diff --git a/archive/compression/compression_test.go b/archive/compression/compression_test.go
index 5b16fcf2d000..4fe9c311c19d 100644
--- a/archive/compression/compression_test.go
+++ b/archive/compression/compression_test.go
@@ -21,7 +21,6 @@ import (
 	"compress/gzip"
 	"context"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -80,7 +79,7 @@ func testCompressDecompress(t *testing.T, size int, compression Compression) Dec
 	if err != nil {
 		t.Fatal(err)
 	}
-	decompressed, err := ioutil.ReadAll(decompressor)
+	decompressed, err := io.ReadAll(decompressor)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -123,7 +122,7 @@ func TestCompressDecompressUncompressed(t *testing.T) {
 
 func TestDetectPigz(t *testing.T) {
 	// Create fake PATH with unpigz executable, make sure detectPigz can find it
-	tempPath, err := ioutil.TempDir("", "containerd_temp_")
+	tempPath, err := os.MkdirTemp("", "containerd_temp_")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -135,7 +134,7 @@ func TestDetectPigz(t *testing.T) {
 
 	fullPath := filepath.Join(tempPath, filename)
 
-	if err := ioutil.WriteFile(fullPath, []byte(""), 0111); err != nil {
+	if err := os.WriteFile(fullPath, []byte(""), 0111); err != nil {
 		t.Fatal(err)
 	}
 
@@ -165,7 +164,7 @@ func TestCmdStream(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	buf, err := ioutil.ReadAll(out)
+	buf, err := io.ReadAll(out)
 	if err != nil {
 		t.Fatalf("failed to read from stdout: %s", err)
 	}
@@ -181,7 +180,7 @@ func TestCmdStreamBad(t *testing.T) {
 		t.Fatalf("failed to start command: %v", err)
 	}
 
-	if buf, err := ioutil.ReadAll(out); err == nil {
+	if buf, err := io.ReadAll(out); err == nil {
 		t.Fatal("command should have failed")
 	} else if err.Error() != "exit status 1: bad result\n" {
 		t.Fatalf("wrong error: %s", err.Error())
diff --git a/archive/issues_test.go b/archive/issues_test.go
index 9d54c7cad6a7..60eeb28b8866 100644
--- a/archive/issues_test.go
+++ b/archive/issues_test.go
@@ -19,7 +19,6 @@ package archive
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -37,7 +36,7 @@ func TestPrefixHeaderReadable(t *testing.T) {
 	// https://gist.github.com/stevvooe/e2a790ad4e97425896206c0816e1a882#file-out-go
 	var testFile = []byte("\x1f\x8b\x08\x08\x44\x21\x68\x59\x00\x03\x74\x2e\x74\x61\x72\x00\x4b\xcb\xcf\x67\xa0\x35\x30\x80\x00\x86\x06\x10\x47\x01\xc1\x37\x40\x00\x54\xb6\xb1\xa1\xa9\x99\x09\x48\x25\x1d\x40\x69\x71\x49\x62\x91\x02\xe5\x76\xa1\x79\x84\x21\x91\xd6\x80\x72\xaf\x8f\x82\x51\x30\x0a\x46\x36\x00\x00\xf0\x1c\x1e\x95\x00\x06\x00\x00")
 
-	tmpDir, err := ioutil.TempDir("", "prefix-test")
+	tmpDir, err := os.MkdirTemp("", "prefix-test")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/archive/tar_linux_test.go b/archive/tar_linux_test.go
index 9b6d46259c9c..a75fefe9caaf 100644
--- a/archive/tar_linux_test.go
+++ b/archive/tar_linux_test.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 	"testing"
@@ -38,7 +37,7 @@ import (
 func TestOverlayApply(t *testing.T) {
 	testutil.RequiresRoot(t)
 
-	base, err := ioutil.TempDir("", "test-ovl-diff-apply-")
+	base, err := os.MkdirTemp("", "test-ovl-diff-apply-")
 	if err != nil {
 		t.Fatalf("unable to create temp dir: %+v", err)
 	}
@@ -57,7 +56,7 @@ func TestOverlayApply(t *testing.T) {
 func TestOverlayApplyNoParents(t *testing.T) {
 	testutil.RequiresRoot(t)
 
-	base, err := ioutil.TempDir("", "test-ovl-diff-apply-")
+	base, err := os.MkdirTemp("", "test-ovl-diff-apply-")
 	if err != nil {
 		t.Fatalf("unable to create temp dir: %+v", err)
 	}
@@ -96,7 +95,7 @@ type overlayContext struct {
 type contextKey struct{}
 
 func (d overlayDiffApplier) TestContext(ctx context.Context) (context.Context, func(), error) {
-	merged, err := ioutil.TempDir(d.tmp, "merged")
+	merged, err := os.MkdirTemp(d.tmp, "merged")
 	if err != nil {
 		return ctx, nil, errors.Wrap(err, "failed to make merged dir")
 	}
@@ -117,7 +116,7 @@ func (d overlayDiffApplier) TestContext(ctx context.Context) (context.Context, f
 func (d overlayDiffApplier) Apply(ctx context.Context, a fstest.Applier) (string, func(), error) {
 	oc := ctx.Value(contextKey{}).(*overlayContext)
 
-	applyCopy, err := ioutil.TempDir(d.tmp, "apply-copy-")
+	applyCopy, err := os.MkdirTemp(d.tmp, "apply-copy-")
 	if err != nil {
 		return "", nil, errors.Wrap(err, "failed to create temp dir")
 	}
@@ -149,7 +148,7 @@ func (d overlayDiffApplier) Apply(ctx context.Context, a fstest.Applier) (string
 		oc.mounted = false
 	}
 
-	next, err := ioutil.TempDir(d.tmp, "lower-")
+	next, err := os.MkdirTemp(d.tmp, "lower-")
 	if err != nil {
 		return "", nil, errors.Wrap(err, "failed to create temp dir")
 	}
diff --git a/archive/tar_test.go b/archive/tar_test.go
index 1e0a29ab94ae..e55652e46f85 100644
--- a/archive/tar_test.go
+++ b/archive/tar_test.go
@@ -25,7 +25,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -234,7 +233,7 @@ func TestBreakouts(t *testing.T) {
 	tc := tartest.TarContext{}.WithUIDGID(os.Getuid(), os.Getgid()).WithModTime(time.Now().UTC())
 	expected := "unbroken"
 	unbrokenCheck := func(root string) error {
-		b, err := ioutil.ReadFile(filepath.Join(root, "etc", "unbroken"))
+		b, err := os.ReadFile(filepath.Join(root, "etc", "unbroken"))
 		if err != nil {
 			return errors.Wrap(err, "failed to read unbroken")
 		}
@@ -244,7 +243,7 @@ func TestBreakouts(t *testing.T) {
 		return nil
 	}
 	errFileDiff := errors.New("files differ")
-	td, err := ioutil.TempDir("", "test-breakouts-")
+	td, err := os.MkdirTemp("", "test-breakouts-")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -331,7 +330,7 @@ func TestBreakouts(t *testing.T) {
 	}
 	fileValue := func(f1 string, content []byte) func(string) error {
 		return func(root string) error {
-			b, err := ioutil.ReadFile(filepath.Join(root, f1))
+			b, err := os.ReadFile(filepath.Join(root, f1))
 			if err != nil {
 				return err
 			}
@@ -421,7 +420,7 @@ func TestBreakouts(t *testing.T) {
 				tc.File("/localetc/emptied", []byte{}, 0644),
 			),
 			validator: func(root string) error {
-				b, err := ioutil.ReadFile(filepath.Join(root, "etc", "emptied"))
+				b, err := os.ReadFile(filepath.Join(root, "etc", "emptied"))
 				if err != nil {
 					return errors.Wrap(err, "failed to read unbroken")
 				}
@@ -755,11 +754,11 @@ func TestBreakouts(t *testing.T) {
 			name: "HardlinkSymlinkChmod",
 			w: func() tartest.WriterToTar {
 				p := filepath.Join(td, "perm400")
-				if err := ioutil.WriteFile(p, []byte("..."), 0400); err != nil {
+				if err := os.WriteFile(p, []byte("..."), 0400); err != nil {
 					t.Fatal(err)
 				}
 				ep := filepath.Join(td, "also-exists-outside-root")
-				if err := ioutil.WriteFile(ep, []byte("..."), 0640); err != nil {
+				if err := os.WriteFile(ep, []byte("..."), 0640); err != nil {
 					t.Fatal(err)
 				}
 
@@ -843,12 +842,12 @@ func TestApplyTar(t *testing.T) {
 }
 
 func testApply(a fstest.Applier) error {
-	td, err := ioutil.TempDir("", "test-apply-")
+	td, err := os.MkdirTemp("", "test-apply-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
 	defer os.RemoveAll(td)
-	dest, err := ioutil.TempDir("", "test-apply-dest-")
+	dest, err := os.MkdirTemp("", "test-apply-dest-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -884,12 +883,12 @@ func testApply(a fstest.Applier) error {
 }
 
 func testBaseDiff(a fstest.Applier) error {
-	td, err := ioutil.TempDir("", "test-base-diff-")
+	td, err := os.MkdirTemp("", "test-base-diff-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
 	defer os.RemoveAll(td)
-	dest, err := ioutil.TempDir("", "test-base-diff-dest-")
+	dest, err := os.MkdirTemp("", "test-base-diff-dest-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -911,12 +910,12 @@ func testBaseDiff(a fstest.Applier) error {
 }
 
 func testDiffApply(appliers ...fstest.Applier) error {
-	td, err := ioutil.TempDir("", "test-diff-apply-")
+	td, err := os.MkdirTemp("", "test-diff-apply-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
 	defer os.RemoveAll(td)
-	dest, err := ioutil.TempDir("", "test-diff-apply-dest-")
+	dest, err := os.MkdirTemp("", "test-diff-apply-dest-")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -937,7 +936,7 @@ func testDiffApply(appliers ...fstest.Applier) error {
 		}
 	}
 
-	diffBytes, err := ioutil.ReadAll(Diff(context.Background(), dest, td))
+	diffBytes, err := io.ReadAll(Diff(context.Background(), dest, td))
 	if err != nil {
 		return errors.Wrap(err, "failed to create diff")
 	}
@@ -951,7 +950,7 @@ func testDiffApply(appliers ...fstest.Applier) error {
 
 func makeWriterToTarTest(wt tartest.WriterToTar, a fstest.Applier, validate func(string) error, applyErr error) func(*testing.T) {
 	return func(t *testing.T) {
-		td, err := ioutil.TempDir("", "test-writer-to-tar-")
+		td, err := os.MkdirTemp("", "test-writer-to-tar-")
 		if err != nil {
 			t.Fatalf("Failed to create temp dir: %v", err)
 		}
@@ -1255,7 +1254,7 @@ func whiteoutEntry(name string) tarEntryValidator {
 
 func makeDiffTarTest(validators []tarEntryValidator, a, b fstest.Applier) func(*testing.T) {
 	return func(t *testing.T) {
-		ad, err := ioutil.TempDir("", "test-make-diff-tar-")
+		ad, err := os.MkdirTemp("", "test-make-diff-tar-")
 		if err != nil {
 			t.Fatalf("failed to create temp dir: %v", err)
 		}
@@ -1264,7 +1263,7 @@ func makeDiffTarTest(validators []tarEntryValidator, a, b fstest.Applier) func(*
 			t.Fatalf("failed to apply a: %v", err)
 		}
 
-		bd, err := ioutil.TempDir("", "test-make-diff-tar-")
+		bd, err := os.MkdirTemp("", "test-make-diff-tar-")
 		if err != nil {
 			t.Fatalf("failed to create temp dir: %v", err)
 		}
@@ -1290,7 +1289,7 @@ func makeDiffTarTest(validators []tarEntryValidator, a, b fstest.Applier) func(*
 			}
 			var b []byte
 			if hdr.Typeflag == tar.TypeReg && hdr.Size > 0 {
-				b, err = ioutil.ReadAll(tr)
+				b, err = io.ReadAll(tr)
 				if err != nil {
 					t.Fatalf("tar read file error: %v", err)
 				}
@@ -1308,7 +1307,7 @@ func makeDiffTarTest(validators []tarEntryValidator, a, b fstest.Applier) func(*
 type diffApplier struct{}
 
 func (d diffApplier) TestContext(ctx context.Context) (context.Context, func(), error) {
-	base, err := ioutil.TempDir("", "test-diff-apply-")
+	base, err := os.MkdirTemp("", "test-diff-apply-")
 	if err != nil {
 		return ctx, nil, errors.Wrap(err, "failed to create temp dir")
 	}
@@ -1320,7 +1319,7 @@ func (d diffApplier) TestContext(ctx context.Context) (context.Context, func(),
 func (d diffApplier) Apply(ctx context.Context, a fstest.Applier) (string, func(), error) {
 	base := ctx.Value(d).(string)
 
-	applyCopy, err := ioutil.TempDir("", "test-diffapply-apply-copy-")
+	applyCopy, err := os.MkdirTemp("", "test-diffapply-apply-copy-")
 	if err != nil {
 		return "", nil, errors.Wrap(err, "failed to create temp dir")
 	}
@@ -1332,7 +1331,7 @@ func (d diffApplier) Apply(ctx context.Context, a fstest.Applier) (string, func(
 		return "", nil, errors.Wrap(err, "failed to apply changes to copy of base")
 	}
 
-	diffBytes, err := ioutil.ReadAll(Diff(ctx, base, applyCopy))
+	diffBytes, err := io.ReadAll(Diff(ctx, base, applyCopy))
 	if err != nil {
 		return "", nil, errors.Wrap(err, "failed to create diff")
 	}
@@ -1345,7 +1344,7 @@ func (d diffApplier) Apply(ctx context.Context, a fstest.Applier) (string, func(
 }
 
 func readDirNames(p string) ([]string, error) {
-	fis, err := ioutil.ReadDir(p)
+	fis, err := os.ReadDir(p)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cio/io_test.go b/cio/io_test.go
index 5ad46f356eeb..b52a0bf4ae71 100644
--- a/cio/io_test.go
+++ b/cio/io_test.go
@@ -23,7 +23,6 @@ import (
 	"bytes"
 	"context"
 	"io"
-	"io/ioutil"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -50,7 +49,7 @@ func TestNewFIFOSetInDir(t *testing.T) {
 		t.Skip("NewFIFOSetInDir has different behaviour on windows")
 	}
 
-	root, err := ioutil.TempDir("", "test-new-fifo-set")
+	root, err := os.MkdirTemp("", "test-new-fifo-set")
 	assert.NilError(t, err)
 	defer os.RemoveAll(root)
 
@@ -69,12 +68,12 @@ func TestNewFIFOSetInDir(t *testing.T) {
 	}
 	assert.Assert(t, is.DeepEqual(fifos, expected, cmpFIFOSet))
 
-	files, err := ioutil.ReadDir(root)
+	files, err := os.ReadDir(root)
 	assert.NilError(t, err)
 	assert.Check(t, is.Len(files, 1))
 
 	assert.NilError(t, fifos.Close())
-	files, err = ioutil.ReadDir(root)
+	files, err = os.ReadDir(root)
 	assert.NilError(t, err)
 	assert.Check(t, is.Len(files, 0))
 }
@@ -102,19 +101,19 @@ func TestNewAttach(t *testing.T) {
 	fifos, err := NewFIFOSetInDir("", "theid", false)
 	assert.NilError(t, err)
 
-	io, err := attacher(fifos)
+	attachedFifos, err := attacher(fifos)
 	assert.NilError(t, err)
-	defer io.Close()
+	defer attachedFifos.Close()
 
-	producers := setupFIFOProducers(t, io.Config())
+	producers := setupFIFOProducers(t, attachedFifos.Config())
 	initProducers(t, producers, expectedStdout, expectedStderr)
 
-	actualStdin, err := ioutil.ReadAll(producers.Stdin)
+	actualStdin, err := io.ReadAll(producers.Stdin)
 	assert.NilError(t, err)
 
-	io.Wait()
-	io.Cancel()
-	assert.NilError(t, io.Close())
+	attachedFifos.Wait()
+	attachedFifos.Cancel()
+	assert.NilError(t, attachedFifos.Close())
 
 	assert.Check(t, is.Equal(expectedStdout, stdout.String()))
 	assert.Check(t, is.Equal(expectedStderr, stderr.String()))
diff --git a/cio/io_unix.go b/cio/io_unix.go
index 2896fb9d6e7a..99281c9d1b94 100644
--- a/cio/io_unix.go
+++ b/cio/io_unix.go
@@ -22,7 +22,6 @@ package cio
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -39,7 +38,7 @@ func NewFIFOSetInDir(root, id string, terminal bool) (*FIFOSet, error) {
 			return nil, err
 		}
 	}
-	dir, err := ioutil.TempDir(root, "")
+	dir, err := os.MkdirTemp(root, "")
 	if err != nil {
 		return nil, err
 	}
diff --git a/cio/io_unix_test.go b/cio/io_unix_test.go
index 47fe60da84b1..fc4fad8a9e5e 100644
--- a/cio/io_unix_test.go
+++ b/cio/io_unix_test.go
@@ -22,7 +22,6 @@ package cio
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -66,7 +65,7 @@ func TestOpenFifosWithTerminal(t *testing.T) {
 	var ctx, cancel = context.WithCancel(context.Background())
 	defer cancel()
 
