diff --git a/api/services/content/content.pb.go b/api/services/content/content.pb.go
index 0346b12..d42341c 100644
--- a/api/services/content/content.pb.go
+++ b/api/services/content/content.pb.go
@@ -2588,7 +2588,7 @@ func init() {
 
 var fileDescriptorContent = []byte{
 	// 768 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xb4, 0x55, 0x4f, 0x6f, 0xd3, 0x4e,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xb4, 0x55, 0x4f, 0x6f, 0xd3, 0x4e,
 	0x10, 0xcd, 0xe6, 0x8f, 0x7f, 0xcd, 0x24, 0xed, 0x2f, 0x6c, 0x43, 0x15, 0xb9, 0xad, 0x13, 0xc2,
 	0x25, 0xaa, 0x84, 0x53, 0xc2, 0x0d, 0x0e, 0xc8, 0x49, 0x4b, 0x55, 0xa4, 0x52, 0xc9, 0x8d, 0x54,
 	0x71, 0x42, 0x4e, 0xb2, 0x09, 0x96, 0x1a, 0xaf, 0xb1, 0x37, 0x55, 0xe1, 0xc4, 0x05, 0x09, 0xf5,
diff --git a/api/services/execution/execution.pb.go b/api/services/execution/execution.pb.go
index 1de463a..6755c0c 100644
--- a/api/services/execution/execution.pb.go
+++ b/api/services/execution/execution.pb.go
@@ -19,6 +19,8 @@
 		ListResponse
 		KillRequest
 		EventsRequest
+		ExecRequest
+		ExecResponse
 */
 package execution
 
@@ -141,6 +143,27 @@ func (m *EventsRequest) Reset()                    { *m = EventsRequest{} }
 func (*EventsRequest) ProtoMessage()               {}
 func (*EventsRequest) Descriptor() ([]byte, []int) { return fileDescriptorExecution, []int{9} }
 
+type ExecRequest struct {
+	ID       string                `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
+	Terminal bool                  `protobuf:"varint,2,opt,name=terminal,proto3" json:"terminal,omitempty"`
+	Stdin    string                `protobuf:"bytes,3,opt,name=stdin,proto3" json:"stdin,omitempty"`
+	Stdout   string                `protobuf:"bytes,4,opt,name=stdout,proto3" json:"stdout,omitempty"`
+	Stderr   string                `protobuf:"bytes,5,opt,name=stderr,proto3" json:"stderr,omitempty"`
+	Spec     *google_protobuf1.Any `protobuf:"bytes,6,opt,name=spec" json:"spec,omitempty"`
+}
+
+func (m *ExecRequest) Reset()                    { *m = ExecRequest{} }
+func (*ExecRequest) ProtoMessage()               {}
+func (*ExecRequest) Descriptor() ([]byte, []int) { return fileDescriptorExecution, []int{10} }
+
+type ExecResponse struct {
+	Pid uint32 `protobuf:"varint,1,opt,name=pid,proto3" json:"pid,omitempty"`
+}
+
+func (m *ExecResponse) Reset()                    { *m = ExecResponse{} }
+func (*ExecResponse) ProtoMessage()               {}
+func (*ExecResponse) Descriptor() ([]byte, []int) { return fileDescriptorExecution, []int{11} }
+
 func init() {
 	proto.RegisterType((*CreateRequest)(nil), "containerd.v1.services.CreateRequest")
 	proto.RegisterType((*CreateResponse)(nil), "containerd.v1.services.CreateResponse")
@@ -152,6 +175,8 @@ func init() {
 	proto.RegisterType((*ListResponse)(nil), "containerd.v1.services.ListResponse")
 	proto.RegisterType((*KillRequest)(nil), "containerd.v1.services.KillRequest")
 	proto.RegisterType((*EventsRequest)(nil), "containerd.v1.services.EventsRequest")
+	proto.RegisterType((*ExecRequest)(nil), "containerd.v1.services.ExecRequest")
+	proto.RegisterType((*ExecResponse)(nil), "containerd.v1.services.ExecResponse")
 }
 
 // Reference imports to suppress errors if they are not otherwise used.
@@ -172,6 +197,7 @@ type ContainerServiceClient interface {
 	List(ctx context.Context, in *ListRequest, opts ...grpc.CallOption) (*ListResponse, error)
 	Kill(ctx context.Context, in *KillRequest, opts ...grpc.CallOption) (*google_protobuf.Empty, error)
 	Events(ctx context.Context, in *EventsRequest, opts ...grpc.CallOption) (ContainerService_EventsClient, error)
+	Exec(ctx context.Context, in *ExecRequest, opts ...grpc.CallOption) (*ExecResponse, error)
 }
 
 type containerServiceClient struct {
@@ -268,6 +294,15 @@ func (x *containerServiceEventsClient) Recv() (*containerd_v1_types1.Event, erro
 	return m, nil
 }
 
+func (c *containerServiceClient) Exec(ctx context.Context, in *ExecRequest, opts ...grpc.CallOption) (*ExecResponse, error) {
+	out := new(ExecResponse)
+	err := grpc.Invoke(ctx, "/containerd.v1.services.ContainerService/Exec", in, out, c.cc, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // Server API for ContainerService service
 
 type ContainerServiceServer interface {
@@ -278,6 +313,7 @@ type ContainerServiceServer interface {
 	List(context.Context, *ListRequest) (*ListResponse, error)
 	Kill(context.Context, *KillRequest) (*google_protobuf.Empty, error)
 	Events(*EventsRequest, ContainerService_EventsServer) error
+	Exec(context.Context, *ExecRequest) (*ExecResponse, error)
 }
 
 func RegisterContainerServiceServer(s *grpc.Server, srv ContainerServiceServer) {
@@ -413,6 +449,24 @@ func (x *containerServiceEventsServer) Send(m *containerd_v1_types1.Event) error
 	return x.ServerStream.SendMsg(m)
 }
 
+func _ContainerService_Exec_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ExecRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ContainerServiceServer).Exec(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/containerd.v1.services.ContainerService/Exec",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ContainerServiceServer).Exec(ctx, req.(*ExecRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 var _ContainerService_serviceDesc = grpc.ServiceDesc{
 	ServiceName: "containerd.v1.services.ContainerService",
 	HandlerType: (*ContainerServiceServer)(nil),
@@ -441,6 +495,10 @@ var _ContainerService_serviceDesc = grpc.ServiceDesc{
 			MethodName: "Kill",
 			Handler:    _ContainerService_Kill_Handler,
 		},
+		{
+			MethodName: "Exec",
+			Handler:    _ContainerService_Exec_Handler,
+		},
 	},
 	Streams: []grpc.StreamDesc{
 		{
@@ -767,6 +825,91 @@ func (m *EventsRequest) MarshalTo(dAtA []byte) (int, error) {
 	return i, nil
 }
 
+func (m *ExecRequest) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ExecRequest) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if len(m.ID) > 0 {
+		dAtA[i] = 0xa
+		i++
+		i = encodeVarintExecution(dAtA, i, uint64(len(m.ID)))
+		i += copy(dAtA[i:], m.ID)
+	}
+	if m.Terminal {
+		dAtA[i] = 0x10
+		i++
+		if m.Terminal {
+			dAtA[i] = 1
+		} else {
+			dAtA[i] = 0
+		}
+		i++
+	}
+	if len(m.Stdin) > 0 {
+		dAtA[i] = 0x1a
+		i++
+		i = encodeVarintExecution(dAtA, i, uint64(len(m.Stdin)))
+		i += copy(dAtA[i:], m.Stdin)
+	}
+	if len(m.Stdout) > 0 {
+		dAtA[i] = 0x22
+		i++
+		i = encodeVarintExecution(dAtA, i, uint64(len(m.Stdout)))
+		i += copy(dAtA[i:], m.Stdout)
+	}
+	if len(m.Stderr) > 0 {
+		dAtA[i] = 0x2a
+		i++
+		i = encodeVarintExecution(dAtA, i, uint64(len(m.Stderr)))
+		i += copy(dAtA[i:], m.Stderr)
+	}
+	if m.Spec != nil {
+		dAtA[i] = 0x32
+		i++
+		i = encodeVarintExecution(dAtA, i, uint64(m.Spec.Size()))
+		n2, err := m.Spec.MarshalTo(dAtA[i:])
+		if err != nil {
+			return 0, err
+		}
+		i += n2
+	}
+	return i, nil
+}
+
+func (m *ExecResponse) Marshal() (dAtA []byte, err error) {
+	size := m.Size()
+	dAtA = make([]byte, size)
+	n, err := m.MarshalTo(dAtA)
+	if err != nil {
+		return nil, err
+	}
+	return dAtA[:n], nil
+}
+
+func (m *ExecResponse) MarshalTo(dAtA []byte) (int, error) {
+	var i int
+	_ = i
+	var l int
+	_ = l
+	if m.Pid != 0 {
+		dAtA[i] = 0x8
+		i++
+		i = encodeVarintExecution(dAtA, i, uint64(m.Pid))
+	}
+	return i, nil
+}
+
 func encodeFixed64Execution(dAtA []byte, offset int, v uint64) int {
 	dAtA[offset] = uint8(v)
 	dAtA[offset+1] = uint8(v >> 8)
@@ -929,6 +1072,44 @@ func (m *EventsRequest) Size() (n int) {
 	return n
 }
 
