Which jobs are flaking:
pull-kubernetes-e2e-gce
ci-cos-containerd-e2e-ubuntu-gce
ci-kubernetes-e2e-kops-gce

Changes needed to get the fix into official containerd releases:

• runc race condition fixed - Fix race checking for process exit and waiting for exec fifo opencontainers/runc#2185
• runc release - https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc10
• cri bump of runc - Bump to opencontainers/runc new version - v1.0.0-rc10 containerd/cri#1383
• containerd bump of runc/cri - Bump to opencontainers/runc new version - v1.0.0-rc10 containerd/containerd#3973
• containerd 1.2.x release - [release/1.2] Prepare v1.2.12 release containerd/containerd#3984
• containerd 1.3.x release - https://github.com/containerd/containerd/releases/tag/v1.3.3

As I understand it, this is what we need to get the fix into our CI environments:

For kind:

• kind containerd build with updated runc - temporarily pin to runc v1.0.0-rc10 kind-ci/containerd-nightlies#11
• kind containerd-nightly release include patch - temporarily pin to runc v1.0.0-rc10 kind-ci/containerd-nightlies#11
• kind containerd-nightly release - https://github.com/kind-ci/containerd-nightlies/releases/tag/containerd-1.3.2-24-gda15d825
• kind pick up new containerd release - Bump runc kubernetes-sigs/kind#1285

For GCE / kube-up:

• Update runc to fix hang during start and exec moby/moby#36097
• cri bump of runc - Bump to opencontainers/runc new version - v1.0.0-rc10 containerd/cri#1383
• containerd bump of runc/cri - Bump to opencontainers/runc new version - v1.0.0-rc10 containerd/containerd#3973
• containerd 1.2.x release - [release/1.2] Prepare v1.2.12 release containerd/containerd#3984
• containerd 1.3.x release - https://github.com/containerd/containerd/releases/tag/v1.3.3
• COS image update with new runc version - Switch test COS image to include runc-1.0.0-rc10 fix. #88102

Which test(s) are flaking:

• [sig-storage] ConfigMap should be consumable from pods in volume as non-root with FSGroup [LinuxOnly] [NodeFeature:FSGroup]
• [sig-storage] Projected downwardAPI should provide podname as non-root with fsgroup [LinuxOnly] [NodeFeature:FSGroup]
• [sig-storage] Projected configMap should be consumable from pods in volume with mappings as non-root [NodeConformance] [Conformance]
• [sig-storage] EmptyDir volumes should support (root,0644,tmpfs) [LinuxOnly] [NodeConformance] [Conformance]
• [sig-storage] In-tree Volumes [Driver: hostPathSymlink] [Testpattern: Inline-volume (default fs)] subPath should support file as subpath [LinuxOnly]
• [sig-storage] In-tree Volumes [Driver: local][LocalVolumeType: blockfs] [Testpattern: Pre-provisioned PV (default fs)] subPath should support readOnly file specified in the volumeMount [LinuxOnly]

Testgrid link:

Reason for failure:

runc race condition fixed in opencontainers/runc#2185

Anything else we need to know:
https://storage.googleapis.com/k8s-gubernator/triage/index.html?text=OCI%20runtime%20start%20failed

Test containers appear to be exiting with a CRI error?

/sig node
for CRI expertise

/sig storage
for test ownership