-	ioFifoDir, err := ioutil.TempDir("", fmt.Sprintf("cio-%s", t.Name()))
+	ioFifoDir, err := os.MkdirTemp("", fmt.Sprintf("cio-%s", t.Name()))
 	if err != nil {
 		t.Fatalf("unexpected error during creating temp dir: %v", err)
 	}
diff --git a/cmd/containerd-stress/density.go b/cmd/containerd-stress/density.go
index 27b537dd2901..4b2ad50ca12a 100644
--- a/cmd/containerd-stress/density.go
+++ b/cmd/containerd-stress/density.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/signal"
 	"path/filepath"
@@ -172,7 +171,7 @@ func getMaps(pid int) (map[string]int, error) {
 }
 
 func getppid(pid int) (int, error) {
-	bytes, err := ioutil.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat"))
+	bytes, err := os.ReadFile(filepath.Join("/proc", strconv.Itoa(pid), "stat"))
 	if err != nil {
 		return 0, err
 	}
diff --git a/cmd/containerd/command/main.go b/cmd/containerd/command/main.go
index ff633dff5a29..127b00ddb15f 100644
--- a/cmd/containerd/command/main.go
+++ b/cmd/containerd/command/main.go
@@ -19,7 +19,7 @@ package command
 import (
 	gocontext "context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net"
 	"os"
 	"os/signal"
@@ -56,7 +56,7 @@ high performance container runtime
 
 func init() {
 	// Discard grpc logs so that they don't mess with our stdio
-	grpclog.SetLoggerV2(grpclog.NewLoggerV2(ioutil.Discard, ioutil.Discard, ioutil.Discard))
+	grpclog.SetLoggerV2(grpclog.NewLoggerV2(io.Discard, io.Discard, io.Discard))
 
 	cli.VersionPrinter = func(c *cli.Context) {
 		fmt.Println(c.App.Name, version.Package, c.App.Version, version.Revision)
diff --git a/cmd/containerd/command/publish.go b/cmd/containerd/command/publish.go
index 82e75f35e406..02ceecb0df17 100644
--- a/cmd/containerd/command/publish.go
+++ b/cmd/containerd/command/publish.go
@@ -19,7 +19,6 @@ package command
 import (
 	gocontext "context"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"time"
@@ -73,7 +72,7 @@ var publishCommand = cli.Command{
 }
 
 func getEventPayload(r io.Reader) (*types.Any, error) {
-	data, err := ioutil.ReadAll(r)
+	data, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/containerd/command/service_windows.go b/cmd/containerd/command/service_windows.go
index a0700ccb7cf6..2e5384eaad1f 100644
--- a/cmd/containerd/command/service_windows.go
+++ b/cmd/containerd/command/service_windows.go
@@ -18,7 +18,7 @@ package command
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 	"log"
 	"os"
 	"path/filepath"
@@ -249,7 +249,7 @@ func registerUnregisterService(root string) (bool, error) {
 			return true, err
 		}
 
-		logOutput := ioutil.Discard
+		logOutput := io.Discard
 		if logFileFlag != "" {
 			f, err := os.OpenFile(logFileFlag, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
 			if err != nil {
diff --git a/cmd/ctr/app/main.go b/cmd/ctr/app/main.go
index bf274385c0bf..4beb24ba1bf9 100644
--- a/cmd/ctr/app/main.go
+++ b/cmd/ctr/app/main.go
@@ -18,7 +18,7 @@ package app
 
 import (
 	"fmt"
-	"io/ioutil"
+	"io"
 
 	"github.com/containerd/containerd/cmd/ctr/commands/containers"
 	"github.com/containerd/containerd/cmd/ctr/commands/content"
@@ -46,7 +46,7 @@ var extraCmds = []cli.Command{}
 
 func init() {
 	// Discard grpc logs so that they don't mess with our stdio
-	grpclog.SetLoggerV2(grpclog.NewLoggerV2(ioutil.Discard, ioutil.Discard, ioutil.Discard))
+	grpclog.SetLoggerV2(grpclog.NewLoggerV2(io.Discard, io.Discard, io.Discard))
 
 	cli.VersionPrinter = func(c *cli.Context) {
 		fmt.Println(c.App.Name, version.Package, c.App.Version)
diff --git a/cmd/ctr/commands/content/content.go b/cmd/ctr/commands/content/content.go
index 99ed64ebd416..9ff52ec6c0d7 100644
--- a/cmd/ctr/commands/content/content.go
+++ b/cmd/ctr/commands/content/content.go
@@ -19,7 +19,6 @@ package content
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"strings"
 	"text/tabwriter"
@@ -519,7 +518,7 @@ func edit(context *cli.Context, rd io.Reader) (io.ReadCloser, error) {
 		return nil, fmt.Errorf("editor is required")
 	}
 
-	tmp, err := ioutil.TempFile(os.Getenv("XDG_RUNTIME_DIR"), "edit-")
+	tmp, err := os.CreateTemp(os.Getenv("XDG_RUNTIME_DIR"), "edit-")
 	if err != nil {
 		return nil, err
 	}
diff --git a/cmd/ctr/commands/resolver.go b/cmd/ctr/commands/resolver.go
index 3571ecfc4bb6..95c6ed609369 100644
--- a/cmd/ctr/commands/resolver.go
+++ b/cmd/ctr/commands/resolver.go
@@ -23,10 +23,10 @@ import (
 	"crypto/x509"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptrace"
 	"net/http/httputil"
+	"os"
 	"strings"
 
 	"github.com/containerd/console"
@@ -124,7 +124,7 @@ func resolverDefaultTLS(clicontext *cli.Context) (*tls.Config, error) {
 	}
 
 	if tlsRootPath := clicontext.String("tlscacert"); tlsRootPath != "" {
-		tlsRootData, err := ioutil.ReadFile(tlsRootPath)
+		tlsRootData, err := os.ReadFile(tlsRootPath)
 		if err != nil {
 			return nil, errors.Wrapf(err, "failed to read %q", tlsRootPath)
 		}
diff --git a/cmd/ctr/commands/shim/shim.go b/cmd/ctr/commands/shim/shim.go
index 57585a02fa95..20871d7def43 100644
--- a/cmd/ctr/commands/shim/shim.go
+++ b/cmd/ctr/commands/shim/shim.go
@@ -22,8 +22,8 @@ package shim
 import (
 	gocontext "context"
 	"fmt"
-	"io/ioutil"
 	"net"
+	"os"
 	"path/filepath"
 	"strings"
 
@@ -174,7 +174,7 @@ var execCommand = cli.Command{
 		}
 
 		// read spec file and extract Any object
-		spec, err := ioutil.ReadFile(context.String("spec"))
+		spec, err := os.ReadFile(context.String("spec"))
 		if err != nil {
 			return err
 		}
diff --git a/cmd/gen-manpages/main.go b/cmd/gen-manpages/main.go
index 0672e12df172..61ec6a3af150 100644
--- a/cmd/gen-manpages/main.go
+++ b/cmd/gen-manpages/main.go
@@ -19,7 +19,6 @@ package main
 import (
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -62,7 +61,7 @@ func run() error {
 		return err
 	}
 	_ = os.MkdirAll(dir, os.ModePerm)
-	if err := ioutil.WriteFile(filepath.Join(dir, fmt.Sprintf("%s.%s", name, section)), []byte(data), 0644); err != nil {
+	if err := os.WriteFile(filepath.Join(dir, fmt.Sprintf("%s.%s", name, section)), []byte(data), 0644); err != nil {
 		return err
 	}
 	return nil
diff --git a/content/helpers.go b/content/helpers.go
index 00fae1fc80d8..b6ed17278614 100644
--- a/content/helpers.go
+++ b/content/helpers.go
@@ -19,7 +19,6 @@ package content
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"sync"
 	"time"
@@ -230,7 +229,7 @@ func seekReader(r io.Reader, offset, size int64) (io.Reader, error) {
 	}
 
 	// well then, let's just discard up to the offset
-	n, err := copyWithBuffer(ioutil.Discard, io.LimitReader(r, offset))
+	n, err := copyWithBuffer(io.Discard, io.LimitReader(r, offset))
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to discard to offset")
 	}
diff --git a/content/local/store.go b/content/local/store.go
index 5e2101c33fb2..b4a388bad995 100644
--- a/content/local/store.go
+++ b/content/local/store.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -568,7 +567,7 @@ func (s *store) writer(ctx context.Context, ref string, total int64, expected di
 
 		// the ingest is new, we need to setup the target location.
 		// write the ref to a file for later use
-		if err := ioutil.WriteFile(refp, []byte(ref), 0666); err != nil {
+		if err := os.WriteFile(refp, []byte(ref), 0666); err != nil {
 			return nil, err
 		}
 
@@ -581,7 +580,7 @@ func (s *store) writer(ctx context.Context, ref string, total int64, expected di
 		}
 
 		if total > 0 {
-			if err := ioutil.WriteFile(filepath.Join(path, "total"), []byte(fmt.Sprint(total)), 0666); err != nil {
+			if err := os.WriteFile(filepath.Join(path, "total"), []byte(fmt.Sprint(total)), 0666); err != nil {
 				return nil, err
 			}
 		}
@@ -656,13 +655,13 @@ func (s *store) ingestPaths(ref string) (string, string, string) {
 }
 
 func readFileString(path string) (string, error) {
-	p, err := ioutil.ReadFile(path)
+	p, err := os.ReadFile(path)
 	return string(p), err
 }
 
 // readFileTimestamp reads a file with just a timestamp present.
 func readFileTimestamp(p string) (time.Time, error) {
-	b, err := ioutil.ReadFile(p)
+	b, err := os.ReadFile(p)
 	if err != nil {
 		if os.IsNotExist(err) {
 			err = errors.Wrap(errdefs.ErrNotFound, err.Error())
diff --git a/content/local/store_test.go b/content/local/store_test.go
index 156fcd14020b..e89c742418cf 100644
--- a/content/local/store_test.go
+++ b/content/local/store_test.go
@@ -23,7 +23,6 @@ import (
 	_ "crypto/sha256" // required for digest package
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -158,7 +157,7 @@ func TestContentWriter(t *testing.T) {
 	}
 	expected := digest.FromBytes(p)
 
-	checkCopy(t, int64(len(p)), cw, bufio.NewReader(ioutil.NopCloser(bytes.NewReader(p))))
+	checkCopy(t, int64(len(p)), cw, bufio.NewReader(io.NopCloser(bytes.NewReader(p))))
 
 	if err := cw.Commit(ctx, int64(len(p)), expected); err != nil {
 		t.Fatal(err)
@@ -174,7 +173,7 @@ func TestContentWriter(t *testing.T) {
 	}
 
 	// now, attempt to write the same data again
-	checkCopy(t, int64(len(p)), cw, bufio.NewReader(ioutil.NopCloser(bytes.NewReader(p))))
+	checkCopy(t, int64(len(p)), cw, bufio.NewReader(io.NopCloser(bytes.NewReader(p))))
 	if err := cw.Commit(ctx, int64(len(p)), expected); err == nil {
 		t.Fatal("expected already exists error")
 	} else if !errdefs.IsAlreadyExists(err) {
@@ -184,7 +183,7 @@ func TestContentWriter(t *testing.T) {
 	path := checkBlobPath(t, cs, expected)
 
 	// read the data back, make sure its the same
-	pp, err := ioutil.ReadFile(path)
+	pp, err := os.ReadFile(path)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -299,7 +298,7 @@ func contentStoreEnv(t checker) (context.Context, string, content.Store, func())
 	}
 	fn := runtime.FuncForPC(pc)
 
-	tmpdir, err := ioutil.TempDir("", filepath.Base(fn.Name())+"-")
+	tmpdir, err := os.MkdirTemp("", filepath.Base(fn.Name())+"-")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -362,7 +361,7 @@ func checkWrite(ctx context.Context, t checker, cs content.Store, dgst digest.Di
 }
 
 func TestWriterTruncateRecoversFromIncompleteWrite(t *testing.T) {
-	tmpdir, err := ioutil.TempDir("", "test-local-content-store-recover")
+	tmpdir, err := os.MkdirTemp("", "test-local-content-store-recover")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tmpdir)
 
@@ -401,7 +400,7 @@ func setupIncompleteWrite(ctx context.Context, t *testing.T, cs content.Store, r
 }
 
 func TestWriteReadEmptyFileTimestamp(t *testing.T) {
-	root, err := ioutil.TempDir("", "test-write-read-file-timestamp")
+	root, err := os.MkdirTemp("", "test-write-read-file-timestamp")
 	if err != nil {
 		t.Errorf("failed to create a tmp dir: %v", err)
 	}
diff --git a/content/testsuite/testsuite.go b/content/testsuite/testsuite.go
index 2402534ea28f..c0ee78d62fc8 100644
--- a/content/testsuite/testsuite.go
+++ b/content/testsuite/testsuite.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"runtime"
@@ -104,7 +103,7 @@ func makeTest(t *testing.T, name string, storeFn func(ctx context.Context, root
 		ctx := context.WithValue(context.Background(), nameKey{}, name)
 		ctx = logtest.WithT(ctx, t)
 
-		tmpDir, err := ioutil.TempDir("", "content-suite-"+name+"-")
+		tmpDir, err := os.MkdirTemp("", "content-suite-"+name+"-")
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -782,7 +781,7 @@ func checkSmallBlob(ctx context.Context, t *testing.T, store content.Store) {
 	}
 	defer ra.Close()
 	r := io.NewSectionReader(ra, 0, readSize)
-	b, err := ioutil.ReadAll(r)
+	b, err := io.ReadAll(r)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1080,7 +1079,7 @@ func createContent(size int64) ([]byte, digest.Digest) {
 	// test runs. An atomic integer works just good enough for this.
 	seed := atomic.AddInt64(&contentSeed, 1)
 
-	b, err := ioutil.ReadAll(io.LimitReader(rand.New(rand.NewSource(seed)), size))
+	b, err := io.ReadAll(io.LimitReader(rand.New(rand.NewSource(seed)), size))
 	if err != nil {
 		panic(err)
 	}
diff --git a/contrib/apparmor/apparmor.go b/contrib/apparmor/apparmor.go
index 8131d612f774..343043980178 100644
--- a/contrib/apparmor/apparmor.go
+++ b/contrib/apparmor/apparmor.go
@@ -22,7 +22,6 @@ package apparmor
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"os"
 
 	"github.com/containerd/containerd/containers"
@@ -65,7 +64,7 @@ func LoadDefaultProfile(name string) error {
 	if err != nil {
 		return err
 	}
-	f, err := ioutil.TempFile(os.Getenv("XDG_RUNTIME_DIR"), p.Name)
+	f, err := os.CreateTemp(os.Getenv("XDG_RUNTIME_DIR"), p.Name)
 	if err != nil {
 		return err
 	}
diff --git a/contrib/apparmor/template.go b/contrib/apparmor/template.go
index f105334d5373..89bf7786ca4b 100644
--- a/contrib/apparmor/template.go
+++ b/contrib/apparmor/template.go
@@ -25,7 +25,6 @@ import (
 	"bufio"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path"
 	"strconv"
@@ -131,7 +130,7 @@ func loadData(name string) (*data, error) {
 	p.Version = ver
 
 	// Figure out the daemon profile.
-	currentProfile, err := ioutil.ReadFile("/proc/self/attr/current")
+	currentProfile, err := os.ReadFile("/proc/self/attr/current")
 	if err != nil {
 		// If we couldn't get the daemon profile, assume we are running
 		// unconfined which is generally the default.
diff --git a/contrib/fuzz/archive_fuzzer.go b/contrib/fuzz/archive_fuzzer.go
index 54efc7bc4268..fe1348e84da9 100644
--- a/contrib/fuzz/archive_fuzzer.go
+++ b/contrib/fuzz/archive_fuzzer.go
@@ -18,7 +18,6 @@ package fuzz
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"os"
 
 	fuzz "github.com/AdaLogics/go-fuzz-headers"
@@ -37,7 +36,7 @@ func FuzzApply(data []byte) int {
 		return 0
 	}
 	maxIters := 20
-	tmpDir, err := ioutil.TempDir("", "prefix-test")
+	tmpDir, err := os.MkdirTemp("", "prefix-test")
 	if err != nil {
 		return 0
 	}
@@ -63,7 +62,7 @@ func FuzzImportIndex(data []byte) int {
 	}
 	ctx := context.Background()
 	r := bytes.NewReader(tarBytes)
-	tmpdir, err := ioutil.TempDir("", "fuzzing-")
+	tmpdir, err := os.MkdirTemp("", "fuzzing-")
 	if err != nil {
 		return 0
 	}
diff --git a/contrib/fuzz/container_fuzzer.go b/contrib/fuzz/container_fuzzer.go
index 4bc2925808ba..f124993b8775 100644
--- a/contrib/fuzz/container_fuzzer.go
+++ b/contrib/fuzz/container_fuzzer.go
@@ -27,7 +27,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"strings"
@@ -148,7 +147,7 @@ func checkIfShouldRestart(err error) {
 // startDaemon() starts the daemon.
 func startDaemon(ctx context.Context, shouldTearDown bool) {
 	buf := bytes.NewBuffer(nil)
-	stdioFile, err := ioutil.TempFile("", "")
+	stdioFile, err := os.CreateTemp("", "")
 	if err != nil {
 		// We panic here as it is a fuzz-blocker that
 		// may need fixing
diff --git a/contrib/fuzz/content_fuzzer.go b/contrib/fuzz/content_fuzzer.go
index fd47150d8e99..179c9f2c4887 100644
--- a/contrib/fuzz/content_fuzzer.go
+++ b/contrib/fuzz/content_fuzzer.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	_ "crypto/sha256" // required by go-digest
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -101,7 +100,7 @@ func FuzzCSWalk(data []byte) int {
 	ctx := context.Background()
 	expected := map[digest.Digest]struct{}{}
 	found := map[digest.Digest]struct{}{}
-	tmpdir, err := ioutil.TempDir("", "fuzzing-")
+	tmpdir, err := os.MkdirTemp("", "fuzzing-")
 	if err != nil {
 		return 0
 	}
@@ -145,7 +144,7 @@ func FuzzArchiveExport(data []byte) int {
 		return 0
 	}
 	ctx := context.Background()
-	tmpdir, err := ioutil.TempDir("", "fuzzing-")
+	tmpdir, err := os.MkdirTemp("", "fuzzing-")
 	if err != nil {
 		return 0
 	}
diff --git a/contrib/fuzz/docker_fuzzer.go b/contrib/fuzz/docker_fuzzer.go
index 5451fdb55b64..ecfab0beda69 100644
--- a/contrib/fuzz/docker_fuzzer.go
+++ b/contrib/fuzz/docker_fuzzer.go
@@ -25,7 +25,7 @@ package docker
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -67,7 +67,7 @@ func FuzzFetcher(data []byte) int {
 	if err != nil {
 		return 0
 	}
-	b, err := ioutil.ReadAll(rc)
+	b, err := io.ReadAll(rc)
 	if err != nil {
 		return 0
 	}
diff --git a/contrib/seccomp/seccomp.go b/contrib/seccomp/seccomp.go
index b7cf1765d756..5292cbcec3e5 100644
--- a/contrib/seccomp/seccomp.go
+++ b/contrib/seccomp/seccomp.go
@@ -20,7 +20,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
+	"os"
 
