Packages

The client/ and pkg/ (and parts of core/) directories hold reusable Go packages that can be imported outside of the daemon. This section covers the most important ones.

Package	Path	What it gives you
client	client/	A high-level Go client for the daemon (the embeddable API)
pkg/oci	pkg/oci/	Helpers for building OCI runtime specs (used by ctr, the CRI plugin, and embedders)
pkg/namespaces	pkg/namespaces/	Namespace propagation through ctx
pkg/archive	pkg/archive/	tar/gzip helpers tailored to OCI layer formats
pkg/sys	pkg/sys/	Cross-platform syscalls and filesystem helpers
pkg/dialer	pkg/dialer/	Cross-platform unix-socket / named-pipe dialer used by both client and server code
pkg/filters	pkg/filters/	Field-path filter syntax used in Walk, List, and Subscribe calls
pkg/identifiers	pkg/identifiers/	Validation for namespace, container, and image names
pkg/labels	pkg/labels/	Label key constants used across the metadata store
pkg/cio	pkg/cio/	Container I/O helpers (fifo creation, std-attach handlers)
pkg/cap	pkg/cap/	Linux capability set helpers
pkg/seccomp	pkg/seccomp/	seccomp profile loaders
pkg/rdt, pkg/blockio	pkg/rdt/, pkg/blockio/	Intel RDT and block I/O class management for Linux
pkg/atomicfile	pkg/atomicfile/	Atomic write-then-rename helper
pkg/ioutil	pkg/ioutil/	Stream helpers (AtomicWriteFile, LimitWriter)
pkg/progress	pkg/progress/	Terminal progress bars used by ctr
pkg/tracing	pkg/tracing/	OpenTelemetry wrapper used by all plugin code
pkg/timeout	pkg/timeout/	Centralized timeout registry keyed by config.Timeouts
pkg/reference	pkg/reference/	OCI reference parser (registry, namespace, name, tag, digest)
pkg/imageverifier	pkg/imageverifier/	Image verifier interface and bindir runner
pkg/snapshotters	pkg/snapshotters/	Standard snapshot label keys (containerd.io/snapshot/<key>)

What stays in core/ vs pkg/

core/ contains interface definitions and built-in implementations of containerd-specific subsystems (the content store, the snapshotter, the runtime, the differ, ...). These are imported by plugins and by the daemon itself.

pkg/ contains helpers that aren't tied to any one subsystem. Many of them predate the v2 reorg.

internal/ is the catch-all for things that aren't intended to be imported from outside the daemon — the CRI plugin, fsverity helpers, NRI internals, and so on. The Go module system enforces this: anything under internal/ cannot be imported by code outside the containerd/containerd/v2 module.

How embedders use these

A typical Go program embedding containerd:

import (
    containerd "github.com/containerd/containerd/v2/client"
    "github.com/containerd/containerd/v2/pkg/namespaces"
    "github.com/containerd/containerd/v2/pkg/oci"
    "github.com/containerd/containerd/v2/pkg/cio"
)

Imports are stable across patch releases on a given major version. RELEASES.md describes the exact stability guarantees and the deprecation procedure.