Rodrigo Campos

@henry118 cool, thanks! Just to understand, would you like this PR for 2.0? Or also the follow-up PR? I think maintainers need to review now, that is the next step...

This indeed fixes the issue with the nginx image too. Do the rejects still apply to the last version? It seems @kolyshkin might not, and it is not changing permissions...

I was aware of the containerd PR, but thanks anyways :) Sure, feel free to ping me for review when you open the PRs

This still LGTM. Let me know if it's ready, IMHO this is ready to merge.

@kolyshkin I see you marked this as ready, but as you didn't re-request a review, it doesn't notify anyone. Is this ready for review? I see the first 3 commits...

@lifubang Thanks, but can you elaborate on what is the error exactly? The link to a test case, what does that mean? Should that test fail? Or is it working...

@lifubang I fully agree, let's make this PR be 1 or 1 and 2. And PR 3 can be done later, maybe even after the 1.2.0 release (I'm not sure...

I think the output of "runc features" should be provided to the plugin, as that is the only reliable way to know how to act. It's not only relevant for...

This is borderline for me. Is it a regression? I mean, I feel like we should be allowed to change which syscalls we do after the seccomp policies are applied...

@AkihiroSuda if you notify on the exec syscall, then you can see if exec was done or not and accept all before processing an exec, after the exec do whatever...