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/oci"
@@ -33,7 +33,7 @@ import (
 func WithProfile(profile string) oci.SpecOpts {
 	return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error {
 		s.Linux.Seccomp = &specs.LinuxSeccomp{}
-		f, err := ioutil.ReadFile(profile)
+		f, err := os.ReadFile(profile)
 		if err != nil {
 			return fmt.Errorf("cannot load seccomp profile %q: %v", profile, err)
 		}
diff --git a/diff/apply/apply.go b/diff/apply/apply.go
index 1d0a95e6c2b5..937d02ce8d63 100644
--- a/diff/apply/apply.go
+++ b/diff/apply/apply.go
@@ -19,7 +19,6 @@ package apply
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"time"
 
 	"github.com/containerd/containerd/content"
@@ -99,7 +98,7 @@ func (s *fsApplier) Apply(ctx context.Context, desc ocispec.Descriptor, mounts [
 	}
 
 	// Read any trailing data
-	if _, err := io.Copy(ioutil.Discard, rc); err != nil {
+	if _, err := io.Copy(io.Discard, rc); err != nil {
 		return emptyDesc, err
 	}
 
diff --git a/diff/lcow/lcow.go b/diff/lcow/lcow.go
index 3a3ead414a7d..20fb4db418fc 100644
--- a/diff/lcow/lcow.go
+++ b/diff/lcow/lcow.go
@@ -21,7 +21,6 @@ package lcow
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path"
 	"runtime"
@@ -166,7 +165,7 @@ func (s windowsLcowDiff) Apply(ctx context.Context, desc ocispec.Descriptor, mou
 	outFile.Close()
 
 	// Read any trailing data
-	if _, err := io.Copy(ioutil.Discard, rc); err != nil {
+	if _, err := io.Copy(io.Discard, rc); err != nil {
 		return emptyDesc, err
 	}
 
diff --git a/diff/stream_windows.go b/diff/stream_windows.go
index 8f03d2f4c1a4..3058bd251275 100644
--- a/diff/stream_windows.go
+++ b/diff/stream_windows.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -155,7 +154,7 @@ func (c *binaryProcessor) Close() error {
 }
 
 func getUiqPath() (string, error) {
-	dir, err := ioutil.TempDir("", "")
+	dir, err := os.MkdirTemp("", "")
 	if err != nil {
 		return "", err
 	}
diff --git a/diff/windows/windows.go b/diff/windows/windows.go
index 7285d2945fc1..0bcf3adcd3d0 100644
--- a/diff/windows/windows.go
+++ b/diff/windows/windows.go
@@ -24,7 +24,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"time"
 
 	winio "github.com/Microsoft/go-winio"
@@ -150,7 +149,7 @@ func (s windowsDiff) Apply(ctx context.Context, desc ocispec.Descriptor, mounts
 	}
 
 	// Read any trailing data
-	if _, err := io.Copy(ioutil.Discard, rc); err != nil {
+	if _, err := io.Copy(io.Discard, rc); err != nil {
 		return emptyDesc, err
 	}
 
diff --git a/images/archive/importer.go b/images/archive/importer.go
index f0de1dc056fb..b935006d199f 100644
--- a/images/archive/importer.go
+++ b/images/archive/importer.go
@@ -24,7 +24,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"path"
 
 	"github.com/containerd/containerd/archive/compression"
@@ -223,7 +222,7 @@ func ImportIndex(ctx context.Context, store content.Store, reader io.Reader, opt
 }
 
 func onUntarJSON(r io.Reader, j interface{}) error {
-	b, err := ioutil.ReadAll(r)
+	b, err := io.ReadAll(r)
 	if err != nil {
 		return err
 	}
diff --git a/integration/addition_gids_test.go b/integration/addition_gids_test.go
index 9c481e5d7787..c196f749a5a8 100644
--- a/integration/addition_gids_test.go
+++ b/integration/addition_gids_test.go
@@ -20,7 +20,6 @@
 package integration
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -32,7 +31,7 @@ import (
 )
 
 func TestAdditionalGids(t *testing.T) {
-	testPodLogDir, err := ioutil.TempDir("/tmp", "additional-gids")
+	testPodLogDir, err := os.MkdirTemp("/tmp", "additional-gids")
 	require.NoError(t, err)
 	defer os.RemoveAll(testPodLogDir)
 
@@ -74,7 +73,7 @@ func TestAdditionalGids(t *testing.T) {
 	}, time.Second, 30*time.Second))
 
 	t.Log("Search additional groups in container log")
-	content, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
+	content, err := os.ReadFile(filepath.Join(testPodLogDir, containerName))
 	assert.NoError(t, err)
 	assert.Contains(t, string(content), "groups=1(daemon),10(wheel),1234")
 }
diff --git a/integration/client/client_test.go b/integration/client/client_test.go
index d4eeadaa62da..57eb7522fe9f 100644
--- a/integration/client/client_test.go
+++ b/integration/client/client_test.go
@@ -22,7 +22,6 @@ import (
 	"flag"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -90,7 +89,7 @@ func TestMain(m *testing.M) {
 	if !noDaemon {
 		sys.ForceRemoveAll(defaultRoot)
 
-		stdioFile, err := ioutil.TempFile("", "")
+		stdioFile, err := os.CreateTemp("", "")
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "could not create a new stdio temp file: %s\n", err)
 			os.Exit(1)
@@ -497,7 +496,7 @@ func TestClientReconnect(t *testing.T) {
 }
 
 func createShimDebugConfig() string {
-	f, err := ioutil.TempFile("", "containerd-config-")
+	f, err := os.CreateTemp("", "containerd-config-")
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Failed to create config file: %s\n", err)
 		os.Exit(1)
diff --git a/integration/client/container_checkpoint_test.go b/integration/client/container_checkpoint_test.go
index e33f4f9c8cde..52354c557b1e 100644
--- a/integration/client/container_checkpoint_test.go
+++ b/integration/client/container_checkpoint_test.go
@@ -22,7 +22,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -455,7 +454,7 @@ func TestCheckpointRestoreWithImagePath(t *testing.T) {
 	}
 
 	// create image path store criu image files
-	crDir, err := ioutil.TempDir("", "test-cr")
+	crDir, err := os.MkdirTemp("", "test-cr")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -473,7 +472,7 @@ func TestCheckpointRestoreWithImagePath(t *testing.T) {
 	task.Delete(ctx)
 
 	// check image files have been dumped into image path
-	if files, err := ioutil.ReadDir(imagePath); err != nil || len(files) == 0 {
+	if files, err := os.ReadDir(imagePath); err != nil || len(files) == 0 {
 		t.Fatal("failed to checkpoint with image path set")
 	}
 
diff --git a/integration/client/container_linux_test.go b/integration/client/container_linux_test.go
index e4d53c1529f8..b5d837e95cc3 100644
--- a/integration/client/container_linux_test.go
+++ b/integration/client/container_linux_test.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -573,7 +572,7 @@ func TestDaemonReconnectsToShimIOPipesOnRestart(t *testing.T) {
 
 	<-statusC
 
-	stdioContents, err := ioutil.ReadFile(ctrdStdioFilePath)
+	stdioContents, err := os.ReadFile(ctrdStdioFilePath)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -1963,7 +1962,7 @@ func TestContainerNoSTDIN(t *testing.T) {
 	}
 	defer container.Delete(ctx, WithSnapshotCleanup)
 
-	task, err := container.NewTask(ctx, cio.NewCreator(cio.WithStreams(nil, ioutil.Discard, ioutil.Discard)))
+	task, err := container.NewTask(ctx, cio.NewCreator(cio.WithStreams(nil, io.Discard, io.Discard)))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/integration/client/container_test.go b/integration/client/container_test.go
index d995a36fdaea..231ebe22f27f 100644
--- a/integration/client/container_test.go
+++ b/integration/client/container_test.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path"
 	"runtime"
@@ -231,7 +230,7 @@ func TestContainerOutput(t *testing.T) {
 }
 
 func withByteBuffers(stdout io.Writer) cio.Opt {
-	// TODO: could this use ioutil.Discard?
+	// TODO: could this use io.Discard?
 	return func(streams *cio.Streams) {
 		streams.Stdin = new(bytes.Buffer)
 		streams.Stdout = stdout
@@ -515,7 +514,7 @@ func TestContainerCloseIO(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	task, err := container.NewTask(ctx, cio.NewCreator(cio.WithStreams(r, stdout, ioutil.Discard)))
+	task, err := container.NewTask(ctx, cio.NewCreator(cio.WithStreams(r, stdout, io.Discard)))
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/integration/client/daemon_config_linux_test.go b/integration/client/daemon_config_linux_test.go
index 564a9d271b48..51a2a06994e3 100644
--- a/integration/client/daemon_config_linux_test.go
+++ b/integration/client/daemon_config_linux_test.go
@@ -21,7 +21,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -52,7 +51,7 @@ func newDaemonWithConfig(t *testing.T, configTOML string) (*Client, *daemon, fun
 		buf               = bytes.NewBuffer(nil)
 	)
 
-	tempDir, err := ioutil.TempDir("", "containerd-test-new-daemon-with-config")
+	tempDir, err := os.MkdirTemp("", "containerd-test-new-daemon-with-config")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -63,7 +62,7 @@ func newDaemonWithConfig(t *testing.T, configTOML string) (*Client, *daemon, fun
 	}()
 
 	configTOMLFile := filepath.Join(tempDir, "config.toml")
-	if err = ioutil.WriteFile(configTOMLFile, []byte(configTOML), 0600); err != nil {
+	if err = os.WriteFile(configTOMLFile, []byte(configTOML), 0600); err != nil {
 		t.Fatal(err)
 	}
 
@@ -119,7 +118,7 @@ func newDaemonWithConfig(t *testing.T, configTOML string) (*Client, *daemon, fun
 
 // TestDaemonRuntimeRoot ensures plugin.linux.runtime_root is not ignored
 func TestDaemonRuntimeRoot(t *testing.T) {
-	runtimeRoot, err := ioutil.TempDir("", "containerd-test-runtime-root")
+	runtimeRoot, err := os.MkdirTemp("", "containerd-test-runtime-root")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/integration/client/import_test.go b/integration/client/import_test.go
index 22d5603a7f6e..7471db217bc2 100644
--- a/integration/client/import_test.go
+++ b/integration/client/import_test.go
@@ -22,7 +22,6 @@ import (
 	"encoding/json"
 	"io"
 
-	"io/ioutil"
 	"math/rand"
 	"reflect"
 	"testing"
@@ -285,7 +284,7 @@ func checkImages(t *testing.T, target digest.Digest, actual []images.Image, name
 }
 
 func createContent(size int64, seed int64) ([]byte, digest.Digest) {
-	b, err := ioutil.ReadAll(io.LimitReader(rand.New(rand.NewSource(seed)), size))
+	b, err := io.ReadAll(io.LimitReader(rand.New(rand.NewSource(seed)), size))
 	if err != nil {
 		panic(err)
 	}
diff --git a/integration/common.go b/integration/common.go
index 8d7b687a7b4b..f3822ecb6bc8 100644
--- a/integration/common.go
+++ b/integration/common.go
@@ -18,7 +18,7 @@ package integration
 
 import (
 	"fmt"
-	"io/ioutil"
+	"os"
 	"testing"
 
 	cri "github.com/containerd/containerd/integration/cri-api/pkg/apis"
@@ -56,7 +56,7 @@ func initImages(imageListFile string) {
 	}
 
 	if imageListFile != "" {
-		fileContent, err := ioutil.ReadFile(imageListFile)
+		fileContent, err := os.ReadFile(imageListFile)
 		if err != nil {
 			panic(fmt.Errorf("Error reading '%v' file contents: %v", imageList, err))
 		}
diff --git a/integration/container_log_test.go b/integration/container_log_test.go
index 903da0026ca2..cd8b4dc6f410 100644
--- a/integration/container_log_test.go
+++ b/integration/container_log_test.go
@@ -18,7 +18,6 @@ package integration
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -31,7 +30,7 @@ import (
 )
 
 func TestContainerLogWithoutTailingNewLine(t *testing.T) {
-	testPodLogDir, err := ioutil.TempDir("/tmp", "container-log-without-tailing-newline")
+	testPodLogDir, err := os.MkdirTemp("/tmp", "container-log-without-tailing-newline")
 	require.NoError(t, err)
 	defer os.RemoveAll(testPodLogDir)
 
@@ -73,7 +72,7 @@ func TestContainerLogWithoutTailingNewLine(t *testing.T) {
 	}, time.Second, 30*time.Second))
 
 	t.Log("Check container log")
-	content, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
+	content, err := os.ReadFile(filepath.Join(testPodLogDir, containerName))
 	assert.NoError(t, err)
 	checkContainerLog(t, string(content), []string{
 		fmt.Sprintf("%s %s %s", runtime.Stdout, runtime.LogTagPartial, "abcd"),
@@ -81,7 +80,7 @@ func TestContainerLogWithoutTailingNewLine(t *testing.T) {
 }
 
 func TestLongContainerLog(t *testing.T) {
-	testPodLogDir, err := ioutil.TempDir("/tmp", "long-container-log")
+	testPodLogDir, err := os.MkdirTemp("/tmp", "long-container-log")
 	require.NoError(t, err)
 	defer os.RemoveAll(testPodLogDir)
 
@@ -130,7 +129,7 @@ func TestLongContainerLog(t *testing.T) {
 	}, time.Second, 30*time.Second))
 
 	t.Log("Check container log")
-	content, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
+	content, err := os.ReadFile(filepath.Join(testPodLogDir, containerName))
 	assert.NoError(t, err)
 	checkContainerLog(t, string(content), []string{
 		fmt.Sprintf("%s %s %s", runtime.Stdout, runtime.LogTagFull, strings.Repeat("a", maxSize-1)),
diff --git a/integration/container_volume_test.go b/integration/container_volume_test.go
index 6b999a1112dd..8c70d8ada78d 100644
--- a/integration/container_volume_test.go
+++ b/integration/container_volume_test.go
@@ -17,7 +17,6 @@
 package integration
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -36,7 +35,7 @@ func createRegularFile(basePath, content string) (string, error) {
 	}
 
 	newFile := filepath.Join(newFolder, "foo.txt")
-	err = ioutil.WriteFile(newFile, []byte(content), 0644)
+	err = os.WriteFile(newFile, []byte(content), 0644)
 	return filepath.Join("regular", "foo.txt"), err
 }
 
@@ -83,11 +82,11 @@ func TestContainerSymlinkVolumes(t *testing.T) {
 	} {
 		testCase := testCase // capture range variable
 		t.Run(name, func(t *testing.T) {
-			testPodLogDir, err := ioutil.TempDir("", "symlink-test")
+			testPodLogDir, err := os.MkdirTemp("", "symlink-test")
 			require.NoError(t, err)
 			defer os.RemoveAll(testPodLogDir)
 
-			testVolDir, err := ioutil.TempDir("", "symlink-test-vol")
+			testVolDir, err := os.MkdirTemp("", "symlink-test-vol")
 			require.NoError(t, err)
 			defer os.RemoveAll(testVolDir)
 
@@ -137,7 +136,7 @@ func TestContainerSymlinkVolumes(t *testing.T) {
 				return false, nil
 			}, time.Second, 30*time.Second))
 
-			output, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
+			output, err := os.ReadFile(filepath.Join(testPodLogDir, containerName))
 			assert.NoError(t, err)
 
 			assert.Contains(t, string(output), content)
diff --git a/integration/image_load_test.go b/integration/image_load_test.go
index 87a2be266184..debf19566118 100644
--- a/integration/image_load_test.go
+++ b/integration/image_load_test.go
@@ -17,7 +17,6 @@
 package integration
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -40,8 +39,8 @@ func TestImageLoad(t *testing.T) {
 	t.Logf("docker save image into tarball")
 	output, err := exec.Command("docker", "pull", testImage).CombinedOutput()
 	require.NoError(t, err, "output: %q", output)
-	// ioutil.TempFile also opens a file, which might prevent us from overwriting that file with docker save.
-	tarDir, err := ioutil.TempDir("", "image-load")
+	// os.CreateTemp also opens a file, which might prevent us from overwriting that file with docker save.
+	tarDir, err := os.MkdirTemp("", "image-load")
 	tar := filepath.Join(tarDir, "image.tar")
 	require.NoError(t, err)
 	defer func() {
diff --git a/integration/pod_dualstack_test.go b/integration/pod_dualstack_test.go
index 4b3ed9f3e6a1..63e47871c1d2 100644
--- a/integration/pod_dualstack_test.go
+++ b/integration/pod_dualstack_test.go
@@ -17,7 +17,6 @@
 package integration
 
 import (
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -32,7 +31,7 @@ import (
 )
 
 func TestPodDualStack(t *testing.T) {
-	testPodLogDir, err := ioutil.TempDir("/tmp", "dualstack")
+	testPodLogDir, err := os.MkdirTemp("/tmp", "dualstack")
 	require.NoError(t, err)
 	defer os.RemoveAll(testPodLogDir)
 
@@ -77,7 +76,7 @@ func TestPodDualStack(t *testing.T) {
 		return false, nil
 	}, time.Second, 30*time.Second))
 
