {
 	images, err := l.store.List(ctx, req.Filters...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &imagesapi.ListImagesResponse{
@@ -125,7 +126,7 @@ func (l *local) Create(ctx context.Context, req *imagesapi.CreateImageRequest, _
 	}
 	created, err := l.store.Create(ctx, image)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	resp.Image = imageToProto(&created)
@@ -157,7 +158,7 @@ func (l *local) Update(ctx context.Context, req *imagesapi.UpdateImageRequest, _
 
 	updated, err := l.store.Update(ctx, image, fieldpaths...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	resp.Image = imageToProto(&updated)
@@ -177,7 +178,7 @@ func (l *local) Delete(ctx context.Context, req *imagesapi.DeleteImageRequest, _
 
 	// Sync option handled here after event is published
 	if err := l.store.Delete(ctx, req.Name, opts...); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	if req.Sync {
diff --git a/plugins/services/introspection/local.go b/plugins/services/introspection/local.go
index 19e7594ef..69b0977d4 100644
--- a/plugins/services/introspection/local.go
+++ b/plugins/services/introspection/local.go
@@ -32,6 +32,12 @@ import (
 
 	api "github.com/containerd/containerd/api/services/introspection/v1"
 	"github.com/containerd/containerd/api/types"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+	"github.com/containerd/typeurl/v2"
+
 	"github.com/containerd/containerd/v2/core/introspection"
 	"github.com/containerd/containerd/v2/pkg/filters"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
@@ -39,10 +45,6 @@ import (
 	"github.com/containerd/containerd/v2/plugins"
 	"github.com/containerd/containerd/v2/plugins/services"
 	"github.com/containerd/containerd/v2/plugins/services/warning"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/plugin"
-	"github.com/containerd/plugin/registry"
-	"github.com/containerd/typeurl/v2"
 )
 
 func init() {
@@ -222,7 +224,7 @@ func pluginToPB(p *plugin.Plugin) *api.Plugin {
 
 	var initErr *rpc.Status
 	if err := p.Err(); err != nil {
-		st, ok := status.FromError(errdefs.ToGRPC(err))
+		st, ok := status.FromError(errgrpc.ToGRPC(err))
 		if ok {
 			var details []*ptypes.Any
 			for _, d := range st.Proto().Details {
@@ -307,7 +309,7 @@ func (l *Local) PluginInfo(ctx context.Context, pluginType, id string, options a
 
 		info, err := pi.PluginInfo(ctx, options)
 		if err != nil {
-			return resp, errdefs.ToGRPC(err)
+			return resp, errgrpc.ToGRPC(err)
 		}
 		ai, err := typeurl.MarshalAny(info)
 		if err != nil {
diff --git a/plugins/services/introspection/service.go b/plugins/services/introspection/service.go
index 09209f188..38bc6fb7c 100644
--- a/plugins/services/introspection/service.go
+++ b/plugins/services/introspection/service.go
@@ -22,15 +22,16 @@ import (
 	"fmt"
 
 	api "github.com/containerd/containerd/api/services/introspection/v1"
-	"github.com/containerd/containerd/v2/core/introspection"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/containerd/v2/plugins/services"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc"
+
+	"github.com/containerd/containerd/v2/core/introspection"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/plugins/services"
 )
 
 func init() {
@@ -71,12 +72,12 @@ func (s *server) Register(server *grpc.Server) error {
 
 func (s *server) Plugins(ctx context.Context, req *api.PluginsRequest) (resp *api.PluginsResponse, err error) {
 	resp, err = s.local.Plugins(ctx, req.Filters...)
-	return resp, errdefs.ToGRPC(err)
+	return resp, errgrpc.ToGRPC(err)
 }
 
 func (s *server) Server(ctx context.Context, _ *ptypes.Empty) (resp *api.ServerResponse, err error) {
 	resp, err = s.local.Server(ctx)
-	return resp, errdefs.ToGRPC(err)
+	return resp, errgrpc.ToGRPC(err)
 }
 
 func (s *server) PluginInfo(ctx context.Context, req *api.PluginInfoRequest) (resp *api.PluginInfoResponse, err error) {
@@ -84,10 +85,10 @@ func (s *server) PluginInfo(ctx context.Context, req *api.PluginInfoRequest) (re
 	if req.Options != nil {
 		options, err = typeurl.UnmarshalAny(req.Options)
 		if err != nil {
-			return resp, errdefs.ToGRPC(fmt.Errorf("failed to unmarshal plugin info Options: %w", err))
+			return resp, errgrpc.ToGRPC(fmt.Errorf("failed to unmarshal plugin info Options: %w", err))
 		}
 	}
 
 	resp, err = s.local.PluginInfo(ctx, req.Type, req.ID, options)
-	return resp, errdefs.ToGRPC(err)
+	return resp, errgrpc.ToGRPC(err)
 }
diff --git a/plugins/services/leases/service.go b/plugins/services/leases/service.go
index 1d254c312..515733f10 100644
--- a/plugins/services/leases/service.go
+++ b/plugins/services/leases/service.go
@@ -20,14 +20,15 @@ import (
 	"context"
 
 	api "github.com/containerd/containerd/api/services/leases/v1"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+	"google.golang.org/grpc"
+
 	"github.com/containerd/containerd/v2/core/leases"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/plugin"
-	"github.com/containerd/plugin/registry"
-	"google.golang.org/grpc"
 )
 
 var empty = &ptypes.Empty{}
@@ -71,7 +72,7 @@ func (s *service) Create(ctx context.Context, r *api.CreateRequest) (*api.Create
 
 	l, err := s.lm.Create(ctx, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.CreateResponse{
@@ -87,7 +88,7 @@ func (s *service) Delete(ctx context.Context, r *api.DeleteRequest) (*ptypes.Emp
 	if err := s.lm.Delete(ctx, leases.Lease{
 		ID: r.ID,
 	}, opts...); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -95,7 +96,7 @@ func (s *service) Delete(ctx context.Context, r *api.DeleteRequest) (*ptypes.Emp
 func (s *service) List(ctx context.Context, r *api.ListRequest) (*api.ListResponse, error) {
 	l, err := s.lm.List(ctx, r.Filters...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	apileases := make([]*api.Lease, len(l))
@@ -117,7 +118,7 @@ func (s *service) AddResource(ctx context.Context, r *api.AddResourceRequest) (*
 		ID:   r.Resource.ID,
 		Type: r.Resource.Type,
 	}); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -131,7 +132,7 @@ func (s *service) DeleteResource(ctx context.Context, r *api.DeleteResourceReque
 		ID:   r.Resource.ID,
 		Type: r.Resource.Type,
 	}); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -143,7 +144,7 @@ func (s *service) ListResources(ctx context.Context, r *api.ListResourcesRequest
 
 	rs, err := s.lm.ListResources(ctx, lease)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	apiResources := make([]*api.Resource, 0, len(rs))
diff --git a/plugins/services/namespaces/local.go b/plugins/services/namespaces/local.go
index 7ab3b0767..966bb7420 100644
--- a/plugins/services/namespaces/local.go
+++ b/plugins/services/namespaces/local.go
@@ -22,19 +22,20 @@ import (
 
 	eventstypes "github.com/containerd/containerd/api/events"
 	api "github.com/containerd/containerd/api/services/namespaces/v1"
-	"github.com/containerd/containerd/v2/core/events"
-	"github.com/containerd/containerd/v2/core/metadata"
-	"github.com/containerd/containerd/v2/pkg/namespaces"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/containerd/v2/plugins/services"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
 	bolt "go.etcd.io/bbolt"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
+
+	"github.com/containerd/containerd/v2/core/events"
+	"github.com/containerd/containerd/v2/core/metadata"
+	"github.com/containerd/containerd/v2/pkg/namespaces"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
+	"github.com/containerd/containerd/v2/plugins"
+	"github.com/containerd/containerd/v2/plugins/services"
 )
 
 var empty = &ptypes.Empty{}
@@ -80,7 +81,7 @@ func (l *local) Get(ctx context.Context, req *api.GetNamespaceRequest, _ ...grpc
 	return &resp, l.withStoreView(ctx, func(ctx context.Context, store namespaces.Store) error {
 		labels, err := store.Labels(ctx, req.Name)
 		if err != nil {
-			return errdefs.ToGRPC(err)
+			return errgrpc.ToGRPC(err)
 		}
 
 		resp.Namespace = &api.Namespace{
@@ -106,7 +107,7 @@ func (l *local) List(ctx context.Context, req *api.ListNamespacesRequest, _ ...g
 			if err != nil {
 				// In general, this should be unlikely, since we are holding a
 				// transaction to service this request.
-				return errdefs.ToGRPC(err)
+				return errgrpc.ToGRPC(err)
 			}
 
 			resp.Namespaces = append(resp.Namespaces, &api.Namespace{
@@ -124,7 +125,7 @@ func (l *local) Create(ctx context.Context, req *api.CreateNamespaceRequest, _ .
 
 	if err := l.withStoreUpdate(ctx, func(ctx context.Context, store namespaces.Store) error {
 		if err := store.Create(ctx, req.Namespace.Name, req.Namespace.Labels); err != nil {
-			return errdefs.ToGRPC(err)
+			return errgrpc.ToGRPC(err)
 		}
 
 		for k, v := range req.Namespace.Labels {
@@ -171,7 +172,7 @@ func (l *local) Update(ctx context.Context, req *api.UpdateNamespaceRequest, _ .
 			// get current set of labels
 			labels, err := store.Labels(ctx, req.Namespace.Name)
 			if err != nil {
-				return errdefs.ToGRPC(err)
+				return errgrpc.ToGRPC(err)
 			}
 
 			for k := range labels {
@@ -206,7 +207,7 @@ func (l *local) Update(ctx context.Context, req *api.UpdateNamespaceRequest, _ .
 