+func (m *ExecRequest) Size() (n int) {
+	var l int
+	_ = l
+	l = len(m.ID)
+	if l > 0 {
+		n += 1 + l + sovExecution(uint64(l))
+	}
+	if m.Terminal {
+		n += 2
+	}
+	l = len(m.Stdin)
+	if l > 0 {
+		n += 1 + l + sovExecution(uint64(l))
+	}
+	l = len(m.Stdout)
+	if l > 0 {
+		n += 1 + l + sovExecution(uint64(l))
+	}
+	l = len(m.Stderr)
+	if l > 0 {
+		n += 1 + l + sovExecution(uint64(l))
+	}
+	if m.Spec != nil {
+		l = m.Spec.Size()
+		n += 1 + l + sovExecution(uint64(l))
+	}
+	return n
+}
+
+func (m *ExecResponse) Size() (n int) {
+	var l int
+	_ = l
+	if m.Pid != 0 {
+		n += 1 + sovExecution(uint64(m.Pid))
+	}
+	return n
+}
+
 func sovExecution(x uint64) (n int) {
 	for {
 		n++
@@ -1051,6 +1232,31 @@ func (this *EventsRequest) String() string {
 	}, "")
 	return s
 }
+func (this *ExecRequest) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ExecRequest{`,
+		`ID:` + fmt.Sprintf("%v", this.ID) + `,`,
+		`Terminal:` + fmt.Sprintf("%v", this.Terminal) + `,`,
+		`Stdin:` + fmt.Sprintf("%v", this.Stdin) + `,`,
+		`Stdout:` + fmt.Sprintf("%v", this.Stdout) + `,`,
+		`Stderr:` + fmt.Sprintf("%v", this.Stderr) + `,`,
+		`Spec:` + strings.Replace(fmt.Sprintf("%v", this.Spec), "Any", "google_protobuf1.Any", 1) + `,`,
+		`}`,
+	}, "")
+	return s
+}
+func (this *ExecResponse) String() string {
+	if this == nil {
+		return "nil"
+	}
+	s := strings.Join([]string{`&ExecResponse{`,
+		`Pid:` + fmt.Sprintf("%v", this.Pid) + `,`,
+		`}`,
+	}, "")
+	return s
+}
 func valueToStringExecution(v interface{}) string {
 	rv := reflect.ValueOf(v)
 	if rv.IsNil() {
@@ -2070,6 +2276,294 @@ func (m *EventsRequest) Unmarshal(dAtA []byte) error {
 	}
 	return nil
 }
+func (m *ExecRequest) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowExecution
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExecRequest: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExecRequest: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field ID", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthExecution
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.ID = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 2:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Terminal", wireType)
+			}
+			var v int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				v |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			m.Terminal = bool(v != 0)
+		case 3:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Stdin", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthExecution
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Stdin = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 4:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Stdout", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthExecution
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Stdout = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 5:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Stderr", wireType)
+			}
+			var stringLen uint64
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				stringLen |= (uint64(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			intStringLen := int(stringLen)
+			if intStringLen < 0 {
+				return ErrInvalidLengthExecution
+			}
+			postIndex := iNdEx + intStringLen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			m.Stderr = string(dAtA[iNdEx:postIndex])
+			iNdEx = postIndex
+		case 6:
+			if wireType != 2 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Spec", wireType)
+			}
+			var msglen int
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				msglen |= (int(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+			if msglen < 0 {
+				return ErrInvalidLengthExecution
+			}
+			postIndex := iNdEx + msglen
+			if postIndex > l {
+				return io.ErrUnexpectedEOF
+			}
+			if m.Spec == nil {
+				m.Spec = &google_protobuf1.Any{}
+			}
+			if err := m.Spec.Unmarshal(dAtA[iNdEx:postIndex]); err != nil {
+				return err
+			}
+			iNdEx = postIndex
+		default:
+			iNdEx = preIndex
+			skippy, err := skipExecution(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthExecution
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
+func (m *ExecResponse) Unmarshal(dAtA []byte) error {
+	l := len(dAtA)
+	iNdEx := 0
+	for iNdEx < l {
+		preIndex := iNdEx
+		var wire uint64
+		for shift := uint(0); ; shift += 7 {
+			if shift >= 64 {
+				return ErrIntOverflowExecution
+			}
+			if iNdEx >= l {
+				return io.ErrUnexpectedEOF
+			}
+			b := dAtA[iNdEx]
+			iNdEx++
+			wire |= (uint64(b) & 0x7F) << shift
+			if b < 0x80 {
+				break
+			}
+		}
+		fieldNum := int32(wire >> 3)
+		wireType := int(wire & 0x7)
+		if wireType == 4 {
+			return fmt.Errorf("proto: ExecResponse: wiretype end group for non-group")
+		}
+		if fieldNum <= 0 {
+			return fmt.Errorf("proto: ExecResponse: illegal tag %d (wire type %d)", fieldNum, wire)
+		}
+		switch fieldNum {
+		case 1:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			m.Pid = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowExecution
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Pid |= (uint32(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
+		default:
+			iNdEx = preIndex
+			skippy, err := skipExecution(dAtA[iNdEx:])
+			if err != nil {
+				return err
+			}
+			if skippy < 0 {
+				return ErrInvalidLengthExecution
+			}
+			if (iNdEx + skippy) > l {
+				return io.ErrUnexpectedEOF
+			}
+			iNdEx += skippy
+		}
+	}
+
+	if iNdEx > l {
+		return io.ErrUnexpectedEOF
+	}
+	return nil
+}
 func skipExecution(dAtA []byte) (n int, err error) {
 	l := len(dAtA)
 	iNdEx := 0
@@ -2180,45 +2674,49 @@ func init() {
 }
 