-	content, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
+	content, err := os.ReadFile(filepath.Join(testPodLogDir, containerName))
 	assert.NoError(t, err)
 	status, err := runtimeService.PodSandboxStatus(sb)
 	require.NoError(t, err)
diff --git a/integration/pod_hostname_test.go b/integration/pod_hostname_test.go
index b3d4e705cedd..28028f1b6d9b 100644
--- a/integration/pod_hostname_test.go
+++ b/integration/pod_hostname_test.go
@@ -17,7 +17,6 @@
 package integration
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	goruntime "runtime"
@@ -65,7 +64,7 @@ func TestPodHostname(t *testing.T) {
 			if test.needsHostNetwork && goruntime.GOOS == "windows" {
 				t.Skip("Skipped on Windows.")
 			}
-			testPodLogDir, err := ioutil.TempDir("/tmp", "hostname")
+			testPodLogDir, err := os.MkdirTemp("/tmp", "hostname")
 			require.NoError(t, err)
 			defer os.RemoveAll(testPodLogDir)
 
@@ -121,7 +120,7 @@ func TestPodHostname(t *testing.T) {
 				return false, nil
 			}, time.Second, 30*time.Second))
 
-			content, err := ioutil.ReadFile(filepath.Join(testPodLogDir, containerName))
+			content, err := os.ReadFile(filepath.Join(testPodLogDir, containerName))
 			assert.NoError(t, err)
 
 			t.Log("Search hostname env in container log")
diff --git a/integration/remote/util/util_unix.go b/integration/remote/util/util_unix.go
index 6ff278cfdbfc..2be67bd5e692 100644
--- a/integration/remote/util/util_unix.go
+++ b/integration/remote/util/util_unix.go
@@ -38,7 +38,6 @@ package util
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -73,7 +72,7 @@ func CreateListener(endpoint string) (net.Listener, error) {
 	}
 
 	// Create the socket on a tempfile and move it to the destination socket to handle improprer cleanup
-	file, err := ioutil.TempFile(filepath.Dir(addr), "")
+	file, err := os.CreateTemp(filepath.Dir(addr), "")
 	if err != nil {
 		return nil, fmt.Errorf("failed to create temporary file: %v", err)
 	}
diff --git a/integration/sandbox_clean_remove_test.go b/integration/sandbox_clean_remove_test.go
index 9a6ed5d4dba0..95e5a49cbc21 100644
--- a/integration/sandbox_clean_remove_test.go
+++ b/integration/sandbox_clean_remove_test.go
@@ -20,7 +20,6 @@
 package integration
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -40,11 +39,11 @@ func TestSandboxRemoveWithoutIPLeakage(t *testing.T) {
 	t.Logf("Make sure host-local ipam is in use")
 	config, err := CRIConfig()
 	require.NoError(t, err)
-	fs, err := ioutil.ReadDir(config.NetworkPluginConfDir)
+	fs, err := os.ReadDir(config.NetworkPluginConfDir)
 	require.NoError(t, err)
 	require.NotEmpty(t, fs)
 	f := filepath.Join(config.NetworkPluginConfDir, fs[0].Name())
-	cniConfig, err := ioutil.ReadFile(f)
+	cniConfig, err := os.ReadFile(f)
 	require.NoError(t, err)
 	if !strings.Contains(string(cniConfig), "host-local") {
 		t.Skip("host-local ipam is not in use")
diff --git a/integration/util/util_unix.go b/integration/util/util_unix.go
index 425e4d6a148c..3fa7cddaabf3 100644
--- a/integration/util/util_unix.go
+++ b/integration/util/util_unix.go
@@ -38,7 +38,6 @@ package util
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/url"
 	"os"
@@ -73,7 +72,7 @@ func CreateListener(endpoint string) (net.Listener, error) {
 	}
 
 	// Create the socket on a tempfile and move it to the destination socket to handle improprer cleanup
-	file, err := ioutil.TempFile(filepath.Dir(addr), "")
+	file, err := os.CreateTemp(filepath.Dir(addr), "")
 	if err != nil {
 		return nil, fmt.Errorf("failed to create temporary file: %v", err)
 	}
diff --git a/log/logtest/context.go b/log/logtest/context.go
index 870c62aa7baf..218f525eb24f 100644
--- a/log/logtest/context.go
+++ b/log/logtest/context.go
@@ -19,7 +19,7 @@ package logtest
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"path/filepath"
 	"runtime"
 	"testing"
@@ -37,7 +37,7 @@ func WithT(ctx context.Context, t testing.TB) context.Context {
 
 	// Increase debug level for tests
 	l.SetLevel(logrus.DebugLevel)
-	l.SetOutput(ioutil.Discard)
+	l.SetOutput(io.Discard)
 	l.SetReportCaller(true)
 
 	// Add testing hook
diff --git a/metadata/buckets_test.go b/metadata/buckets_test.go
index 727082f02cf8..b5a73d0d05ef 100644
--- a/metadata/buckets_test.go
+++ b/metadata/buckets_test.go
@@ -17,7 +17,7 @@
 package metadata
 
 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"testing"
 
@@ -28,7 +28,7 @@ import (
 )
 
 func TestHasSharedLabel(t *testing.T) {
-	tmpdir, err := ioutil.TempDir("", "bucket-testing-")
+	tmpdir, err := os.MkdirTemp("", "bucket-testing-")
 	if err != nil {
 		t.Error(err)
 	}
@@ -64,7 +64,7 @@ func TestHasSharedLabel(t *testing.T) {
 }
 
 func TestGetShareableBucket(t *testing.T) {
-	tmpdir, err := ioutil.TempDir("", "bucket-testing-")
+	tmpdir, err := os.MkdirTemp("", "bucket-testing-")
 	if err != nil {
 		t.Error(err)
 	}
diff --git a/metadata/containers_test.go b/metadata/containers_test.go
index 5ccf48338394..f207e569ea8f 100644
--- a/metadata/containers_test.go
+++ b/metadata/containers_test.go
@@ -19,7 +19,6 @@ package metadata
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -715,7 +714,7 @@ func testEnv(t *testing.T) (context.Context, *bolt.DB, func()) {
 	ctx = namespaces.WithNamespace(ctx, "testing")
 	ctx = logtest.WithT(ctx, t)
 
-	dirname, err := ioutil.TempDir("", strings.Replace(t.Name(), "/", "_", -1)+"-")
+	dirname, err := os.MkdirTemp("", strings.Replace(t.Name(), "/", "_", -1)+"-")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/metadata/db_test.go b/metadata/db_test.go
index cceef22b7117..5b59399a9458 100644
--- a/metadata/db_test.go
+++ b/metadata/db_test.go
@@ -21,7 +21,6 @@ import (
 	"encoding/binary"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -74,7 +73,7 @@ func testDB(t *testing.T, opt ...testOpt) (context.Context, *DB, func()) {
 		o(&topts)
 	}
 
-	dirname, err := ioutil.TempDir("", strings.Replace(t.Name(), "/", "_", -1)+"-")
+	dirname, err := os.MkdirTemp("", strings.Replace(t.Name(), "/", "_", -1)+"-")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -765,7 +764,7 @@ type testLease struct {
 }
 
 func newStores(t testing.TB) (*DB, content.Store, snapshots.Snapshotter, func()) {
-	td, err := ioutil.TempDir("", "gc-test-")
+	td, err := os.MkdirTemp("", "gc-test-")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/metadata/gc_test.go b/metadata/gc_test.go
index f8cd99927887..86dc888907e3 100644
--- a/metadata/gc_test.go
+++ b/metadata/gc_test.go
@@ -19,7 +19,6 @@ package metadata
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -389,7 +388,7 @@ func TestGCRefs(t *testing.T) {
 }
 
 func newDatabase() (*bolt.DB, func(), error) {
-	td, err := ioutil.TempDir("", "gc-roots-")
+	td, err := os.MkdirTemp("", "gc-roots-")
 	if err != nil {
 		return nil, nil, err
 	}
diff --git a/mount/fmountat_linux_test.go b/mount/fmountat_linux_test.go
index 06b3a26673fb..a74c1617379f 100644
--- a/mount/fmountat_linux_test.go
+++ b/mount/fmountat_linux_test.go
@@ -17,7 +17,6 @@
 package mount
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -46,7 +45,7 @@ func makeTestForFMountat(fn fMountatCaseFunc) func(t *testing.T) {
 	return func(t *testing.T) {
 		t.Parallel()
 
-		suiteDir, err := ioutil.TempDir("", "fmountat-test-")
+		suiteDir, err := os.MkdirTemp("", "fmountat-test-")
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -94,7 +93,7 @@ func testFMountatNormal(t *testing.T, root string) {
 	defer umount(t, fsdir)
 
 	// check hi file
-	content, err := ioutil.ReadFile(filepath.Join(fsdir, "hi"))
+	content, err := os.ReadFile(filepath.Join(fsdir, "hi"))
 	if err != nil {
 		t.Fatalf("failed to read file: %+v", err)
 	}
diff --git a/mount/lookup_linux_test.go b/mount/lookup_linux_test.go
index a60adff7d7db..dd43fb3a01d8 100644
--- a/mount/lookup_linux_test.go
+++ b/mount/lookup_linux_test.go
@@ -18,7 +18,6 @@ package mount
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -42,7 +41,7 @@ func checkLookup(t *testing.T, fsType, mntPoint, dir string) {
 
 func testLookup(t *testing.T, fsType string) {
 	testutil.RequiresRoot(t)
-	mnt, err := ioutil.TempDir("", "containerd-mountinfo-test-lookup")
+	mnt, err := os.MkdirTemp("", "containerd-mountinfo-test-lookup")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -69,7 +68,7 @@ func testLookup(t *testing.T, fsType string) {
 	assert.Check(t, strings.HasPrefix(loop.Device, "/dev/loop"))
 	checkLookup(t, fsType, mnt, mnt)
 
-	newMnt, err := ioutil.TempDir("", "containerd-mountinfo-test-newMnt")
+	newMnt, err := os.MkdirTemp("", "containerd-mountinfo-test-newMnt")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -100,19 +99,19 @@ func TestLookupWithXFS(t *testing.T) {
 }
 
 func TestLookupWithOverlay(t *testing.T) {
-	lower, err := ioutil.TempDir("", "containerd-mountinfo-test-lower")
+	lower, err := os.MkdirTemp("", "containerd-mountinfo-test-lower")
 	assert.NilError(t, err)
 	defer os.RemoveAll(lower)
 
-	upper, err := ioutil.TempDir("", "containerd-mountinfo-test-upper")
+	upper, err := os.MkdirTemp("", "containerd-mountinfo-test-upper")
 	assert.NilError(t, err)
 	defer os.RemoveAll(upper)
 
-	work, err := ioutil.TempDir("", "containerd-mountinfo-test-work")
+	work, err := os.MkdirTemp("", "containerd-mountinfo-test-work")
 	assert.NilError(t, err)
 	defer os.RemoveAll(work)
 
-	overlay, err := ioutil.TempDir("", "containerd-mountinfo-test-overlay")
+	overlay, err := os.MkdirTemp("", "containerd-mountinfo-test-overlay")
 	assert.NilError(t, err)
 	defer os.RemoveAll(overlay)
 
diff --git a/mount/losetup_linux_test.go b/mount/losetup_linux_test.go
index e6dcffd01bf3..938950fc5f88 100644
--- a/mount/losetup_linux_test.go
+++ b/mount/losetup_linux_test.go
@@ -17,7 +17,6 @@
 package mount
 
 import (
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -29,7 +28,7 @@ var randomData = []byte("randomdata")
 func createTempFile(t *testing.T) string {
 	t.Helper()
 
-	f, err := ioutil.TempFile("", "losetup")
+	f, err := os.CreateTemp("", "losetup")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/mount/mount_linux_test.go b/mount/mount_linux_test.go
index 3641c634f5e3..3310e3dbb377 100644
--- a/mount/mount_linux_test.go
+++ b/mount/mount_linux_test.go
@@ -18,7 +18,6 @@ package mount
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -105,7 +104,7 @@ func TestFUSEHelper(t *testing.T) {
 	if err != nil {
 		t.Skip("fuse-overlayfs not installed")
 	}
-	td, err := ioutil.TempDir("", "fuse")
+	td, err := os.MkdirTemp("", "fuse")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/mount/temp.go b/mount/temp.go
index 9dc4010fee2f..5d0b11748bd6 100644
--- a/mount/temp.go
+++ b/mount/temp.go
@@ -18,7 +18,6 @@ package mount
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 
 	"github.com/containerd/containerd/log"
@@ -31,7 +30,7 @@ var tempMountLocation = getTempDir()
 // The mounts are valid during the call to the f.
 // Finally we will unmount and remove the temp dir regardless of the result of f.
 func WithTempMount(ctx context.Context, mounts []Mount, f func(root string) error) (err error) {
-	root, uerr := ioutil.TempDir(tempMountLocation, "containerd-mount")
+	root, uerr := os.MkdirTemp(tempMountLocation, "containerd-mount")
 	if uerr != nil {
 		return errors.Wrapf(uerr, "failed to create temp dir")
 	}
diff --git a/oci/spec_opts.go b/oci/spec_opts.go
index 8f74f62ed3c9..4d895e8a8226 100644
--- a/oci/spec_opts.go
+++ b/oci/spec_opts.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -147,7 +146,7 @@ func WithSpecFromBytes(p []byte) SpecOpts {
 // WithSpecFromFile loads the specification from the provided filename.
 func WithSpecFromFile(filename string) SpecOpts {
 	return func(ctx context.Context, c Client, container *containers.Container, s *Spec) error {
-		p, err := ioutil.ReadFile(filename)
+		p, err := os.ReadFile(filename)
 		if err != nil {
 			return errors.Wrap(err, "cannot load spec config file")
 		}
diff --git a/oci/spec_opts_linux_test.go b/oci/spec_opts_linux_test.go
index ea85a6e1964c..71f010906c41 100644
--- a/oci/spec_opts_linux_test.go
+++ b/oci/spec_opts_linux_test.go
@@ -18,7 +18,6 @@ package oci
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -115,14 +114,14 @@ func TestDropCaps(t *testing.T) {
 func TestGetDevices(t *testing.T) {
 	testutil.RequiresRoot(t)
 
-	dir, err := ioutil.TempDir("/dev", t.Name())
+	dir, err := os.MkdirTemp("/dev", t.Name())
 	if err != nil {
 		t.Fatal(err)
 	}
 	defer os.RemoveAll(dir)
 
 	zero := filepath.Join(dir, "zero")
-	if err := ioutil.WriteFile(zero, nil, 0600); err != nil {
+	if err := os.WriteFile(zero, nil, 0600); err != nil {
 		t.Fatal(err)
 	}
 
@@ -162,7 +161,7 @@ func TestGetDevices(t *testing.T) {
 	})
 	t.Run("two devices", func(t *testing.T) {
 		nullDev := filepath.Join(dir, "null")
-		if err := ioutil.WriteFile(nullDev, nil, 0600); err != nil {
+		if err := os.WriteFile(nullDev, nil, 0600); err != nil {
 			t.Fatal(err)
 		}
 
@@ -237,7 +236,7 @@ func TestGetDevices(t *testing.T) {
 			}
 		})
 		t.Run("regular file in dir", func(t *testing.T) {
-			if err := ioutil.WriteFile(filepath.Join(dir, "somefile"), []byte("hello"), 0600); err != nil {
+			if err := os.WriteFile(filepath.Join(dir, "somefile"), []byte("hello"), 0600); err != nil {
 				t.Fatal(err)
 			}
 			defer os.Remove(filepath.Join(dir, "somefile"))
diff --git a/oci/spec_opts_test.go b/oci/spec_opts_test.go
index a7fbaa81b9fa..546594abde98 100644
--- a/oci/spec_opts_test.go
+++ b/oci/spec_opts_test.go
@@ -22,7 +22,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"os"
 	"path/filepath"
@@ -327,7 +326,7 @@ func TestWithSpecFromFile(t *testing.T) {
 		ctx = namespaces.WithNamespace(context.Background(), "test")
 	)
 
-	fp, err := ioutil.TempFile("", "testwithdefaultspec.json")
+	fp, err := os.CreateTemp("", "testwithdefaultspec.json")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/oci/utils_unix.go b/oci/utils_unix.go
index 0e28fe45fbc7..f358a2089a61 100644
--- a/oci/utils_unix.go
+++ b/oci/utils_unix.go
@@ -20,7 +20,6 @@
 package oci
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -53,7 +52,7 @@ func getDevices(path, containerPath string) ([]specs.LinuxDevice, error) {
 		return []specs.LinuxDevice{*dev}, nil
 	}
 
-	files, err := ioutil.ReadDir(path)
+	files, err := os.ReadDir(path)
 	if err != nil {
 		return nil, err
 	}
diff --git a/pkg/apparmor/apparmor_linux.go b/pkg/apparmor/apparmor_linux.go
index a3e417ff29f3..ab54df8eab67 100644
--- a/pkg/apparmor/apparmor_linux.go
+++ b/pkg/apparmor/apparmor_linux.go
@@ -17,7 +17,6 @@
 package apparmor
 
 import (
-	"io/ioutil"
 	"os"
 	"sync"
 )
@@ -36,7 +35,7 @@ func hostSupports() bool {
 	checkAppArmor.Do(func() {
 		// see https://github.com/opencontainers/runc/blob/0d49470392206f40eaab3b2190a57fe7bb3df458/libcontainer/apparmor/apparmor_linux.go
 		if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" {
-			buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
+			buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
 			appArmorSupported = err == nil && len(buf) > 1 && buf[0] == 'Y'
 		}
 	})
diff --git a/pkg/cri/io/logger.go b/pkg/cri/io/logger.go
index ee3d37e8a695..674a89fdff8a 100644
--- a/pkg/cri/io/logger.go
+++ b/pkg/cri/io/logger.go
@@ -21,7 +21,6 @@ import (
 	"bytes"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"time"
 
 	"github.com/sirupsen/logrus"
@@ -43,7 +42,7 @@ const (
 
 // NewDiscardLogger creates logger which discards all the input.
 func NewDiscardLogger() io.WriteCloser {
-	return cioutil.NewNopWriteCloser(ioutil.Discard)
+	return cioutil.NewNopWriteCloser(io.Discard)
 }
 