 func (l *local) Delete(ctx context.Context, req *api.DeleteNamespaceRequest, _ ...grpc.CallOption) (*ptypes.Empty, error) {
 	if err := l.withStoreUpdate(ctx, func(ctx context.Context, store namespaces.Store) error {
-		return errdefs.ToGRPC(store.Delete(ctx, req.Name))
+		return errgrpc.ToGRPC(store.Delete(ctx, req.Name))
 	}); err != nil {
 		return empty, err
 	}
diff --git a/plugins/services/sandbox/controller_service.go b/plugins/services/sandbox/controller_service.go
index b0e5ce7d1..21d1c0544 100644
--- a/plugins/services/sandbox/controller_service.go
+++ b/plugins/services/sandbox/controller_service.go
@@ -26,14 +26,16 @@ import (
 
 	eventtypes "github.com/containerd/containerd/api/events"
 	api "github.com/containerd/containerd/api/services/sandbox/v1"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/log"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+
 	"github.com/containerd/containerd/v2/core/events"
 	"github.com/containerd/containerd/v2/core/sandbox"
 	"github.com/containerd/containerd/v2/pkg/protobuf"
 	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/log"
-	"github.com/containerd/plugin"
-	"github.com/containerd/plugin/registry"
 )
 
 func init() {
@@ -105,7 +107,7 @@ func (s *controllerService) Create(ctx context.Context, req *api.ControllerCreat
 	// TODO: Rootfs
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	var sb sandbox.Sandbox
 	if req.Sandbox != nil {
@@ -115,13 +117,13 @@ func (s *controllerService) Create(ctx context.Context, req *api.ControllerCreat
 	}
 	err = ctrl.Create(ctx, sb, sandbox.WithOptions(req.GetOptions()))
 	if err != nil {
-		return &api.ControllerCreateResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerCreateResponse{}, errgrpc.ToGRPC(err)
 	}
 
 	if err := s.publisher.Publish(ctx, "sandboxes/create", &eventtypes.SandboxCreate{
 		SandboxID: req.GetSandboxID(),
 	}); err != nil {
-		return &api.ControllerCreateResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerCreateResponse{}, errgrpc.ToGRPC(err)
 	}
 
 	return &api.ControllerCreateResponse{
@@ -133,17 +135,17 @@ func (s *controllerService) Start(ctx context.Context, req *api.ControllerStartR
 	log.G(ctx).WithField("req", req).Debug("start sandbox")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	inst, err := ctrl.Start(ctx, req.GetSandboxID())
 	if err != nil {
-		return &api.ControllerStartResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerStartResponse{}, errgrpc.ToGRPC(err)
 	}
 
 	if err := s.publisher.Publish(ctx, "sandboxes/start", &eventtypes.SandboxStart{
 		SandboxID: req.GetSandboxID(),
 	}); err != nil {
-		return &api.ControllerStartResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerStartResponse{}, errgrpc.ToGRPC(err)
 	}
 
 	return &api.ControllerStartResponse{
@@ -158,20 +160,20 @@ func (s *controllerService) Stop(ctx context.Context, req *api.ControllerStopReq
 	log.G(ctx).WithField("req", req).Debug("delete sandbox")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
-	return &api.ControllerStopResponse{}, errdefs.ToGRPC(ctrl.Stop(ctx, req.GetSandboxID(), sandbox.WithTimeout(time.Duration(req.TimeoutSecs)*time.Second)))
+	return &api.ControllerStopResponse{}, errgrpc.ToGRPC(ctrl.Stop(ctx, req.GetSandboxID(), sandbox.WithTimeout(time.Duration(req.TimeoutSecs)*time.Second)))
 }
 
 func (s *controllerService) Wait(ctx context.Context, req *api.ControllerWaitRequest) (*api.ControllerWaitResponse, error) {
 	log.G(ctx).WithField("req", req).Debug("wait sandbox")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	exitStatus, err := ctrl.Wait(ctx, req.GetSandboxID())
 	if err != nil {
-		return &api.ControllerWaitResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerWaitResponse{}, errgrpc.ToGRPC(err)
 	}
 
 	if err := s.publisher.Publish(ctx, "sandboxes/exit", &eventtypes.SandboxExit{
@@ -179,7 +181,7 @@ func (s *controllerService) Wait(ctx context.Context, req *api.ControllerWaitReq
 		ExitStatus: exitStatus.ExitStatus,
 		ExitedAt:   protobuf.ToTimestamp(exitStatus.ExitedAt),
 	}); err != nil {
-		return &api.ControllerWaitResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerWaitResponse{}, errgrpc.ToGRPC(err)
 	}
 
 	return &api.ControllerWaitResponse{
@@ -192,11 +194,11 @@ func (s *controllerService) Status(ctx context.Context, req *api.ControllerStatu
 	log.G(ctx).WithField("req", req).Debug("sandbox status")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	cstatus, err := ctrl.Status(ctx, req.GetSandboxID(), req.GetVerbose())
 	if err != nil {
-		return &api.ControllerStatusResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerStatusResponse{}, errgrpc.ToGRPC(err)
 	}
 	extra := &anypb.Any{}
 	if cstatus.Extra != nil {
@@ -220,20 +222,20 @@ func (s *controllerService) Shutdown(ctx context.Context, req *api.ControllerShu
 	log.G(ctx).WithField("req", req).Debug("shutdown sandbox")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
-	return &api.ControllerShutdownResponse{}, errdefs.ToGRPC(ctrl.Shutdown(ctx, req.GetSandboxID()))
+	return &api.ControllerShutdownResponse{}, errgrpc.ToGRPC(ctrl.Shutdown(ctx, req.GetSandboxID()))
 }
 
 func (s *controllerService) Metrics(ctx context.Context, req *api.ControllerMetricsRequest) (*api.ControllerMetricsResponse, error) {
 	log.G(ctx).WithField("req", req).Debug("sandbox metrics")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	metrics, err := ctrl.Metrics(ctx, req.GetSandboxID())
 	if err != nil {
-		return &api.ControllerMetricsResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerMetricsResponse{}, errgrpc.ToGRPC(err)
 	}
 	return &api.ControllerMetricsResponse{
 		Metrics: metrics,
@@ -246,14 +248,14 @@ func (s *controllerService) Update(
 	log.G(ctx).WithField("req", req).Debug("sandbox update resource")
 	ctrl, err := s.getController(req.Sandboxer)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	if req.Sandbox == nil {
 		return nil, fmt.Errorf("sandbox can not be nil")
 	}
 	err = ctrl.Update(ctx, req.SandboxID, sandbox.FromProto(req.Sandbox), req.Fields...)
 	if err != nil {
-		return &api.ControllerUpdateResponse{}, errdefs.ToGRPC(err)
+		return &api.ControllerUpdateResponse{}, errgrpc.ToGRPC(err)
 	}
 	return &api.ControllerUpdateResponse{}, nil
 }
diff --git a/plugins/services/sandbox/store_service.go b/plugins/services/sandbox/store_service.go
index 8e6edde0a..6ac424813 100644
--- a/plugins/services/sandbox/store_service.go
+++ b/plugins/services/sandbox/store_service.go
@@ -23,12 +23,13 @@ import (
 
 	api "github.com/containerd/containerd/api/services/sandbox/v1"
 	"github.com/containerd/containerd/api/types"
-	"github.com/containerd/containerd/v2/core/sandbox"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
+
+	"github.com/containerd/containerd/v2/core/sandbox"
+	"github.com/containerd/containerd/v2/plugins"
 )
 
 func init() {
@@ -65,7 +66,7 @@ func (s *sandboxService) Create(ctx context.Context, req *api.StoreCreateRequest
 	log.G(ctx).WithField("req", req).Debug("create sandbox")
 	sb, err := s.store.Create(ctx, sandbox.FromProto(req.Sandbox))
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.StoreCreateResponse{Sandbox: sandbox.ToProto(&sb)}, nil
@@ -76,7 +77,7 @@ func (s *sandboxService) Update(ctx context.Context, req *api.StoreUpdateRequest
 
 	sb, err := s.store.Update(ctx, sandbox.FromProto(req.Sandbox), req.Fields...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.StoreUpdateResponse{Sandbox: sandbox.ToProto(&sb)}, nil
@@ -87,7 +88,7 @@ func (s *sandboxService) List(ctx context.Context, req *api.StoreListRequest) (*
 
 	resp, err := s.store.List(ctx, req.Filters...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	list := make([]*types.Sandbox, len(resp))
@@ -102,7 +103,7 @@ func (s *sandboxService) Get(ctx context.Context, req *api.StoreGetRequest) (*ap
 	log.G(ctx).WithField("req", req).Debug("get sandbox")
 	resp, err := s.store.Get(ctx, req.SandboxID)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	desc := sandbox.ToProto(&resp)
@@ -112,7 +113,7 @@ func (s *sandboxService) Get(ctx context.Context, req *api.StoreGetRequest) (*ap
 func (s *sandboxService) Delete(ctx context.Context, req *api.StoreDeleteRequest) (*api.StoreDeleteResponse, error) {
 	log.G(ctx).WithField("req", req).Debug("delete sandbox")
 	if err := s.store.Delete(ctx, req.SandboxID); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.StoreDeleteResponse{}, nil
diff --git a/plugins/services/snapshots/service.go b/plugins/services/snapshots/service.go
index 2611d81da..24274f48e 100644
--- a/plugins/services/snapshots/service.go
+++ b/plugins/services/snapshots/service.go
@@ -20,17 +20,19 @@ import (
 	"context"
 
 	snapshotsapi "github.com/containerd/containerd/api/services/snapshots/v1"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/log"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+	"google.golang.org/grpc"
+
 	"github.com/containerd/containerd/v2/core/mount"
 	"github.com/containerd/containerd/v2/core/snapshots"
 	"github.com/containerd/containerd/v2/core/snapshots/proxy"
 	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
 	"github.com/containerd/containerd/v2/plugins"
 	"github.com/containerd/containerd/v2/plugins/services"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/log"
-	"github.com/containerd/plugin"
-	"github.com/containerd/plugin/registry"
-	"google.golang.org/grpc"
 )
 
 func init() {
@@ -61,12 +63,12 @@ func newService(ic *plugin.InitContext) (interface{}, error) {
 
 func (s *service) getSnapshotter(name string) (snapshots.Snapshotter, error) {
 	if name == "" {
-		return nil, errdefs.ToGRPCf(errdefs.ErrInvalidArgument, "snapshotter argument missing")
+		return nil, errgrpc.ToGRPCf(errdefs.ErrInvalidArgument, "snapshotter argument missing")
 	}
 