 var fileDescriptorExecution = []byte{
-	// 629 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x54, 0x4d, 0x6f, 0xd3, 0x40,
-	0x10, 0xad, 0x93, 0xd4, 0x2d, 0x93, 0xa6, 0x54, 0xab, 0x2a, 0x5a, 0x8c, 0xe4, 0x46, 0xa6, 0x2d,
-	0x39, 0xd9, 0x10, 0x6e, 0x08, 0x21, 0xd1, 0x0f, 0xa1, 0xaa, 0x14, 0x84, 0x7b, 0xe0, 0x88, 0xdc,
-	0x64, 0x1b, 0x56, 0x72, 0x76, 0xcd, 0xee, 0xba, 0x6a, 0x6f, 0xf0, 0xcb, 0xb8, 0xf6, 0xc8, 0x91,
-	0x13, 0xa2, 0xf9, 0x25, 0x68, 0xd7, 0x76, 0xea, 0x94, 0x18, 0xc3, 0xc5, 0x9a, 0x19, 0xcf, 0xec,
-	0xcc, 0xbc, 0xf7, 0x76, 0xe1, 0xf5, 0x98, 0xaa, 0x4f, 0xe9, 0x99, 0x3f, 0xe4, 0x93, 0x60, 0xc8,
-	0x99, 0x8a, 0x28, 0x23, 0x62, 0x54, 0x36, 0xa3, 0x84, 0x06, 0x92, 0x88, 0x0b, 0x3a, 0x24, 0x32,
-	0x20, 0x97, 0x64, 0x98, 0x2a, 0xca, 0xd9, 0xad, 0xe5, 0x27, 0x82, 0x2b, 0x8e, 0xba, 0xb7, 0x25,
-	0xfe, 0xc5, 0x53, 0xbf, 0xa8, 0x70, 0x1e, 0x8e, 0x39, 0x1f, 0xc7, 0x24, 0x30, 0x59, 0x67, 0xe9,
-	0x79, 0x40, 0x26, 0x89, 0xba, 0xca, 0x8a, 0x9c, 0x07, 0x77, 0x7f, 0x46, 0xac, 0xf8, 0xb5, 0x39,
-	0xe6, 0x63, 0x6e, 0xcc, 0x40, 0x5b, 0x79, 0xf4, 0xc5, 0x3f, 0x8d, 0xab, 0xae, 0x12, 0x22, 0x83,
-	0x09, 0x4f, 0x99, 0xca, 0xbe, 0x79, 0xf5, 0xc1, 0x7f, 0x54, 0xcf, 0x82, 0xb7, 0x56, 0x76, 0x8a,
-	0xf7, 0xb5, 0x01, 0x9d, 0x7d, 0x41, 0x22, 0x45, 0x42, 0xf2, 0x39, 0x25, 0x52, 0xa1, 0x2e, 0x34,
-	0xe8, 0x08, 0x5b, 0x3d, 0xab, 0x7f, 0x6f, 0xcf, 0x9e, 0xfe, 0xdc, 0x6a, 0x1c, 0x1d, 0x84, 0x0d,
-	0x3a, 0x42, 0x7d, 0x68, 0xc9, 0x84, 0x0c, 0x71, 0xa3, 0x67, 0xf5, 0xdb, 0x83, 0x4d, 0x3f, 0xdb,
-	0xd6, 0x2f, 0xb6, 0xf5, 0x5f, 0xb1, 0xab, 0xd0, 0x64, 0xa0, 0x01, 0xd8, 0x82, 0x73, 0x75, 0x2e,
-	0x71, 0xb3, 0xd7, 0xec, 0xb7, 0x07, 0x8e, 0x3f, 0x0f, 0xa7, 0x99, 0xc9, 0x3f, 0xd1, 0xbb, 0x84,
-	0x79, 0x26, 0xc2, 0xb0, 0x22, 0x52, 0xa6, 0xe8, 0x84, 0xe0, 0x96, 0x6e, 0x1d, 0x16, 0x2e, 0xda,
-	0x84, 0x65, 0xa9, 0x46, 0x94, 0xe1, 0x65, 0x13, 0xcf, 0x1c, 0xd4, 0x05, 0x5b, 0xaa, 0x11, 0x4f,
-	0x15, 0xb6, 0x4d, 0x38, 0xf7, 0xf2, 0x38, 0x11, 0x02, 0xaf, 0xcc, 0xe2, 0x44, 0x08, 0xe4, 0xc0,
-	0xaa, 0x22, 0x62, 0x42, 0x59, 0x14, 0xe3, 0xd5, 0x9e, 0xd5, 0x5f, 0x0d, 0x67, 0xbe, 0xf7, 0x1c,
-	0xd6, 0x0b, 0x08, 0x64, 0xc2, 0x99, 0x24, 0x95, 0x18, 0x6c, 0x40, 0x33, 0xa1, 0x23, 0x03, 0x41,
-	0x27, 0xd4, 0xa6, 0xb7, 0x0b, 0x6b, 0xa7, 0x2a, 0x12, 0xaa, 0x06, 0x3d, 0xef, 0x31, 0x74, 0x0e,
-	0x48, 0x4c, 0x6a, 0x61, 0xf6, 0x8e, 0x60, 0xbd, 0x48, 0xac, 0x19, 0x66, 0x0b, 0xda, 0xe4, 0x92,
-	0xaa, 0x8f, 0x52, 0x45, 0x2a, 0x95, 0xf9, 0x50, 0xa0, 0x43, 0xa7, 0x26, 0xe2, 0xed, 0x40, 0xfb,
-	0x88, 0x9d, 0xf3, 0xba, 0x8e, 0x1d, 0x68, 0xbf, 0xa1, 0xb2, 0xd8, 0xc0, 0x7b, 0x0b, 0x6b, 0x99,
-	0x9b, 0xb7, 0x7f, 0x09, 0x30, 0xa3, 0x4f, 0x62, 0xcb, 0x30, 0xea, 0x2e, 0x64, 0x74, 0xbf, 0x88,
-	0x85, 0xa5, 0x0a, 0xef, 0x1d, 0xb4, 0x8f, 0x69, 0x1c, 0xd7, 0xc9, 0x4b, 0x13, 0x47, 0xc7, 0x9a,
-	0x9e, 0x6c, 0x91, 0xdc, 0xd3, 0x90, 0x47, 0x71, 0x8c, 0x9b, 0x86, 0x33, 0x6d, 0x7a, 0xf7, 0xa1,
-	0x73, 0x78, 0x41, 0x98, 0x92, 0xf9, 0x91, 0x83, 0x6f, 0x2d, 0xd8, 0x98, 0xf5, 0x3e, 0xcd, 0xee,
-	0x2a, 0xfa, 0x00, 0x76, 0x46, 0x2a, 0xda, 0xf1, 0x17, 0xdf, 0x66, 0x7f, 0x4e, 0xf7, 0xce, 0x6e,
-	0x5d, 0x5a, 0x8e, 0xc7, 0x21, 0x2c, 0x1b, 0xc6, 0xd1, 0x76, 0x55, 0x41, 0x59, 0x10, 0x4e, 0xf7,
-	0x8f, 0x8b, 0x72, 0xa8, 0xdf, 0x0c, 0x3d, 0x5f, 0xc6, 0x73, 0xf5, 0x7c, 0x73, 0x82, 0xa9, 0x9e,
-	0xef, 0x8e, 0x5c, 0x8e, 0xa1, 0xa5, 0x59, 0x47, 0x8f, 0xaa, 0xf2, 0x4b, 0x9a, 0x70, 0x6a, 0x88,
-	0x44, 0xef, 0xa1, 0xa5, 0xc5, 0x50, 0x7d, 0x58, 0x49, 0x39, 0xce, 0xf6, 0xdf, 0x93, 0xf2, 0xf9,
-	0xf6, 0xa1, 0xa5, 0xf5, 0x50, 0x7d, 0x64, 0x49, 0x2d, 0x95, 0xe8, 0x9d, 0x80, 0x9d, 0x69, 0xa0,
-	0x1a, 0xbd, 0x39, 0x8d, 0x38, 0x8b, 0xdf, 0x20, 0x93, 0xf3, 0xc4, 0xda, 0xc3, 0xd7, 0x37, 0xee,
-	0xd2, 0x8f, 0x1b, 0x77, 0xe9, 0xcb, 0xd4, 0xb5, 0xae, 0xa7, 0xae, 0xf5, 0x7d, 0xea, 0x5a, 0xbf,
-	0xa6, 0xae, 0x75, 0x66, 0x9b, 0xc6, 0xcf, 0x7e, 0x07, 0x00, 0x00, 0xff, 0xff, 0xd5, 0xe9, 0x01,
-	0xd2, 0x5b, 0x06, 0x00, 0x00,
+	// 691 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x94, 0xcd, 0x6e, 0xd3, 0x4e,
+	0x10, 0xc0, 0xeb, 0x7c, 0xb8, 0xfd, 0x8f, 0x9b, 0xfe, 0xab, 0x55, 0x15, 0x19, 0x23, 0xb9, 0x91,
+	0x69, 0x4b, 0x4e, 0x36, 0x84, 0x1b, 0x42, 0x48, 0xb4, 0x8d, 0x50, 0x55, 0x0a, 0xc2, 0x3d, 0x70,
+	0x44, 0x6e, 0xb2, 0x0d, 0x2b, 0x39, 0x5e, 0xe3, 0x5d, 0x57, 0xcd, 0x0d, 0x5e, 0x81, 0x37, 0xe1,
+	0x2d, 0x7a, 0xe4, 0xc8, 0x09, 0xd1, 0x3c, 0x09, 0xda, 0xb5, 0x9d, 0xd8, 0x25, 0x8b, 0xe1, 0x62,
+	0xcd, 0x8c, 0x67, 0x76, 0xe7, 0xe3, 0x37, 0x0b, 0x2f, 0x27, 0x84, 0x7f, 0x48, 0x2f, 0xdc, 0x11,
+	0x9d, 0x7a, 0x23, 0x1a, 0xf1, 0x80, 0x44, 0x38, 0x19, 0x97, 0xc5, 0x20, 0x26, 0x1e, 0xc3, 0xc9,
+	0x15, 0x19, 0x61, 0xe6, 0xe1, 0x6b, 0x3c, 0x4a, 0x39, 0xa1, 0xd1, 0x52, 0x72, 0xe3, 0x84, 0x72,
+	0x8a, 0xba, 0xcb, 0x10, 0xf7, 0xea, 0xb1, 0x5b, 0x44, 0x58, 0xf7, 0x27, 0x94, 0x4e, 0x42, 0xec,
+	0x49, 0xaf, 0x8b, 0xf4, 0xd2, 0xc3, 0xd3, 0x98, 0xcf, 0xb2, 0x20, 0xeb, 0xde, 0xdd, 0x9f, 0x41,
+	0x54, 0xfc, 0xda, 0x99, 0xd0, 0x09, 0x95, 0xa2, 0x27, 0xa4, 0xdc, 0xfa, 0xec, 0xaf, 0xd2, 0xe5,
+	0xb3, 0x18, 0x33, 0x6f, 0x4a, 0xd3, 0x88, 0x67, 0xdf, 0x3c, 0xfa, 0xf8, 0x1f, 0xa2, 0x17, 0xc6,
+	0xa5, 0x94, 0x9d, 0xe2, 0x7c, 0x6e, 0x40, 0xe7, 0x28, 0xc1, 0x01, 0xc7, 0x3e, 0xfe, 0x98, 0x62,
+	0xc6, 0x51, 0x17, 0x1a, 0x64, 0x6c, 0x6a, 0x3d, 0xad, 0xff, 0xdf, 0xa1, 0x3e, 0xff, 0xb1, 0xdb,
+	0x38, 0x39, 0xf6, 0x1b, 0x64, 0x8c, 0xfa, 0xd0, 0x62, 0x31, 0x1e, 0x99, 0x8d, 0x9e, 0xd6, 0x37,
+	0x06, 0x3b, 0x6e, 0x56, 0xad, 0x5b, 0x54, 0xeb, 0xbe, 0x88, 0x66, 0xbe, 0xf4, 0x40, 0x03, 0xd0,
+	0x13, 0x4a, 0xf9, 0x25, 0x33, 0x9b, 0xbd, 0x66, 0xdf, 0x18, 0x58, 0x6e, 0xb5, 0x9d, 0x32, 0x27,
+	0xf7, 0x4c, 0xd4, 0xe2, 0xe7, 0x9e, 0xc8, 0x84, 0xf5, 0x24, 0x8d, 0x38, 0x99, 0x62, 0xb3, 0x25,
+	0xae, 0xf6, 0x0b, 0x15, 0xed, 0x40, 0x9b, 0xf1, 0x31, 0x89, 0xcc, 0xb6, 0xb4, 0x67, 0x0a, 0xea,
+	0x82, 0xce, 0xf8, 0x98, 0xa6, 0xdc, 0xd4, 0xa5, 0x39, 0xd7, 0x72, 0x3b, 0x4e, 0x12, 0x73, 0x7d,
+	0x61, 0xc7, 0x49, 0x82, 0x2c, 0xd8, 0xe0, 0x38, 0x99, 0x92, 0x28, 0x08, 0xcd, 0x8d, 0x9e, 0xd6,
+	0xdf, 0xf0, 0x17, 0xba, 0xf3, 0x14, 0xb6, 0x8a, 0x16, 0xb0, 0x98, 0x46, 0x0c, 0x2b, 0x7b, 0xb0,
+	0x0d, 0xcd, 0x98, 0x8c, 0x65, 0x0b, 0x3a, 0xbe, 0x10, 0x9d, 0x03, 0xd8, 0x3c, 0xe7, 0x41, 0xc2,
+	0x6b, 0xba, 0xe7, 0x3c, 0x84, 0xce, 0x31, 0x0e, 0x71, 0x6d, 0x9b, 0x9d, 0x13, 0xd8, 0x2a, 0x1c,
+	0x6b, 0x92, 0xd9, 0x05, 0x03, 0x5f, 0x13, 0xfe, 0x9e, 0xf1, 0x80, 0xa7, 0x2c, 0x4f, 0x0a, 0x84,
+	0xe9, 0x5c, 0x5a, 0x9c, 0x7d, 0x30, 0x4e, 0xa2, 0x4b, 0x5a, 0x77, 0x63, 0x07, 0x8c, 0x57, 0x84,
+	0x15, 0x15, 0x38, 0xaf, 0x61, 0x33, 0x53, 0xf3, 0xeb, 0x9f, 0x03, 0x2c, 0xc6, 0xc7, 0x4c, 0x4d,
+	0x4e, 0xd4, 0x5e, 0x39, 0xd1, 0xa3, 0xc2, 0xe6, 0x97, 0x22, 0x9c, 0x37, 0x60, 0x9c, 0x92, 0x30,
+	0xac, 0xc3, 0x4b, 0x0c, 0x8e, 0x4c, 0xc4, 0x78, 0xb2, 0x42, 0x72, 0x4d, 0xb4, 0x3c, 0x08, 0x43,
+	0xb3, 0x29, 0x67, 0x26, 0x44, 0xe7, 0x7f, 0xe8, 0x0c, 0xaf, 0x70, 0xc4, 0x59, 0x91, 0xf1, 0x57,
+	0x0d, 0x8c, 0xe1, 0x35, 0x1e, 0xd5, 0x5d, 0x51, 0x66, 0xa0, 0x51, 0x65, 0x60, 0x49, 0x59, 0x73,
+	0x35, 0x65, 0x2d, 0x05, 0x65, 0xed, 0x0a, 0x65, 0xc5, 0x8e, 0xe8, 0x75, 0x3b, 0xe2, 0xf4, 0x60,
+	0x33, 0x4b, 0x39, 0xef, 0x72, 0x4e, 0x96, 0xb6, 0x20, 0x6b, 0xf0, 0xa5, 0x0d, 0xdb, 0x8b, 0x8e,
+	0x9e, 0x67, 0x2f, 0x10, 0x7a, 0x07, 0x7a, 0x86, 0x2a, 0xda, 0x77, 0x57, 0xbf, 0x51, 0x6e, 0x65,
+	0x9b, 0xad, 0x83, 0x3a, 0xb7, 0xfc, 0xfe, 0x21, 0xb4, 0x25, 0xc7, 0x68, 0x4f, 0x15, 0x50, 0xc6,
+	0xdc, 0xea, 0xfe, 0x56, 0xda, 0x50, 0xbc, 0x84, 0x22, 0xbf, 0x8c, 0x5e, 0x75, 0x7e, 0x95, 0x35,
+	0x50, 0xe7, 0x77, 0x67, 0x09, 0x4e, 0xa1, 0x25, 0x58, 0x46, 0x0f, 0x54, 0xfe, 0x25, 0xd2, 0xad,
+	0x1a, 0x3c, 0xd1, 0x5b, 0x68, 0x09, 0xc4, 0xd5, 0x87, 0x95, 0xf6, 0xc1, 0xda, 0xfb, 0xb3, 0x53,
+	0x9e, 0xdf, 0x11, 0xb4, 0x04, 0xe5, 0xea, 0x23, 0x4b, 0x3b, 0xa0, 0xec, 0xde, 0x19, 0xe8, 0x19,
+	0xd9, 0xea, 0xee, 0x55, 0xc8, 0xb7, 0x56, 0xbf, 0xac, 0xd2, 0xe7, 0x91, 0x26, 0xca, 0x14, 0x8c,
+	0xa9, 0x73, 0x2a, 0x2d, 0x8d, 0xba, 0xcc, 0x32, 0xa6, 0x87, 0xe6, 0xcd, 0xad, 0xbd, 0xf6, 0xfd,
+	0xd6, 0x5e, 0xfb, 0x34, 0xb7, 0xb5, 0x9b, 0xb9, 0xad, 0x7d, 0x9b, 0xdb, 0xda, 0xcf, 0xb9, 0xad,
+	0x5d, 0xe8, 0xb2, 0x96, 0x27, 0xbf, 0x02, 0x00, 0x00, 0xff, 0xff, 0x69, 0x61, 0x1c, 0xa9, 0x84,
+	0x07, 0x00, 0x00,
 }
diff --git a/api/services/execution/execution.proto b/api/services/execution/execution.proto
index 20b0856..060c30e 100644
--- a/api/services/execution/execution.proto
+++ b/api/services/execution/execution.proto
@@ -16,6 +16,7 @@ service ContainerService {
 	rpc List(ListRequest) returns (ListResponse);
 	rpc Kill(KillRequest) returns (google.protobuf.Empty);
 	rpc Events(EventsRequest) returns (stream containerd.v1.types.Event);
+	rpc Exec(ExecRequest) returns (ExecResponse);
 }
 