 // NewCRILogger returns a write closer which redirect container log into
diff --git a/pkg/cri/io/logger_test.go b/pkg/cri/io/logger_test.go
index 000cb1c0d7da..e4eaccbb8ade 100644
--- a/pkg/cri/io/logger_test.go
+++ b/pkg/cri/io/logger_test.go
@@ -18,7 +18,7 @@ package io
 
 import (
 	"bytes"
-	"io/ioutil"
+	"io"
 	"strings"
 	"testing"
 	"time"
@@ -237,7 +237,7 @@ func TestRedirectLogs(t *testing.T) {
 		},
 	} {
 		t.Logf("TestCase %q", desc)
-		rc := ioutil.NopCloser(strings.NewReader(test.input))
+		rc := io.NopCloser(strings.NewReader(test.input))
 		buf := bytes.NewBuffer(nil)
 		wc := cioutil.NewNopWriteCloser(buf)
 		redirectLogs("test-path", rc, wc, test.stream, test.maxLen)
diff --git a/pkg/cri/opts/container.go b/pkg/cri/opts/container.go
index 472104b048ef..1e8232bcfe23 100644
--- a/pkg/cri/opts/container.go
+++ b/pkg/cri/opts/container.go
@@ -18,7 +18,6 @@ package opts
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -67,7 +66,7 @@ func WithVolumes(volumeMounts map[string]string) containerd.NewContainerOpts {
 		if err != nil {
 			return err
 		}
-		root, err := ioutil.TempDir("", "ctd-volume")
+		root, err := os.MkdirTemp("", "ctd-volume")
 		if err != nil {
 			return err
 		}
@@ -108,7 +107,7 @@ func WithVolumes(volumeMounts map[string]string) containerd.NewContainerOpts {
 // copyExistingContents copies from the source to the destination and
 // ensures the ownership is appropriately set.
 func copyExistingContents(source, destination string) error {
-	dstList, err := ioutil.ReadDir(destination)
+	dstList, err := os.ReadDir(destination)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/cri/opts/spec_linux.go b/pkg/cri/opts/spec_linux.go
index bf05116ee116..ba002c93ad90 100644
--- a/pkg/cri/opts/spec_linux.go
+++ b/pkg/cri/opts/spec_linux.go
@@ -19,7 +19,6 @@ package opts
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sort"
@@ -533,7 +532,7 @@ var (
 // cgroup v1.
 func cgroupv1HasHugetlb() (bool, error) {
 	_cgroupv1HasHugetlbOnce.Do(func() {
-		if _, err := ioutil.ReadDir("/sys/fs/cgroup/hugetlb"); err != nil {
+		if _, err := os.ReadDir("/sys/fs/cgroup/hugetlb"); err != nil {
 			_cgroupv1HasHugetlbErr = errors.Wrap(err, "readdir /sys/fs/cgroup/hugetlb")
 			_cgroupv1HasHugetlb = false
 		} else {
@@ -548,7 +547,7 @@ func cgroupv1HasHugetlb() (bool, error) {
 // cgroup v2.
 func cgroupv2HasHugetlb() (bool, error) {
 	_cgroupv2HasHugetlbOnce.Do(func() {
-		controllers, err := ioutil.ReadFile("/sys/fs/cgroup/cgroup.controllers")
+		controllers, err := os.ReadFile("/sys/fs/cgroup/cgroup.controllers")
 		if err != nil {
 			_cgroupv2HasHugetlbErr = errors.Wrap(err, "read /sys/fs/cgroup/cgroup.controllers")
 			return
@@ -696,7 +695,7 @@ func nullOpt(_ context.Context, _ oci.Client, _ *containers.Container, _ *runtim
 }
 
 func getCurrentOOMScoreAdj() (int, error) {
-	b, err := ioutil.ReadFile("/proc/self/oom_score_adj")
+	b, err := os.ReadFile("/proc/self/oom_score_adj")
 	if err != nil {
 		return 0, errors.Wrap(err, "could not get the daemon oom_score_adj")
 	}
diff --git a/pkg/cri/server/helpers_linux_test.go b/pkg/cri/server/helpers_linux_test.go
index ca19c154ad74..23bba8d556bf 100644
--- a/pkg/cri/server/helpers_linux_test.go
+++ b/pkg/cri/server/helpers_linux_test.go
@@ -17,7 +17,6 @@
 package server
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -66,11 +65,11 @@ func TestEnsureRemoveAllWithMount(t *testing.T) {
 		t.Skip("skipping test that requires root")
 	}
 
-	dir1, err := ioutil.TempDir("", "test-ensure-removeall-with-dir1")
+	dir1, err := os.MkdirTemp("", "test-ensure-removeall-with-dir1")
 	if err != nil {
 		t.Fatal(err)
 	}
-	dir2, err := ioutil.TempDir("", "test-ensure-removeall-with-dir2")
+	dir2, err := os.MkdirTemp("", "test-ensure-removeall-with-dir2")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/cri/server/helpers_test.go b/pkg/cri/server/helpers_test.go
index 7a2c3478201c..5dfa3695d9f2 100644
--- a/pkg/cri/server/helpers_test.go
+++ b/pkg/cri/server/helpers_test.go
@@ -18,7 +18,7 @@ package server
 
 import (
 	"context"
-	"io/ioutil"
+	"os"
 	"testing"
 	"time"
 
@@ -489,7 +489,7 @@ func TestEnsureRemoveAllNotExist(t *testing.T) {
 }
 
 func TestEnsureRemoveAllWithDir(t *testing.T) {
-	dir, err := ioutil.TempDir("", "test-ensure-removeall-with-dir")
+	dir, err := os.MkdirTemp("", "test-ensure-removeall-with-dir")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -499,7 +499,7 @@ func TestEnsureRemoveAllWithDir(t *testing.T) {
 }
 
 func TestEnsureRemoveAllWithFile(t *testing.T) {
-	tmp, err := ioutil.TempFile("", "test-ensure-removeall-with-dir")
+	tmp, err := os.CreateTemp("", "test-ensure-removeall-with-dir")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/pkg/cri/server/image_pull.go b/pkg/cri/server/image_pull.go
index 2d439e225e1a..38985c068598 100644
--- a/pkg/cri/server/image_pull.go
+++ b/pkg/cri/server/image_pull.go
@@ -21,10 +21,10 @@ import (
 	"crypto/x509"
 	"encoding/base64"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
+	"os"
 	"path/filepath"
 	"strings"
 	"time"
@@ -301,7 +301,7 @@ func (c *criService) getTLSConfig(registryTLSConfig criconfig.TLSConfig) (*tls.C
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to get system cert pool")
 		}
-		caCert, err := ioutil.ReadFile(registryTLSConfig.CAFile)
+		caCert, err := os.ReadFile(registryTLSConfig.CAFile)
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to load CA file")
 		}
diff --git a/pkg/cri/server/restart.go b/pkg/cri/server/restart.go
index a5d6e55200e0..ffcb5cd1da64 100644
--- a/pkg/cri/server/restart.go
+++ b/pkg/cri/server/restart.go
@@ -17,7 +17,6 @@
 package server
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	goruntime "runtime"
@@ -458,7 +457,7 @@ func (c *criService) loadImages(ctx context.Context, cImages []containerd.Image)
 
 func cleanupOrphanedIDDirs(ctx context.Context, cntrs []containerd.Container, base string) error {
 	// Cleanup orphaned id directories.
-	dirs, err := ioutil.ReadDir(base)
+	dirs, err := os.ReadDir(base)
 	if err != nil && !os.IsNotExist(err) {
 		return errors.Wrap(err, "failed to read base directory")
 	}
diff --git a/pkg/cri/server/service_test.go b/pkg/cri/server/service_test.go
index 50b015396f05..472397dca72f 100644
--- a/pkg/cri/server/service_test.go
+++ b/pkg/cri/server/service_test.go
@@ -18,7 +18,6 @@ package server
 
 import (
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -73,7 +72,7 @@ func newTestCRIService() *criService {
 func TestLoadBaseOCISpec(t *testing.T) {
 	spec := oci.Spec{Version: "1.0.2", Hostname: "default"}
 
-	file, err := ioutil.TempFile("", "spec-test-")
+	file, err := os.CreateTemp("", "spec-test-")
 	require.NoError(t, err)
 
 	defer func() {
diff --git a/pkg/cri/server/update_runtime_config_test.go b/pkg/cri/server/update_runtime_config_test.go
index 84cc25ce9b15..4f1f0b772e07 100644
--- a/pkg/cri/server/update_runtime_config_test.go
+++ b/pkg/cri/server/update_runtime_config_test.go
@@ -17,7 +17,6 @@
 package server
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -94,11 +93,11 @@ func TestUpdateRuntimeConfig(t *testing.T) {
 		},
 	} {
 		t.Run(name, func(t *testing.T) {
-			testDir, err := ioutil.TempDir(os.TempDir(), "test-runtime-config")
+			testDir, err := os.MkdirTemp(os.TempDir(), "test-runtime-config")
 			require.NoError(t, err)
 			defer os.RemoveAll(testDir)
 			templateName := filepath.Join(testDir, "template")
-			err = ioutil.WriteFile(templateName, []byte(testTemplate), 0666)
+			err = os.WriteFile(templateName, []byte(testTemplate), 0666)
 			require.NoError(t, err)
 			confDir := filepath.Join(testDir, "net.d")
 			confName := filepath.Join(confDir, cniConfigFileName)
@@ -131,7 +130,7 @@ func TestUpdateRuntimeConfig(t *testing.T) {
 				_, err := os.Stat(confName)
 				assert.Error(t, err)
 			} else {
-				got, err := ioutil.ReadFile(confName)
+				got, err := os.ReadFile(confName)
 				assert.NoError(t, err)
 				assert.Equal(t, expected, string(got))
 			}
diff --git a/pkg/cri/store/container/status.go b/pkg/cri/store/container/status.go
index bfabaec0d51b..ed9d574f4e49 100644
--- a/pkg/cri/store/container/status.go
+++ b/pkg/cri/store/container/status.go
@@ -18,7 +18,6 @@ package container
 
 import (
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -182,7 +181,7 @@ func StoreStatus(root, id string, status Status) (StatusStorage, error) {
 // writing to the file during loading.
 func LoadStatus(root, id string) (Status, error) {
 	path := filepath.Join(root, "status")
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return Status{}, errors.Wrapf(err, "failed to read status from %q", path)
 	}
diff --git a/pkg/cri/store/container/status_test.go b/pkg/cri/store/container/status_test.go
index c20f13fd8cdc..9ca07f34b767 100644
--- a/pkg/cri/store/container/status_test.go
+++ b/pkg/cri/store/container/status_test.go
@@ -19,7 +19,6 @@ package container
 import (
 	"encoding/json"
 	"errors"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -115,7 +114,7 @@ func TestStatus(t *testing.T) {
 	assert := assertlib.New(t)
 	require := requirelib.New(t)
 
-	tempDir, err := ioutil.TempDir(os.TempDir(), "status-test")
+	tempDir, err := os.MkdirTemp(os.TempDir(), "status-test")
 	require.NoError(err)
 	defer os.RemoveAll(tempDir)
 	statusFile := filepath.Join(tempDir, "status")
diff --git a/pkg/cri/store/image/sort_test.go b/pkg/cri/store/image/sort_test.go
index 65f0d9194bc7..00731ec53194 100644
--- a/pkg/cri/store/image/sort_test.go
+++ b/pkg/cri/store/image/sort_test.go
@@ -18,7 +18,6 @@ package image
 
 import (
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"testing"
 
@@ -27,7 +26,7 @@ import (
 
 func TestReferenceSorting(t *testing.T) {
 	digested := func(seed int64) string {
-		b, err := ioutil.ReadAll(io.LimitReader(rand.New(rand.NewSource(seed)), 64))
+		b, err := io.ReadAll(io.LimitReader(rand.New(rand.NewSource(seed)), 64))
 		if err != nil {
 			panic(err)
 		}
diff --git a/pkg/ioutil/write_closer_test.go b/pkg/ioutil/write_closer_test.go
index 25272a5fd2ac..00b150df8ab7 100644
--- a/pkg/ioutil/write_closer_test.go
+++ b/pkg/ioutil/write_closer_test.go
@@ -17,7 +17,6 @@
 package ioutil
 
 import (
-	"io/ioutil"
 	"os"
 	"sort"
 	"strconv"
@@ -69,7 +68,7 @@ func TestSerialWriteCloser(t *testing.T) {
 			testData[i] = []byte(repeatNumber(i, dataLen) + "\n")
 		}
 
-		f, err := ioutil.TempFile("", "serial-write-closer")
+		f, err := os.CreateTemp("", "serial-write-closer")
 		require.NoError(t, err)
 		defer os.RemoveAll(f.Name())
 		defer f.Close()
@@ -91,7 +90,7 @@ func TestSerialWriteCloser(t *testing.T) {
 		wc.Close()
 
 		// Check test result
-		content, err := ioutil.ReadFile(f.Name())
+		content, err := os.ReadFile(f.Name())
 		require.NoError(t, err)
 		resultData := strings.Split(strings.TrimSpace(string(content)), "\n")
 		require.Len(t, resultData, goroutine)
diff --git a/pkg/os/os.go b/pkg/os/os.go
index b84d423ff444..3a9d8159b3bf 100644
--- a/pkg/os/os.go
+++ b/pkg/os/os.go
@@ -18,7 +18,6 @@ package os
 
 import (
 	"io"
-	"io/ioutil"
 	"os"
 
 	"github.com/moby/sys/symlink"
@@ -78,9 +77,9 @@ func (RealOS) CopyFile(src, dest string, perm os.FileMode) error {
 	return err
 }
 
-// WriteFile will call ioutil.WriteFile to write data into a file.
+// WriteFile will call os.WriteFile to write data into a file.
 func (RealOS) WriteFile(filename string, data []byte, perm os.FileMode) error {
-	return ioutil.WriteFile(filename, data, perm)
+	return os.WriteFile(filename, data, perm)
 }
 
 // Hostname will call os.Hostname to get the hostname of the host.
diff --git a/pkg/os/os_windows_test.go b/pkg/os/os_windows_test.go
index 4ac5a8e02ce5..b54531e43316 100644
--- a/pkg/os/os_windows_test.go
+++ b/pkg/os/os_windows_test.go
@@ -19,7 +19,6 @@ package os
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -162,7 +161,7 @@ func setupVHDVolume(t *testing.T, vhdPath string) string {
 }
 
 func writeFile(t *testing.T, path string, content []byte) {
-	if err := ioutil.WriteFile(path, content, 0644); err != nil {
+	if err := os.WriteFile(path, content, 0644); err != nil {
 		t.Fatal(err)
 	}
 }
diff --git a/pkg/process/io_test.go b/pkg/process/io_test.go
index 7e472f026c31..7c7574e7c6cc 100644
--- a/pkg/process/io_test.go
+++ b/pkg/process/io_test.go
@@ -21,8 +21,8 @@ package process
 
 import (
 	"context"
-	"io/ioutil"
 	"net/url"
+	"os"
 	"testing"
 
 	"github.com/containerd/containerd/namespaces"
@@ -68,6 +68,6 @@ func TestNewBinaryIOCleanup(t *testing.T) {
 
 func descriptorCount(t *testing.T) int {
 	t.Helper()
-	files, _ := ioutil.ReadDir("/proc/self/fd")
+	files, _ := os.ReadDir("/proc/self/fd")
 	return len(files)
 }
diff --git a/pkg/testutil/helpers.go b/pkg/testutil/helpers.go
index 66b26bcbe866..9a9f857e2cd4 100644
--- a/pkg/testutil/helpers.go
+++ b/pkg/testutil/helpers.go
@@ -19,7 +19,6 @@ package testutil
 import (
 	"flag"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -53,7 +52,7 @@ func DumpDir(t *testing.T, root string) {
 			}
 			t.Log(fi.Mode(), fmt.Sprintf("%10s", ""), path, "->", target)
 		} else if fi.Mode().IsRegular() {
-			p, err := ioutil.ReadFile(path)
+			p, err := os.ReadFile(path)
 			if err != nil {
 				t.Logf("error reading file: %v", err)
 				return nil
diff --git a/remotes/docker/config/hosts.go b/remotes/docker/config/hosts.go
index 40330f17eae8..c0a462b0a99d 100644
--- a/remotes/docker/config/hosts.go
+++ b/remotes/docker/config/hosts.go
@@ -20,7 +20,6 @@ package config
 import (
 	"context"
 	"crypto/tls"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/url"
@@ -170,7 +169,7 @@ func ConfigureHosts(ctx context.Context, options HostOptions) docker.RegistryHos
 						tlsConfig.RootCAs = rootPool
 					}
 					for _, f := range host.caCerts {
-						data, err := ioutil.ReadFile(f)
+						data, err := os.ReadFile(f)
 						if err != nil {
 							return nil, errors.Wrapf(err, "unable to read CA cert %q", f)
 						}
@@ -182,13 +181,13 @@ func ConfigureHosts(ctx context.Context, options HostOptions) docker.RegistryHos
 
 				if host.clientPairs != nil {
 					for _, pair := range host.clientPairs {
-						certPEMBlock, err := ioutil.ReadFile(pair[0])
+						certPEMBlock, err := os.ReadFile(pair[0])
 						if err != nil {
 							return nil, errors.Wrapf(err, "unable to read CERT file %q", pair[0])
 						}
 						var keyPEMBlock []byte
 						if pair[1] != "" {
-							keyPEMBlock, err = ioutil.ReadFile(pair[1])
+							keyPEMBlock, err = os.ReadFile(pair[1])
 							if err != nil {
 								return nil, errors.Wrapf(err, "unable to read CERT file %q", pair[1])
 							}
@@ -251,7 +250,7 @@ func hostDirectory(host string) string {
 }
 
 func loadHostDir(ctx context.Context, hostsDir string) ([]hostConfig, error) {
-	b, err := ioutil.ReadFile(filepath.Join(hostsDir, "hosts.toml"))
+	b, err := os.ReadFile(filepath.Join(hostsDir, "hosts.toml"))
 	if err != nil && !os.IsNotExist(err) {
 		return nil, err
 	}
@@ -536,7 +535,7 @@ func makeAbsPath(p string, base string) string {
 //   the ".cert", which may contain the private key. If the ".cert" file
 //   does not contain the private key, the caller should detect and error.
 func loadCertFiles(ctx context.Context, certsDir string) ([]hostConfig, error) {
-	fs, err := ioutil.ReadDir(certsDir)
+	fs, err := os.ReadDir(certsDir)
 	if err != nil && !os.IsNotExist(err) {
 		return nil, err
 	}
diff --git a/remotes/docker/config/hosts_test.go b/remotes/docker/config/hosts_test.go
index 44586fa5e194..dda81099186c 100644
--- a/remotes/docker/config/hosts_test.go
+++ b/remotes/docker/config/hosts_test.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path/filepath"
@@ -209,7 +208,7 @@ ca = "/etc/path/default"
 }
 
 func TestLoadCertFiles(t *testing.T) {
-	dir, err := ioutil.TempDir("", t.Name())
+	dir, err := os.MkdirTemp("", t.Name())
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -257,16 +256,16 @@ func TestLoadCertFiles(t *testing.T) {
 			defer os.RemoveAll(hostDir)
 
 			for _, f := range tc.input.caCerts {
-				if err := ioutil.WriteFile(f, testKey, 0600); err != nil {
+				if err := os.WriteFile(f, testKey, 0600); err != nil {
 					t.Fatal(err)
 				}
 			}
 
 			for _, pair := range tc.input.clientPairs {
-				if err := ioutil.WriteFile(pair[0], testKey, 0600); err != nil {
+				if err := os.WriteFile(pair[0], testKey, 0600); err != nil {
 					t.Fatal(err)
 				}
-				if err := ioutil.WriteFile(pair[1], testKey, 0600); err != nil {
+				if err := os.WriteFile(pair[1], testKey, 0600); err != nil {
 					t.Fatal(err)
 				}
 			}
diff --git a/remotes/docker/fetcher.go b/remotes/docker/fetcher.go
index 5796fbf4a1d6..62098d22787b 100644
--- a/remotes/docker/fetcher.go
+++ b/remotes/docker/fetcher.go
@@ -21,7 +21,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strings"
@@ -197,7 +196,7 @@ func (r dockerFetcher) open(ctx context.Context, req *request, mediatype string,
 
