Affected by GO-2026-5064
and 6 other vulnerabilities
GO-2026-5064: containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd
GO-2026-5338: containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd
GO-2026-5475: containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd
GO-2026-5622: Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd
GO-2026-5758: containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd
GO-2026-6444: containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service in github.com/containerd/containerd
GO-2026-6597: Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd
NewWalkingDiff is a generic implementation of diff.Comparer. The diff is
calculated by mounting both the upper and lower mount sets and walking the
mounted directories concurrently. Changes are calculated by comparing files
against each other or by comparing file existence between directories.
NewWalkingDiff uses no special characteristics of the mount sets and is
expected to work with any filesystem.