 	sn := s.ss[name]
 	if sn == nil {
-		return nil, errdefs.ToGRPCf(errdefs.ErrInvalidArgument, "snapshotter not loaded: %s", name)
+		return nil, errgrpc.ToGRPCf(errdefs.ErrInvalidArgument, "snapshotter not loaded: %s", name)
 	}
 	return sn, nil
 }
@@ -89,7 +91,7 @@ func (s *service) Prepare(ctx context.Context, pr *snapshotsapi.PrepareSnapshotR
 	}
 	mounts, err := sn.Prepare(ctx, pr.Key, pr.Parent, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.PrepareSnapshotResponse{
@@ -109,7 +111,7 @@ func (s *service) View(ctx context.Context, pr *snapshotsapi.ViewSnapshotRequest
 	}
 	mounts, err := sn.View(ctx, pr.Key, pr.Parent, opts...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &snapshotsapi.ViewSnapshotResponse{
 		Mounts: mount.ToProto(mounts),
@@ -125,7 +127,7 @@ func (s *service) Mounts(ctx context.Context, mr *snapshotsapi.MountsRequest) (*
 
 	mounts, err := sn.Mounts(ctx, mr.Key)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &snapshotsapi.MountsResponse{
 		Mounts: mount.ToProto(mounts),
@@ -144,7 +146,7 @@ func (s *service) Commit(ctx context.Context, cr *snapshotsapi.CommitSnapshotReq
 		opts = append(opts, snapshots.WithLabels(cr.Labels))
 	}
 	if err := sn.Commit(ctx, cr.Name, cr.Key, opts...); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
@@ -158,7 +160,7 @@ func (s *service) Remove(ctx context.Context, rr *snapshotsapi.RemoveSnapshotReq
 	}
 
 	if err := sn.Remove(ctx, rr.Key); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
@@ -173,7 +175,7 @@ func (s *service) Stat(ctx context.Context, sr *snapshotsapi.StatSnapshotRequest
 
 	info, err := sn.Stat(ctx, sr.Key)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.StatSnapshotResponse{Info: proxy.InfoToProto(info)}, nil
@@ -188,7 +190,7 @@ func (s *service) Update(ctx context.Context, sr *snapshotsapi.UpdateSnapshotReq
 
 	info, err := sn.Update(ctx, proxy.InfoFromProto(sr.Info), sr.UpdateMask.GetPaths()...)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &snapshotsapi.UpdateSnapshotResponse{Info: proxy.InfoToProto(info)}, nil
@@ -242,7 +244,7 @@ func (s *service) Usage(ctx context.Context, ur *snapshotsapi.UsageRequest) (*sn
 
 	usage, err := sn.Usage(ctx, ur.Key)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return proxy.UsageToProto(usage), nil
@@ -256,12 +258,12 @@ func (s *service) Cleanup(ctx context.Context, cr *snapshotsapi.CleanupRequest)
 
 	c, ok := sn.(snapshots.Cleaner)
 	if !ok {
-		return nil, errdefs.ToGRPCf(errdefs.ErrNotImplemented, "snapshotter does not implement Cleanup method")
+		return nil, errgrpc.ToGRPCf(errdefs.ErrNotImplemented, "snapshotter does not implement Cleanup method")
 	}
 
 	err = c.Cleanup(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return empty, nil
diff --git a/plugins/services/streaming/service.go b/plugins/services/streaming/service.go
index d83e4344a..f576563fe 100644
--- a/plugins/services/streaming/service.go
+++ b/plugins/services/streaming/service.go
@@ -21,15 +21,16 @@ import (
 	"io"
 
 	api "github.com/containerd/containerd/api/services/streaming/v1"
-	"github.com/containerd/containerd/v2/core/streaming"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/containerd/v2/plugins"
-	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
 	"github.com/containerd/typeurl/v2"
 	"google.golang.org/grpc"
+
+	"github.com/containerd/containerd/v2/core/streaming"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
+	"github.com/containerd/containerd/v2/plugins"
 )
 
 var emptyResponse typeurl.Any
@@ -110,9 +111,9 @@ type serviceStream struct {
 }
 
 func (ss *serviceStream) Send(a typeurl.Any) (err error) {
-	err = errdefs.FromGRPC(ss.s.Send(typeurl.MarshalProto(a)))
+	err = errgrpc.ToNative(ss.s.Send(typeurl.MarshalProto(a)))
 	if !errors.Is(err, io.EOF) {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 	}
 	return
 }
@@ -120,7 +121,7 @@ func (ss *serviceStream) Send(a typeurl.Any) (err error) {
 func (ss *serviceStream) Recv() (a typeurl.Any, err error) {
 	a, err = ss.s.Recv()
 	if !errors.Is(err, io.EOF) {
-		err = errdefs.FromGRPC(err)
+		err = errgrpc.ToNative(err)
 	}
 	return
 }
diff --git a/plugins/services/tasks/local.go b/plugins/services/tasks/local.go
index f0d657cd4..faf4b69f2 100644
--- a/plugins/services/tasks/local.go
+++ b/plugins/services/tasks/local.go
@@ -30,6 +30,18 @@ import (
 	"github.com/containerd/containerd/api/types"
 	"github.com/containerd/containerd/api/types/runc/options"
 	"github.com/containerd/containerd/api/types/task"
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
+	"github.com/containerd/log"
+	"github.com/containerd/plugin"
+	"github.com/containerd/plugin/registry"
+	"github.com/containerd/typeurl/v2"
+	"github.com/opencontainers/go-digest"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+
 	"github.com/containerd/containerd/v2/core/containers"
 	"github.com/containerd/containerd/v2/core/content"
 	"github.com/containerd/containerd/v2/core/events"
@@ -47,16 +59,6 @@ import (
 	"github.com/containerd/containerd/v2/pkg/timeout"
 	"github.com/containerd/containerd/v2/plugins"
 	"github.com/containerd/containerd/v2/plugins/services"
-	"github.com/containerd/errdefs"
-	"github.com/containerd/log"
-	"github.com/containerd/plugin"
-	"github.com/containerd/plugin/registry"
-	"github.com/containerd/typeurl/v2"
-	"github.com/opencontainers/go-digest"
-	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
-	"google.golang.org/grpc"
-	"google.golang.org/grpc/codes"
-	"google.golang.org/grpc/status"
 )
 
 var (
@@ -153,7 +155,7 @@ type local struct {
 func (l *local) Create(ctx context.Context, r *api.CreateTaskRequest, _ ...grpc.CallOption) (*api.CreateTaskResponse, error) {
 	container, err := l.getContainer(ctx, r.ContainerID)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	var (
@@ -228,14 +230,14 @@ func (l *local) Create(ctx context.Context, r *api.CreateTaskRequest, _ ...grpc.
 
 	_, err = rtime.Get(ctx, r.ContainerID)
 	if err != nil && !errdefs.IsNotFound(err) {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	if err == nil {
-		return nil, errdefs.ToGRPC(fmt.Errorf("task %s: %w", r.ContainerID, errdefs.ErrAlreadyExists))
+		return nil, errgrpc.ToGRPC(fmt.Errorf("task %s: %w", r.ContainerID, errdefs.ErrAlreadyExists))
 	}
 	c, err := rtime.Create(ctx, r.ContainerID, opts)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	labels := map[string]string{"runtime": container.Runtime.Name}
 	if err := l.monitor.Monitor(c, labels); err != nil {
@@ -259,15 +261,15 @@ func (l *local) Start(ctx context.Context, r *api.StartRequest, _ ...grpc.CallOp
 	p := runtime.Process(t)
 	if r.ExecID != "" {
 		if p, err = t.Process(ctx, r.ExecID); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	if err := p.Start(ctx); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	state, err := p.State(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &api.StartResponse{
 		Pid: state.Pid,
@@ -292,7 +294,7 @@ func (l *local) Delete(ctx context.Context, r *api.DeleteTaskRequest, _ ...grpc.
 
