ADR-018 The runtime refuses what it cannot honour

The CRI service (src/cri.rs) is in place before most of what the kubelet can ask of it. A request this runtime would carry out differently from what it says is refused with INVALID_ARGUMENT and the reason, never run in part: image volumes and mount propagation, devices, a terminal or stdin, a privileged container, a pod on the host's network, any runtime handler but the default.

A container started without the volume holding its secrets would look like it works and be wrong; refusing shows exactly where the runtime stands.

The cost: a pod that needs any of these does not start here until the piece is built, and the kubelet reports the reason.

Added on 21 October, after a review found fields that were decoded and then ignored: sysctls, SELinux labels, a supplemental groups policy other than Merge, a user namespace (hostUsers: false, which would otherwise run as root on the host while believing it does not) and joining another container's PID namespace are refused too. AppArmor is the one exception and is still ignored: on hosts with AppArmor the kubelet can ask for the default profile for pods that name none, so refusing it could refuse every pod there. Profiles are being built; until they are applied, pods here run without the confinement containerd gives them on such hosts, and the comparison says so.

Superseded in part by ADR-036 on 26 October: a pod on the host's network or in its IPC or PID namespace, added capabilities and a privileged container are now run, as containerd runs them.