diff --git a/go.mod b/go.mod
index e9406bceba0..c0820e80db1 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/opencontainers/runc
 go 1.16
 
 require (
-	github.com/checkpoint-restore/go-criu/v5 v5.1.0
+	github.com/checkpoint-restore/go-criu/v5 v5.3.0
 	github.com/cilium/ebpf v0.7.0
 	github.com/containerd/console v1.0.3
 	github.com/coreos/go-systemd/v22 v22.3.2
diff --git a/go.sum b/go.sum
index 51a11563e44..3857300fadc 100644
--- a/go.sum
+++ b/go.sum
@@ -1,6 +1,6 @@
 github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/checkpoint-restore/go-criu/v5 v5.1.0 h1:BkVH17kcwgmKMnFArsvLrxuBbMwfvPNYRB7mfJ0lzyI=
-github.com/checkpoint-restore/go-criu/v5 v5.1.0/go.mod h1:iaS8bb7p6zKJanp1Qe8mpl7+bnkYBR500psJR6mwma0=
+github.com/checkpoint-restore/go-criu/v5 v5.3.0 h1:wpFFOoomK3389ue2lAb0Boag6XPht5QYpipxmSNL4d8=
+github.com/checkpoint-restore/go-criu/v5 v5.3.0/go.mod h1:E/eQpaFtUKGOOSEBZgmKAcn+zUUwWxqcaKZlF54wK8E=
 github.com/cilium/ebpf v0.7.0 h1:1k/q3ATgxSXRdrmPfH8d7YK0GfqVsEKZAX9dQZvs56k=
 github.com/cilium/ebpf v0.7.0/go.mod h1:/oI2+1shJiTGAMgl6/RgJr36Eo1jzrRcAWbcXO2usCA=
 github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
@@ -21,7 +21,6 @@ github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5x
 github.com/godbus/dbus/v5 v5.0.5 h1:9Eg0XUhQxtkV8ykTMKtMMYY72g4NgxtRq4jgh4Ih5YM=
 github.com/godbus/dbus/v5 v5.0.5/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
@@ -74,7 +73,6 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/.gitignore b/vendor/github.com/checkpoint-restore/go-criu/v5/.gitignore
index 6c7385fa2f8..1b87ff10e6b 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/.gitignore
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/.gitignore
@@ -1,5 +1,6 @@
 test/test
+test/test.coverage
 test/piggie/piggie
-test/phaul
+test/phaul/phaul
+test/phaul/phaul.coverage
 image
-stats/stats.proto
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/Makefile b/vendor/github.com/checkpoint-restore/go-criu/v5/Makefile
index a5c5f5542b8..67c43a05b32 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/Makefile
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/Makefile
@@ -1,5 +1,12 @@
+SHELL = /bin/bash
 GO ?= go
 CC ?= gcc
+COVERAGE_PATH ?= $(shell pwd)/.coverage
+CRIU_FEATURE_MEM_TRACK = $(shell if criu check --feature mem_dirty_track > /dev/null; then echo 1; else echo 0; fi)
+CRIU_FEATURE_LAZY_PAGES = $(shell if criu check --feature uffd-noncoop > /dev/null; then echo 1; else echo 0; fi)
+CRIU_FEATURE_PIDFD_STORE = $(shell if criu check --feature pidfd_store > /dev/null; then echo 1; else echo 0; fi)
+
+export CRIU_FEATURE_MEM_TRACK CRIU_FEATURE_LAZY_PAGES CRIU_FEATURE_PIDFD_STORE
 
 all: build test phaul-test
 
@@ -9,13 +16,15 @@ lint:
 build:
 	$(GO) build -v ./...
 
-TEST_BINARIES := test/test test/piggie/piggie test/phaul/phaul
+TEST_PAYLOAD := test/piggie/piggie
+TEST_BINARIES := test/test $(TEST_PAYLOAD) test/phaul/phaul
+COVERAGE_BINARIES := test/test.coverage test/phaul/phaul.coverage
 test-bin: $(TEST_BINARIES)
 
 test/piggie/piggie: test/piggie/piggie.c
 	$(CC) $^ -o $@
 
-test/test: test/*.go
+test/test: test/main.go
 	$(GO) build -v -o $@ $^
 
 test: $(TEST_BINARIES)
@@ -27,7 +36,7 @@ test: $(TEST_BINARIES)
 	}
 	rm -rf image
 
-test/phaul/phaul: test/phaul/*.go
+test/phaul/phaul: test/phaul/main.go
 	$(GO) build -v -o $@ $^
 
 phaul-test: $(TEST_BINARIES)
@@ -37,10 +46,41 @@ phaul-test: $(TEST_BINARIES)
 	pkill -9 piggie; \
 	}
 