 	exit, err := l.v2Runtime.Delete(ctx, r.ContainerID)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	return &api.DeleteResponse{
@@ -309,11 +311,11 @@ func (l *local) DeleteProcess(ctx context.Context, r *api.DeleteProcessRequest,
 	}
 	process, err := t.Process(ctx, r.ExecID)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	exit, err := process.Delete(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &api.DeleteResponse{
 		ID:         r.ExecID,
@@ -370,12 +372,12 @@ func (l *local) Get(ctx context.Context, r *api.GetRequest, _ ...grpc.CallOption
 	p := runtime.Process(task)
 	if r.ExecID != "" {
 		if p, err = task.Process(ctx, r.ExecID); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	t, err := getProcessState(ctx, p)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &api.GetResponse{
 		Process: t,
@@ -386,7 +388,7 @@ func (l *local) List(ctx context.Context, r *api.ListTasksRequest, _ ...grpc.Cal
 	resp := &api.ListTasksResponse{}
 	tasks, err := l.v2Runtime.Tasks(ctx, false)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	addTasks(ctx, resp, tasks)
 	return resp, nil
@@ -412,7 +414,7 @@ func (l *local) Pause(ctx context.Context, r *api.PauseTaskRequest, _ ...grpc.Ca
 	}
 	err = t.Pause(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -424,7 +426,7 @@ func (l *local) Resume(ctx context.Context, r *api.ResumeTaskRequest, _ ...grpc.
 	}
 	err = t.Resume(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -437,11 +439,11 @@ func (l *local) Kill(ctx context.Context, r *api.KillRequest, _ ...grpc.CallOpti
 	p := runtime.Process(t)
 	if r.ExecID != "" {
 		if p, err = t.Process(ctx, r.ExecID); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	if err := p.Kill(ctx, r.Signal, r.All); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -453,7 +455,7 @@ func (l *local) ListPids(ctx context.Context, r *api.ListPidsRequest, _ ...grpc.
 	}
 	processList, err := t.Pids(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	var processes []*task.ProcessInfo
 	for _, p := range processList {
@@ -491,7 +493,7 @@ func (l *local) Exec(ctx context.Context, r *api.ExecProcessRequest, _ ...grpc.C
 			Terminal: r.Terminal,
 		},
 	}); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -504,14 +506,14 @@ func (l *local) ResizePty(ctx context.Context, r *api.ResizePtyRequest, _ ...grp
 	p := runtime.Process(t)
 	if r.ExecID != "" {
 		if p, err = t.Process(ctx, r.ExecID); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	if err := p.ResizePty(ctx, runtime.ConsoleSize{
 		Width:  r.Width,
 		Height: r.Height,
 	}); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -524,12 +526,12 @@ func (l *local) CloseIO(ctx context.Context, r *api.CloseIORequest, _ ...grpc.Ca
 	p := runtime.Process(t)
 	if r.ExecID != "" {
 		if p, err = t.Process(ctx, r.ExecID); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	if r.Stdin {
 		if err := p.CloseIO(ctx); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	return empty, nil
@@ -553,12 +555,12 @@ func (l *local) Checkpoint(ctx context.Context, r *api.CheckpointTaskRequest, _
 		checkpointImageExists = true
 		image, err = os.MkdirTemp(os.Getenv("XDG_RUNTIME_DIR"), "ctrd-checkpoint")
 		if err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 		defer os.RemoveAll(image)
 	}
 	if err := t.Checkpoint(ctx, image, r.Options); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	// do not commit checkpoint image if checkpoint ImagePath is passed,
 	// return if checkpointImageExists is false
@@ -584,7 +586,7 @@ func (l *local) Checkpoint(ctx context.Context, r *api.CheckpointTaskRequest, _
 	spec := bytes.NewReader(data)
 	specD, err := l.writeContent(ctx, images.MediaTypeContainerd1CheckpointConfig, filepath.Join(image, "spec"), spec)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &api.CheckpointTaskResponse{
 		Descriptors: []*types.Descriptor{
@@ -600,7 +602,7 @@ func (l *local) Update(ctx context.Context, r *api.UpdateTaskRequest, _ ...grpc.
 		return nil, err
 	}
 	if err := t.Update(ctx, r.Resources, r.Annotations); err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return empty, nil
 }
@@ -627,12 +629,12 @@ func (l *local) Wait(ctx context.Context, r *api.WaitRequest, _ ...grpc.CallOpti
 	p := runtime.Process(t)
 	if r.ExecID != "" {
 		if p, err = t.Process(ctx, r.ExecID); err != nil {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	exit, err := p.Wait(ctx)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &api.WaitResponse{
 		ExitStatus: exit.Status,
@@ -697,7 +699,7 @@ func (l *local) getContainer(ctx context.Context, id string) (*containers.Contai
 	var container containers.Container
 	container, err := l.containers.Get(ctx, id)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	return &container, nil
 }
diff --git a/plugins/services/transfer/service.go b/plugins/services/transfer/service.go
index 8dfca3816..9b4113f20 100644
--- a/plugins/services/transfer/service.go
+++ b/plugins/services/transfer/service.go
@@ -22,13 +22,8 @@ import (
 	transferapi "github.com/containerd/containerd/api/services/transfer/v1"
 	"github.com/containerd/containerd/api/types"
 	transferTypes "github.com/containerd/containerd/api/types/transfer"
-	"github.com/containerd/containerd/v2/core/streaming"
-	"github.com/containerd/containerd/v2/core/transfer"
-	tplugins "github.com/containerd/containerd/v2/core/transfer/plugins"
-	"github.com/containerd/containerd/v2/pkg/oci"
-	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
-	"github.com/containerd/containerd/v2/plugins"
 	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/errgrpc"
 	"github.com/containerd/log"
 	"github.com/containerd/plugin"
 	"github.com/containerd/plugin/registry"
@@ -37,6 +32,13 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 	"google.golang.org/protobuf/types/known/emptypb"
+
+	"github.com/containerd/containerd/v2/core/streaming"
+	"github.com/containerd/containerd/v2/core/transfer"
+	tplugins "github.com/containerd/containerd/v2/core/transfer/plugins"
+	"github.com/containerd/containerd/v2/pkg/oci"
+	ptypes "github.com/containerd/containerd/v2/pkg/protobuf/types"
+	"github.com/containerd/containerd/v2/plugins"
 )
 
 var empty = &ptypes.Empty{}
@@ -91,7 +93,7 @@ func (s *service) Transfer(ctx context.Context, req *transferapi.TransferRequest
 		if req.Options.ProgressStream != "" {
 			stream, err := s.streamManager.Get(ctx, req.Options.ProgressStream)
 			if err != nil {
-				return nil, errdefs.ToGRPC(err)
+				return nil, errgrpc.ToGRPC(err)
 			}
 			defer stream.Close()
 
@@ -123,18 +125,18 @@ func (s *service) Transfer(ctx context.Context, req *transferapi.TransferRequest
 	}
 	src, err := s.convertAny(ctx, req.Source)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 	dst, err := s.convertAny(ctx, req.Destination)
 	if err != nil {
-		return nil, errdefs.ToGRPC(err)
+		return nil, errgrpc.ToGRPC(err)
 	}
 
 	for _, t := range s.transferrers {
 		if err := t.Transfer(ctx, src, dst, transferOpts...); err == nil {
 			return empty, nil
 		} else if !errdefs.IsNotImplemented(err) {
-			return nil, errdefs.ToGRPC(err)
+			return nil, errgrpc.ToGRPC(err)
 		}
 	}
 	return nil, status.Errorf(codes.Unimplemented, "method Transfer not implemented for %s to %s", req.Source.GetTypeUrl(), req.Destination.GetTypeUrl())
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go b/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go
index 6238e103b..a15609abd 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/hns/hnsendpoint.go
@@ -29,7 +29,7 @@ const (
 )
 
 func (es EndpointState) String() string {
-	return [...]string{"Uninitialized", "Attached", "AttachedSharing", "Detached", "Degraded", "Destroyed"}[es]
+	return [...]string{"Uninitialized", "Created", "Attached", "AttachedSharing", "Detached", "Degraded", "Destroyed"}[es]
 }
 
 // HNSEndpoint represents a network endpoint in HNS
diff --git a/vendor/github.com/Microsoft/hcsshim/internal/oc/errors.go b/vendor/github.com/Microsoft/hcsshim/internal/oc/errors.go
index 8c41a3661..995a854f2 100644
--- a/vendor/github.com/Microsoft/hcsshim/internal/oc/errors.go
+++ b/vendor/github.com/Microsoft/hcsshim/internal/oc/errors.go
@@ -6,7 +6,7 @@ import (
 	"net"
 	"os"
 
-	"github.com/containerd/errdefs"
+	"github.com/containerd/containerd/errdefs"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
diff --git a/vendor/github.com/containerd/containerd/LICENSE b/vendor/github.com/containerd/containerd/LICENSE
new file mode 100644
index 000000000..584149b6e
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/containerd/containerd/NOTICE b/vendor/github.com/containerd/containerd/NOTICE
new file mode 100644
index 000000000..8915f0277
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/NOTICE
@@ -0,0 +1,16 @@
+Docker
+Copyright 2012-2015 Docker, Inc.
+
+This product includes software developed at Docker, Inc. (https://www.docker.com).
+
+The following is courtesy of our legal counsel:
+
+
+Use and transfer of Docker may be subject to certain restrictions by the
+United States and other governments.
+It is your responsibility to ensure that your use and/or transfer does not
+violate applicable laws.
+
+For more information, please see https://www.bis.doc.gov
+
+See also https://www.apache.org/dev/crypto.html and/or seek legal counsel.
diff --git a/vendor/github.com/containerd/containerd/errdefs/errors.go b/vendor/github.com/containerd/containerd/errdefs/errors.go
new file mode 100644
index 000000000..de22cadd4
--- /dev/null
+++ b/vendor/github.com/containerd/containerd/errdefs/errors.go
@@ -0,0 +1,72 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package errdefs defines the common errors used throughout containerd
+// packages.
+//
+// Use with fmt.Errorf to add context to an error.
+//
+// To detect an error class, use the IsXXX functions to tell whether an error
+// is of a certain type.
+package errdefs
+
+import (
+	"github.com/containerd/errdefs"
+)
+
+// Definitions of common error types used throughout containerd. All containerd
+// errors returned by most packages will map into one of these errors classes.
+// Packages should return errors of these types when they want to instruct a
+// client to take a particular action.
+//
+// These errors map closely to grpc errors.
+var (
+	ErrUnknown            = errdefs.ErrUnknown
+	ErrInvalidArgument    = errdefs.ErrInvalidArgument
+	ErrNotFound           = errdefs.ErrNotFound
+	ErrAlreadyExists      = errdefs.ErrAlreadyExists
+	ErrPermissionDenied   = errdefs.ErrPermissionDenied
+	ErrResourceExhausted  = errdefs.ErrResourceExhausted
+	ErrFailedPrecondition = errdefs.ErrFailedPrecondition
+	ErrConflict           = errdefs.ErrConflict
+	ErrNotModified        = errdefs.ErrNotModified
+	ErrAborted            = errdefs.ErrAborted
+	ErrOutOfRange         = errdefs.ErrOutOfRange
+	ErrNotImplemented     = errdefs.ErrNotImplemented
+	ErrInternal           = errdefs.ErrInternal
+	ErrUnavailable        = errdefs.ErrUnavailable
+	ErrDataLoss           = errdefs.ErrDataLoss
+	ErrUnauthenticated    = errdefs.ErrUnauthenticated
+
+	IsCanceled           = errdefs.IsCanceled
+	IsUnknown            = errdefs.IsUnknown
+	IsInvalidArgument    = errdefs.IsInvalidArgument
+	IsDeadlineExceeded   = errdefs.IsDeadlineExceeded
+	IsNotFound           = errdefs.IsNotFound
+	IsAlreadyExists      = errdefs.IsAlreadyExists
+	IsPermissionDenied   = errdefs.IsPermissionDenied
+	IsResourceExhausted  = errdefs.IsResourceExhausted
+	IsFailedPrecondition = errdefs.IsFailedPrecondition
+	IsConflict           = errdefs.IsConflict
+	IsNotModified        = errdefs.IsNotModified
+	IsAborted            = errdefs.IsAborted
+	IsOutOfRange         = errdefs.IsOutOfRange
+	IsNotImplemented     = errdefs.IsNotImplemented
+	IsInternal           = errdefs.IsInternal
+	IsUnavailable        = errdefs.IsUnavailable
+	IsDataLoss           = errdefs.IsDataLoss
+	IsUnauthorized       = errdefs.IsUnauthorized
+)
diff --git a/vendor/github.com/containerd/errdefs/grpc.go b/vendor/github.com/containerd/containerd/errdefs/grpc.go
similarity index 100%
rename from vendor/github.com/containerd/errdefs/grpc.go
rename to vendor/github.com/containerd/containerd/errdefs/grpc.go
diff --git a/vendor/github.com/containerd/errdefs/errors.go b/vendor/github.com/containerd/errdefs/errors.go
index 876225597..f654d1964 100644
--- a/vendor/github.com/containerd/errdefs/errors.go
+++ b/vendor/github.com/containerd/errdefs/errors.go
@@ -21,9 +21,6 @@
 //
 // To detect an error class, use the IsXXX functions to tell whether an error
 // is of a certain type.
-//
-// The functions ToGRPC and FromGRPC can be used to map server-side and
-// client-side errors to the correct types.
 package errdefs
 
