diff --git a/Dockerfile b/Dockerfile
index dd808d277661..0a3bb13a5a5c 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,10 +1,10 @@
 # syntax=docker/dockerfile-upstream:master
 
 ARG RUNC_VERSION=v1.3.3
-ARG CONTAINERD_VERSION=v2.1.4
+ARG CONTAINERD_VERSION=v2.2.1
 # CONTAINERD_ALT_VERSION_... defines fallback containerd version for integration tests
-ARG CONTAINERD_ALT_VERSION_20=v2.0.6
-ARG CONTAINERD_ALT_VERSION_17=v1.7.28
+ARG CONTAINERD_ALT_VERSION_21=v2.1.6
+ARG CONTAINERD_ALT_VERSION_17=v1.7.30
 ARG REGISTRY_VERSION=v2.8.3
 ARG ROOTLESSKIT_VERSION=v2.3.5
 ARG CNI_VERSION=v1.8.0
@@ -231,7 +231,7 @@ RUN mkdir -p /etc/cdi /var/run/cdi /etc/buildkit/cdi
 FROM gobuild-base AS containerd-build
 WORKDIR /go/src/github.com/containerd/containerd
 ARG TARGETPLATFORM
-ENV CGO_ENABLED=1 CGO_LDFLAGS="-fuse-ld=lld" BUILDTAGS=no_btrfs GO111MODULE=off
+ENV CGO_ENABLED=1 CGO_LDFLAGS="-fuse-ld=lld" BUILDTAGS="no_btrfs nri_no_wasm" GO111MODULE=off
 RUN xx-apk add musl-dev gcc && xx-go --wrap
 COPY --chmod=755 <<-EOT /build.sh
 #!/bin/sh
@@ -261,11 +261,11 @@ ARG CONTAINERD_VERSION
 ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_VERSION" .
 RUN /build.sh
 
-# containerd-alt-20 builds containerd v2.0 for integration tests
-FROM containerd-build AS containerd-alt-20
+# containerd-alt-21 builds containerd v2.1 for integration tests
+FROM containerd-build AS containerd-alt-21
 WORKDIR /go/src/github.com/containerd/containerd
-ARG CONTAINERD_ALT_VERSION_20
-ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_ALT_VERSION_20" .
+ARG CONTAINERD_ALT_VERSION_21
+ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_ALT_VERSION_21" .
 RUN /build.sh
 
 # containerd-alt-17 builds containerd v1.7 for integration tests
@@ -432,7 +432,7 @@ RUN curl -fsSL https://raw.githubusercontent.com/moby/moby/v25.0.1/hack/dind > /
   && chmod 0755 /docker-entrypoint.sh
 ENTRYPOINT ["/docker-entrypoint.sh"]
 # musl is needed to directly use the registry binary that is built on alpine
-ENV BUILDKIT_INTEGRATION_CONTAINERD_EXTRA="containerd-2.0=/opt/containerd-alt-20/bin,containerd-1.7=/opt/containerd-alt-17/bin"
+ENV BUILDKIT_INTEGRATION_CONTAINERD_EXTRA="containerd-2.1=/opt/containerd-alt-21/bin,containerd-1.7=/opt/containerd-alt-17/bin"
 ENV BUILDKIT_INTEGRATION_SNAPSHOTTER=stargz
 ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1
 ENV BUILDKIT_TEST_SIGN_FIXTURES=/tmp/buildkit_test_sign_fixtures
@@ -446,7 +446,7 @@ COPY --link --from=minio-mc /usr/bin/mc /usr/bin/
 COPY --link --from=nydus /out/nydus-static/* /usr/bin/
 COPY --link --from=stargz-snapshotter /out/* /usr/bin/
 COPY --link --from=rootlesskit /rootlesskit /usr/bin/
-COPY --link --from=containerd-alt-20 /out/containerd* /opt/containerd-alt-20/bin/
+COPY --link --from=containerd-alt-21 /out/containerd* /opt/containerd-alt-21/bin/
 COPY --link --from=containerd-alt-17 /out/containerd* /opt/containerd-alt-17/bin/
 COPY --link --from=registry /out /usr/bin/
 COPY --link --from=runc /usr/bin/runc /usr/bin/