+test/test.coverage: test/*.go
+	$(GO) test \
+		-covermode=count \
+		-coverpkg=./... \
+		-mod=vendor \
+		-tags coverage \
+		-buildmode=pie -c -o $@ $^
+
+test/phaul/phaul.coverage: test/phaul/*.go
+	$(GO) test \
+		-covermode=count \
+		-coverpkg=./... \
+		-mod=vendor \
+		-tags coverage \
+		-buildmode=pie -c -o $@ $^
+
+coverage: $(COVERAGE_BINARIES) $(TEST_PAYLOAD)
+	mkdir -p $(COVERAGE_PATH)
+	mkdir -p image
+	PID=$$(test/piggie/piggie) && { \
+	test/test.coverage -test.coverprofile=coverprofile.integration.$$RANDOM -test.outputdir=${COVERAGE_PATH} COVERAGE dump $$PID image && \
+	test/test.coverage -test.coverprofile=coverprofile.integration.$$RANDOM -test.outputdir=${COVERAGE_PATH} COVERAGE restore image; \
+	pkill -9 piggie; \
+	}
+	rm -rf image
+	PID=$$(test/piggie/piggie) && { \
+	test/phaul/phaul.coverage -test.coverprofile=coverprofile.integration.$$RANDOM -test.outputdir=${COVERAGE_PATH} COVERAGE $$PID; \
+	pkill -9 piggie; \
+	}
+	echo "mode: set" > .coverage/coverage.out && cat .coverage/coverprofile* | \
+		grep -v mode: | sort -r | awk '{if($$1 != last) {print $$0;last=$$1}}' >> .coverage/coverage.out
+
 clean:
-	@rm -f $(TEST_BINARIES)
-	@rm -rf image
-	@rm -f rpc/rpc.proto stats/stats.proto
+	@rm -f $(TEST_BINARIES) $(COVERAGE_BINARIES) codecov
+	@rm -rf image $(COVERAGE_PATH)
 
 rpc/rpc.proto:
 	curl -sSL https://raw.githubusercontent.com/checkpoint-restore/criu/master/images/rpc.proto -o $@
@@ -49,14 +89,19 @@ stats/stats.proto:
 	curl -sSL https://raw.githubusercontent.com/checkpoint-restore/criu/master/images/stats.proto -o $@
 
 rpc/rpc.pb.go: rpc/rpc.proto
-	protoc --go_out=. --go_opt=Mrpc/rpc.proto=rpc/ $^
+	protoc --go_out=. --go_opt=M$^=rpc/ $^
 
 stats/stats.pb.go: stats/stats.proto
-	protoc --go_out=. $^
+	protoc --go_out=. --go_opt=M$^=stats/ $^
 
 vendor:
 	GO111MODULE=on $(GO) mod tidy
 	GO111MODULE=on $(GO) mod vendor
 	GO111MODULE=on $(GO) mod verify
 
-.PHONY: build test phaul-test test-bin clean lint vendor
+codecov:
+	curl -Os https://uploader.codecov.io/latest/linux/codecov
+	chmod +x codecov
+	./codecov -f '.coverage/coverage.out'
+
+.PHONY: build test phaul-test test-bin clean lint vendor coverage codecov
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/README.md b/vendor/github.com/checkpoint-restore/go-criu/v5/README.md
index 390da3e98b0..a7483321b5c 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/README.md
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/README.md
@@ -16,7 +16,7 @@ The following example would print the version of CRIU:
 import (
 	"log"
 
-	"github.com/checkpoint/restore/go-criu/v5"
+	"github.com/checkpoint-restore/go-criu/v5"
 )
 
 func main() {
@@ -50,6 +50,7 @@ The following table shows the relation between go-criu and criu versions:
 
 | Major version  | Latest release | CRIU version |
 | -------------- | -------------- | ------------ |
+| v5             | 5.2.0          | 3.16         |
 | v5             | 5.0.0          | 3.15         |
 | v4             | 4.1.0          | 3.14         |
 
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/features.go b/vendor/github.com/checkpoint-restore/go-criu/v5/features.go
new file mode 100644
index 00000000000..c7127f95157
--- /dev/null
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/features.go
@@ -0,0 +1,45 @@
+package criu
+
+import (
+	"fmt"
+
+	"github.com/checkpoint-restore/go-criu/v5/rpc"
+)
+
+// Feature checking in go-criu is based on the libcriu feature checking function.
+
+// Feature checking allows the user to check if CRIU supports
+// certain features. There are CRIU features which do not depend
+// on the version of CRIU but on kernel features or architecture.
+//
+// One example is memory tracking. Memory tracking can be disabled
+// in the kernel or there are architectures which do not support
+// it (aarch64 for example). By using the feature check a libcriu
+// user can easily query CRIU if a certain feature is available.
+//
+// The features which should be checked can be marked in the
+// structure 'struct criu_feature_check'. Each structure member
+// that is set to true will result in CRIU checking for the
+// availability of that feature in the current combination of
+// CRIU/kernel/architecture.
+//
+// Available features will be set to true when the function
+// returns successfully. Missing features will be set to false.
+
+func (c *Criu) FeatureCheck(features *rpc.CriuFeatures) (*rpc.CriuFeatures, error) {
+	resp, err := c.doSwrkWithResp(
+		rpc.CriuReqType_FEATURE_CHECK,
+		nil,
+		nil,
+		features,
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	if resp.GetType() != rpc.CriuReqType_FEATURE_CHECK {
+		return nil, fmt.Errorf("Unexpected CRIU RPC response")
+	}
+
+	return features, nil
+}
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/go.mod b/vendor/github.com/checkpoint-restore/go-criu/v5/go.mod
index 69595701f8b..cf4fea9f05e 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/go.mod
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/go.mod
@@ -3,7 +3,6 @@ module github.com/checkpoint-restore/go-criu/v5
 go 1.13
 