 import (
@@ -36,57 +33,411 @@ import (
 // Packages should return errors of these types when they want to instruct a
 // client to take a particular action.
 //
-// For the most part, we just try to provide local grpc errors. Most conditions
-// map very well to those defined by grpc.
+// These errors map closely to grpc errors.
 var (
-	ErrUnknown            = errors.New("unknown") // used internally to represent a missed mapping.
-	ErrInvalidArgument    = errors.New("invalid argument")
-	ErrNotFound           = errors.New("not found")
-	ErrAlreadyExists      = errors.New("already exists")
-	ErrFailedPrecondition = errors.New("failed precondition")
-	ErrUnavailable        = errors.New("unavailable")
-	ErrNotImplemented     = errors.New("not implemented") // represents not supported and unimplemented
+	ErrUnknown            = errUnknown{}
+	ErrInvalidArgument    = errInvalidArgument{}
+	ErrNotFound           = errNotFound{}
+	ErrAlreadyExists      = errAlreadyExists{}
+	ErrPermissionDenied   = errPermissionDenied{}
+	ErrResourceExhausted  = errResourceExhausted{}
+	ErrFailedPrecondition = errFailedPrecondition{}
+	ErrConflict           = errConflict{}
+	ErrNotModified        = errNotModified{}
+	ErrAborted            = errAborted{}
+	ErrOutOfRange         = errOutOfRange{}
+	ErrNotImplemented     = errNotImplemented{}
+	ErrInternal           = errInternal{}
+	ErrUnavailable        = errUnavailable{}
+	ErrDataLoss           = errDataLoss{}
+	ErrUnauthenticated    = errUnauthorized{}
 )
 
-// IsInvalidArgument returns true if the error is due to an invalid argument
-func IsInvalidArgument(err error) bool {
-	return errors.Is(err, ErrInvalidArgument)
-}
-
-// IsNotFound returns true if the error is due to a missing object
-func IsNotFound(err error) bool {
-	return errors.Is(err, ErrNotFound)
-}
-
-// IsAlreadyExists returns true if the error is due to an already existing
-// metadata item
-func IsAlreadyExists(err error) bool {
-	return errors.Is(err, ErrAlreadyExists)
-}
-
-// IsFailedPrecondition returns true if an operation could not proceed to the
-// lack of a particular condition
-func IsFailedPrecondition(err error) bool {
-	return errors.Is(err, ErrFailedPrecondition)
-}
-
-// IsUnavailable returns true if the error is due to a resource being unavailable
-func IsUnavailable(err error) bool {
-	return errors.Is(err, ErrUnavailable)
-}
-
-// IsNotImplemented returns true if the error is due to not being implemented
-func IsNotImplemented(err error) bool {
-	return errors.Is(err, ErrNotImplemented)
+// cancelled maps to Moby's "ErrCancelled"
+type cancelled interface {
+	Cancelled()
 }
 
 // IsCanceled returns true if the error is due to `context.Canceled`.
 func IsCanceled(err error) bool {
-	return errors.Is(err, context.Canceled)
+	return errors.Is(err, context.Canceled) || isInterface[cancelled](err)
+}
+
+type errUnknown struct{}
+
+func (errUnknown) Error() string { return "unknown" }
+
+func (errUnknown) Unknown() {}
+
+func (e errUnknown) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// unknown maps to Moby's "ErrUnknown"
+type unknown interface {
+	Unknown()
+}
+
+// IsUnknown returns true if the error is due to an unknown error,
+// unhandled condition or unexpected response.
+func IsUnknown(err error) bool {
+	return errors.Is(err, errUnknown{}) || isInterface[unknown](err)
+}
+
+type errInvalidArgument struct{}
+
+func (errInvalidArgument) Error() string { return "invalid argument" }
+
+func (errInvalidArgument) InvalidParameter() {}
+
+func (e errInvalidArgument) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// invalidParameter maps to Moby's "ErrInvalidParameter"
+type invalidParameter interface {
+	InvalidParameter()
+}
+
+// IsInvalidArgument returns true if the error is due to an invalid argument
+func IsInvalidArgument(err error) bool {
+	return errors.Is(err, ErrInvalidArgument) || isInterface[invalidParameter](err)
+}
+
+// deadlineExceed maps to Moby's "ErrDeadline"
+type deadlineExceeded interface {
+	DeadlineExceeded()
 }
 