 message CreateRequest {
@@ -66,3 +67,16 @@ message KillRequest {
 
 message EventsRequest {
 }
+
+message ExecRequest {
+	string id = 1 [(gogoproto.customname) = "ID"];
+	bool terminal = 2;
+	string stdin = 3;
+	string stdout = 4;
+	string stderr = 5;
+	google.protobuf.Any spec = 6;
+}
+
+message ExecResponse {
+	uint32 pid = 1;
+}
diff --git a/api/services/images/images.pb.go b/api/services/images/images.pb.go
index 40680b0..63bfcde 100644
--- a/api/services/images/images.pb.go
+++ b/api/services/images/images.pb.go
@@ -1335,7 +1335,7 @@ func init() {
 
 var fileDescriptorImages = []byte{
 	// 419 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x52, 0x4d, 0x6f, 0xd3, 0x40,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x52, 0x4d, 0x6f, 0xd3, 0x40,
 	0x10, 0xcd, 0x36, 0xa9, 0x25, 0xc6, 0xe4, 0xb2, 0xaa, 0x90, 0x71, 0x91, 0x6b, 0x99, 0x4b, 0xc5,
 	0x61, 0x0d, 0xe6, 0x02, 0x52, 0x29, 0x22, 0x2a, 0x54, 0x48, 0x1c, 0x2a, 0x1f, 0xb9, 0x39, 0xee,
 	0x60, 0x2c, 0xd5, 0x5e, 0xe3, 0x5d, 0x57, 0xca, 0x0d, 0xfe, 0x5d, 0x8e, 0x1c, 0x39, 0x21, 0xe2,
diff --git a/api/services/rootfs/rootfs.pb.go b/api/services/rootfs/rootfs.pb.go
index 1335eee..b012d69 100644
--- a/api/services/rootfs/rootfs.pb.go
+++ b/api/services/rootfs/rootfs.pb.go
@@ -1103,7 +1103,7 @@ func init() {
 
 var fileDescriptorRootfs = []byte{
 	// 428 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xac, 0x52, 0x4d, 0xab, 0xd3, 0x40,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xac, 0x52, 0x4d, 0xab, 0xd3, 0x40,
 	0x14, 0xed, 0xf8, 0x24, 0xad, 0x23, 0x7d, 0x8b, 0xc1, 0x45, 0x08, 0x9a, 0x94, 0xb8, 0x29, 0x82,
 	0x09, 0xd6, 0x85, 0x1b, 0x5d, 0xf8, 0x5e, 0x2c, 0xbe, 0x85, 0x20, 0x11, 0xd1, 0x9d, 0x4c, 0x93,
 	0x31, 0x1d, 0x6c, 0xe7, 0x8e, 0x33, 0xd3, 0x42, 0x77, 0xfe, 0x0e, 0x7f, 0x51, 0x97, 0x2e, 0x45,
diff --git a/api/services/shim/shim.pb.go b/api/services/shim/shim.pb.go
index c1831d5..bb41657 100644
--- a/api/services/shim/shim.pb.go
+++ b/api/services/shim/shim.pb.go
@@ -195,6 +195,7 @@ func (*ExitRequest) Descriptor() ([]byte, []int) { return fileDescriptorShim, []
 type KillRequest struct {
 	Signal uint32 `protobuf:"varint,1,opt,name=signal,proto3" json:"signal,omitempty"`
 	All    bool   `protobuf:"varint,2,opt,name=all,proto3" json:"all,omitempty"`
+	Pid    uint32 `protobuf:"varint,3,opt,name=pid,proto3" json:"pid,omitempty"`
 }
 
 func (m *KillRequest) Reset()                    { *m = KillRequest{} }
@@ -1141,6 +1142,11 @@ func (m *KillRequest) MarshalTo(dAtA []byte) (int, error) {
 		}
 		i++
 	}
+	if m.Pid != 0 {
+		dAtA[i] = 0x18
+		i++
+		i = encodeVarintShim(dAtA, i, uint64(m.Pid))
+	}
 	return i, nil
 }
 
@@ -1376,6 +1382,9 @@ func (m *KillRequest) Size() (n int) {
 	if m.All {
 		n += 2
 	}
+	if m.Pid != 0 {
+		n += 1 + sovShim(uint64(m.Pid))
+	}
 	return n
 }
 
@@ -1563,6 +1572,7 @@ func (this *KillRequest) String() string {
 	s := strings.Join([]string{`&KillRequest{`,
 		`Signal:` + fmt.Sprintf("%v", this.Signal) + `,`,
 		`All:` + fmt.Sprintf("%v", this.All) + `,`,
+		`Pid:` + fmt.Sprintf("%v", this.Pid) + `,`,
 		`}`,
 	}, "")
 	return s
@@ -3105,6 +3115,25 @@ func (m *KillRequest) Unmarshal(dAtA []byte) error {
 				}
 			}
 			m.All = bool(v != 0)
+		case 3:
+			if wireType != 0 {
+				return fmt.Errorf("proto: wrong wireType = %d for field Pid", wireType)
+			}
+			m.Pid = 0
+			for shift := uint(0); ; shift += 7 {
+				if shift >= 64 {
+					return ErrIntOverflowShim
+				}
+				if iNdEx >= l {
+					return io.ErrUnexpectedEOF
+				}
+				b := dAtA[iNdEx]
+				iNdEx++
+				m.Pid |= (uint32(b) & 0x7F) << shift
+				if b < 0x80 {
+					break
+				}
+			}
 		default:
 			iNdEx = preIndex
 			skippy, err := skipShim(dAtA[iNdEx:])
@@ -3236,58 +3265,58 @@ func init() {
 }
 
