trying to understand /run/containerd/io.containerd.runtime.v2.task/k8s.io/???????/rootfs and container pod file system relation

[chriseizus]

Hi,

I hope someone could help me understand what is this /run/containerd/io.containerd.runtime.v2.task/k8s.io/??/rootfs for?
I was guessing this rootfs under the runtime is to reflect the real container/pod runtime filesystem.
But looks like I'm wrong, this 2 don't match.

My company's vul scan found some vul package under /run/containerd/io.containerd.runtime.v2.task/k8s.io/??/rootfs, I found the container name under config.json and I was trying to remediate and try to patch the container image with the correct package. in container run shell, I can see all the packages are patched but under this /run/containerd/io.containerd.runtime.v2.task/k8s.io/??/rootfs, it's still showing some old files.

Would like to get some explanation for the containerd runtime how the file system is stored.