diff --git a/apply-patches b/apply-patches
new file mode 100644
index 0000000000000000000000000000000000000000..cd12d910bb9b6f2fcaaddba646dda82651432d22
--- /dev/null
+++ b/apply-patches
@@ -0,0 +1,34 @@
+#!/bin/bash
+
+# Description: This shell script is used to apply patches for the project
+# Author: zhangzhihui@xfusion.com
+# Create: 2023-03-27
+
+set -ex
+
+pkg=moby-20.10.23
+cwd=$PWD
+src=$cwd/$pkg
+
+if [ ! -d patch ];then
+  tar -xzf patch.tar.gz
+fi
+
+cd $src
+git init
+git add .
+git config user.name 'build'
+git config user.email 'build@obs.com'
+git commit -m "init build"
+cd $cwd
+
+series=$cwd/series.conf
+while IPF=read -r line
+do
+  if [[ "$line" =~ ^patch* ]];then
+    echo git apply $cwd/$line
+    cd $src && git apply $cwd/$line
+  fi
+done < "$series"
+
+mv $src/.git $src/git
diff --git a/moby.spec b/moby.spec
index ff5f37b67c58f27afc0f5ea3ffcd0b0810699eab..14e70606c9856dba29b628beeff319b5a91b3796 100644
--- a/moby.spec
+++ b/moby.spec
@@ -7,7 +7,7 @@
 
 Name: 	  docker 
 Version:  20.10.23
-Release:  1
+Release:  2
 Summary:  The open-source application container engine
 License:  ASL 2.0
 URL:	  https://www.docker.com
@@ -22,6 +22,9 @@ Source3:  libnetwork-dcdf8f17.tar.gz
 Source4:  docker.service
 Source5:  docker.socket
 Source6:  docker.sysconfig
+Source7:  apply-patches
+Source8:  series.conf
+Source9:  patch.tar.gz
 
 
 Requires: %{name}-engine = %{version}-%{release}
@@ -90,6 +93,13 @@ Docker client binary and related utilities
 %setup -q -T -n %{_source_docker_init} -b 2
 %setup -q -T -n %{_source_docker_proxy} -b 3
 
+cd %{_builddir}
+cp %{SOURCE7} .
+cp %{SOURCE8} .
+cp %{SOURCE9} .
+
+sh ./apply-patches
+
 %build
 export GO111MODULE=off
 # build docker daemon
@@ -200,6 +210,9 @@ fi
 %systemd_postun_with_restart docker.service
 
 %changelog
+* Fri Mar 31 2023 zhangzhihui<zhangzhihui@xfusion.com> - 20.10.23-2
+- DESC: sync upstream patch to update containerd to v1.6.16
+
 * Wed Mar 29 2023 xulei<xulei@xfusion.com> - 20.10.23-1
 - DESC:update to 20.10.23
 
diff --git a/patch/backport-0001-20.10-update-containerd-binary-to-v1.6.16.patch b/patch/backport-0001-20.10-update-containerd-binary-to-v1.6.16.patch
new file mode 100644
index 0000000000000000000000000000000000000000..8f786112daf33c0b6f2aeaa704a90312e486bdd9
--- /dev/null
+++ b/patch/backport-0001-20.10-update-containerd-binary-to-v1.6.16.patch
@@ -0,0 +1,35 @@
+From 526ae907e2828307f54315b184457c64bf1b299d Mon Sep 17 00:00:00 2001
+From: Sebastiaan van Stijn <github@gone.nl>
+Date: Mon, 30 Jan 2023 09:17:32 +0100
+Subject: [PATCH] [20.10] update containerd binary to v1.6.16
+
+Notable Updates
+
+- Fix push error propagation
+- Fix slice append error with HugepageLimits for Linux
+- Update default seccomp profile for PKU and CAP_SYS_NICE
+- Fix overlayfs error when upperdirlabel option is set
+
+full diff: https://github.com/containerd/containerd/compare/v1.6.15...v1.6.16
+
+Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
+---
+ hack/dockerfile/install/containerd.installer | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/hack/dockerfile/install/containerd.installer b/hack/dockerfile/install/containerd.installer
+index 1915f8ae35..8bc635be81 100755
+--- a/hack/dockerfile/install/containerd.installer
++++ b/hack/dockerfile/install/containerd.installer
+@@ -15,7 +15,7 @@ set -e
+ # the binary version you may also need to update the vendor version to pick up
+ # bug fixes or new APIs, however, usually the Go packages are built from a
+ # commit from the master branch.
+-: "${CONTAINERD_VERSION:=v1.6.15}"
++: "${CONTAINERD_VERSION:=v1.6.16}"
+ 
+ install_containerd() (
+ 	echo "Install containerd version $CONTAINERD_VERSION"
+-- 
+2.20.1
+
diff --git a/series.conf b/series.conf
new file mode 100644
index 0000000000000000000000000000000000000000..a655a9b52924f176f3ced979a45173c9c8aa88b5
--- /dev/null
+++ b/series.conf
@@ -0,0 +1 @@
+patch/backport-0001-20.10-update-containerd-binary-to-v1.6.16.patch