Peter Hunt

thank you for your time and also patience!

can you get the outer podspec for me? since it's build I'm like 70% sure it's the capability difference

can you add ``` [crio.runtime] default_capabilities = [ "CHOWN", "DAC_OVERRIDE", "FSETID", "FOWNER", "SETGID", "SETUID", "SETPCAP", "SYS_CHROOT", "NET_BIND_SERVICE", "KILL", ] ``` to /etc/crio/crio.conf.d/99-chroot.conf restart crio and retry?

a less heavy hammer would be editing the helm chart to give the SYS_CHROOT capability to just the container that needs it. I think that'd be a better solution

cc @Mo-Fatah @sohankunkerkar

@hernandanielg are you still working on this? if not, @shipra101 could take it over

yeah the idea was to move more of the NRI pieces internally. the objects NRI uses to pass between processes could be used internally with plugins that are loaded at...

I see something like https://github.com/knqyf263/go-plugin being a good basis

@saschagrunert did you still want this?

carrying https://github.com/cri-o/cri-o/pull/7058 for simplicity