diff --git a/third_party/go/patches/containerd-netns-statedir.patch b/third_party/go/patches/containerd-netns-statedir.patch
new file mode 100644
index 0000000..a693eb7
--- /dev/null
+++ b/third_party/go/patches/containerd-netns-statedir.patch
@@ -0,0 +1,96 @@
+Copyright 2020 The Monogon Project Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
+From 3e7a8cebf9d40487adc7d4a22b5c628add5e7eac Mon Sep 17 00:00:00 2001
+From: Lorenz Brun <lorenz@nexantic.com>
+Date: Wed, 27 Jan 2021 13:05:30 +0100
+Subject: [PATCH] Move netns directory into StateDir
+
+---
+ pkg/netns/netns_unix.go   | 12 +++++-------
+ pkg/server/sandbox_run.go |  3 ++-
+ 2 files changed, 7 insertions(+), 8 deletions(-)
+
+diff --git a/pkg/netns/netns_unix.go b/pkg/netns/netns_unix.go
+index 7449e235..b31716cb 100644
+--- a/pkg/netns/netns_unix.go
++++ b/pkg/netns/netns_unix.go
+@@ -48,14 +48,12 @@ import (
+ 	osinterface "github.com/containerd/cri/pkg/os"
+ )
+ 
+-const nsRunDir = "/var/run/netns"
+-
+ // Some of the following functions are migrated from
+ // https://github.com/containernetworking/plugins/blob/master/pkg/testutils/netns_linux.go
+ 
+ // newNS creates a new persistent (bind-mounted) network namespace and returns the
+ // path to the network namespace.
+-func newNS() (nsPath string, err error) {
++func newNS(baseDir string) (nsPath string, err error) {
+ 	b := make([]byte, 16)
+ 	if _, err := rand.Reader.Read(b); err != nil {
+ 		return "", errors.Wrap(err, "failed to generate random netns name")
+@@ -64,13 +62,13 @@ func newNS() (nsPath string, err error) {
+ 	// Create the directory for mounting network namespaces
+ 	// This needs to be a shared mountpoint in case it is mounted in to
+ 	// other namespaces (containers)
+-	if err := os.MkdirAll(nsRunDir, 0755); err != nil {
++	if err := os.MkdirAll(baseDir, 0755); err != nil {
+ 		return "", err
+ 	}
+ 
+ 	// create an empty file at the mount point
+ 	nsName := fmt.Sprintf("cni-%x-%x-%x-%x-%x", b[0:4], b[4:6], b[6:8], b[8:10], b[10:])
+-	nsPath = path.Join(nsRunDir, nsName)
++	nsPath = path.Join(baseDir, nsName)
+ 	mountPointFd, err := os.Create(nsPath)
+ 	if err != nil {
+ 		return "", err
+@@ -164,8 +162,8 @@ type NetNS struct {
+ }
+ 
+ // NewNetNS creates a network namespace.
+-func NewNetNS() (*NetNS, error) {
+-	path, err := newNS()
++func NewNetNS(baseDir string) (*NetNS, error) {
++	path, err := newNS(baseDir)
+ 	if err != nil {
+ 		return nil, errors.Wrap(err, "failed to setup netns")
+ 	}
+diff --git a/pkg/server/sandbox_run.go b/pkg/server/sandbox_run.go
+index dd4c51e3..32a2d6e8 100644
+--- a/pkg/server/sandbox_run.go
++++ b/pkg/server/sandbox_run.go
+@@ -19,6 +19,7 @@ package server
+ import (
+ 	"encoding/json"
+ 	"math"
++	"path/filepath"
+ 	goruntime "runtime"
+ 	"strings"
+ 
+@@ -117,7 +118,7 @@ func (c *criService) RunPodSandbox(ctx context.Context, r *runtime.RunPodSandbox
+ 		// handle. NetNSPath in sandbox metadata and NetNS is non empty only for non host network
+ 		// namespaces. If the pod is in host network namespace then both are empty and should not
+ 		// be used.
+-		sandbox.NetNS, err = netns.NewNetNS()
++		sandbox.NetNS, err = netns.NewNetNS(filepath.Join(c.config.StateDir, "netns"))
+ 		if err != nil {
+ 			return nil, errors.Wrapf(err, "failed to create network namespace for sandbox %q", id)
+ 		}
+-- 
+2.25.1
+