"signal":      "Signal from the last termination of the container",
	"reason":      "(brief) reason from the last termination of the container",
	"message":     "Message regarding the last termination of the container",
	"startedAt":   "Time at which previous execution of the container started",
	"finishedAt":  "Time at which the container last terminated",
	"containerID": "Container's ID in the format '<type>://<container_id>'",
}

// Pod. Ephemeral containers may not be removed or restarted.
message EphemeralContainer {
  // Ephemeral containers have all of the fields of Container, plus additional fields
  // specific to ephemeral containers. Fields in common with Container are in the
  // following inlined struct so than an EphemeralContainer may easily be converted
  // to a Container.

	// - spec.containers[*].securityContext.appArmorProfile
	// - spec.containers[*].securityContext.seLinuxOptions
	// - spec.containers[*].securityContext.seccompProfile
	// - spec.containers[*].securityContext.capabilities
	// - spec.containers[*].securityContext.readOnlyRootFilesystem
	// - spec.containers[*].securityContext.privileged
	// - spec.containers[*].securityContext.allowPrivilegeEscalation

	// containers have completed, all init containers with restartPolicy "Always"
	// will be shut down. This lifecycle differs from normal init containers and
	// is often referred to as a "sidecar" container. Although this init
	// container still starts in the init container sequence, it does not wait
	// for the container to complete before proceeding to the next init

  optional string imageID = 7;

  // ContainerID is the ID of the container in the format '<type>://<container_id>'.
  // Where type is a container runtime identifier, returned from Version call of CRI API
  // (for example "containerd").
  // +optional
  optional string containerID = 8;

  // Started indicates whether the container has finished its postStart lifecycle hook
  // and passed its startup probe.

 - spec.securityContext.supplementalGroupsPolicy - spec.containers[*].securityContext.appArmorProfile - spec.containers[*].securityContext.seLinuxOptions - spec.containers[*].securityContext.seccompProfile - spec.containers[*].securityContext.capabilities - spec.containers[*].securityContext.readOnlyRootFilesystem - spec.containers[*].securityContext.privileged - spec.containers[*].securityContext.allowPrivilegeEscalation - spec.containers[*].securityContext.procMount - spec.containers[*].securityContext.runAsUser...

Object.entries(b?.values??{}))S!=="DEFAULT"&&d.addVariant(y?`${p}${S}`:`${p}-${S}`,({args:E,container:I})=>m(_,w?{modifier:E?.modifier,container:I}:{container:I}),{...b,value:_,id:x,type:oo.MatchVariant,variantInfo:lo.Base});let k="DEFAULT"in(b?.values??{});d.addVariant(p,({args:S,container:_})=>S?.value===Kr&&!k?null:m(S?.value===Kr?b.values.DEFAULT:S?.value??(typeof S=="string"?S:""),w?{modifier:S?.modifier,container:_}:{container:_}),{...b,id:x,type:oo.MatchVariant,variantInfo:lo.Dynamic})}};return d}function...

* Bump GCE ContainerVM
  * to container-vm-v20161208 ([release notes](https://cloud.google.com/compute/docs/containers/container_vms#changelog)) ([#38432](https://github.com/kubernetes/kubernetes/pull/38432), [@timstclair](https://github.com/timstclair))

Two alpha features were also added in this release.

The RuntimeClass alpha feature enables a node to surface multiple runtime options to support a variety of workload types.  Examples include native linux containers, and “sandboxed” containers that isolate the container from the host kernel.

    - [API changes and improvements for ephemeral containers](#api-changes-and-improvements-for-ephemeral-containers)
  - [Known Issues](#known-issues)
    - [CPU and Memory manager are not working correctly for Guaranteed Pods with multiple containers](#cpu-and-memory-manager-are-not-working-correctly-for-guaranteed-pods-with-multiple-containers)