Since models are practically programs that TensorFlow executes, using untrusted
models or graphs is equivalent to running untrusted code.

If you need to run untrusted models, execute them inside a
[**sandbox**](https://developers.google.com/code-sandboxing). Memory corruptions
in TensorFlow ops can be recognized as security issues only if they are
reachable and exploitable through production-grade, benign models.

### Compilation

- Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded ([#92614](https://github.com/kubernetes/kubernetes/pull/92614), [@tnqn](https://github.com/tnqn)) [SIG Node and Testing]

- Fixed kubelet creating extra sandbox for pods with RestartPolicyOnFailure after all containers succeeded ([#92614](https://github.com/kubernetes/kubernetes/pull/92614), [@tnqn](https://github.com/tnqn)) [SIG Node and Testing]

* Fix a bug where kubelet would not retry pod sandbox creation when the restart policy of the pod is Never ([#79451](https://github.com/kubernetes/kubernetes/pull/79451), [@yujuhong](https://github.com/yujuhong))

- Updated pause image to version 3.5, which now runs per default as pseudo user and group `65535:65535`. This does not have any effect on remote container runtimes like CRI-O and containerd, which setup the pod sandbox user and group on their own. ([#100292](https://github.com/kubernetes/kubernetes/pull/100292), [@saschagrunert](https://github.com/saschagrunert))

* Support copying "options" in resolv.conf into pod sandbox when dnsPolicy is Default ([#54773](https://github.com/kubernetes/kubernetes/pull/54773), [@phsiao](https://github.com/phsiao))

    with your own mocks or fakes.

    The interface will also let you use OkHttp's API with another HTTP client's
    implementation. This is useful in sandboxed environments like Google App
    Engine.

 *  **OkHttp now does cookies.** We've replaced `java.net.CookieHandler` with
    a new interface, `CookieJar` and added our own `Cookie` model class. This

EAAkB,EAAI,EAG1BE,EAAexM,GAAe,SAAU9H,GACvC,OAAOA,IAASmU,GACdE,GAAkB,GACrBE,EAAkBzM,GAAe,SAAU9H,GAC1C,OAAwC,EAAjCxD,EAAS2X,EAAcnU,IAC5BqU,GAAkB,GACrBnB,EAAW,CAAE,SAAUlT,EAAMnB,EAAS+Q,GACrC,IAAIlQ,GAAS0U,IAAqBxE,GAAO/Q,IAAY+E,MAClDuQ,EAAetV,GAAU3B,SAC1BoX,EAActU,EAAMnB,EAAS+Q,GAC7B2E,EAAiBvU,EAAMnB,EAAS+Q,IAIlC,OADAuE,EAAe,KACRzU,IAGD5B,EAAI2C,EAAK3C,IAChB,GAAO6S,EAAUrN,EAAKmL,SAAUgE,EAAQ3U,GAAIR,MAC3C4V,EAAW,CAAEpL,GAAemL,GAAgBC,GAAYvC,QAClD,CAIN,IAHAA,EAAUrN,EAAK8I,OAAQqG,EAAQ3U,GAAIR,MAAOhB,MAA...

- `kubeadm`: now shows a warning message when detecting that the sandbox image of the container runtime is inconsistent with that used by kubeadm ([#115610](https://github.com/kubernetes/kubernetes/pull/115610), [@SataQiu](https://github.com/SataQiu))

    and
    [`tf.keras.layers.CuDNNLSTM`](https://www.tensorflow.org/versions/r1.9/api_docs/python/tf/keras/layers/CuDNNLSTM)
    layers.
    [Try it](https://colab.sandbox.google.com/github/tensorflow/tensorflow/blob/master/tensorflow/contrib/eager/python/examples/nmt_with_attention/nmt_with_attention.ipynb?linkId=53292082).
*   Adding support of core