 			// Discard up to offset
 			// Could use buffer pool here but this case should be rare
-			n, err := io.Copy(ioutil.Discard, io.LimitReader(resp.Body, offset))
+			n, err := io.Copy(io.Discard, io.LimitReader(resp.Body, offset))
 			if err != nil {
 				return nil, errors.Wrap(err, "failed to discard to offset")
 			}
diff --git a/remotes/docker/fetcher_test.go b/remotes/docker/fetcher_test.go
index a9d0e39f8614..3805b5f68240 100644
--- a/remotes/docker/fetcher_test.go
+++ b/remotes/docker/fetcher_test.go
@@ -21,7 +21,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"math/rand"
 	"net/http"
 	"net/http/httptest"
@@ -73,7 +72,7 @@ func TestFetcherOpen(t *testing.T) {
 		if err != nil {
 			t.Fatalf("failed to open: %+v", err)
 		}
-		b, err := ioutil.ReadAll(rc)
+		b, err := io.ReadAll(rc)
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/remotes/docker/httpreadseeker.go b/remotes/docker/httpreadseeker.go
index 58c866bcdec1..cf1c182ebe24 100644
--- a/remotes/docker/httpreadseeker.go
+++ b/remotes/docker/httpreadseeker.go
@@ -19,7 +19,6 @@ package docker
 import (
 	"bytes"
 	"io"
-	"io/ioutil"
 
 	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/log"
@@ -162,7 +161,7 @@ func (hrs *httpReadSeeker) reader() (io.Reader, error) {
 		// as the length is already satisfied but we just return the empty
 		// reader instead.
 
-		hrs.rc = ioutil.NopCloser(bytes.NewReader([]byte{}))
+		hrs.rc = io.NopCloser(bytes.NewReader([]byte{}))
 	}
 
 	return hrs.rc, nil
diff --git a/remotes/docker/pusher.go b/remotes/docker/pusher.go
index 97ed66a6ab01..593aa5d933fa 100644
--- a/remotes/docker/pusher.go
+++ b/remotes/docker/pusher.go
@@ -19,7 +19,6 @@ package docker
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"strings"
@@ -263,7 +262,7 @@ func (p dockerPusher) push(ctx context.Context, desc ocispec.Descriptor, ref str
 
 	pr, pw := io.Pipe()
 	respC := make(chan response, 1)
-	body := ioutil.NopCloser(pr)
+	body := io.NopCloser(pr)
 
 	req.body = func() (io.ReadCloser, error) {
 		if body == nil {
diff --git a/remotes/docker/resolver.go b/remotes/docker/resolver.go
index 1be9e1d05c67..4af1d19db829 100644
--- a/remotes/docker/resolver.go
+++ b/remotes/docker/resolver.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/url"
 	"path"
@@ -359,7 +358,7 @@ func (r *dockerResolver) Resolve(ctx context.Context, ref string) (string, ocisp
 							return "", ocispec.Descriptor{}, err
 						}
 					}
-				} else if _, err := io.Copy(ioutil.Discard, &bodyReader); err != nil {
+				} else if _, err := io.Copy(io.Discard, &bodyReader); err != nil {
 					return "", ocispec.Descriptor{}, err
 				}
 				size = bodyReader.bytesRead
diff --git a/remotes/docker/resolver_test.go b/remotes/docker/resolver_test.go
index 1f2ff8c01c09..ee8c311e7d1a 100644
--- a/remotes/docker/resolver_test.go
+++ b/remotes/docker/resolver_test.go
@@ -23,7 +23,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"strconv"
@@ -574,7 +573,7 @@ func testocimanifest(ctx context.Context, f remotes.Fetcher, desc ocispec.Descri
 	if err != nil {
 		return nil, errors.Wrapf(err, "failed to fetch %s", desc.Digest)
 	}
-	p, err := ioutil.ReadAll(r)
+	p, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}
diff --git a/remotes/docker/schema1/converter.go b/remotes/docker/schema1/converter.go
index 8314c01d5a6f..e30b6f5845eb 100644
--- a/remotes/docker/schema1/converter.go
+++ b/remotes/docker/schema1/converter.go
@@ -23,7 +23,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"strconv"
 	"strings"
 	"sync"
@@ -230,7 +229,7 @@ func (c *Converter) Convert(ctx context.Context, opts ...ConvertOpt) (ocispec.De
 // ReadStripSignature reads in a schema1 manifest and returns a byte array
 // with the "signatures" field stripped
 func ReadStripSignature(schema1Blob io.Reader) ([]byte, error) {
-	b, err := ioutil.ReadAll(io.LimitReader(schema1Blob, manifestSizeLimit)) // limit to 8MB
+	b, err := io.ReadAll(io.LimitReader(schema1Blob, manifestSizeLimit)) // limit to 8MB
 	if err != nil {
 		return nil, err
 	}
diff --git a/remotes/errors/errors.go b/remotes/errors/errors.go
index 519dbac105f2..67ccb23df6e8 100644
--- a/remotes/errors/errors.go
+++ b/remotes/errors/errors.go
@@ -19,7 +19,6 @@ package errors
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 )
 
@@ -41,7 +40,7 @@ func (e ErrUnexpectedStatus) Error() string {
 func NewUnexpectedStatusErr(resp *http.Response) error {
 	var b []byte
 	if resp.Body != nil {
-		b, _ = ioutil.ReadAll(io.LimitReader(resp.Body, 64000)) // 64KB
+		b, _ = io.ReadAll(io.LimitReader(resp.Body, 64000)) // 64KB
 	}
 	err := ErrUnexpectedStatus{
 		Body:          b,
diff --git a/rootfs/init.go b/rootfs/init.go
index 9316b9ddae9f..922d8e196223 100644
--- a/rootfs/init.go
+++ b/rootfs/init.go
@@ -19,7 +19,6 @@ package rootfs
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 
 	"github.com/containerd/containerd/log"
@@ -75,7 +74,7 @@ func createInitLayer(ctx context.Context, parent, initName string, initFn func(s
 	// TODO: ensure not exist error once added to snapshot package
 
 	// Create tempdir
-	td, err := ioutil.TempDir(os.Getenv("XDG_RUNTIME_DIR"), "create-init-")
+	td, err := os.MkdirTemp(os.Getenv("XDG_RUNTIME_DIR"), "create-init-")
 	if err != nil {
 		return "", err
 	}
diff --git a/runtime/v1/linux/bundle.go b/runtime/v1/linux/bundle.go
index deb94d285c4d..28cb9d4456e8 100644
--- a/runtime/v1/linux/bundle.go
+++ b/runtime/v1/linux/bundle.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"crypto/sha256"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -70,7 +69,7 @@ func newBundle(id, path, workDir string, spec []byte) (b *bundle, err error) {
 	if err := os.MkdirAll(rootfs, 0711); err != nil {
 		return nil, err
 	}
-	err = ioutil.WriteFile(filepath.Join(path, configFilename), spec, 0666)
+	err = os.WriteFile(filepath.Join(path, configFilename), spec, 0666)
 	return &bundle{
 		id:      id,
 		path:    path,
@@ -148,7 +147,7 @@ func (b *bundle) shimAddress(namespace, socketPath string) string {
 
 func (b *bundle) loadAddress() (string, error) {
 	addressPath := filepath.Join(b.path, "address")
-	data, err := ioutil.ReadFile(addressPath)
+	data, err := os.ReadFile(addressPath)
 	if err != nil {
 		return "", err
 	}
diff --git a/runtime/v1/linux/runtime.go b/runtime/v1/linux/runtime.go
index d498181530db..4734fcdd8d14 100644
--- a/runtime/v1/linux/runtime.go
+++ b/runtime/v1/linux/runtime.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -288,7 +287,7 @@ func (r *Runtime) Tasks(ctx context.Context, all bool) ([]runtime.Task, error) {
 }
 
 func (r *Runtime) restoreTasks(ctx context.Context) ([]*Task, error) {
-	dir, err := ioutil.ReadDir(r.state)
+	dir, err := os.ReadDir(r.state)
 	if err != nil {
 		return nil, err
 	}
@@ -340,7 +339,7 @@ func (r *Runtime) Delete(ctx context.Context, id string) (*runtime.Exit, error)
 }
 
 func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) {
-	dir, err := ioutil.ReadDir(filepath.Join(r.state, ns))
+	dir, err := os.ReadDir(filepath.Join(r.state, ns))
 	if err != nil {
 		return nil, err
 	}
@@ -413,7 +412,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) {
 		if r.config.ShimDebug {
 			go copyAndClose(os.Stdout, shimStdoutLog)
 		} else {
-			go copyAndClose(ioutil.Discard, shimStdoutLog)
+			go copyAndClose(io.Discard, shimStdoutLog)
 		}
 
 		shimStderrLog, err := v1.OpenShimStderrLog(ctx, logDirPath)
@@ -428,7 +427,7 @@ func (r *Runtime) loadTasks(ctx context.Context, ns string) ([]*Task, error) {
 		if r.config.ShimDebug {
 			go copyAndClose(os.Stderr, shimStderrLog)
 		} else {
-			go copyAndClose(ioutil.Discard, shimStderrLog)
+			go copyAndClose(io.Discard, shimStderrLog)
 		}
 
 		t, err := newTask(id, ns, pid, s, r.events, r.tasks, bundle)
diff --git a/runtime/v1/shim/client/client.go b/runtime/v1/shim/client/client.go
index 82343fc9a12f..869f1f941462 100644
--- a/runtime/v1/shim/client/client.go
+++ b/runtime/v1/shim/client/client.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -75,8 +74,8 @@ func WithStart(binary, address, daemonAddress, cgroup string, debug bool, exitHa
 		}
 		defer f.Close()
 
-		stdoutCopy := ioutil.Discard
-		stderrCopy := ioutil.Discard
+		stdoutCopy := io.Discard
+		stderrCopy := io.Discard
 		stdoutLog, err := v1.OpenShimStdoutLog(ctx, config.WorkDir)
 		if err != nil {
 			return nil, nil, errors.Wrapf(err, "failed to create stdout log")
diff --git a/runtime/v1/shim/service.go b/runtime/v1/shim/service.go
index ca59e675251e..c0b32dcca844 100644
--- a/runtime/v1/shim/service.go
+++ b/runtime/v1/shim/service.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -543,7 +542,7 @@ func (s *Service) checkProcesses(e runc.Exit) {
 
 func shouldKillAllOnExit(ctx context.Context, bundlePath string) bool {
 	var bundleSpec specs.Spec
-	bundleConfigContents, err := ioutil.ReadFile(filepath.Join(bundlePath, "config.json"))
+	bundleConfigContents, err := os.ReadFile(filepath.Join(bundlePath, "config.json"))
 	if err != nil {
 		log.G(ctx).WithError(err).Error("shouldKillAllOnExit: failed to read config.json")
 		return true
diff --git a/runtime/v2/bundle.go b/runtime/v2/bundle.go
index 1a58e627b5b5..ea26f730e42b 100644
--- a/runtime/v2/bundle.go
+++ b/runtime/v2/bundle.go
@@ -19,7 +19,6 @@ package v2
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -100,7 +99,7 @@ func NewBundle(ctx context.Context, root, state, id string, spec []byte) (b *Bun
 		return nil, err
 	}
 	// write the spec to the bundle
-	err = ioutil.WriteFile(filepath.Join(b.Path, configFilename), spec, 0666)
+	err = os.WriteFile(filepath.Join(b.Path, configFilename), spec, 0666)
 	return b, err
 }
 
diff --git a/runtime/v2/manager.go b/runtime/v2/manager.go
index 0d6ae641e9db..d75907feb4b3 100644
--- a/runtime/v2/manager.go
+++ b/runtime/v2/manager.go
@@ -19,7 +19,6 @@ package v2
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -234,7 +233,7 @@ func (m *TaskManager) Tasks(ctx context.Context, all bool) ([]runtime.Task, erro
 }
 
 func (m *TaskManager) loadExistingTasks(ctx context.Context) error {
-	nsDirs, err := ioutil.ReadDir(m.state)
+	nsDirs, err := os.ReadDir(m.state)
 	if err != nil {
 		return err
 	}
@@ -265,7 +264,7 @@ func (m *TaskManager) loadTasks(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	shimDirs, err := ioutil.ReadDir(filepath.Join(m.state, ns))
+	shimDirs, err := os.ReadDir(filepath.Join(m.state, ns))
 	if err != nil {
 		return err
 	}
@@ -285,7 +284,7 @@ func (m *TaskManager) loadTasks(ctx context.Context) error {
 			return err
 		}
 		// fast path
-		bf, err := ioutil.ReadDir(bundle.Path)
+		bf, err := os.ReadDir(bundle.Path)
 		if err != nil {
 			bundle.Delete()
 			log.G(ctx).WithError(err).Errorf("fast path read bundle path for %s", bundle.Path)
@@ -334,7 +333,7 @@ func (m *TaskManager) cleanupWorkDirs(ctx context.Context) error {
 	if err != nil {
 		return err
 	}
-	dirs, err := ioutil.ReadDir(filepath.Join(m.root, ns))
+	dirs, err := os.ReadDir(filepath.Join(m.root, ns))
 	if err != nil {
 		return err
 	}
diff --git a/runtime/v2/runc/container.go b/runtime/v2/runc/container.go
index 90b3bbc31463..11798f16849e 100644
--- a/runtime/v2/runc/container.go
+++ b/runtime/v2/runc/container.go
@@ -22,7 +22,6 @@ package runc
 import (
 	"context"
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -175,7 +174,7 @@ func ReadOptions(path string) (*options.Options, error) {
 		return nil, err
 	}
 
-	data, err := ioutil.ReadFile(filePath)
+	data, err := os.ReadFile(filePath)
 	if err != nil {
 		return nil, err
 	}
@@ -192,12 +191,12 @@ func WriteOptions(path string, opts options.Options) error {
 	if err != nil {
 		return err
 	}
-	return ioutil.WriteFile(filepath.Join(path, optionsFilename), data, 0600)
+	return os.WriteFile(filepath.Join(path, optionsFilename), data, 0600)
 }
 
 // ReadRuntime reads the runtime information from the path
 func ReadRuntime(path string) (string, error) {
-	data, err := ioutil.ReadFile(filepath.Join(path, "runtime"))
+	data, err := os.ReadFile(filepath.Join(path, "runtime"))
 	if err != nil {
 		return "", err
 	}
@@ -206,7 +205,7 @@ func ReadRuntime(path string) (string, error) {
 
 // WriteRuntime writes the runtime information into the path
 func WriteRuntime(path, runtime string) error {
-	return ioutil.WriteFile(filepath.Join(path, "runtime"), []byte(runtime), 0600)
+	return os.WriteFile(filepath.Join(path, "runtime"), []byte(runtime), 0600)
 }
 
 func newInit(ctx context.Context, path, workDir, namespace string, platform stdio.Platform,
diff --git a/runtime/v2/runc/util.go b/runtime/v2/runc/util.go
index 73eebe2f7446..c965a2214204 100644
--- a/runtime/v2/runc/util.go
+++ b/runtime/v2/runc/util.go
@@ -22,7 +22,7 @@ package runc
 import (
 	"context"
 	"encoding/json"
-	"io/ioutil"
+	"os"
 	"path/filepath"
 