 require (
-	github.com/golang/protobuf v1.5.2
 	golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c
-	google.golang.org/protobuf v1.26.0
+	google.golang.org/protobuf v1.27.1
 )
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/go.sum b/vendor/github.com/checkpoint-restore/go-criu/v5/go.sum
index 7e17df214ab..789fdcb11aa 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/go.sum
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/go.sum
@@ -1,6 +1,4 @@
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c h1:VwygUrnw9jn88c4u8GD3rZQbqrP/tgas88tPUbBxQrk=
@@ -8,5 +6,5 @@ golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7w
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
+google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/main.go b/vendor/github.com/checkpoint-restore/go-criu/v5/main.go
index 78811c309ce..88b1b24587a 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/main.go
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/main.go
@@ -87,19 +87,19 @@ func (c *Criu) sendAndRecv(reqB []byte) ([]byte, int, error) {
 }
 
 func (c *Criu) doSwrk(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify) error {
-	resp, err := c.doSwrkWithResp(reqType, opts, nfy)
+	resp, err := c.doSwrkWithResp(reqType, opts, nfy, nil)
 	if err != nil {
 		return err
 	}
 	respType := resp.GetType()
 	if respType != reqType {
-		return errors.New("unexpected responce")
+		return errors.New("unexpected CRIU RPC response")
 	}
 
 	return nil
 }
 
-func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify) (*rpc.CriuResp, error) {
+func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy Notify, features *rpc.CriuFeatures) (*rpc.CriuResp, error) {
 	var resp *rpc.CriuResp
 
 	req := rpc.CriuReq{
@@ -111,6 +111,10 @@ func (c *Criu) doSwrkWithResp(reqType rpc.CriuReqType, opts *rpc.CriuOpts, nfy N
 		opts.NotifyScripts = proto.Bool(true)
 	}
 
+	if features != nil {
+		req.Features = features
+	}
+
 	if c.swrkCmd == nil {
 		err := c.Prepare()
 		if err != nil {
@@ -209,7 +213,7 @@ func (c *Criu) StartPageServer(opts *rpc.CriuOpts) error {
 
 // StartPageServerChld starts the page server and returns PID and port
 func (c *Criu) StartPageServerChld(opts *rpc.CriuOpts) (int, int, error) {
-	resp, err := c.doSwrkWithResp(rpc.CriuReqType_PAGE_SERVER_CHLD, opts, nil)
+	resp, err := c.doSwrkWithResp(rpc.CriuReqType_PAGE_SERVER_CHLD, opts, nil, nil)
 	if err != nil {
 		return 0, 0, err
 	}
@@ -220,7 +224,7 @@ func (c *Criu) StartPageServerChld(opts *rpc.CriuOpts) (int, int, error) {
 // GetCriuVersion executes the VERSION RPC call and returns the version
 // as an integer. Major * 10000 + Minor * 100 + SubLevel
 func (c *Criu) GetCriuVersion() (int, error) {
-	resp, err := c.doSwrkWithResp(rpc.CriuReqType_VERSION, nil, nil)
+	resp, err := c.doSwrkWithResp(rpc.CriuReqType_VERSION, nil, nil, nil)
 	if err != nil {
 		return 0, err
 	}
diff --git a/vendor/github.com/checkpoint-restore/go-criu/v5/rpc/rpc.pb.go b/vendor/github.com/checkpoint-restore/go-criu/v5/rpc/rpc.pb.go
index 9f22f15393d..15e33fea52f 100644
--- a/vendor/github.com/checkpoint-restore/go-criu/v5/rpc/rpc.pb.go
+++ b/vendor/github.com/checkpoint-restore/go-criu/v5/rpc/rpc.pb.go
@@ -2,8 +2,8 @@
 
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
-// 	protoc-gen-go v1.26.0
-// 	protoc        v3.14.0
+// 	protoc-gen-go v1.27.1
+// 	protoc        v3.12.4
 // source: rpc/rpc.proto
 
 package rpc
diff --git a/vendor/modules.txt b/vendor/modules.txt
index c0a067dcfb7..30888448aef 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,4 +1,4 @@
-# github.com/checkpoint-restore/go-criu/v5 v5.1.0
+# github.com/checkpoint-restore/go-criu/v5 v5.3.0
 ## explicit
 github.com/checkpoint-restore/go-criu/v5
 github.com/checkpoint-restore/go-criu/v5/rpc