diff --git a/components/engine/vendor.conf b/components/engine/vendor.conf
index f1b6a2ae3a8..d53b0aec207 100644
--- a/components/engine/vendor.conf
+++ b/components/engine/vendor.conf
@@ -103,7 +103,7 @@ google.golang.org/genproto b3e7c2fb04031add52c4817f53f43757ccbf9c18
 github.com/docker/docker-credential-helpers v0.5.0
 
 # containerd
-github.com/containerd/containerd cfb82a876ecc11b5ca0977d1733adbe58599088a
+github.com/containerd/containerd 6e23458c129b551d5c9871e5174f6b1b7f6d1170 https://github.com/docker/containerd
 github.com/tonistiigi/fifo 1405643975692217d6720f8b54aeee1bf2cd5cf4
 
 # cluster
diff --git a/components/engine/vendor/github.com/containerd/containerd/runtime/container_linux.go b/components/engine/vendor/github.com/containerd/containerd/runtime/container_linux.go
index 9f3526a1048..5608b2190da 100644
--- a/components/engine/vendor/github.com/containerd/containerd/runtime/container_linux.go
+++ b/components/engine/vendor/github.com/containerd/containerd/runtime/container_linux.go
@@ -112,11 +112,11 @@ func i64Ptr(i int64) *int64   { return &i }
 func (c *container) UpdateResources(r *Resource) error {
 	sr := ocs.LinuxResources{
 		Memory: &ocs.LinuxMemory{
-			Limit:       u64Ptr(uint64(r.Memory)),
-			Reservation: u64Ptr(uint64(r.MemoryReservation)),
-			Swap:        u64Ptr(uint64(r.MemorySwap)),
-			Kernel:      u64Ptr(uint64(r.KernelMemory)),
-			KernelTCP:   u64Ptr(uint64(r.KernelTCPMemory)),
+			Limit:       i64Ptr(r.Memory),
+			Reservation: i64Ptr(r.MemoryReservation),
+			Swap:        i64Ptr(r.MemorySwap),
+			Kernel:      i64Ptr(r.KernelMemory),
+			KernelTCP:   i64Ptr(r.KernelTCPMemory),
 		},
 		CPU: &ocs.LinuxCPU{
 			Shares: u64Ptr(uint64(r.CPUShares)),
diff --git a/components/engine/vendor/github.com/containerd/containerd/runtime/process.go b/components/engine/vendor/github.com/containerd/containerd/runtime/process.go
index 2df67d95a9b..f5dd3ee155e 100644
--- a/components/engine/vendor/github.com/containerd/containerd/runtime/process.go
+++ b/components/engine/vendor/github.com/containerd/containerd/runtime/process.go
@@ -262,10 +262,27 @@ func (p *process) handleSigkilledShim(rst uint32, rerr error) (uint32, error) {
 		}
 		if ppid == "1" {
 			logrus.Warnf("containerd: %s:%s shim died, killing associated process", p.container.id, p.id)
+			// Before sending SIGKILL to container, we need to make sure
+			// the container is not in Paused state. If the container is
+			// Paused, the container will not response to any signal
+			// we should Resume it after sending SIGKILL
+			var (
+				s    State
+				err1 error
+			)
+			if p.container != nil {
+				s, err1 = p.container.Status()
+			}
+
 			unix.Kill(p.pid, syscall.SIGKILL)
 			if err != nil && err != syscall.ESRCH {
 				return UnknownStatus, fmt.Errorf("containerd: unable to SIGKILL %s:%s (pid %v): %v", p.container.id, p.id, p.pid, err)
 			}
+			if p.container != nil {
+				if err1 == nil && s == Paused {
+					p.container.Resume()
+				}
+			}
 
 			// wait for the process to die
 			for {
@@ -289,6 +306,17 @@ func (p *process) handleSigkilledShim(rst uint32, rerr error) (uint32, error) {
 		return rst, rerr
 	}
 
+	// The shim was SIGKILLED
+	// We should get the container state first
+	// to make sure the container is not in
+	// Pause state, if it's Paused, we should resume it
+	// and it will exit immediately because shim will send sigkill to
+	// container when died.
+	s, err1 := p.container.Status()
+	if err1 == nil && s == Paused {
+		p.container.Resume()
+	}
+
 	// Ensure we got the shim ProcessState
 	<-p.cmdDoneCh