And the **container** itself (in contrast to the **container image**) is the actual running instance of the image, comparable to a **process**. In fact, a container is running only when it has a **process running** (and normally it's only a single process). The container stops when there's no process running in it.

## Container Images

Use [CertificatePinner](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-certificate-pinner/) to restrict which certificates and certificate authorities are trusted. Certificate pinning increases security, but limits your server team’s abilities to update their TLS certificates. **Do not use certificate pinning without the blessing of your server’s TLS administrator!**

=== ":material-language-kotlin: Kotlin"
    ```kotlin
      private val client = OkHttpClient.Builder()

    }
  }

  private static class NoOpService extends AbstractService {
    boolean running = false;

    @Override
    protected void doStart() {
      assertFalse(running);
      running = true;
      notifyStarted();
    }

    @Override
    protected void doStop() {
      assertTrue(running);
      running = false;
      notifyStopped();
    }
  }

  enum WorkerRunningState {
    /** Runnable is not running and not queued for execution */
    IDLE,
    /** Runnable is not running, but is being queued for execution */
    QUEUING,
    /** runnable has been submitted but has not yet begun execution */
    QUEUED,
    RUNNING,
  }

  /** Underlying executor that all submitted Runnable objects are run on. */

    steps:
      - name: Stop old running containers (if any)
        shell: bash
        run: |
          running_containers=$(docker ps -q) && \
          if [[ $running_containers == "" ]]; then
            echo "No running containers";
          else
            echo "Running container(s) found" && \
            docker stop $running_containers;
          fi
          docker container prune -f

        pyver: ['3.10']
    steps:
      - name: Stop old running containers (if any)
        shell: bash
        run: |
          running_containers=$(docker ps -q) && \
          if [[ $running_containers == "" ]]; then
            echo "No running containers";
          else
            echo "Running container(s) found" && \
            docker stop $running_containers;
          fi
          docker container prune -f

        }
      };
  private static final ListenerCallQueue.Event<Listener> RUNNING_EVENT =
      new ListenerCallQueue.Event<Listener>() {
        @Override
        public void call(Listener listener) {
          listener.running();
        }

        @Override
        public String toString() {
          return "running()";
        }
      };

// Package-wide variables from generator "generated".
option go_package = "k8s.io/api/node/v1beta1";

// Overhead structure represents the resource overhead associated with running a pod.
message Overhead {
  // podFixed represents the fixed resource overhead associated with running a pod.
  // +optional
  map<string, k8s.io.apimachinery.pkg.api.resource.Quantity> podFixed = 1;
}

research](https://scholar.google.com/scholar?q=gpu+side+channel) shows that it
might be possible to use side channel attacks on the GPU to leak data from other
running models or processes in the same system. GPUs can also have
implementation bugs that might allow attackers to leave malicious code running
and leak or tamper with applications from other users. Please report
vulnerabilities to the vendor of the affected hardware accelerator.

    }
  }

  private static class NoOpService extends AbstractService {
    boolean running = false;

    @Override
    protected void doStart() {
      assertFalse(running);
      running = true;
      notifyStarted();
    }

    @Override
    protected void doStop() {
      assertTrue(running);
      running = false;
      notifyStopped();
    }
  }