 	"github.com/containerd/containerd/api/events"
@@ -66,7 +66,7 @@ func GetTopic(e interface{}) string {
 // there is an error reading the spec or if the container has a private PID namespace
 func ShouldKillAllOnExit(ctx context.Context, bundlePath string) bool {
 	var bundleSpec specs.Spec
-	bundleConfigContents, err := ioutil.ReadFile(filepath.Join(bundlePath, "config.json"))
+	bundleConfigContents, err := os.ReadFile(filepath.Join(bundlePath, "config.json"))
 	if err != nil {
 		log.G(ctx).WithError(err).Error("shouldKillAllOnExit: failed to read config.json")
 		return true
diff --git a/runtime/v2/runc/v1/service.go b/runtime/v2/runc/v1/service.go
index 770a83a055b5..be077b5530e2 100644
--- a/runtime/v2/runc/v1/service.go
+++ b/runtime/v2/runc/v1/service.go
@@ -21,7 +21,7 @@ package v1
 
 import (
 	"context"
-	"io/ioutil"
+	"io"
 	"os"
 	"path/filepath"
 	"sync"
@@ -180,7 +180,7 @@ func (s *service) StartShim(ctx context.Context, opts shim.StartOpts) (_ string,
 	if err := shim.WritePidFile("shim.pid", cmd.Process.Pid); err != nil {
 		return "", err
 	}
-	if data, err := ioutil.ReadAll(os.Stdin); err == nil {
+	if data, err := io.ReadAll(os.Stdin); err == nil {
 		if len(data) > 0 {
 			var any ptypes.Any
 			if err := proto.Unmarshal(data, &any); err != nil {
diff --git a/runtime/v2/runc/v2/service.go b/runtime/v2/runc/v2/service.go
index 9ea5e767a2d2..93d264815667 100644
--- a/runtime/v2/runc/v2/service.go
+++ b/runtime/v2/runc/v2/service.go
@@ -22,7 +22,7 @@ package v2
 import (
 	"context"
 	"encoding/json"
-	"io/ioutil"
+	"io"
 	"os"
 	"path/filepath"
 	"sync"
@@ -245,7 +245,7 @@ func (s *service) StartShim(ctx context.Context, opts shim.StartOpts) (_ string,
 	}()
 	// make sure to wait after start
 	go cmd.Wait()
-	if data, err := ioutil.ReadAll(os.Stdin); err == nil {
+	if data, err := io.ReadAll(os.Stdin); err == nil {
 		if len(data) > 0 {
 			var any ptypes.Any
 			if err := proto.Unmarshal(data, &any); err != nil {
diff --git a/runtime/v2/shim.go b/runtime/v2/shim.go
index 43a19591b858..56e347563763 100644
--- a/runtime/v2/shim.go
+++ b/runtime/v2/shim.go
@@ -19,7 +19,6 @@ package v2
 import (
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"time"
@@ -55,7 +54,7 @@ func init() {
 }
 
 func loadAddress(path string) (string, error) {
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return "", err
 	}
diff --git a/runtime/v2/shim/util.go b/runtime/v2/shim/util.go
index 58f2e9b3faf2..95805113f9c4 100644
--- a/runtime/v2/shim/util.go
+++ b/runtime/v2/shim/util.go
@@ -20,7 +20,6 @@ import (
 	"bytes"
 	"context"
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -193,7 +192,7 @@ func ReadAddress(path string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return "", err
 	}
diff --git a/services/introspection/local.go b/services/introspection/local.go
index 988f1e834bdb..a409e1cacc53 100644
--- a/services/introspection/local.go
+++ b/services/introspection/local.go
@@ -18,7 +18,6 @@ package introspection
 
 import (
 	context "context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sync"
@@ -114,7 +113,7 @@ func (l *Local) getUUID() (string, error) {
 	l.mu.Lock()
 	defer l.mu.Unlock()
 
-	data, err := ioutil.ReadFile(l.uuidPath())
+	data, err := os.ReadFile(l.uuidPath())
 	if err != nil {
 		if os.IsNotExist(err) {
 			return l.generateUUID()
@@ -138,7 +137,7 @@ func (l *Local) generateUUID() (string, error) {
 		return "", err
 	}
 	uu := u.String()
-	if err := ioutil.WriteFile(path, []byte(uu), 0666); err != nil {
+	if err := os.WriteFile(path, []byte(uu), 0666); err != nil {
 		return "", err
 	}
 	return uu, nil
diff --git a/services/server/config/config_test.go b/services/server/config/config_test.go
index 6775e8459e2f..3964032a78c7 100644
--- a/services/server/config/config_test.go
+++ b/services/server/config/config_test.go
@@ -17,7 +17,6 @@
 package config
 
 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"sort"
@@ -62,12 +61,12 @@ func TestMergeConfigs(t *testing.T) {
 }
 
 func TestResolveImports(t *testing.T) {
-	tempDir, err := ioutil.TempDir("", "containerd_")
+	tempDir, err := os.MkdirTemp("", "containerd_")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tempDir)
 
 	for _, filename := range []string{"config_1.toml", "config_2.toml", "test.toml"} {
-		err = ioutil.WriteFile(filepath.Join(tempDir, filename), []byte(""), 0600)
+		err = os.WriteFile(filepath.Join(tempDir, filename), []byte(""), 0600)
 		assert.NilError(t, err)
 	}
 
@@ -96,12 +95,12 @@ root = "/var/lib/containerd"
 	accepts = ["application/vnd.docker.image.rootfs.diff.tar.gzip"]
 	path = "unpigz"
 `
-	tempDir, err := ioutil.TempDir("", "containerd_")
+	tempDir, err := os.MkdirTemp("", "containerd_")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tempDir)
 
 	path := filepath.Join(tempDir, "config.toml")
-	err = ioutil.WriteFile(path, []byte(data), 0600)
+	err = os.WriteFile(path, []byte(data), 0600)
 	assert.NilError(t, err)
 
 	var out Config
@@ -128,14 +127,14 @@ imports = ["data2.toml"]
 disabled_plugins = ["io.containerd.v1.xyz"]
 `
 
-	tempDir, err := ioutil.TempDir("", "containerd_")
+	tempDir, err := os.MkdirTemp("", "containerd_")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tempDir)
 
-	err = ioutil.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0600)
+	err = os.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0600)
 	assert.NilError(t, err)
 
-	err = ioutil.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0600)
+	err = os.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0600)
 	assert.NilError(t, err)
 
 	var out Config
@@ -158,14 +157,14 @@ imports = ["data2.toml", "data1.toml"]
 disabled_plugins = ["io.containerd.v1.xyz"]
 imports = ["data1.toml", "data2.toml"]
 `
-	tempDir, err := ioutil.TempDir("", "containerd_")
+	tempDir, err := os.MkdirTemp("", "containerd_")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tempDir)
 
-	err = ioutil.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0600)
+	err = os.WriteFile(filepath.Join(tempDir, "data1.toml"), []byte(data1), 0600)
 	assert.NilError(t, err)
 
-	err = ioutil.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0600)
+	err = os.WriteFile(filepath.Join(tempDir, "data2.toml"), []byte(data2), 0600)
 	assert.NilError(t, err)
 
 	var out Config
@@ -190,12 +189,12 @@ version = 2
   shim_debug = true
 `
 
-	tempDir, err := ioutil.TempDir("", "containerd_")
+	tempDir, err := os.MkdirTemp("", "containerd_")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tempDir)
 
 	path := filepath.Join(tempDir, "config.toml")
-	err = ioutil.WriteFile(path, []byte(data), 0600)
+	err = os.WriteFile(path, []byte(data), 0600)
 	assert.NilError(t, err)
 
 	var out Config
@@ -216,12 +215,12 @@ func TestDecodePluginInV1Config(t *testing.T) {
   shim_debug = true
 `
 
-	tempDir, err := ioutil.TempDir("", "containerd_")
+	tempDir, err := os.MkdirTemp("", "containerd_")
 	assert.NilError(t, err)
 	defer os.RemoveAll(tempDir)
 
 	path := filepath.Join(tempDir, "config.toml")
-	err = ioutil.WriteFile(path, []byte(data), 0600)
+	err = os.WriteFile(path, []byte(data), 0600)
 	assert.NilError(t, err)
 
 	var out Config
diff --git a/services/server/server.go b/services/server/server.go
index 6a36bd4a61f7..ac15b5649040 100644
--- a/services/server/server.go
+++ b/services/server/server.go
@@ -22,7 +22,6 @@ import (
 	"crypto/x509"
 	"expvar"
 	"io"
-	"io/ioutil"
 	"net"
 	"net/http"
 	"net/http/pprof"
@@ -131,7 +130,7 @@ func New(ctx context.Context, config *srvconfig.Config) (*Server, error) {
 
 		if config.GRPC.TCPTLSCA != "" {
 			caCertPool := x509.NewCertPool()
-			caCert, err := ioutil.ReadFile(config.GRPC.TCPTLSCA)
+			caCert, err := os.ReadFile(config.GRPC.TCPTLSCA)
 			if err != nil {
 				return nil, errors.Wrap(err, "failed to load CA file")
 			}
diff --git a/services/tasks/local.go b/services/tasks/local.go
index 773325b15530..d6b97c988407 100644
--- a/services/tasks/local.go
+++ b/services/tasks/local.go
@@ -21,7 +21,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -154,7 +153,7 @@ func (l *local) Create(ctx context.Context, r *api.CreateTaskRequest, _ ...grpc.
 	}
 	// jump get checkpointPath from checkpoint image
 	if checkpointPath == "" && r.Checkpoint != nil {
-		checkpointPath, err = ioutil.TempDir(os.Getenv("XDG_RUNTIME_DIR"), "ctrd-checkpoint")
+		checkpointPath, err = os.MkdirTemp(os.Getenv("XDG_RUNTIME_DIR"), "ctrd-checkpoint")
 		if err != nil {
 			return nil, err
 		}
@@ -538,7 +537,7 @@ func (l *local) Checkpoint(ctx context.Context, r *api.CheckpointTaskRequest, _
 	checkpointImageExists := false
 	if image == "" {
 		checkpointImageExists = true
-		image, err = ioutil.TempDir(os.Getenv("XDG_RUNTIME_DIR"), "ctd-checkpoint")
+		image, err = os.MkdirTemp(os.Getenv("XDG_RUNTIME_DIR"), "ctd-checkpoint")
 		if err != nil {
 			return nil, errdefs.ToGRPC(err)
 		}
diff --git a/snapshots/btrfs/btrfs_test.go b/snapshots/btrfs/btrfs_test.go
index c51443da457a..9eef4040ce42 100644
--- a/snapshots/btrfs/btrfs_test.go
+++ b/snapshots/btrfs/btrfs_test.go
@@ -22,7 +22,6 @@ package btrfs
 import (
 	"bytes"
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -46,7 +45,7 @@ func boltSnapshotter(t *testing.T) func(context.Context, string) (snapshots.Snap
 		t.Skipf("could not find mkfs.btrfs: %v", err)
 	}
 
-	procModules, err := ioutil.ReadFile("/proc/modules")
+	procModules, err := os.ReadFile("/proc/modules")
 	if err == nil && !bytes.Contains(procModules, []byte("btrfs")) {
 		t.Skip("check for btrfs kernel module failed, skipping test")
 	}
@@ -122,14 +121,14 @@ func TestBtrfsMounts(t *testing.T) {
 	ctx := context.Background()
 
 	// create temporary directory for mount point
-	mountPoint, err := ioutil.TempDir("", "containerd-btrfs-test")
+	mountPoint, err := os.MkdirTemp("", "containerd-btrfs-test")
 	if err != nil {
 		t.Fatal("could not create mount point for btrfs test", err)
 	}
 	defer os.RemoveAll(mountPoint)
 	t.Log("temporary mount point created", mountPoint)
 
-	root, err := ioutil.TempDir(mountPoint, "TestBtrfsPrepare-")
+	root, err := os.MkdirTemp(mountPoint, "TestBtrfsPrepare-")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -168,7 +167,7 @@ func TestBtrfsMounts(t *testing.T) {
 	defer testutil.Unmount(t, target)
 
 	// write in some data
-	if err := ioutil.WriteFile(filepath.Join(target, "foo"), []byte("content"), 0777); err != nil {
+	if err := os.WriteFile(filepath.Join(target, "foo"), []byte("content"), 0777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -198,7 +197,7 @@ func TestBtrfsMounts(t *testing.T) {
 	defer testutil.Unmount(t, target)
 
 	// TODO(stevvooe): Verify contents of "foo"
-	if err := ioutil.WriteFile(filepath.Join(target, "bar"), []byte("content"), 0777); err != nil {
+	if err := os.WriteFile(filepath.Join(target, "bar"), []byte("content"), 0777); err != nil {
 		t.Fatal(err)
 	}
 
diff --git a/snapshots/devmapper/config_test.go b/snapshots/devmapper/config_test.go
index 80ba5859d73e..d156a8985162 100644
--- a/snapshots/devmapper/config_test.go
+++ b/snapshots/devmapper/config_test.go
@@ -20,7 +20,6 @@
 package devmapper
 
 import (
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -37,7 +36,7 @@ func TestLoadConfig(t *testing.T) {
 		BaseImageSize: "128Mb",
 	}
 
-	file, err := ioutil.TempFile("", "devmapper-config-")
+	file, err := os.CreateTemp("", "devmapper-config-")
 	assert.NilError(t, err)
 
 	encoder := toml.NewEncoder(file)
diff --git a/snapshots/devmapper/dmsetup/dmsetup_test.go b/snapshots/devmapper/dmsetup/dmsetup_test.go
index 7eb478637ad0..06759894decc 100644
--- a/snapshots/devmapper/dmsetup/dmsetup_test.go
+++ b/snapshots/devmapper/dmsetup/dmsetup_test.go
@@ -20,7 +20,6 @@
 package dmsetup
 
 import (
-	"io/ioutil"
 	"os"
 	"strings"
 	"testing"
@@ -44,7 +43,7 @@ const (
 func TestDMSetup(t *testing.T) {
 	testutil.RequiresRoot(t)
 
-	tempDir, err := ioutil.TempDir("", "dmsetup-tests-")
+	tempDir, err := os.MkdirTemp("", "dmsetup-tests-")
 	assert.NilError(t, err, "failed to make temp dir for tests")
 
 	defer func() {
@@ -191,7 +190,7 @@ func testVersion(t *testing.T) {
 }
 
 func createLoopbackDevice(t *testing.T, dir string) (string, string) {
-	file, err := ioutil.TempFile(dir, "dmsetup-tests-")
+	file, err := os.CreateTemp(dir, "dmsetup-tests-")
 	assert.NilError(t, err)
 
 	size, err := units.RAMInBytes("16Mb")
diff --git a/snapshots/devmapper/metadata_test.go b/snapshots/devmapper/metadata_test.go
index a621ae3f0008..17b2bb2d35ba 100644
--- a/snapshots/devmapper/metadata_test.go
+++ b/snapshots/devmapper/metadata_test.go
@@ -21,7 +21,6 @@ package devmapper
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -233,7 +232,7 @@ func TestPoolMetadata_GetDeviceNames(t *testing.T) {
 }
 
 func createStore(t *testing.T) (tempDir string, store *PoolMetadata) {
-	tempDir, err := ioutil.TempDir("", "pool-metadata-")
+	tempDir, err := os.MkdirTemp("", "pool-metadata-")
 	assert.NilError(t, err, "couldn't create temp directory for metadata tests")
 
 	path := filepath.Join(tempDir, "test.db")
diff --git a/snapshots/devmapper/pool_device_test.go b/snapshots/devmapper/pool_device_test.go
index e5179b245008..f68d41609f65 100644
--- a/snapshots/devmapper/pool_device_test.go
+++ b/snapshots/devmapper/pool_device_test.go
@@ -22,7 +22,6 @@ package devmapper
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -62,7 +61,7 @@ func TestPoolDevice(t *testing.T) {
 	logrus.SetLevel(logrus.DebugLevel)
 	ctx := context.Background()
 
-	tempDir, err := ioutil.TempDir("", "pool-device-test-")
+	tempDir, err := os.MkdirTemp("", "pool-device-test-")
 	assert.NilError(t, err, "couldn't get temp directory for testing")
 
 	_, loopDataDevice := createLoopbackDevice(t, tempDir)
@@ -112,7 +111,7 @@ func TestPoolDevice(t *testing.T) {
 	err = mount.WithTempMount(ctx, getMounts(thinDevice1), func(thin1MountPath string) error {
 		// Write v1 test file on 'thin-1' device
 		thin1TestFilePath := filepath.Join(thin1MountPath, "TEST")
-		err := ioutil.WriteFile(thin1TestFilePath, []byte("test file (v1)"), 0700)
+		err := os.WriteFile(thin1TestFilePath, []byte("test file (v1)"), 0700)
 		assert.NilError(t, err, "failed to write test file v1 on '%s' volume", thinDevice1)
 
 		return nil
@@ -126,7 +125,7 @@ func TestPoolDevice(t *testing.T) {
 	// Update TEST file on 'thin-1' to v2
 	err = mount.WithTempMount(ctx, getMounts(thinDevice1), func(thin1MountPath string) error {
 		thin1TestFilePath := filepath.Join(thin1MountPath, "TEST")
-		err = ioutil.WriteFile(thin1TestFilePath, []byte("test file (v2)"), 0700)
+		err = os.WriteFile(thin1TestFilePath, []byte("test file (v2)"), 0700)
 		assert.NilError(t, err, "failed to write test file v2 on 'thin-1' volume after taking snapshot")
 
 		return nil
@@ -137,7 +136,7 @@ func TestPoolDevice(t *testing.T) {
 	// Mount 'snap-1' and make sure TEST file is v1
 	err = mount.WithTempMount(ctx, getMounts(snapDevice1), func(snap1MountPath string) error {
 		// Read test file from snapshot device and make sure it's v1
-		fileData, err := ioutil.ReadFile(filepath.Join(snap1MountPath, "TEST"))
+		fileData, err := os.ReadFile(filepath.Join(snap1MountPath, "TEST"))
 		assert.NilError(t, err, "couldn't read test file from '%s' device", snapDevice1)
 		assert.Equal(t, "test file (v1)", string(fileData), "test file content is invalid on snapshot")
 