 // IsDeadlineExceeded returns true if the error is due to
 // `context.DeadlineExceeded`.
 func IsDeadlineExceeded(err error) bool {
-	return errors.Is(err, context.DeadlineExceeded)
+	return errors.Is(err, context.DeadlineExceeded) || isInterface[deadlineExceeded](err)
+}
+
+type errNotFound struct{}
+
+func (errNotFound) Error() string { return "not found" }
+
+func (errNotFound) NotFound() {}
+
+func (e errNotFound) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// notFound maps to Moby's "ErrNotFound"
+type notFound interface {
+	NotFound()
+}
+
+// IsNotFound returns true if the error is due to a missing object
+func IsNotFound(err error) bool {
+	return errors.Is(err, ErrNotFound) || isInterface[notFound](err)
+}
+
+type errAlreadyExists struct{}
+
+func (errAlreadyExists) Error() string { return "already exists" }
+
+func (errAlreadyExists) AlreadyExists() {}
+
+func (e errAlreadyExists) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+type alreadyExists interface {
+	AlreadyExists()
+}
+
+// IsAlreadyExists returns true if the error is due to an already existing
+// metadata item
+func IsAlreadyExists(err error) bool {
+	return errors.Is(err, ErrAlreadyExists) || isInterface[alreadyExists](err)
+}
+
+type errPermissionDenied struct{}
+
+func (errPermissionDenied) Error() string { return "permission denied" }
+
+func (errPermissionDenied) Forbidden() {}
+
+func (e errPermissionDenied) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// forbidden maps to Moby's "ErrForbidden"
+type forbidden interface {
+	Forbidden()
+}
+
+// IsPermissionDenied returns true if the error is due to permission denied
+// or forbidden (403) response
+func IsPermissionDenied(err error) bool {
+	return errors.Is(err, ErrPermissionDenied) || isInterface[forbidden](err)
+}
+
+type errResourceExhausted struct{}
+
+func (errResourceExhausted) Error() string { return "resource exhausted" }
+
+func (errResourceExhausted) ResourceExhausted() {}
+
+func (e errResourceExhausted) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+type resourceExhausted interface {
+	ResourceExhausted()
+}
+
+// IsResourceExhausted returns true if the error is due to
+// a lack of resources or too many attempts.
+func IsResourceExhausted(err error) bool {
+	return errors.Is(err, errResourceExhausted{}) || isInterface[resourceExhausted](err)
+}
+
+type errFailedPrecondition struct{}
+
+func (e errFailedPrecondition) Error() string { return "failed precondition" }
+
+func (errFailedPrecondition) FailedPrecondition() {}
+
+func (e errFailedPrecondition) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+type failedPrecondition interface {
+	FailedPrecondition()
+}
+
+// IsFailedPrecondition returns true if an operation could not proceed due to
+// the lack of a particular condition
+func IsFailedPrecondition(err error) bool {
+	return errors.Is(err, errFailedPrecondition{}) || isInterface[failedPrecondition](err)
+}
+
+type errConflict struct{}
+
+func (errConflict) Error() string { return "conflict" }
+
+func (errConflict) Conflict() {}
+
+func (e errConflict) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// conflict maps to Moby's "ErrConflict"
+type conflict interface {
+	Conflict()
+}
+
+// IsConflict returns true if an operation could not proceed due to
+// a conflict.
+func IsConflict(err error) bool {
+	return errors.Is(err, errConflict{}) || isInterface[conflict](err)
+}
+
+type errNotModified struct{}
+
+func (errNotModified) Error() string { return "not modified" }
+
+func (errNotModified) NotModified() {}
+
+func (e errNotModified) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// notModified maps to Moby's "ErrNotModified"
+type notModified interface {
+	NotModified()
+}
+
+// IsNotModified returns true if an operation could not proceed due
+// to an object not modified from a previous state.
+func IsNotModified(err error) bool {
+	return errors.Is(err, errNotModified{}) || isInterface[notModified](err)
+}
+
+type errAborted struct{}
+
+func (errAborted) Error() string { return "aborted" }
+
+func (errAborted) Aborted() {}
+
+func (e errAborted) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+type aborted interface {
+	Aborted()
+}
+
+// IsAborted returns true if an operation was aborted.
+func IsAborted(err error) bool {
+	return errors.Is(err, errAborted{}) || isInterface[aborted](err)
+}
+
+type errOutOfRange struct{}
+
+func (errOutOfRange) Error() string { return "out of range" }
+
+func (errOutOfRange) OutOfRange() {}
+
+func (e errOutOfRange) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+type outOfRange interface {
+	OutOfRange()
+}
+
+// IsOutOfRange returns true if an operation could not proceed due
+// to data being out of the expected range.
+func IsOutOfRange(err error) bool {
+	return errors.Is(err, errOutOfRange{}) || isInterface[outOfRange](err)
+}
+
+type errNotImplemented struct{}
+
+func (errNotImplemented) Error() string { return "not implemented" }
+
+func (errNotImplemented) NotImplemented() {}
+
+func (e errNotImplemented) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// notImplemented maps to Moby's "ErrNotImplemented"
+type notImplemented interface {
+	NotImplemented()
+}
+
+// IsNotImplemented returns true if the error is due to not being implemented
+func IsNotImplemented(err error) bool {
+	return errors.Is(err, errNotImplemented{}) || isInterface[notImplemented](err)
+}
+
+type errInternal struct{}
+
+func (errInternal) Error() string { return "internal" }
+
+func (errInternal) System() {}
+
+func (e errInternal) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// system maps to Moby's "ErrSystem"
+type system interface {
+	System()
+}
+
+// IsInternal returns true if the error returns to an internal or system error
+func IsInternal(err error) bool {
+	return errors.Is(err, errInternal{}) || isInterface[system](err)
+}
+
+type errUnavailable struct{}
+
+func (errUnavailable) Error() string { return "unavailable" }
+
+func (errUnavailable) Unavailable() {}
+
+func (e errUnavailable) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// unavailable maps to Moby's "ErrUnavailable"
+type unavailable interface {
+	Unavailable()
+}
+
+// IsUnavailable returns true if the error is due to a resource being unavailable
+func IsUnavailable(err error) bool {
+	return errors.Is(err, errUnavailable{}) || isInterface[unavailable](err)
+}
+
+type errDataLoss struct{}
+
+func (errDataLoss) Error() string { return "data loss" }
+
+func (errDataLoss) DataLoss() {}
+
+func (e errDataLoss) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// dataLoss maps to Moby's "ErrDataLoss"
+type dataLoss interface {
+	DataLoss()
+}
+
+// IsDataLoss returns true if data during an operation was lost or corrupted
+func IsDataLoss(err error) bool {
+	return errors.Is(err, errDataLoss{}) || isInterface[dataLoss](err)
+}
+
+type errUnauthorized struct{}
+
+func (errUnauthorized) Error() string { return "unauthorized" }
+
+func (errUnauthorized) Unauthorized() {}
+
+func (e errUnauthorized) WithMessage(msg string) error {
+	return customMessage{e, msg}
+}
+
+// unauthorized maps to Moby's "ErrUnauthorized"
+type unauthorized interface {
+	Unauthorized()
+}
+
+// IsUnauthorized returns true if the error indicates that the user was
+// unauthenticated or unauthorized.
+func IsUnauthorized(err error) bool {
+	return errors.Is(err, errUnauthorized{}) || isInterface[unauthorized](err)
+}
+
+func isInterface[T any](err error) bool {
+	for {
+		switch x := err.(type) {
+		case T:
+			return true
+		case customMessage:
+			err = x.err
+		case interface{ Unwrap() error }:
+			err = x.Unwrap()
+			if err == nil {
+				return false
+			}
+		case interface{ Unwrap() []error }:
+			for _, err := range x.Unwrap() {
+				if isInterface[T](err) {
+					return true
+				}
+			}
+			return false
+		default:
+			return false
+		}
+	}
+}
+
+// customMessage is used to provide a defined error with a custom message.
+// The message is not wrapped but can be compared by the `Is(error) bool` interface.
+type customMessage struct {
+	err error
+	msg string
+}
+
+func (c customMessage) Is(err error) bool {
+	return c.err == err
+}
+
+func (c customMessage) As(target any) bool {
+	return errors.As(c.err, target)
+}
+
+func (c customMessage) Error() string {
+	return c.msg
 }
diff --git a/vendor/github.com/containerd/errdefs/pkg/LICENSE b/vendor/github.com/containerd/errdefs/pkg/LICENSE
new file mode 100644
index 000000000..584149b6e
--- /dev/null
+++ b/vendor/github.com/containerd/errdefs/pkg/LICENSE
@@ -0,0 +1,191 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
diff --git a/vendor/github.com/containerd/errdefs/pkg/errgrpc/grpc.go b/vendor/github.com/containerd/errdefs/pkg/errgrpc/grpc.go
new file mode 100644
index 000000000..59577595a
--- /dev/null
+++ b/vendor/github.com/containerd/errdefs/pkg/errgrpc/grpc.go
@@ -0,0 +1,353 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package errgrpc provides utility functions for translating errors to
+// and from a gRPC context.
+//
+// The functions ToGRPC and ToNative can be used to map server-side and
+// client-side errors to the correct types.
+package errgrpc
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"reflect"
+	"strconv"
+	"strings"
+
+	spb "google.golang.org/genproto/googleapis/rpc/status"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/proto"
+	"google.golang.org/protobuf/protoadapt"
+	"google.golang.org/protobuf/types/known/anypb"
+
+	"github.com/containerd/typeurl/v2"
+
+	"github.com/containerd/errdefs"
+	"github.com/containerd/errdefs/pkg/internal/cause"
+	"github.com/containerd/errdefs/pkg/internal/types"
+)
+
+// ToGRPC will attempt to map the error into a grpc error, from the error types
+// defined in the the errdefs package and attempign to preserve the original
+// description. Any type which does not resolve to a defined error type will
+// be assigned the unknown error code.
+//
+// Further information may be extracted from certain errors depending on their
+// type. The grpc error details will be used to attempt to preserve as much of
+// the error structures and types as possible.
+//
+// Errors which can be marshaled using protobuf or typeurl will be considered
+// for including as GRPC error details.
+// Additionally, use the following interfaces in errors to preserve custom types:
+//
+//	WrapError(error) error     - Used to wrap the previous error
+//	JoinErrors(...error) error - Used to join all previous errors
+//	CollapseError()            - Used for errors which carry information but
+//	                             should not have their error message shown.
+func ToGRPC(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	if _, ok := status.FromError(err); ok {
+		// error has already been mapped to grpc
+		return err
+	}
+	st := statusFromError(err)
+	if st != nil {
+		if details := errorDetails(err, false); len(details) > 0 {
+			if ds, _ := st.WithDetails(details...); ds != nil {
+				st = ds
+			}
+		}
+		err = st.Err()
+	}
+	return err
+}
+
+func statusFromError(err error) *status.Status {
+	switch errdefs.Resolve(err) {
+	case errdefs.ErrInvalidArgument:
+		return status.New(codes.InvalidArgument, err.Error())
+	case errdefs.ErrNotFound:
+		return status.New(codes.NotFound, err.Error())
+	case errdefs.ErrAlreadyExists:
+		return status.New(codes.AlreadyExists, err.Error())
+	case errdefs.ErrPermissionDenied:
+		return status.New(codes.PermissionDenied, err.Error())
+	case errdefs.ErrResourceExhausted:
+		return status.New(codes.ResourceExhausted, err.Error())
+	case errdefs.ErrFailedPrecondition, errdefs.ErrConflict, errdefs.ErrNotModified:
+		return status.New(codes.FailedPrecondition, err.Error())
+	case errdefs.ErrAborted:
+		return status.New(codes.Aborted, err.Error())
+	case errdefs.ErrOutOfRange:
+		return status.New(codes.OutOfRange, err.Error())
+	case errdefs.ErrNotImplemented:
+		return status.New(codes.Unimplemented, err.Error())
+	case errdefs.ErrInternal:
+		return status.New(codes.Internal, err.Error())
+	case errdefs.ErrUnavailable:
+		return status.New(codes.Unavailable, err.Error())
+	case errdefs.ErrDataLoss:
+		return status.New(codes.DataLoss, err.Error())
+	case errdefs.ErrUnauthenticated:
+		return status.New(codes.Unauthenticated, err.Error())
+	case context.DeadlineExceeded:
+		return status.New(codes.DeadlineExceeded, err.Error())
+	case context.Canceled:
+		return status.New(codes.Canceled, err.Error())
+	case errdefs.ErrUnknown:
+		return status.New(codes.Unknown, err.Error())
+	}
+	return nil
+}
+
+// errorDetails returns an array of errors which make up the provided error.
+// If firstIncluded is true, then all encodable errors will be used, otherwise
