Giuseppe Scrivano

does it work if you force `ENOSYS` for `statx` ( or allow it) in your seccomp profile?

is it something worth adding to the runtime specs?

I agree it is useful. crun implements it with an annotation. I have already opened a similar issue: https://github.com/opencontainers/runtime-spec/issues/1020

I agree to clarify it in the runtime-specs

I think the way to move forward is to add support for zstd to the different clients but still keep the gzip compression as the default. Generating these images should...

yes, I think it should be case 2, an image made of two different layers. It would be very confusing to support case 1 this way.

> But let's ask @giuseppe -- why you ended up with 30s timeout? I've copied the timeout you set here: https://github.com/opencontainers/runc/blob/master/libcontainer/cgroups/systemd/common.go#L345 :smile: Although I've decided to ignore any error, so...

alternative idea: what do you think about supporting the capability value in addition to its name? e.g. ```json "capabilities": { "bounding": [ "CAP_CHOWN", "1", "CAP_DAC_READ", ... ``` the higher level...

maybe we could at least agree on a few exit codes so that container engines don't have to parse the error string.

> And yeah, #1040 should definitely wait -- I don't want to rush adding more logic to cgroup configuration until we're sure it makes sense. I'd prefer if it has...