Pid Limiting is Graduating to Beta ([#757](https://github.com/kubernetes/enhancements/issues/757))

- Prevents a pod from starving pid resource
- Ability to isolate pid resources pod-to-pod and node-to-pod
kubernetes/kubernetes: [#73651](https://github.com/kubernetes/kubernetes/pull/73651)

  * Fix incorrect CPU usage with 4.7 kernel
  * OOM parser uses kmsg
  * Add hugepages support
  * Add CRI-O support

* Sharing a PID namespace between containers in a pod is disabled by default in version 1.8. To enable for a node, use the `--docker-disable-shared-pid=false` kubelet flag. Be aware that PID namespace sharing requires Docker version greater than or equal to 1.13.1.

* Fix issues related to the eviction manager.

- The --docker-disable-shared-pid kubelet flag has been removed. PID namespace sharing can instead be enable per-pod using the ShareProcessNamespace option. ([#66506](https://github.com/kubernetes/kubernetes/pull/66506), [@verb](https://github.com/verb))

  optional EphemeralContainerCommon ephemeralContainerCommon = 1;

  // If set, the name of the container from PodSpec that this ephemeral container targets.
  // The ephemeral container will be run in the namespaces (IPC, PID, etc) of this container.
  // If not set then the ephemeral container uses the namespaces configured in the Pod spec.
  //
  // The container runtime must implement support for this feature. If the runtime does not

### PID Limits graduates to General Availability

PID Limits features are now generally available on both `SupportNodePidsLimit` (node-to-pod PID isolation) and `SupportPodPidsLimit` (ability to limit PIDs per pod), after being enabled-by-default in beta stage for a year.

* Some container runtimes share a process (PID) namespace for all containers in a pod. This will become the default for Docker in a future release of Kubernetes. You can preview this functionality if running with the CRI and Docker 1.13.1 by enabling the --experimental-docker-enable-shared-pid kubelet flag. ([#41583](https://github.com/kubernetes/kubernetes/pull/41583), [@verb](https://github.com/verb))

When using the separate flag, the order in which they're specified doesn't matter.  ([#58123](https://github.com/kubernetes/kubernetes/pull/58123), [@hzxuzhonghu](https://github.com/hzxuzhonghu))

* The kubelet  --docker-disable-shared-pid flag, which runs docker containers with a process namespace that is shared between all containers in a pod, is now deprecated and will be removed in a future release. It is replaced by `v1.Pod.Spec.ShareProcessNamespace`, which configures this behavior....

* Sharing a PID namespace between containers in a pod is disabled by default in 1.8. To enable for a node, use the --docker-disable-shared-pid=false kubelet flag. Note that PID namespace sharing requires docker >= 1.13.1. ([#51634](https://github.com/kubernetes/kubernetes/pull/51634), [@verb](https://github.com/verb))

pkg syscall (netbsd-arm64-cgo), type Flock_t struct
pkg syscall (netbsd-arm64-cgo), type Flock_t struct, Len int64
pkg syscall (netbsd-arm64-cgo), type Flock_t struct, Pid int32
pkg syscall (netbsd-arm64-cgo), type Flock_t struct, Start int64
pkg syscall (netbsd-arm64-cgo), type Flock_t struct, Type int16
pkg syscall (netbsd-arm64-cgo), type Flock_t struct, Whence int16

pkg syscall (darwin-arm64), type FdSet struct, Bits [32]int32
pkg syscall (darwin-arm64), type Flock_t struct
pkg syscall (darwin-arm64), type Flock_t struct, Len int64
pkg syscall (darwin-arm64), type Flock_t struct, Pid int32
pkg syscall (darwin-arm64), type Flock_t struct, Start int64
pkg syscall (darwin-arm64), type Flock_t struct, Type int16
pkg syscall (darwin-arm64), type Flock_t struct, Whence int16