+// the first error in an error list will be not be used, to account for the
+// the base status error which details are added to via wrap or join.
+//
+// The errors are ordered in way that they can be applied in order by either
+// wrapping or joining the errors to recreate an error with the same structure
+// when `WrapError` and `JoinErrors` interfaces are used.
+//
+// The intent is that when re-applying the errors to create a single error, the
+// results of calls to `Error()`, `errors.Is`, `errors.As`, and "%+v" formatting
+// is the same as the original error.
+func errorDetails(err error, firstIncluded bool) []protoadapt.MessageV1 {
+	switch uerr := err.(type) {
+	case interface{ Unwrap() error }:
+		details := errorDetails(uerr.Unwrap(), firstIncluded)
+
+		// If the type is able to wrap, then include if proto
+		if _, ok := err.(interface{ WrapError(error) error }); ok {
+			// Get proto message
+			if protoErr := toProtoMessage(err); protoErr != nil {
+				details = append(details, protoErr)
+			}
+		}
+
+		return details
+	case interface{ Unwrap() []error }:
+		var details []protoadapt.MessageV1
+		for i, e := range uerr.Unwrap() {
+			details = append(details, errorDetails(e, firstIncluded || i > 0)...)
+		}
+
+		if _, ok := err.(interface{ JoinErrors(...error) error }); ok {
+			// Get proto message
+			if protoErr := toProtoMessage(err); protoErr != nil {
+				details = append(details, protoErr)
+			}
+		}
+		return details
+	}
+
+	if firstIncluded {
+		if protoErr := toProtoMessage(err); protoErr != nil {
+			return []protoadapt.MessageV1{protoErr}
+		}
+		if gs, ok := status.FromError(ToGRPC(err)); ok {
+			return []protoadapt.MessageV1{gs.Proto()}
+		}
+		// TODO: Else include unknown extra error type?
+	}
+
+	return nil
+}
+
+func toProtoMessage(err error) protoadapt.MessageV1 {
+	// Do not double encode proto messages, otherwise use Any
+	if pm, ok := err.(protoadapt.MessageV1); ok {
+		return pm
+	}
+	if pm, ok := err.(proto.Message); ok {
+		return protoadapt.MessageV1Of(pm)
+	}
+
+	if reflect.TypeOf(err).Kind() == reflect.Ptr {
+		a, aerr := typeurl.MarshalAny(err)
+		if aerr == nil {
+			return &anypb.Any{
+				TypeUrl: a.GetTypeUrl(),
+				Value:   a.GetValue(),
+			}
+		}
+	}
+	return nil
+}
+
+// ToGRPCf maps the error to grpc error codes, assembling the formatting string
+// and combining it with the target error string.
+//
+// This is equivalent to grpc.ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err))
+func ToGRPCf(err error, format string, args ...interface{}) error {
+	return ToGRPC(fmt.Errorf("%s: %w", fmt.Sprintf(format, args...), err))
+}
+
+// ToNative returns the underlying error from a grpc service based on the grpc
+// error code. The grpc details are used to add wrap the error in more context
+// or support multiple errors.
+func ToNative(err error) error {
+	if err == nil {
+		return nil
+	}
+
+	s, isGRPC := status.FromError(err)
+
+	var (
+		desc string
+		code codes.Code
+	)
+
+	if isGRPC {
+		desc = s.Message()
+		code = s.Code()
+	} else {
+		desc = err.Error()
+		code = codes.Unknown
+	}
+
+	var cls error // divide these into error classes, becomes the cause
+
+	switch code {
+	case codes.InvalidArgument:
+		cls = errdefs.ErrInvalidArgument
+	case codes.AlreadyExists:
+		cls = errdefs.ErrAlreadyExists
+	case codes.NotFound:
+		cls = errdefs.ErrNotFound
+	case codes.Unavailable:
+		cls = errdefs.ErrUnavailable
+	case codes.FailedPrecondition:
+		// TODO: Has suffix is not sufficient for conflict and not modified
+		// Message should start with ": " or be at beginning of a line
+		// Message should end with ": " or be at the end of a line
+		// Compile a regex
+		if desc == errdefs.ErrConflict.Error() || strings.HasSuffix(desc, ": "+errdefs.ErrConflict.Error()) {
+			cls = errdefs.ErrConflict
+		} else if desc == errdefs.ErrNotModified.Error() || strings.HasSuffix(desc, ": "+errdefs.ErrNotModified.Error()) {
+			cls = errdefs.ErrNotModified
+		} else {
+			cls = errdefs.ErrFailedPrecondition
+		}
+	case codes.Unimplemented:
+		cls = errdefs.ErrNotImplemented
+	case codes.Canceled:
+		cls = context.Canceled
+	case codes.DeadlineExceeded:
+		cls = context.DeadlineExceeded
+	case codes.Aborted:
+		cls = errdefs.ErrAborted
+	case codes.Unauthenticated:
+		cls = errdefs.ErrUnauthenticated
+	case codes.PermissionDenied:
+		cls = errdefs.ErrPermissionDenied
+	case codes.Internal:
+		cls = errdefs.ErrInternal
+	case codes.DataLoss:
+		cls = errdefs.ErrDataLoss
+	case codes.OutOfRange:
+		cls = errdefs.ErrOutOfRange
+	case codes.ResourceExhausted:
+		cls = errdefs.ErrResourceExhausted
+	default:
+		if idx := strings.LastIndex(desc, cause.UnexpectedStatusPrefix); idx > 0 {
+			if status, uerr := strconv.Atoi(desc[idx+len(cause.UnexpectedStatusPrefix):]); uerr == nil && status >= 200 && status < 600 {
+				cls = cause.ErrUnexpectedStatus{Status: status}
+			}
+		}
+		if cls == nil {
+			cls = errdefs.ErrUnknown
+		}
+	}
+
+	msg := rebaseMessage(cls, desc)
+	if msg == "" {
+		err = cls
+	} else if msg != desc {
+		err = fmt.Errorf("%s: %w", msg, cls)
+	} else if wm, ok := cls.(interface{ WithMessage(string) error }); ok {
+		err = wm.WithMessage(msg)
+	} else {
+		err = fmt.Errorf("%s: %w", msg, cls)
+	}
+
+	if isGRPC {
+		errs := []error{err}
+		for _, a := range s.Details() {
+			var derr error
+
+			// First decode error if needed
+			if s, ok := a.(*spb.Status); ok {
+				derr = ToNative(status.ErrorProto(s))
+			} else if e, ok := a.(error); ok {
+				derr = e
+			} else if dany, ok := a.(typeurl.Any); ok {
+				i, uerr := typeurl.UnmarshalAny(dany)
+				if uerr == nil {
+					if e, ok = i.(error); ok {
+						derr = e
+					} else {
+						derr = fmt.Errorf("non-error unmarshalled detail: %v", i)
+					}
+				} else {
+					derr = fmt.Errorf("error of type %q with failure to unmarshal: %v", dany.GetTypeUrl(), uerr)
+				}
+			} else {
+				derr = fmt.Errorf("non-error detail: %v", a)
+			}
+
+			switch werr := derr.(type) {
+			case interface{ WrapError(error) error }:
+				errs[len(errs)-1] = werr.WrapError(errs[len(errs)-1])
+			case interface{ JoinErrors(...error) error }:
+				// TODO: Consider whether this should support joining a subset
+				errs[0] = werr.JoinErrors(errs...)
+			case interface{ CollapseError() }:
+				errs[len(errs)-1] = types.CollapsedError(errs[len(errs)-1], derr)
+			default:
+				errs = append(errs, derr)
+			}
+
+		}
+		if len(errs) > 1 {
+			err = errors.Join(errs...)
+		} else {
+			err = errs[0]
+		}
+	}
+
+	return err
+}
+
+// rebaseMessage removes the repeats for an error at the end of an error
+// string. This will happen when taking an error over grpc then remapping it.
+//
+// Effectively, we just remove the string of cls from the end of err if it
+// appears there.
+func rebaseMessage(cls error, desc string) string {
+	clss := cls.Error()
+	if desc == clss {
+		return ""
+	}
+
+	return strings.TrimSuffix(desc, ": "+clss)
+}
diff --git a/vendor/github.com/containerd/errdefs/pkg/internal/cause/cause.go b/vendor/github.com/containerd/errdefs/pkg/internal/cause/cause.go
new file mode 100644
index 000000000..d88756bb0
--- /dev/null
+++ b/vendor/github.com/containerd/errdefs/pkg/internal/cause/cause.go
@@ -0,0 +1,33 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package cause is used to define root causes for errors
+// common to errors packages like grpc and http.
+package cause
+
+import "fmt"
+
+type ErrUnexpectedStatus struct {
+	Status int
+}
+
+const UnexpectedStatusPrefix = "unexpected status "
+
+func (e ErrUnexpectedStatus) Error() string {
+	return fmt.Sprintf("%s%d", UnexpectedStatusPrefix, e.Status)
+}
+
+func (ErrUnexpectedStatus) Unknown() {}
diff --git a/vendor/github.com/containerd/errdefs/pkg/internal/types/collapsible.go b/vendor/github.com/containerd/errdefs/pkg/internal/types/collapsible.go
new file mode 100644
index 000000000..a37e7722a
--- /dev/null
+++ b/vendor/github.com/containerd/errdefs/pkg/internal/types/collapsible.go
@@ -0,0 +1,57 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package types
+
+import "fmt"
+
+// CollapsibleError indicates the error should be collapsed
+type CollapsibleError interface {
+	CollapseError()
+}
+
+// CollapsedError returns a new error with the collapsed
+// error returned on unwrapped or when formatted with "%+v"
+func CollapsedError(err error, collapsed ...error) error {
+	return collapsedError{err, collapsed}
+}
+
+type collapsedError struct {
+	error
+	collapsed []error
+}
+
+func (c collapsedError) Unwrap() []error {
+	return append([]error{c.error}, c.collapsed...)
+}
+
+func (c collapsedError) Format(s fmt.State, verb rune) {
+	switch verb {
+	case 'v':
+		if s.Flag('+') {
+			fmt.Fprintf(s, "%+v", c.error)
+			for _, err := range c.collapsed {
+				fmt.Fprintf(s, "\n%+v", err)
+			}
+			return
+		}
+		fallthrough
+	case 's':
+		fmt.Fprint(s, c.Error())
+	case 'q':
+		fmt.Fprintf(s, "%q", c.Error())
+	}
+}
diff --git a/vendor/github.com/containerd/errdefs/resolve.go b/vendor/github.com/containerd/errdefs/resolve.go
new file mode 100644
index 000000000..c02d4a73f
--- /dev/null
+++ b/vendor/github.com/containerd/errdefs/resolve.go
@@ -0,0 +1,147 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+package errdefs
+
+import "context"
+
+// Resolve returns the first error found in the error chain which matches an
+// error defined in this package or context error. A raw, unwrapped error is
+// returned or ErrUnknown if no matching error is found.
+//
+// This is useful for determining a response code based on the outermost wrapped
+// error rather than the original cause. For example, a not found error deep
+// in the code may be wrapped as an invalid argument. When determining status
+// code from Is* functions, the depth or ordering of the error is not
+// considered.
+//
+// The search order is depth first, a wrapped error returned from any part of
+// the chain from `Unwrap() error` will be returned before any joined errors
+// as returned by `Unwrap() []error`.
+func Resolve(err error) error {
+	if err == nil {
+		return nil
+	}
+	err = firstError(err)
+	if err == nil {
+		err = ErrUnknown
+	}
+	return err
+}
+
+func firstError(err error) error {
+	for {
+		switch err {
+		case ErrUnknown,
+			ErrInvalidArgument,
+			ErrNotFound,
+			ErrAlreadyExists,
+			ErrPermissionDenied,
+			ErrResourceExhausted,
+			ErrFailedPrecondition,
+			ErrConflict,
+			ErrNotModified,
+			ErrAborted,
+			ErrOutOfRange,
+			ErrNotImplemented,
+			ErrInternal,
+			ErrUnavailable,
+			ErrDataLoss,
+			ErrUnauthenticated,
+			context.DeadlineExceeded,
+			context.Canceled:
+			return err
+		}
+		switch e := err.(type) {
+		case customMessage:
+			err = e.err
+		case unknown:
+			return ErrUnknown
+		case invalidParameter:
+			return ErrInvalidArgument
+		case notFound:
+			return ErrNotFound
+		case alreadyExists:
+			return ErrAlreadyExists
+		case forbidden:
+			return ErrPermissionDenied
+		case resourceExhausted:
+			return ErrResourceExhausted
+		case failedPrecondition:
+			return ErrFailedPrecondition
+		case conflict:
+			return ErrConflict
+		case notModified:
+			return ErrNotModified
+		case aborted:
+			return ErrAborted
+		case errOutOfRange:
+			return ErrOutOfRange
+		case notImplemented:
+			return ErrNotImplemented
+		case system:
+			return ErrInternal
+		case unavailable:
+			return ErrUnavailable
+		case dataLoss:
+			return ErrDataLoss
+		case unauthorized:
+			return ErrUnauthenticated
+		case deadlineExceeded:
+			return context.DeadlineExceeded
+		case cancelled:
+			return context.Canceled
+		case interface{ Unwrap() error }:
+			err = e.Unwrap()
+			if err == nil {
+				return nil
+			}
+		case interface{ Unwrap() []error }:
+			for _, ue := range e.Unwrap() {
+				if fe := firstError(ue); fe != nil {
+					return fe
+				}
+			}
+			return nil
+		case interface{ Is(error) bool }:
+			for _, target := range []error{ErrUnknown,
+				ErrInvalidArgument,
+				ErrNotFound,
+				ErrAlreadyExists,
+				ErrPermissionDenied,
+				ErrResourceExhausted,
+				ErrFailedPrecondition,
+				ErrConflict,
+				ErrNotModified,
+				ErrAborted,
+				ErrOutOfRange,
+				ErrNotImplemented,
+				ErrInternal,
+				ErrUnavailable,
+				ErrDataLoss,
+				ErrUnauthenticated,
+				context.DeadlineExceeded,
+				context.Canceled} {
+				if e.Is(target) {
+					return target
+				}
+			}
+			return nil
+		default:
+			return nil
+		}
+	}
+}
diff --git a/vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml b/vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml
index f5f274f96..45c00cb9c 100644
--- a/vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml
+++ b/vendor/github.com/stefanberger/go-pkcs11uri/.travis.yml
@@ -5,7 +5,7 @@ os:
 - linux
 