 var fileDescriptorShim = []byte{
-	// 837 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x94, 0x54, 0xcd, 0x6e, 0xdb, 0x46,
+	// 838 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x94, 0x54, 0xcd, 0x6e, 0xdb, 0x46,
 	0x10, 0x0e, 0x25, 0x9a, 0x96, 0x47, 0xa1, 0x53, 0x2c, 0x0c, 0x83, 0xa1, 0x0b, 0xc5, 0xe5, 0xa5,
-	0x4a, 0x0a, 0x50, 0x8d, 0x72, 0x28, 0x50, 0xb4, 0x87, 0xa6, 0x76, 0xd1, 0x9f, 0x14, 0x10, 0xd6,
-	0xc7, 0x02, 0x0d, 0x68, 0x71, 0x2d, 0x2d, 0x40, 0x72, 0x59, 0xee, 0x52, 0x8d, 0x6e, 0x3d, 0xf7,
-	0x0d, 0x7a, 0xea, 0xbb, 0xf4, 0x94, 0x63, 0x8f, 0x3d, 0x15, 0x8d, 0x9e, 0xa4, 0xd8, 0x1f, 0x8a,
-	0x52, 0x22, 0x8a, 0xca, 0x85, 0x98, 0x99, 0xfd, 0x76, 0x38, 0xf3, 0xcd, 0x7c, 0x0b, 0x5f, 0xce,
-	0xa8, 0x98, 0x97, 0xb7, 0xe1, 0x94, 0xa5, 0xa3, 0x29, 0xcb, 0x44, 0x44, 0x33, 0x52, 0xc4, 0x9b,
-	0x66, 0x94, 0xd3, 0x11, 0x27, 0xc5, 0x82, 0x4e, 0x09, 0x1f, 0xf1, 0x39, 0x4d, 0xd5, 0x27, 0xcc,
-	0x0b, 0x26, 0x18, 0xba, 0xa8, 0x81, 0xe1, 0xe2, 0x69, 0x58, 0xe1, 0x42, 0x09, 0xf1, 0x1f, 0xce,
-	0x18, 0x9b, 0x25, 0x64, 0xa4, 0xa0, 0xb7, 0xe5, 0xdd, 0x28, 0xca, 0x96, 0xfa, 0x9e, 0x7f, 0xf1,
-	0xf6, 0x11, 0x49, 0x73, 0x51, 0x1d, 0x9e, 0xcd, 0xd8, 0x8c, 0x29, 0x73, 0x24, 0x2d, 0x13, 0xfd,
-	0xe2, 0xa0, 0x4a, 0xc5, 0x32, 0x27, 0x7c, 0x94, 0xb2, 0x32, 0x13, 0xfa, 0x6b, 0x6e, 0x5f, 0xbd,
-	0xc7, 0xed, 0x75, 0xb0, 0xb6, 0x74, 0x96, 0xe0, 0xf7, 0x0e, 0xb8, 0x5f, 0x17, 0x24, 0x12, 0x04,
-	0x93, 0x5f, 0x4a, 0xc2, 0x05, 0x3a, 0x87, 0x0e, 0x8d, 0x3d, 0xeb, 0xd2, 0x1a, 0x9e, 0x3c, 0x77,
-	0x56, 0xff, 0x3e, 0xea, 0x7c, 0x77, 0x85, 0x3b, 0x34, 0x46, 0xe7, 0xe0, 0xdc, 0x96, 0x59, 0x9c,
-	0x10, 0xaf, 0x23, 0xcf, 0xb0, 0xf1, 0x90, 0x07, 0xc7, 0x45, 0x99, 0x09, 0x9a, 0x12, 0xaf, 0xab,
-	0x0e, 0x2a, 0x17, 0x3d, 0x84, 0x5e, 0xc6, 0x5e, 0xe6, 0x74, 0xc1, 0x84, 0x67, 0x5f, 0x5a, 0xc3,
-	0x1e, 0x3e, 0xce, 0xd8, 0x44, 0xba, 0xc8, 0x87, 0x9e, 0x20, 0x45, 0x4a, 0xb3, 0x28, 0xf1, 0x8e,
-	0xd4, 0xd1, 0xda, 0x47, 0x67, 0x70, 0xc4, 0x45, 0x4c, 0x33, 0xcf, 0x51, 0xe9, 0xb4, 0x23, 0x7f,
-	0xcf, 0x45, 0xcc, 0x4a, 0xe1, 0x1d, 0xeb, 0xdf, 0x6b, 0xcf, 0xc4, 0x49, 0x51, 0x78, 0xbd, 0x75,
-	0x9c, 0x14, 0x05, 0x1a, 0x83, 0x53, 0x30, 0x26, 0xee, 0xb8, 0x77, 0x72, 0xd9, 0x1d, 0xf6, 0xc7,
-	0x7e, 0xb8, 0x3d, 0x58, 0x45, 0x4c, 0xf8, 0xa3, 0x24, 0x14, 0x1b, 0x64, 0x10, 0xc0, 0x69, 0xc5,
-	0x05, 0xcf, 0x59, 0xc6, 0x09, 0xfa, 0x00, 0xba, 0xb9, 0x61, 0xc3, 0xc5, 0xd2, 0x0c, 0x4e, 0xe1,
-	0xfe, 0x8d, 0x88, 0x0a, 0x61, 0xe8, 0x0a, 0x3e, 0x02, 0xf7, 0x8a, 0x24, 0xa4, 0xe6, 0xef, 0xdd,
-	0x2b, 0x4f, 0xe1, 0xb4, 0x82, 0x98, 0xb4, 0x8f, 0xa0, 0x4f, 0x5e, 0x51, 0xf1, 0x92, 0x8b, 0x48,
-	0x94, 0xdc, 0x60, 0x41, 0x86, 0x6e, 0x54, 0x24, 0xf8, 0xc3, 0x82, 0xfe, 0xf5, 0x2b, 0x32, 0xad,
-	0x92, 0x6e, 0xf2, 0x65, 0x35, 0xf1, 0xd5, 0xd9, 0xcd, 0x57, 0xb7, 0x81, 0x2f, 0x7b, 0x8b, 0xaf,
-	0x21, 0xd8, 0x3c, 0x27, 0x53, 0x35, 0x8d, 0xfe, 0xf8, 0x2c, 0xd4, 0xeb, 0x1c, 0x56, 0xeb, 0x1c,
-	0x7e, 0x95, 0x2d, 0xb1, 0x42, 0x04, 0x57, 0xe0, 0xe0, 0x84, 0xa6, 0x54, 0x20, 0x04, 0xb6, 0xa4,
-	0x51, 0x2f, 0x0b, 0x56, 0xb6, 0x8c, 0xcd, 0xa3, 0x22, 0x56, 0xc5, 0xd8, 0x58, 0xd9, 0x32, 0xc6,
-	0xd9, 0x9d, 0xae, 0xc4, 0xc6, 0xca, 0x0e, 0x2e, 0xe1, 0xbe, 0x6e, 0xb0, 0x91, 0xe9, 0x17, 0x00,
-	0x13, 0xb1, 0x6c, 0xa4, 0x55, 0xf6, 0xfd, 0x2b, 0x8d, 0xc5, 0x5c, 0xfd, 0xca, 0xc5, 0xda, 0x91,
-	0xfd, 0xcd, 0x09, 0x9d, 0xcd, 0xf5, 0xdf, 0x5c, 0x6c, 0xbc, 0xe0, 0x01, 0xb8, 0xd7, 0x0b, 0x92,
-	0x09, 0x5e, 0x0d, 0x4e, 0x0f, 0x72, 0x3d, 0xb7, 0xe0, 0x2f, 0x0b, 0x5c, 0x13, 0x30, 0x25, 0xbd,
-	0xaf, 0x12, 0x4c, 0x89, 0xdd, 0xba, 0xc4, 0x67, 0x92, 0x6c, 0x35, 0x62, 0x49, 0xf6, 0xe9, 0xf8,
-	0x62, 0xe7, 0x12, 0xea, 0x99, 0x63, 0x03, 0x45, 0x9f, 0xc3, 0x49, 0x5e, 0xb0, 0x29, 0xe1, 0x9c,
-	0x70, 0xef, 0x48, 0x2d, 0xef, 0x87, 0x3b, 0xef, 0x4d, 0x34, 0x0a, 0xd7, 0x70, 0xd9, 0xd4, 0x24,
-	0x2a, 0xf9, 0xba, 0xa9, 0x07, 0xe0, 0x62, 0xc2, 0xcb, 0x74, 0x1d, 0x70, 0xe5, 0x5e, 0xd1, 0xf5,
-	0xf6, 0x7e, 0x06, 0xfd, 0x1f, 0x68, 0x92, 0xd4, 0xda, 0x77, 0x38, 0x9d, 0x55, 0x4b, 0xe6, 0x62,
-	0xe3, 0xc9, 0xce, 0xa2, 0x24, 0x51, 0xed, 0xf6, 0xb0, 0x34, 0xc7, 0x7f, 0x1e, 0x83, 0x7d, 0x33,
-	0xa7, 0x29, 0x8a, 0xc0, 0xd1, 0x9a, 0x41, 0x4f, 0xc2, 0x3d, 0x4f, 0x67, 0xb8, 0xf5, 0xc8, 0xf8,
-	0x9f, 0x1c, 0x84, 0x35, 0x73, 0xf8, 0x1e, 0x8e, 0x94, 0xe4, 0xd0, 0xe3, 0xbd, 0xb7, 0x36, 0x65,
-	0xe9, 0x9f, 0xbf, 0xb3, 0xc0, 0xd7, 0xf2, 0x3d, 0x96, 0xe5, 0x6a, 0x2d, 0xb6, 0x94, 0xbb, 0xa5,
-	0xe9, 0x96, 0x72, 0xdf, 0x12, 0xf7, 0x4f, 0x60, 0xcb, 0xcd, 0x46, 0xc3, 0xbd, 0x97, 0x36, 0xd4,
-	0xed, 0x3f, 0x3e, 0x00, 0x69, 0x92, 0x7f, 0x03, 0xdd, 0x89, 0x58, 0xa2, 0x8f, 0xf7, 0xde, 0xa8,
-	0x65, 0xd3, 0xc8, 0x03, 0x06, 0x47, 0xcb, 0xa1, 0x85, 0x87, 0x2d, 0xcd, 0xf8, 0xbb, 0x1f, 0x51,
-	0x85, 0xf9, 0xd4, 0x42, 0x3f, 0xab, 0x39, 0x09, 0xd2, 0x3e, 0xa7, 0x9a, 0xd9, 0x27, 0x87, 0x40,
-	0xeb, 0x3d, 0x50, 0xcb, 0xdd, 0x92, 0x7f, 0x53, 0x00, 0x8d, 0xfd, 0xbf, 0x00, 0x47, 0x0b, 0xa3,
-	0xa5, 0xff, 0x2d, 0xf5, 0x34, 0x66, 0xfb, 0x56, 0x8e, 0x9c, 0x8a, 0xd6, 0x91, 0x53, 0x71, 0x40,
-	0x26, 0x29, 0xc8, 0x96, 0x4c, 0x1b, 0x9a, 0x6d, 0xca, 0xf4, 0xdc, 0x7b, 0xfd, 0x66, 0x70, 0xef,
-	0x9f, 0x37, 0x83, 0x7b, 0xbf, 0xad, 0x06, 0xd6, 0xeb, 0xd5, 0xc0, 0xfa, 0x7b, 0x35, 0xb0, 0xfe,
-	0x5b, 0x0d, 0xac, 0x5b, 0x47, 0x21, 0x9f, 0xfd, 0x1f, 0x00, 0x00, 0xff, 0xff, 0xe1, 0x25, 0x57,
-	0xa4, 0x2a, 0x09, 0x00, 0x00,
+	0x4a, 0x0a, 0x50, 0x8d, 0x72, 0x2b, 0xda, 0x43, 0x53, 0xbb, 0x68, 0xda, 0x14, 0x10, 0xd6, 0xc7,
