If you run containerd as a systemd service, and you try to restart the service while containers are running the systemctl restart containerd will block because while containerd (the daemon) exits when it gets a SIGTERM it doesn't attempt to kill any of the containerd-shims -- which then causes systemd to SIGKILL them after 10 seconds (or whatever the timeout is).