 go:
-  - "1.13.x"
+  - "1.19.x"
 
 matrix:
   include:
@@ -17,7 +17,7 @@ addons:
       - softhsm2
 
 install:
-  - curl -sfL https://install.goreleaser.com/github.com/golangci/golangci-lint.sh | sh -s -- -b $(go env GOPATH)/bin v1.30.0
+  - curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.53.2
 
 script:
   - make
diff --git a/vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go b/vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go
index 39b06548e..82c32e3c8 100644
--- a/vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go
+++ b/vendor/github.com/stefanberger/go-pkcs11uri/pkcs11uri.go
@@ -19,7 +19,6 @@ package pkcs11uri
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -128,6 +127,12 @@ func (uri *Pkcs11URI) SetPathAttribute(name, value string) error {
 	return uri.setAttribute(uri.pathAttributes, name, value)
 }
 
+// SetPathAttributeUnencoded sets the value for a path attribute given as byte[].
+// The value must not have been pct-encoded already.
+func (uri *Pkcs11URI) SetPathAttributeUnencoded(name string, value []byte) {
+	uri.pathAttributes[name] = string(value)
+}
+
 // AddPathAttribute adds a path attribute; it returns an error if an attribute with the same
 // name already existed or if the given value cannot be pct-unescaped
 func (uri *Pkcs11URI) AddPathAttribute(name, value string) error {
@@ -137,6 +142,16 @@ func (uri *Pkcs11URI) AddPathAttribute(name, value string) error {
 	return uri.SetPathAttribute(name, value)
 }
 
+// AddPathAttributeUnencoded adds a path attribute given as byte[] which must not already be pct-encoded;
+// it returns an error if an attribute with the same name already existed
+func (uri *Pkcs11URI) AddPathAttributeUnencoded(name string, value []byte) error {
+	if _, ok := uri.pathAttributes[name]; ok {
+		return errors.New("duplicate path attribute")
+	}
+	uri.SetPathAttributeUnencoded(name, value)
+	return nil
+}
+
 // RemovePathAttribute removes a path attribute
 func (uri *Pkcs11URI) RemovePathAttribute(name string) {
 	delete(uri.pathAttributes, name)
@@ -173,6 +188,12 @@ func (uri *Pkcs11URI) SetQueryAttribute(name, value string) error {
 	return uri.setAttribute(uri.queryAttributes, name, value)
 }
 
+// SetQueryAttributeUnencoded sets the value for a quiery attribute given as byte[].
+// The value must not have been pct-encoded already.
+func (uri *Pkcs11URI) SetQueryAttributeUnencoded(name string, value []byte) {
+	uri.queryAttributes[name] = string(value)
+}
+
 // AddQueryAttribute adds a query attribute; it returns an error if an attribute with the same
 // name already existed or if the given value cannot be pct-unescaped
 func (uri *Pkcs11URI) AddQueryAttribute(name, value string) error {
@@ -182,6 +203,16 @@ func (uri *Pkcs11URI) AddQueryAttribute(name, value string) error {
 	return uri.SetQueryAttribute(name, value)
 }
 
+// AddQueryAttributeUnencoded adds a query attribute given as byte[] which must not already be pct-encoded;
+// it returns an error if an attribute with the same name already existed
+func (uri *Pkcs11URI) AddQueryAttributeUnencoded(name string, value []byte) error {
+	if _, ok := uri.queryAttributes[name]; ok {
+		return errors.New("duplicate query attribute")
+	}
+	uri.SetQueryAttributeUnencoded(name, value)
+	return nil
+}
+
 // RemoveQueryAttribute removes a path attribute
 func (uri *Pkcs11URI) RemoveQueryAttribute(name string) {
 	delete(uri.queryAttributes, name)
@@ -257,7 +288,7 @@ func (uri *Pkcs11URI) GetPIN() (string, error) {
 			if !filepath.IsAbs(pinuri.Path) {
 				return "", fmt.Errorf("PIN URI path '%s' is not absolute", pinuri.Path)
 			}
-			pin, err := ioutil.ReadFile(pinuri.Path)
+			pin, err := os.ReadFile(pinuri.Path)
 			if err != nil {
 				return "", fmt.Errorf("Could not open PIN file: %s", err)
 			}
@@ -426,7 +457,7 @@ func (uri *Pkcs11URI) GetModule() (string, error) {
 	moduleName = strings.ToLower(moduleName)
 
 	for _, dir := range searchdirs {
-		files, err := ioutil.ReadDir(dir)
+		files, err := os.ReadDir(dir)
 		if err != nil {
 			continue
 		}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index e97aa1816..8e1439baa 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -21,7 +21,7 @@ github.com/Microsoft/go-winio/pkg/fs
 github.com/Microsoft/go-winio/pkg/guid
 github.com/Microsoft/go-winio/pkg/security
 github.com/Microsoft/go-winio/vhd
-# github.com/Microsoft/hcsshim v0.12.7
+# github.com/Microsoft/hcsshim v0.12.7 => github.com/dmcgowan/hcsshim v0.12.8-dev.0
 ## explicit; go 1.21
 github.com/Microsoft/hcsshim
 github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1/options
@@ -105,6 +105,9 @@ github.com/containerd/cgroups/v3/cgroup2/stats
 # github.com/containerd/console v1.0.4
 ## explicit; go 1.13
 github.com/containerd/console
+# github.com/containerd/containerd v1.7.23
+## explicit; go 1.21
+github.com/containerd/containerd/errdefs
 # github.com/containerd/containerd/api v1.8.0-rc.3 => ./api
 ## explicit; go 1.21
 github.com/containerd/containerd/api/events
@@ -143,9 +146,14 @@ github.com/containerd/continuity/proto
 github.com/containerd/continuity/sysx
 github.com/containerd/continuity/testutil
 github.com/containerd/continuity/testutil/loopback
-# github.com/containerd/errdefs v0.1.0
+# github.com/containerd/errdefs v0.3.0
 ## explicit; go 1.20
 github.com/containerd/errdefs
+# github.com/containerd/errdefs/pkg v0.3.0
+## explicit; go 1.22
+github.com/containerd/errdefs/pkg/errgrpc
+github.com/containerd/errdefs/pkg/internal/cause
+github.com/containerd/errdefs/pkg/internal/types
 # github.com/containerd/fifo v1.1.0
 ## explicit; go 1.18
 github.com/containerd/fifo
@@ -315,8 +323,6 @@ github.com/grpc-ecosystem/go-grpc-middleware/v2/interceptors
 github.com/grpc-ecosystem/grpc-gateway/v2/internal/httprule
 github.com/grpc-ecosystem/grpc-gateway/v2/runtime
 github.com/grpc-ecosystem/grpc-gateway/v2/utilities
-# github.com/hashicorp/errwrap v1.1.0
-## explicit
 # github.com/intel/goresctrl v0.8.0
 ## explicit; go 1.20
 github.com/intel/goresctrl/pkg/blockio
@@ -444,8 +450,8 @@ github.com/russross/blackfriday/v2
 # github.com/sirupsen/logrus v1.9.3
 ## explicit; go 1.13
 github.com/sirupsen/logrus
-# github.com/stefanberger/go-pkcs11uri v0.0.0-20201008174630-78d3cae3a980
-## explicit
+# github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6
+## explicit; go 1.19
 github.com/stefanberger/go-pkcs11uri
 # github.com/stretchr/testify v1.9.0
 ## explicit; go 1.17
@@ -869,3 +875,4 @@ tags.cncf.io/container-device-interface/pkg/parser
 ## explicit; go 1.19
 tags.cncf.io/container-device-interface/specs-go
 # github.com/containerd/containerd/api => ./api
+# github.com/Microsoft/hcsshim => github.com/dmcgowan/hcsshim v0.12.8-dev.0