+	0x02, 0x0d, 0x68, 0x71, 0x2d, 0x2d, 0x40, 0x72, 0x59, 0xee, 0xd2, 0x8d, 0x6e, 0x3d, 0xf7, 0x0d,
+	0x7a, 0xea, 0xbb, 0xf4, 0x94, 0x63, 0x8f, 0x3d, 0x15, 0x8d, 0x9e, 0xa4, 0xd8, 0x1f, 0x8a, 0x52,
+	0x2c, 0x8a, 0xf2, 0x85, 0x98, 0x99, 0xfd, 0x76, 0x38, 0xf3, 0xcd, 0x7c, 0x0b, 0x5f, 0xcd, 0xa8,
+	0x98, 0x97, 0xd7, 0xe1, 0x94, 0xa5, 0xa3, 0x29, 0xcb, 0x44, 0x44, 0x33, 0x52, 0xc4, 0xeb, 0x66,
+	0x94, 0xd3, 0x11, 0x27, 0xc5, 0x2d, 0x9d, 0x12, 0x3e, 0xe2, 0x73, 0x9a, 0xaa, 0x4f, 0x98, 0x17,
+	0x4c, 0x30, 0x74, 0x56, 0x03, 0xc3, 0xdb, 0xe7, 0x61, 0x85, 0x0b, 0x25, 0xc4, 0x7f, 0x3c, 0x63,
+	0x6c, 0x96, 0x90, 0x91, 0x82, 0x5e, 0x97, 0x37, 0xa3, 0x28, 0x5b, 0xe8, 0x7b, 0xfe, 0xd9, 0x87,
+	0x47, 0x24, 0xcd, 0x45, 0x75, 0x78, 0x32, 0x63, 0x33, 0xa6, 0xcc, 0x91, 0xb4, 0x4c, 0xf4, 0xcb,
+	0xbd, 0x2a, 0x15, 0x8b, 0x9c, 0xf0, 0x51, 0xca, 0xca, 0x4c, 0xe8, 0xaf, 0xb9, 0x7d, 0x71, 0x8f,
+	0xdb, 0xab, 0x60, 0x6d, 0xe9, 0x2c, 0xc1, 0xef, 0x1d, 0x70, 0xbf, 0x29, 0x48, 0x24, 0x08, 0x26,
+	0xbf, 0x94, 0x84, 0x0b, 0x74, 0x0a, 0x1d, 0x1a, 0x7b, 0xd6, 0xb9, 0x35, 0x3c, 0x7a, 0xe9, 0x2c,
+	0xff, 0x7d, 0xd2, 0x79, 0x75, 0x81, 0x3b, 0x34, 0x46, 0xa7, 0xe0, 0x5c, 0x97, 0x59, 0x9c, 0x10,
+	0xaf, 0x23, 0xcf, 0xb0, 0xf1, 0x90, 0x07, 0x87, 0x45, 0x99, 0x09, 0x9a, 0x12, 0xaf, 0xab, 0x0e,
+	0x2a, 0x17, 0x3d, 0x86, 0x5e, 0xc6, 0xde, 0xe4, 0xf4, 0x96, 0x09, 0xcf, 0x3e, 0xb7, 0x86, 0x3d,
+	0x7c, 0x98, 0xb1, 0x89, 0x74, 0x91, 0x0f, 0x3d, 0x41, 0x8a, 0x94, 0x66, 0x51, 0xe2, 0x1d, 0xa8,
+	0xa3, 0x95, 0x8f, 0x4e, 0xe0, 0x80, 0x8b, 0x98, 0x66, 0x9e, 0xa3, 0xd2, 0x69, 0x47, 0xfe, 0x9e,
+	0x8b, 0x98, 0x95, 0xc2, 0x3b, 0xd4, 0xbf, 0xd7, 0x9e, 0x89, 0x93, 0xa2, 0xf0, 0x7a, 0xab, 0x38,
+	0x29, 0x0a, 0x34, 0x06, 0xa7, 0x60, 0x4c, 0xdc, 0x70, 0xef, 0xe8, 0xbc, 0x3b, 0xec, 0x8f, 0xfd,
+	0x70, 0x73, 0xb0, 0x8a, 0x98, 0xf0, 0x47, 0x49, 0x28, 0x36, 0xc8, 0x20, 0x80, 0xe3, 0x8a, 0x0b,
+	0x9e, 0xb3, 0x8c, 0x13, 0xf4, 0x11, 0x74, 0x73, 0xc3, 0x86, 0x8b, 0xa5, 0x19, 0x1c, 0xc3, 0xc3,
+	0x2b, 0x11, 0x15, 0xc2, 0xd0, 0x15, 0x7c, 0x02, 0xee, 0x05, 0x49, 0x48, 0xcd, 0xdf, 0xdd, 0x2b,
+	0xcf, 0xe1, 0xb8, 0x82, 0x98, 0xb4, 0x4f, 0xa0, 0x4f, 0xde, 0x52, 0xf1, 0x86, 0x8b, 0x48, 0x94,
+	0xdc, 0x60, 0x41, 0x86, 0xae, 0x54, 0x24, 0xf8, 0xc3, 0x82, 0xfe, 0xe5, 0x5b, 0x32, 0xad, 0x92,
+	0xae, 0xf3, 0x65, 0x35, 0xf1, 0xd5, 0xd9, 0xce, 0x57, 0xb7, 0x81, 0x2f, 0x7b, 0x83, 0xaf, 0x21,
+	0xd8, 0x3c, 0x27, 0x53, 0x35, 0x8d, 0xfe, 0xf8, 0x24, 0xd4, 0xeb, 0x1c, 0x56, 0xeb, 0x1c, 0x7e,
+	0x9d, 0x2d, 0xb0, 0x42, 0x04, 0x17, 0xe0, 0xe0, 0x84, 0xa6, 0x54, 0x20, 0x04, 0xb6, 0xa4, 0x51,
+	0x2f, 0x0b, 0x56, 0xb6, 0x8c, 0xcd, 0xa3, 0x22, 0x56, 0xc5, 0xd8, 0x58, 0xd9, 0x32, 0xc6, 0xd9,
+	0x8d, 0xae, 0xc4, 0xc6, 0xca, 0x0e, 0xce, 0xe1, 0xa1, 0x6e, 0xb0, 0x91, 0xe9, 0xd7, 0x00, 0x13,
+	0xb1, 0x68, 0xa4, 0x55, 0xf6, 0xfd, 0x2b, 0x8d, 0xc5, 0x5c, 0xfd, 0xca, 0xc5, 0xda, 0x91, 0xfd,
+	0xcd, 0x09, 0x9d, 0xcd, 0xf5, 0xdf, 0x5c, 0x6c, 0xbc, 0xe0, 0x11, 0xb8, 0x97, 0xb7, 0x24, 0x13,
+	0xbc, 0x1a, 0x9c, 0x1e, 0xe4, 0x6a, 0x6e, 0xc1, 0x5f, 0x16, 0xb8, 0x26, 0x60, 0x4a, 0xba, 0xaf,
+	0x12, 0x4c, 0x89, 0xdd, 0xba, 0xc4, 0x17, 0x92, 0x6c, 0x35, 0x62, 0x49, 0xf6, 0xf1, 0xf8, 0x6c,
+	0xeb, 0x12, 0xea, 0x99, 0x63, 0x03, 0x45, 0x5f, 0xc0, 0x51, 0x5e, 0xb0, 0x29, 0xe1, 0x9c, 0x70,
+	0xef, 0x40, 0x2d, 0xef, 0xc7, 0x5b, 0xef, 0x4d, 0x34, 0x0a, 0xd7, 0x70, 0xd9, 0xd4, 0x24, 0x2a,
+	0xf9, 0xaa, 0xa9, 0x47, 0xe0, 0x62, 0xc2, 0xcb, 0x74, 0x15, 0x70, 0xe5, 0x5e, 0xd1, 0xd5, 0xf6,
+	0xbe, 0x82, 0xfe, 0x0f, 0x34, 0x49, 0x6a, 0xed, 0x3b, 0x9c, 0xce, 0xaa, 0x25, 0x73, 0xb1, 0xf1,
+	0x64, 0x67, 0x51, 0x92, 0xa8, 0x76, 0x7b, 0x58, 0x9a, 0x77, 0x7b, 0x1d, 0xff, 0x79, 0x08, 0xf6,
+	0xd5, 0x9c, 0xa6, 0x28, 0x02, 0x47, 0xab, 0x08, 0x3d, 0x0b, 0x77, 0x3c, 0xa6, 0xe1, 0xc6, 0xb3,
+	0xe3, 0x7f, 0xb6, 0x17, 0xd6, 0x4c, 0xe6, 0x7b, 0x38, 0x50, 0x22, 0x44, 0x4f, 0x77, 0xde, 0x5a,
+	0x17, 0xaa, 0x7f, 0x7a, 0x67, 0xa5, 0x2f, 0xe5, 0x0b, 0x2d, 0xcb, 0xd5, 0xea, 0x6c, 0x29, 0x77,
+	0x43, 0xe5, 0x2d, 0xe5, 0x7e, 0x20, 0xf7, 0x9f, 0xc0, 0x96, 0xbb, 0x8e, 0x86, 0x3b, 0x2f, 0xad,
+	0xe9, 0xdd, 0x7f, 0xba, 0x07, 0xd2, 0x24, 0xff, 0x16, 0xba, 0x13, 0xb1, 0x40, 0x9f, 0xee, 0xbc,
+	0x51, 0x0b, 0xa9, 0x91, 0x07, 0x0c, 0x8e, 0x16, 0x48, 0x0b, 0x0f, 0x1b, 0x2a, 0xf2, 0xb7, 0x3f,
+	0xab, 0x0a, 0xf3, 0xb9, 0x85, 0x7e, 0x56, 0x73, 0x12, 0xa4, 0x7d, 0x4e, 0x35, 0xb3, 0xcf, 0xf6,
+	0x81, 0xd6, 0x7b, 0xa0, 0xd6, 0xbd, 0x25, 0xff, 0xba, 0x24, 0x1a, 0xfb, 0x7f, 0x0d, 0x8e, 0x96,
+	0x4a, 0x4b, 0xff, 0x1b, 0x7a, 0x6a, 0xcc, 0xf6, 0x9d, 0x1c, 0x39, 0x15, 0xad, 0x23, 0xa7, 0x62,
+	0x8f, 0x4c, 0x52, 0xa2, 0x2d, 0x99, 0xd6, 0x54, 0xdc, 0x94, 0xe9, 0xa5, 0xf7, 0xee, 0xfd, 0xe0,
+	0xc1, 0x3f, 0xef, 0x07, 0x0f, 0x7e, 0x5b, 0x0e, 0xac, 0x77, 0xcb, 0x81, 0xf5, 0xf7, 0x72, 0x60,
+	0xfd, 0xb7, 0x1c, 0x58, 0xd7, 0x8e, 0x42, 0xbe, 0xf8, 0x3f, 0x00, 0x00, 0xff, 0xff, 0x2c, 0xab,
+	0x2d, 0xf0, 0x3c, 0x09, 0x00, 0x00,
 }
diff --git a/api/services/shim/shim.proto b/api/services/shim/shim.proto
index 1dfad65..6013eeb 100644
--- a/api/services/shim/shim.proto
+++ b/api/services/shim/shim.proto
@@ -100,4 +100,5 @@ message ExitRequest {
 message KillRequest {
 	uint32 signal = 1;
 	bool all = 2;
+	uint32 pid = 3;
 }
diff --git a/api/types/container/container.pb.go b/api/types/container/container.pb.go
index 74771fd..977b19d 100644
--- a/api/types/container/container.pb.go
+++ b/api/types/container/container.pb.go
@@ -1316,7 +1316,7 @@ func init() {
 
