- Dockershim security: pod sandbox now always run with `no-new-privileges` and `runtime/default` seccomp profile
  dockershim seccomp: custom profiles can now have smaller seccomp profiles when set at pod level ([#90948](https://github.com/kubernetes/kubernetes/pull/90948), [@pjbgf](https://github.com/pjbgf)) [SIG Node]

		{"Do", Func, 9},
		{"ForLabels", Func, 9},
		{"Label", Func, 9},
		{"LabelSet", Type, 9},
		{"Labels", Func, 9},
		{"Lookup", Func, 0},
		{"NewProfile", Func, 0},
		{"Profile", Type, 0},
		{"Profiles", Func, 0},
		{"SetGoroutineLabels", Func, 9},
		{"StartCPUProfile", Func, 0},
		{"StopCPUProfile", Func, 0},
		{"WithLabels", Func, 9},
		{"WriteHeapProfile", Func, 0},
	},
	"runtime/trace": {

					RestartPolicy: core.RestartPolicyAlways,
					DNSPolicy:     core.DNSDefault,
				},
			},
		},
		"mismatched AppArmor localhost profiles": {
			expectedError: "Forbidden: apparmor profile in annotation and field must match",
			spec: core.Pod{
				ObjectMeta: metav1.ObjectMeta{
					Name:      "123",
					Namespace: "ns",