containerd v1.2.3 // indirect in go.mod means we import a non-module package (i.e., a package that does not have go.mod) which imports containerd, which means we have to decide which version to use, and we have decided to use v1.2.3.
go mod why -m shows the path from go.mod to an indirect dependency:
$ go mod why -m github.com/containerd/containerd # github.com/containerd/containerd git.arvados.org/arvados.git/cmd/arvados-package github.com/docker/docker/client github.com/docker/docker/errdefs github.com/containerd/containerd/errdefs
We are using a prerelease version of docker/docker (aka moby/moby), possibly because they have/had a small versioning dumpster fire
$ go mod graph | grep github.com/docker/docker git.arvados.org/arvados.git email@example.com+incompatible
go get github.com/docker/docker would upgrade this to v20.10.12+incompatible