 var fileDescriptorContainer = []byte{
 	// 516 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x8c, 0x53, 0x41, 0x8b, 0xd3, 0x5c,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0x8c, 0x53, 0x41, 0x8b, 0xd3, 0x5c,
 	0x14, 0xed, 0x4b, 0xd2, 0xb4, 0xbd, 0x65, 0xfa, 0x3d, 0xde, 0x27, 0x12, 0x47, 0xc8, 0x84, 0x22,
 	0x18, 0x04, 0x53, 0xec, 0x6c, 0xdc, 0x76, 0x9a, 0x30, 0x16, 0x31, 0xad, 0xaf, 0x29, 0xce, 0xae,
 	0x64, 0x9a, 0x10, 0x9f, 0xcc, 0x24, 0x25, 0x79, 0xad, 0xce, 0xce, 0x9f, 0x37, 0x4b, 0x97, 0xae,
diff --git a/api/types/descriptor/descriptor.pb.go b/api/types/descriptor/descriptor.pb.go
index 4062abc..e379da3 100644
--- a/api/types/descriptor/descriptor.pb.go
+++ b/api/types/descriptor/descriptor.pb.go
@@ -404,7 +404,7 @@ func init() {
 
 var fileDescriptorDescriptor = []byte{
 	// 229 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0x72, 0x4b, 0xcf, 0x2c, 0xc9,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x72, 0x4b, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xce, 0xcf, 0x2b, 0x49, 0xcc, 0xcc, 0x4b, 0x2d,
 	0x4a, 0x41, 0x66, 0x26, 0x16, 0x64, 0xea, 0x97, 0x54, 0x16, 0xa4, 0x16, 0xeb, 0xa7, 0xa4, 0x16,
 	0x27, 0x17, 0x65, 0x16, 0x94, 0xe4, 0x17, 0x21, 0x31, 0xf5, 0x0a, 0x8a, 0xf2, 0x4b, 0xf2, 0x85,
diff --git a/api/types/mount/mount.pb.go b/api/types/mount/mount.pb.go
index c509ea1..1748f6e 100644
--- a/api/types/mount/mount.pb.go
+++ b/api/types/mount/mount.pb.go
@@ -473,7 +473,7 @@ func init() {
 
 var fileDescriptorMount = []byte{
 	// 197 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xb2, 0x49, 0xcf, 0x2c, 0xc9,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0xb2, 0x49, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xce, 0xcf, 0x2b, 0x49, 0xcc, 0xcc, 0x4b, 0x2d,
 	0x4a, 0x41, 0x66, 0x26, 0x16, 0x64, 0xea, 0x97, 0x54, 0x16, 0xa4, 0x16, 0xeb, 0xe7, 0xe6, 0x97,
 	0xe6, 0x95, 0x40, 0x48, 0xbd, 0x82, 0xa2, 0xfc, 0x92, 0x7c, 0x21, 0x61, 0x84, 0x3a, 0xbd, 0x32,
diff --git a/cmd/ctr/exec.go b/cmd/ctr/exec.go
new file mode 100644
index 0000000..3d64993
--- /dev/null
+++ b/cmd/ctr/exec.go
@@ -0,0 +1,128 @@
+package main
+
+import (
+	gocontext "context"
+	"encoding/json"
+	"os"
+	"path/filepath"
+
+	"github.com/containerd/containerd/api/services/execution"
+	"github.com/crosbymichael/console"
+	protobuf "github.com/gogo/protobuf/types"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/urfave/cli"
+)
+
+var execCommand = cli.Command{
+	Name:  "exec",
+	Usage: "execute additional processes in an existing container",
+	Flags: []cli.Flag{
+		cli.StringFlag{
+			Name:  "id",
+			Usage: "id of the container",
+		},
+		cli.BoolFlag{
+			Name:  "tty,t",
+			Usage: "allocate a TTY for the container",
+		},
+	},
+	Action: func(context *cli.Context) error {
+		var (
+			id  = context.String("id")
+			ctx = gocontext.Background()
+		)
+
+		process := createProcess(context.Args(), "", context.Bool("tty"))
+		data, err := json.Marshal(process)
+		if err != nil {
+			return err
+		}
+		containers, err := getExecutionService(context)
+		if err != nil {
+			return err
+		}
+		events, err := containers.Events(ctx, &execution.EventsRequest{})
+		if err != nil {
+			return err
+		}
+		tmpDir, err := getTempDir(id)
+		if err != nil {
+			return err
+		}
+		defer os.RemoveAll(tmpDir)
+		request := &execution.ExecRequest{
+			ID: id,
+			Spec: &protobuf.Any{
+				TypeUrl: specs.Version,
+				Value:   data,
+			},
+			Terminal: context.Bool("tty"),
+			Stdin:    filepath.Join(tmpDir, "stdin"),
+			Stdout:   filepath.Join(tmpDir, "stdout"),
+			Stderr:   filepath.Join(tmpDir, "stderr"),
+		}
+		if request.Terminal {
+			con := console.Current()
+			defer con.Reset()
+			if err := con.SetRaw(); err != nil {
+				return err
+			}
+		}
+		fwg, err := prepareStdio(request.Stdin, request.Stdout, request.Stderr, request.Terminal)
+		if err != nil {
+			return err
+		}
+		response, err := containers.Exec(ctx, request)
+		if err != nil {
+			return err
+		}
+		// Ensure we read all io only if container started successfully.
+		defer fwg.Wait()
+
+		status, err := waitContainer(events, id, response.Pid)
+		if err != nil {
+			return err
+		}
+		if status != 0 {
+			return cli.NewExitError("", int(status))
+		}
+		return nil
+	},
+}
+
+func createProcess(args []string, cwd string, tty bool) specs.Process {
+	env := []string{
+		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+	}
+	if tty {
+		env = append(env, "TERM=xterm")
+	}
+	if cwd == "" {
+		cwd = "/"
+	}
+	return specs.Process{
+		Args:            args,
+		Env:             env,
+		Terminal:        tty,
+		Cwd:             cwd,
+		NoNewPrivileges: true,
+		User: specs.User{
+			UID: 0,
+			GID: 0,
+		},
+		Capabilities: &specs.LinuxCapabilities{
+			Bounding:    capabilities,
+			Permitted:   capabilities,
+			Inheritable: capabilities,
+			Effective:   capabilities,
+			Ambient:     capabilities,
+		},
+		Rlimits: []specs.LinuxRlimit{
+			{
+				Type: "RLIMIT_NOFILE",
+				Hard: uint64(1024),
+				Soft: uint64(1024),
+			},
+		},
+	}
+}
diff --git a/cmd/ctr/main.go b/cmd/ctr/main.go
index 89c5912..c9197fe 100644
--- a/cmd/ctr/main.go
+++ b/cmd/ctr/main.go
@@ -55,6 +55,7 @@ containerd client
 		killCommand,
 		shimCommand,
 		pprofCommand,
+		execCommand,
 	}
 	app.Before = func(context *cli.Context) error {
 		if context.GlobalBool("debug") {
diff --git a/cmd/ctr/run.go b/cmd/ctr/run.go
index 3c2ea37..0da5d91 100644
--- a/cmd/ctr/run.go
+++ b/cmd/ctr/run.go
@@ -377,7 +377,7 @@ var runCommand = cli.Command{
 		// Ensure we read all io only if container started successfully.
 		defer fwg.Wait()
 
-		status, err := waitContainer(events, response)
+		status, err := waitContainer(events, response.ID, response.Pid)
 		if err != nil {
 			return err
 		}
diff --git a/cmd/ctr/utils.go b/cmd/ctr/utils.go
index 7dc3628..e312c31 100644
--- a/cmd/ctr/utils.go
+++ b/cmd/ctr/utils.go
@@ -155,7 +155,7 @@ func getTempDir(id string) (string, error) {
 	return tmpDir, nil
 }
 
-func waitContainer(events execution.ContainerService_EventsClient, response *execution.CreateResponse) (uint32, error) {
+func waitContainer(events execution.ContainerService_EventsClient, id string, pid uint32) (uint32, error) {
 	for {
 		e, err := events.Recv()
 		if err != nil {
@@ -164,8 +164,7 @@ func waitContainer(events execution.ContainerService_EventsClient, response *exe
 		if e.Type != container.Event_EXIT {
 			continue
 		}
-		if e.ID == response.ID &&
-			e.Pid == response.Pid {
+		if e.ID == id && e.Pid == pid {
 			return e.ExitStatus, nil
 		}
 	}
diff --git a/config.go b/config.go
deleted file mode 100644
index 77af6d4..0000000
--- a/config.go
+++ /dev/null
@@ -1,18 +0,0 @@
-package containerd
-
-type Process struct {
-	Args []string
-	Env  []string
-	Cwd  string
-	Uid  int
-	Gid  int
-	TTY  bool
-}
-
-type Config struct {
-	Process    Process
-	Hostname   string
-	Domain     string
-	Labels     map[string]string
-	StopSignal int
-}
diff --git a/container.go b/container.go
index 5cf9371..9c43065 100644
--- a/container.go
+++ b/container.go
@@ -23,12 +23,25 @@ type LinuxContainer interface {
 
 	Pause(context.Context) error
 	Resume(context.Context) error
+	Exec(context.Context, ExecOpts) (Process, error)
 }
 
-type ContainerStatus int
+type ExecOpts struct {
+	Spec []byte
+	IO   IO
+}
+
+type Process interface {
+	// State returns the process state
+	State(context.Context) (State, error)
+	// Kill signals a container
+	Kill(context.Context, uint32, bool) error
+}
+
+type Status int
 
 const (
-	CreatedStatus ContainerStatus = iota + 1
+	CreatedStatus Status = iota + 1
 	RunningStatus
 	StoppedStatus
 	DeletedStatus
@@ -37,7 +50,7 @@ const (
 
 type State interface {
 	// Status is the current status of the container
-	Status() ContainerStatus
+	Status() Status
 	// Pid is the main process id for the container
 	Pid() uint32
 }
diff --git a/linux/container.go b/linux/container.go
index 021112c..c833aa5 100644
--- a/linux/container.go
+++ b/linux/container.go
@@ -4,19 +4,21 @@ import (
 	"github.com/containerd/containerd"
 	"github.com/containerd/containerd/api/services/shim"
 	"github.com/containerd/containerd/api/types/container"
+	protobuf "github.com/gogo/protobuf/types"
+	specs "github.com/opencontainers/runtime-spec/specs-go"
 	"golang.org/x/net/context"
 )
 
 type State struct {
 	pid    uint32
-	status containerd.ContainerStatus
+	status containerd.Status
 }
 
 func (s State) Pid() uint32 {
 	return s.pid
 }
 
-func (s State) Status() containerd.ContainerStatus {
+func (s State) Status() containerd.Status {
 	return s.status
 }
 
