Markus Rudy

I ran into this, too, and stepped through the binary to understand what it's trying to do. The files it's trying to open here are for the PKI - you...

`Slot._sig_value_changed` is emitted in `OpArrayCache._ensureCached()`, which is as far as I can tell only triggered upon requests to output slots `Output` and `OutputHdf5`.

I checked the lazyflow operators again and I might have been wrong regarding state: most operators apparently do not keep an internal state. However, some operators (like lazy `OpFilterLabels`, lazy...

For reference: Operators currently wrapped in lazyflow and ilastik codebase: | Wrapped Operator | Where | File | Need rewrite? | | --- | --- | --- | --- |...

Root cause of this is that nixery.dev produces non-conformant image configs. ``` > crane blob nixery.dev/shell/socat@sha256:06479a95f1b24d0f934b8cdc18d89bdc8c89339774d83de13d126cae966a9be0 | jq '.config' { "cmd": [ "bash" ], "env": [ "SSL_CERT_FILE=/etc/ssl/certs/ca-bundle.crt" ] } ```...

This bug specifically, and other bugs related to optional OCI config values, are fixed on current main.

Looking at the configuration options of oci-distribution, this use case seems expected - we could do ```diff diff --git a/src/tools/genpolicy/src/registry.rs b/src/tools/genpolicy/src/registry.rs index 6009dad6e..2ac31b7e9 100644 --- a/src/tools/genpolicy/src/registry.rs +++ b/src/tools/genpolicy/src/registry.rs @@ -13,7...

I found another source of problems when using `genpolicy` in hermetic environments: the pause container needs to be configurable, too. https://github.com/kata-containers/kata-containers/blob/0174568/src/tools/genpolicy/src/pod.rs#L832-L833

Is there a downside to this? Otherwise, let's just merge it. cc @thomasten

> > This problem would obviously go away if we were to drop support for kubebuilder dev workflows. > > I do see your point regarding overhead for supporting the...