@@ -293,7 +292,7 @@ func getMounts(thinDeviceName string) []mount.Mount {
 }
 
 func createLoopbackDevice(t *testing.T, dir string) (string, string) {
-	file, err := ioutil.TempFile(dir, testsPrefix)
+	file, err := os.CreateTemp(dir, testsPrefix)
 	assert.NilError(t, err)
 
 	size, err := units.RAMInBytes("128Mb")
diff --git a/snapshots/devmapper/snapshotter_test.go b/snapshots/devmapper/snapshotter_test.go
index d60430c61387..d8bb73e0ef18 100644
--- a/snapshots/devmapper/snapshotter_test.go
+++ b/snapshots/devmapper/snapshotter_test.go
@@ -23,7 +23,6 @@ import (
 	"context"
 	_ "crypto/sha256"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -87,7 +86,7 @@ func TestSnapshotterSuite(t *testing.T) {
 	ctx = namespaces.WithNamespace(ctx, "testsuite")
 
 	t.Run("DevMapperUsage", func(t *testing.T) {
-		tempDir, err := ioutil.TempDir("", "snapshot-suite-usage")
+		tempDir, err := os.MkdirTemp("", "snapshot-suite-usage")
 		assert.NilError(t, err)
 		defer os.RemoveAll(tempDir)
 
diff --git a/snapshots/native/native.go b/snapshots/native/native.go
index 81d3deb4a090..3502507ba41b 100644
--- a/snapshots/native/native.go
+++ b/snapshots/native/native.go
@@ -18,7 +18,6 @@ package native
 
 import (
 	"context"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -234,7 +233,7 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 	)
 
 	if kind == snapshots.KindActive || parent == "" {
-		td, err = ioutil.TempDir(filepath.Join(o.root, "snapshots"), "new-")
+		td, err = os.MkdirTemp(filepath.Join(o.root, "snapshots"), "new-")
 		if err != nil {
 			return nil, errors.Wrap(err, "failed to create temp dir")
 		}
diff --git a/snapshots/overlay/overlay.go b/snapshots/overlay/overlay.go
index f85bf93c087d..797933bbdb1b 100644
--- a/snapshots/overlay/overlay.go
+++ b/snapshots/overlay/overlay.go
@@ -22,7 +22,6 @@ package overlay
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strings"
@@ -478,7 +477,7 @@ func (o *snapshotter) createSnapshot(ctx context.Context, kind snapshots.Kind, k
 }
 
 func (o *snapshotter) prepareDirectory(ctx context.Context, snapshotDir string, kind snapshots.Kind) (string, error) {
-	td, err := ioutil.TempDir(snapshotDir, "new-")
+	td, err := os.MkdirTemp(snapshotDir, "new-")
 	if err != nil {
 		return "", errors.Wrap(err, "failed to create temp dir")
 	}
diff --git a/snapshots/overlay/overlay_test.go b/snapshots/overlay/overlay_test.go
index defdfdbc9209..0dff7c52817b 100644
--- a/snapshots/overlay/overlay_test.go
+++ b/snapshots/overlay/overlay_test.go
@@ -22,7 +22,6 @@ package overlay
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"syscall"
@@ -80,7 +79,7 @@ func TestOverlay(t *testing.T) {
 
 func testOverlayMounts(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 	ctx := context.TODO()
-	root, err := ioutil.TempDir("", "overlay")
+	root, err := os.MkdirTemp("", "overlay")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -114,7 +113,7 @@ func testOverlayMounts(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 
 func testOverlayCommit(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 	ctx := context.TODO()
-	root, err := ioutil.TempDir("", "overlay")
+	root, err := os.MkdirTemp("", "overlay")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -129,7 +128,7 @@ func testOverlayCommit(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 		t.Fatal(err)
 	}
 	m := mounts[0]
-	if err := ioutil.WriteFile(filepath.Join(m.Source, "foo"), []byte("hi"), 0660); err != nil {
+	if err := os.WriteFile(filepath.Join(m.Source, "foo"), []byte("hi"), 0660); err != nil {
 		t.Fatal(err)
 	}
 	if err := o.Commit(ctx, "base", key); err != nil {
@@ -139,7 +138,7 @@ func testOverlayCommit(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 
 func testOverlayOverlayMount(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 	ctx := context.TODO()
-	root, err := ioutil.TempDir("", "overlay")
+	root, err := os.MkdirTemp("", "overlay")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -233,7 +232,7 @@ func getParents(ctx context.Context, sn snapshots.Snapshotter, root, key string)
 func testOverlayOverlayRead(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 	testutil.RequiresRoot(t)
 	ctx := context.TODO()
-	root, err := ioutil.TempDir("", "overlay")
+	root, err := os.MkdirTemp("", "overlay")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -248,7 +247,7 @@ func testOverlayOverlayRead(t *testing.T, newSnapshotter testsuite.SnapshotterFu
 		t.Fatal(err)
 	}
 	m := mounts[0]
-	if err := ioutil.WriteFile(filepath.Join(m.Source, "foo"), []byte("hi"), 0660); err != nil {
+	if err := os.WriteFile(filepath.Join(m.Source, "foo"), []byte("hi"), 0660); err != nil {
 		t.Fatal(err)
 	}
 	if err := o.Commit(ctx, "base", key); err != nil {
@@ -265,7 +264,7 @@ func testOverlayOverlayRead(t *testing.T, newSnapshotter testsuite.SnapshotterFu
 		t.Fatal(err)
 	}
 	defer syscall.Unmount(dest, 0)
-	data, err := ioutil.ReadFile(filepath.Join(dest, "foo"))
+	data, err := os.ReadFile(filepath.Join(dest, "foo"))
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -276,7 +275,7 @@ func testOverlayOverlayRead(t *testing.T, newSnapshotter testsuite.SnapshotterFu
 
 func testOverlayView(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 	ctx := context.TODO()
-	root, err := ioutil.TempDir("", "overlay")
+	root, err := os.MkdirTemp("", "overlay")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -291,7 +290,7 @@ func testOverlayView(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 		t.Fatal(err)
 	}
 	m := mounts[0]
-	if err := ioutil.WriteFile(filepath.Join(m.Source, "foo"), []byte("hi"), 0660); err != nil {
+	if err := os.WriteFile(filepath.Join(m.Source, "foo"), []byte("hi"), 0660); err != nil {
 		t.Fatal(err)
 	}
 	if err := o.Commit(ctx, "base", key); err != nil {
@@ -303,7 +302,7 @@ func testOverlayView(t *testing.T, newSnapshotter testsuite.SnapshotterFunc) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := ioutil.WriteFile(filepath.Join(getParents(ctx, o, root, "/tmp/top")[0], "foo"), []byte("hi, again"), 0660); err != nil {
+	if err := os.WriteFile(filepath.Join(getParents(ctx, o, root, "/tmp/top")[0], "foo"), []byte("hi, again"), 0660); err != nil {
 		t.Fatal(err)
 	}
 	if err := o.Commit(ctx, "top", key); err != nil {
diff --git a/snapshots/overlay/overlayutils/check.go b/snapshots/overlay/overlayutils/check.go
index 602b1f46c758..27bd305cbcef 100644
--- a/snapshots/overlay/overlayutils/check.go
+++ b/snapshots/overlay/overlayutils/check.go
@@ -21,7 +21,6 @@ package overlayutils
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -40,7 +39,7 @@ import (
 //
 // Ported from moby overlay2.
 func SupportsMultipleLowerDir(d string) error {
-	td, err := ioutil.TempDir(d, "multiple-lowerdir-check")
+	td, err := os.MkdirTemp(d, "multiple-lowerdir-check")
 	if err != nil {
 		return err
 	}
@@ -135,7 +134,7 @@ func NeedsUserXAttr(d string) (bool, error) {
 		}
 	}()
 
-	td, err := ioutil.TempDir(tdRoot, "")
+	td, err := os.MkdirTemp(tdRoot, "")
 	if err != nil {
 		return false, err
 	}
diff --git a/snapshots/overlay/overlayutils/check_test.go b/snapshots/overlay/overlayutils/check_test.go
index f3a4d3b0a1af..3618fa14180d 100644
--- a/snapshots/overlay/overlayutils/check_test.go
+++ b/snapshots/overlay/overlayutils/check_test.go
@@ -20,7 +20,6 @@
 package overlayutils
 
 import (
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -31,7 +30,7 @@ import (
 
 func testOverlaySupported(t testing.TB, expected bool, mkfs ...string) {
 	testutil.RequiresRoot(t)
-	mnt, err := ioutil.TempDir("", "containerd-fs-test-supports-overlay")
+	mnt, err := os.MkdirTemp("", "containerd-fs-test-supports-overlay")
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/snapshots/storage/metastore_bench_test.go b/snapshots/storage/metastore_bench_test.go
index 4c51ded961f5..b7f4f094af98 100644
--- a/snapshots/storage/metastore_bench_test.go
+++ b/snapshots/storage/metastore_bench_test.go
@@ -19,7 +19,6 @@ package storage
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"testing"
 
@@ -43,7 +42,7 @@ func Benchmarks(b *testing.B, name string, metaFn metaFactory) {
 func makeBench(b *testing.B, name string, metaFn metaFactory, fn func(context.Context, *testing.B, *MetaStore)) func(b *testing.B) {
 	return func(b *testing.B) {
 		ctx := context.Background()
-		tmpDir, err := ioutil.TempDir("", "metastore-bench-"+name+"-")
+		tmpDir, err := os.MkdirTemp("", "metastore-bench-"+name+"-")
 		if err != nil {
 			b.Fatal(err)
 		}
@@ -68,7 +67,7 @@ func makeBench(b *testing.B, name string, metaFn metaFactory, fn func(context.Co
 func openCloseWritable(b *testing.B, name string, metaFn metaFactory) func(b *testing.B) {
 	return func(b *testing.B) {
 		ctx := context.Background()
-		tmpDir, err := ioutil.TempDir("", "metastore-bench-"+name+"-")
+		tmpDir, err := os.MkdirTemp("", "metastore-bench-"+name+"-")
 		if err != nil {
 			b.Fatal(err)
 		}
@@ -96,7 +95,7 @@ func openCloseWritable(b *testing.B, name string, metaFn metaFactory) func(b *te
 func openCloseReadonly(b *testing.B, name string, metaFn metaFactory) func(b *testing.B) {
 	return func(b *testing.B) {
 		ctx := context.Background()
-		tmpDir, err := ioutil.TempDir("", "metastore-bench-"+name+"-")
+		tmpDir, err := os.MkdirTemp("", "metastore-bench-"+name+"-")
 		if err != nil {
 			b.Fatal(err)
 		}
diff --git a/snapshots/storage/metastore_test.go b/snapshots/storage/metastore_test.go
index 90ed2ae73e86..7861e49c8f10 100644
--- a/snapshots/storage/metastore_test.go
+++ b/snapshots/storage/metastore_test.go
@@ -19,7 +19,6 @@ package storage
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"testing"
 	"time"
@@ -67,7 +66,7 @@ func MetaStoreSuite(t *testing.T, name string, meta func(root string) (*MetaStor
 func makeTest(t *testing.T, name string, metaFn metaFactory, fn testFunc) func(t *testing.T) {
 	return func(t *testing.T) {
 		ctx := context.Background()
-		tmpDir, err := ioutil.TempDir("", "metastore-test-"+name+"-")
+		tmpDir, err := os.MkdirTemp("", "metastore-test-"+name+"-")
 		if err != nil {
 			t.Fatal(err)
 		}
diff --git a/snapshots/testsuite/helpers.go b/snapshots/testsuite/helpers.go
index 39f9cc5a0fbd..eeed9d2fbee8 100644
--- a/snapshots/testsuite/helpers.go
+++ b/snapshots/testsuite/helpers.go
@@ -19,7 +19,6 @@ package testsuite
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
 	"math/rand"
 	"os"
 
@@ -30,7 +29,7 @@ import (
 )
 
 func applyToMounts(m []mount.Mount, work string, a fstest.Applier) (err error) {
-	td, err := ioutil.TempDir(work, "prepare")
+	td, err := os.MkdirTemp(work, "prepare")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -71,7 +70,7 @@ func createSnapshot(ctx context.Context, sn snapshots.Snapshotter, parent, work
 }
 
 func checkSnapshot(ctx context.Context, sn snapshots.Snapshotter, work, name, check string) (err error) {
-	td, err := ioutil.TempDir(work, "check")
+	td, err := os.MkdirTemp(work, "check")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
@@ -112,7 +111,7 @@ func checkSnapshot(ctx context.Context, sn snapshots.Snapshotter, work, name, ch
 // using the provided appliers, checking each snapshot created in a view
 // against the changes applied to a single directory.
 func checkSnapshots(ctx context.Context, sn snapshots.Snapshotter, work string, as ...fstest.Applier) error {
-	td, err := ioutil.TempDir(work, "flat")
+	td, err := os.MkdirTemp(work, "flat")
 	if err != nil {
 		return errors.Wrap(err, "failed to create temp dir")
 	}
diff --git a/snapshots/testsuite/testsuite.go b/snapshots/testsuite/testsuite.go
index c7f2e07c1d73..ed7244e75500 100644
--- a/snapshots/testsuite/testsuite.go
+++ b/snapshots/testsuite/testsuite.go
@@ -21,7 +21,6 @@ import (
 	//nolint:revive // go-digest needs the blank import. See https://github.com/opencontainers/go-digest#usage.
 	_ "crypto/sha256"
 	"fmt"
-	"io/ioutil"
 	"math/rand"
 	"os"
 	"path/filepath"
@@ -87,7 +86,7 @@ func makeTest(name string, snapshotterFn func(ctx context.Context, root string)
 		// 		work/ -> passed to test functions
 		// 		root/ -> passed to snapshotter
 		//
-		tmpDir, err := ioutil.TempDir("", "snapshot-suite-"+name+"-")
+		tmpDir, err := os.MkdirTemp("", "snapshot-suite-"+name+"-")
 		if err != nil {
 			t.Fatal(err)
 		}
@@ -297,7 +296,7 @@ func checkSnapshotterStatActive(ctx context.Context, t *testing.T, snapshotter s
 	}
 	defer testutil.Unmount(t, preparing)
 
-	if err = ioutil.WriteFile(filepath.Join(preparing, "foo"), []byte("foo\n"), 0777); err != nil {
+	if err = os.WriteFile(filepath.Join(preparing, "foo"), []byte("foo\n"), 0777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -331,7 +330,7 @@ func checkSnapshotterStatCommitted(ctx context.Context, t *testing.T, snapshotte
 	}
 	defer testutil.Unmount(t, preparing)
 
-	if err = ioutil.WriteFile(filepath.Join(preparing, "foo"), []byte("foo\n"), 0777); err != nil {
+	if err = os.WriteFile(filepath.Join(preparing, "foo"), []byte("foo\n"), 0777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -379,7 +378,7 @@ func checkSnapshotterTransitivity(ctx context.Context, t *testing.T, snapshotter
 	}
 	defer testutil.Unmount(t, preparing)
 
-	if err = ioutil.WriteFile(filepath.Join(preparing, "foo"), []byte("foo\n"), 0777); err != nil {
+	if err = os.WriteFile(filepath.Join(preparing, "foo"), []byte("foo\n"), 0777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -394,7 +393,7 @@ func checkSnapshotterTransitivity(ctx context.Context, t *testing.T, snapshotter
 	}
 	defer testutil.Unmount(t, next)
 
-	if err = ioutil.WriteFile(filepath.Join(next, "foo"), []byte("foo bar\n"), 0777); err != nil {
+	if err = os.WriteFile(filepath.Join(next, "foo"), []byte("foo bar\n"), 0777); err != nil {
 		t.Fatal(err)
 	}
 
@@ -804,7 +803,7 @@ func checkSnapshotterViewReadonly(ctx context.Context, t *testing.T, snapshotter
 	}
 
 	testfile := filepath.Join(viewMountPoint, "testfile")
-	if err := ioutil.WriteFile(testfile, []byte("testcontent"), 0777); err != nil {
+	if err := os.WriteFile(testfile, []byte("testcontent"), 0777); err != nil {
 		t.Logf("write to %q failed with %v (EROFS is expected but can be other error code)", testfile, err)
 	} else {
 		t.Fatalf("write to %q should fail (EROFS) but did not fail", testfile)
diff --git a/snapshots/windows/windows.go b/snapshots/windows/windows.go
index 9c609d4f8c16..3fc52c04b5ea 100644
--- a/snapshots/windows/windows.go
+++ b/snapshots/windows/windows.go
@@ -23,7 +23,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -491,7 +490,7 @@ func (s *snapshotter) convertScratchToReadOnlyLayer(ctx context.Context, snapsho
 		return errors.Wrap(err, "failed to reimport snapshot")
 	}
 
-	if _, err := io.Copy(ioutil.Discard, reader); err != nil {
+	if _, err := io.Copy(io.Discard, reader); err != nil {
 		return errors.Wrap(err, "failed discarding extra data in import stream")
 	}
 
diff --git a/sys/fds.go b/sys/fds.go
index 8b1ba8d70345..a71a9cd7e93d 100644
--- a/sys/fds.go
+++ b/sys/fds.go
@@ -20,14 +20,14 @@
 package sys
 
 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"
 	"strconv"
 )
 
 // GetOpenFds returns the number of open fds for the process provided by pid
 func GetOpenFds(pid int) (int, error) {
-	dirs, err := ioutil.ReadDir(filepath.Join("/proc", strconv.Itoa(pid), "fd"))
+	dirs, err := os.ReadDir(filepath.Join("/proc", strconv.Itoa(pid), "fd"))
 	if err != nil {
 		return -1, err
 	}
diff --git a/sys/oom_linux.go b/sys/oom_linux.go
index 82a347c6f727..bb2a3eafb4f9 100644
--- a/sys/oom_linux.go
+++ b/sys/oom_linux.go
@@ -18,7 +18,6 @@ package sys
 
 import (
 	"fmt"
-	"io/ioutil"
 	"os"
 	"strconv"
 	"strings"
@@ -69,7 +68,7 @@ func SetOOMScore(pid, score int) error {
 // no oom score is set, or a sore is set to 0.
 func GetOOMScoreAdj(pid int) (int, error) {
 	path := fmt.Sprintf("/proc/%d/oom_score_adj", pid)
-	data, err := ioutil.ReadFile(path)
+	data, err := os.ReadFile(path)
 	if err != nil {
 		return 0, err
 	}