@@ -43,7 +45,7 @@ func (c *Container) State(ctx context.Context) (containerd.State, error) {
 	if err != nil {
 		return nil, err
 	}
-	var status containerd.ContainerStatus
+	var status containerd.Status
 	switch response.Status {
 	case container.Status_CREATED:
 		status = containerd.CreatedStatus
@@ -78,3 +80,47 @@ func (c *Container) Kill(ctx context.Context, signal uint32, all bool) error {
 	})
 	return err
 }
+
+func (c *Container) Exec(ctx context.Context, opts containerd.ExecOpts) (containerd.Process, error) {
+	request := &shim.ExecRequest{
+		Stdin:    opts.IO.Stdin,
+		Stdout:   opts.IO.Stdout,
+		Stderr:   opts.IO.Stderr,
+		Terminal: opts.IO.Terminal,
+		Spec: &protobuf.Any{
+			TypeUrl: specs.Version,
+			Value:   opts.Spec,
+		},
+	}
+	resp, err := c.shim.Exec(ctx, request)
+	if err != nil {
+		return nil, err
+	}
+	return &Process{
+		pid: int(resp.Pid),
+		c:   c,
+	}, nil
+}
+
+type Process struct {
+	pid int
+	c   *Container
+}
+
+func (p *Process) Kill(ctx context.Context, signal uint32, _ bool) error {
+	_, err := p.c.shim.Kill(ctx, &shim.KillRequest{
+		Signal: signal,
+		Pid:    uint32(p.pid),
+	})
+	return err
+}
+
+func (p *Process) State(ctx context.Context) (containerd.State, error) {
+	// use the container status for the status of the process
+	state, err := p.c.State(ctx)
+	if err != nil {
+		return nil, err
+	}
+	state.(*State).pid = uint32(p.pid)
+	return state, nil
+}
diff --git a/linux/shim/exec.go b/linux/shim/exec.go
index 02de62c..e3307a1 100644
--- a/linux/shim/exec.go
+++ b/linux/shim/exec.go
@@ -139,3 +139,7 @@ func (e *execProcess) Resize(ws console.WinSize) error {
 	}
 	return e.console.Resize(ws)
 }
+
+func (e *execProcess) Signal(sig int) error {
+	return syscall.Kill(e.pid, syscall.Signal(sig))
+}
diff --git a/linux/shim/init.go b/linux/shim/init.go
index d103260..ddc6590 100644
--- a/linux/shim/init.go
+++ b/linux/shim/init.go
@@ -169,3 +169,7 @@ func (p *initProcess) killAll(context context.Context) error {
 		All: true,
 	})
 }
+
+func (p *initProcess) Signal(sig int) error {
+	return syscall.Kill(p.pid, syscall.Signal(sig))
+}
diff --git a/linux/shim/process.go b/linux/shim/process.go
index 3f16fb1..2f0f704 100644
--- a/linux/shim/process.go
+++ b/linux/shim/process.go
@@ -15,5 +15,8 @@ type process interface {
 	Exited(status int)
 	// Status returns the exit status
 	Status() int
+	// Delete deletes the process and its resourcess
 	Delete(context.Context) error
+	// Signal directly signals the process
+	Signal(int) error
 }
diff --git a/linux/shim/service.go b/linux/shim/service.go
index 55bc89c..b2f4fb6 100644
--- a/linux/shim/service.go
+++ b/linux/shim/service.go
@@ -1,11 +1,11 @@
 package shim
 
 import (
+	"fmt"
 	"os"
 	"sync"
 	"syscall"
 
-	"github.com/Sirupsen/logrus"
 	shimapi "github.com/containerd/containerd/api/services/shim"
 	"github.com/containerd/containerd/api/types/container"
 	"github.com/containerd/containerd/reaper"
@@ -53,19 +53,7 @@ func (s *Service) Create(ctx context.Context, r *shimapi.CreateRequest) (*shimap
 		ExitCh: make(chan int, 1),
 	}
 	reaper.Default.Register(pid, cmd)
-	go func() {
-		status, err := reaper.Default.WaitPid(pid)
-		if err != nil {
-			logrus.WithError(err).Error("waitpid")
-		}
-		process.Exited(status)
-		s.events <- &container.Event{
-			Type:       container.Event_EXIT,
-			ID:         s.id,
-			Pid:        uint32(pid),
-			ExitStatus: uint32(status),
-		}
-	}()
+	go s.waitExit(process, pid, cmd)
 	s.events <- &container.Event{
 		Type: container.Event_CREATE,
 		ID:   r.ID,
@@ -110,12 +98,20 @@ func (s *Service) Exec(ctx context.Context, r *shimapi.ExecRequest) (*shimapi.Ex
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.execID++
+	reaper.Default.Lock()
 	process, err := newExecProcess(ctx, s.path, r, s.initProcess, s.execID)
 	if err != nil {
+		reaper.Default.Unlock()
 		return nil, err
 	}
 	pid := process.Pid()
 	s.processes[pid] = process
+	cmd := &reaper.Cmd{
+		ExitCh: make(chan int, 1),
+	}
+	reaper.Default.RegisterNL(pid, cmd)
+	reaper.Default.Unlock()
+	go s.waitExit(process, pid, cmd)
 	s.events <- &container.Event{
 		Type: container.Event_EXEC_ADDED,
 		ID:   s.id,
@@ -219,8 +215,29 @@ func (s *Service) Exit(ctx context.Context, r *shimapi.ExitRequest) (*google_pro
 }
 
 func (s *Service) Kill(ctx context.Context, r *shimapi.KillRequest) (*google_protobuf.Empty, error) {
-	if err := s.initProcess.Kill(ctx, r.Signal, r.All); err != nil {
+	if r.Pid == 0 {
+		if err := s.initProcess.Kill(ctx, r.Signal, r.All); err != nil {
+			return nil, err
+		}
+		return empty, nil
+	}
+	proc, ok := s.processes[int(r.Pid)]
+	if !ok {
+		return nil, fmt.Errorf("process does not exist %d", r.Pid)
+	}
+	if err := proc.Signal(int(r.Signal)); err != nil {
 		return nil, err
 	}
 	return empty, nil
 }
+
+func (s *Service) waitExit(p process, pid int, cmd *reaper.Cmd) {
+	status := <-cmd.ExitCh
+	p.Exited(status)
+	s.events <- &container.Event{
+		Type:       container.Event_EXIT,
+		ID:         s.id,
+		Pid:        uint32(pid),
+		ExitStatus: uint32(status),
+	}
+}
diff --git a/reaper/reaper.go b/reaper/reaper.go
index 2338e9f..2a55702 100644
--- a/reaper/reaper.go
+++ b/reaper/reaper.go
@@ -97,6 +97,12 @@ func (m *Monitor) Register(pid int, c *Cmd) {
 	m.Unlock()
 }
 
+// RegisterNL does not grab the lock internally
+// the caller is responsible for locking the monitor
+func (m *Monitor) RegisterNL(pid int, c *Cmd) {
+	m.cmds[pid] = c
+}
+
 func (m *Monitor) WaitPid(pid int) (int, error) {
 	m.Lock()
 	rc, ok := m.cmds[pid]
diff --git a/services/execution/service.go b/services/execution/service.go
index 5666b96..2c37842 100644
--- a/services/execution/service.go
+++ b/services/execution/service.go
@@ -1,6 +1,7 @@
 package execution
 
 import (
+	"fmt"
 	"sync"
 
 	"github.com/containerd/containerd"
@@ -203,6 +204,33 @@ func (s *Service) Events(r *api.EventsRequest, server api.ContainerService_Event
 	return s.collector.forward(w)
 }
 
+func (s *Service) Exec(ctx context.Context, r *api.ExecRequest) (*api.ExecResponse, error) {
+	c, err := s.getContainer(r.ID)
+	if err != nil {
+		return nil, err
+	}
+	l, ok := c.(containerd.LinuxContainer)
+	if !ok {
+		return nil, fmt.Errorf("cannot exec into a non linux container")
+	}
+	process, err := l.Exec(ctx, containerd.ExecOpts{
+		Spec: r.Spec.Value,
+		IO: containerd.IO{
+			Stdin:    r.Stdin,
+			Stdout:   r.Stdout,
+			Stderr:   r.Stderr,
+			Terminal: r.Terminal,
+		},
+	})
+	state, err := process.State(ctx)
+	if err != nil {
+		return nil, err
+	}
+	return &api.ExecResponse{
+		Pid: state.Pid(),
+	}, nil
+}
+
 func (s *Service) getContainer(id string) (containerd.Container, error) {
 	s.mu.Lock()
 	c, ok := s.containers[id]
diff --git a/snapshot/storage/proto/record.pb.go b/snapshot/storage/proto/record.pb.go
index c54ef6f..6b09269 100644
--- a/snapshot/storage/proto/record.pb.go
+++ b/snapshot/storage/proto/record.pb.go
@@ -447,7 +447,7 @@ func init() {
 
 var fileDescriptorRecord = []byte{
 	// 304 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0x72, 0x49, 0xcf, 0x2c, 0xc9,
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0xff, 0xe2, 0x72, 0x49, 0xcf, 0x2c, 0xc9,
 	0x28, 0x4d, 0xd2, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xce, 0xcf, 0x2b, 0x49, 0xcc, 0xcc, 0x4b, 0x2d,
 	0x4a, 0x41, 0x66, 0x16, 0xe7, 0x25, 0x16, 0x14, 0x67, 0xe4, 0x97, 0xe8, 0x17, 0x97, 0xe4, 0x17,
 	0x25, 0xa6, 0xa7, 0xea, 0x17, 0x14, 0xe5, 0x97, 0xe4, 0xeb, 0x17, 0xa5, 0x26, 0xe7, 0x17, 0xa5,