code: func AtomicImageUpdate(ctx context.Context, container containerd.Container, image containerd.Image, healthcheckFn func() error) error {
  	updateCompleted := false
  	err := pauseAndRun(ctx, container, func() error {
  		if err := container.Update(ctx, WithUpgrade(image)); err != nil {
  			return errors.Wrap(err, "failed to update to new image")
  		}
  		updateCompleted = true
  		task, err := container.Task(ctx, nil)
  		if err != nil {
  			if errdefs.IsNotFound(err) {
  				return nil
  			}
  			return errors.Wrap(err, "failed to lookup task")
  		}
  		return task.Kill(ctx, sigTERM)
  	})
  	if err != nil {
  		if updateCompleted {
  			logrus.WithError(err).Error("failed to update, rolling back")
  			return rollBack(ctx, container)
  		}
  		return err
  	}
  	if err := healthcheckFn(); err != nil {
  		logrus.WithError(err).Error("failed health check, rolling back")
  		return rollBack(ctx, container)
  	}
  	return nil
  }
docs: // AtomicImageUpdate will perform an update of the given container with the new image
  // and verify success via the provided healthcheckFn.  If the healthcheck fails, the
  // container will be reverted to the prior image