diff --git a/Dockerfile b/Dockerfile
index dd808d277661..5da270ecb66f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,29 +1,29 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG RUNC_VERSION=v1.3.3
-ARG CONTAINERD_VERSION=v2.1.4
+ARG RUNC_VERSION=v1.3.4
+ARG CONTAINERD_VERSION=v2.2.1
 # CONTAINERD_ALT_VERSION_... defines fallback containerd version for integration tests
-ARG CONTAINERD_ALT_VERSION_20=v2.0.6
-ARG CONTAINERD_ALT_VERSION_17=v1.7.28
+ARG CONTAINERD_ALT_VERSION_21=v2.1.6
+ARG CONTAINERD_ALT_VERSION_17=v1.7.30
 ARG REGISTRY_VERSION=v2.8.3
-ARG ROOTLESSKIT_VERSION=v2.3.5
-ARG CNI_VERSION=v1.8.0
-ARG STARGZ_SNAPSHOTTER_VERSION=v0.15.1
-ARG NERDCTL_VERSION=v2.1.2
+ARG ROOTLESSKIT_VERSION=v2.3.6
+ARG CNI_VERSION=v1.9.0
+ARG STARGZ_SNAPSHOTTER_VERSION=v0.18.1
+ARG NERDCTL_VERSION=v2.2.0
 ARG DNSNAME_VERSION=v1.3.1
-ARG NYDUS_VERSION=v2.3.7
+ARG NYDUS_VERSION=v2.3.9
 ARG MINIO_VERSION=RELEASE.2025-09-07T16-13-09Z
 ARG MINIO_MC_VERSION=RELEASE.2025-08-13T08-35-41Z
-ARG AZURITE_VERSION=3.33.0
-ARG GOTESTSUM_VERSION=v1.9.0
-ARG DELVE_VERSION=v1.23.1
+ARG AZURITE_VERSION=3.35.0
+ARG GOTESTSUM_VERSION=v1.13.0
+ARG DELVE_VERSION=v1.25.2
 
 ARG EXPORT_BASE=alpine
 ARG ALPINE_VERSION=3.22
 ARG UBUNTU_VERSION=24.04
 
 ARG GO_VERSION=1.25
-ARG XX_VERSION=1.7.0
+ARG XX_VERSION=1.9.0
 ARG BUILDKIT_DEBUG
 
 # minio for s3 integration tests
@@ -231,7 +231,8 @@ RUN mkdir -p /etc/cdi /var/run/cdi /etc/buildkit/cdi
 FROM gobuild-base AS containerd-build
 WORKDIR /go/src/github.com/containerd/containerd
 ARG TARGETPLATFORM
-ENV CGO_ENABLED=1 CGO_LDFLAGS="-fuse-ld=lld" BUILDTAGS=no_btrfs GO111MODULE=off
+# nri_no_wasm: workaround for a compilation error https://github.com/moby/buildkit/pull/6340
+ENV CGO_ENABLED=1 CGO_LDFLAGS="-fuse-ld=lld" BUILDTAGS="no_btrfs nri_no_wasm" GO111MODULE=off
 RUN xx-apk add musl-dev gcc && xx-go --wrap
 COPY --chmod=755 <<-EOT /build.sh
 #!/bin/sh
@@ -261,11 +262,11 @@ ARG CONTAINERD_VERSION
 ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_VERSION" .
 RUN /build.sh
 
-# containerd-alt-20 builds containerd v2.0 for integration tests
-FROM containerd-build AS containerd-alt-20
+# containerd-alt-21 builds containerd v2.1 for integration tests
+FROM containerd-build AS containerd-alt-21
 WORKDIR /go/src/github.com/containerd/containerd
-ARG CONTAINERD_ALT_VERSION_20
-ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_ALT_VERSION_20" .
+ARG CONTAINERD_ALT_VERSION_21
+ADD --keep-git-dir=true "https://github.com/containerd/containerd.git#$CONTAINERD_ALT_VERSION_21" .
 RUN /build.sh
 
 # containerd-alt-17 builds containerd v1.7 for integration tests
@@ -432,7 +433,7 @@ RUN curl -fsSL https://raw.githubusercontent.com/moby/moby/v25.0.1/hack/dind > /
   && chmod 0755 /docker-entrypoint.sh
 ENTRYPOINT ["/docker-entrypoint.sh"]
 # musl is needed to directly use the registry binary that is built on alpine
-ENV BUILDKIT_INTEGRATION_CONTAINERD_EXTRA="containerd-2.0=/opt/containerd-alt-20/bin,containerd-1.7=/opt/containerd-alt-17/bin"
+ENV BUILDKIT_INTEGRATION_CONTAINERD_EXTRA="containerd-2.1=/opt/containerd-alt-21/bin,containerd-1.7=/opt/containerd-alt-17/bin"
 ENV BUILDKIT_INTEGRATION_SNAPSHOTTER=stargz
 ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1
 ENV BUILDKIT_TEST_SIGN_FIXTURES=/tmp/buildkit_test_sign_fixtures
@@ -446,7 +447,7 @@ COPY --link --from=minio-mc /usr/bin/mc /usr/bin/
 COPY --link --from=nydus /out/nydus-static/* /usr/bin/
 COPY --link --from=stargz-snapshotter /out/* /usr/bin/
 COPY --link --from=rootlesskit /rootlesskit /usr/bin/
-COPY --link --from=containerd-alt-20 /out/containerd* /opt/containerd-alt-20/bin/
+COPY --link --from=containerd-alt-21 /out/containerd* /opt/containerd-alt-21/bin/
 COPY --link --from=containerd-alt-17 /out/containerd* /opt/containerd-alt-17/bin/
 COPY --link --from=registry /out /usr/bin/
 COPY --link --from=runc /usr/bin/runc /usr/bin/