}
	unlock(&span.speciallock)
	releasem(mp)

	return handle
}

// The described object is being heap profiled.
type specialprofile struct {
	_       sys.NotInHeap
	special special
	b       *bucket
}

// Set the heap profile bucket associated with addr to b.
func setprofilebucket(p unsafe.Pointer, b *bucket) {
	lock(&mheap_.speciallock)

				api.DeprecatedAppArmorAnnotationKeyPrefix + "ctr":  api.DeprecatedAppArmorAnnotationValueLocalhostPrefix + testProfile,
			}, pod.Annotations)
		},
	}, {
		description: "Pod field localhost but profile is nil",
		pod: &api.Pod{
			Spec: api.PodSpec{
				SecurityContext: &api.PodSecurityContext{
					AppArmorProfile: &api.AppArmorProfile{
						Type: api.AppArmorProfileTypeLocalhost,
					},
				},

// It provides a certificate verifier, complete with a chain builder.
//
// The package targets the X.509 technical profile defined by the IETF (RFC
// 2459/3280/5280), and as further restricted by the CA/Browser Forum Baseline
// Requirements. There is minimal support for features outside of these
// profiles, as the primary goal of the package is to provide compatibility
// with the publicly trusted TLS certificate ecosystem and its policies and

	if e != nil {
		return nil, e
	}
	return (*Tokenprimarygroup)(i), nil
}

// GetUserProfileDirectory retrieves path to the
// root directory of the access token t user's profile.
func (t Token) GetUserProfileDirectory() (string, error) {
	n := uint32(100)
	for {
		b := make([]uint16, n)
		e := GetUserProfileDirectory(t, &b[0], &n)
		if e == nil {
			return UTF16ToString(b), nil

                        || "error".equalsIgnoreCase(v.getValue3()) || "login".equalsIgnoreCase(v.getValue3())
                        || "profile".equalsIgnoreCase(v.getValue3())) {
                    return false;
                }
                return true;
            }).toArray(n -> new Tuple3[n]));
            propMap.put(VIRTUAL_HOST_HEADERS, hosts);

            <trusting group="net.rubygrapefruit"/>
            <trusting group="org.gradle"/>
            <trusting group="org.gradle.exemplar"/>
            <trusting group="org.gradle.profiler"/>
            <trusting group="^com[.]gradle($|([.].*))" regex="true"/>
            <trusting group="^org[.]gradle($|([.].*))" regex="true"/>
         </trusted-key>

//
// If this frame did a normal call, then frame.pc is a return PC, so this will
// return frame.pc-1, which points into the CALL instruction. If the frame was
// interrupted by a signal (e.g., profiler, segv, etc) then frame.pc is for the
// trapped instruction, so this returns frame.pc. See issue #34123. Finally,
// frame.pc can be at function entry when the frame is initialized without

			continue
		}

		protocol := strings.ToLower(string(svcInfo.Protocol()))
		// Precompute svcNameString; with many services the many calls
		// to ServicePortName.String() show up in CPU profiles.
		svcPortNameString := svcPortName.String()

		// Handle traffic that loops back to the originator with SNAT.
		for _, e := range proxier.endpointsMap[svcPortName] {
			ep, ok := e.(*proxy.BaseEndpointInfo)

	fullSize := span.elemsize
	if rate := MemProfileRate; rate > 0 {
		// Note cache c only valid while m acquired; see #47302
		//
		// N.B. Use the full size because that matches how the GC
		// will update the mem profile on the "free" side.
		if rate != 1 && fullSize < c.nextSample {
			c.nextSample -= fullSize
		} else {
			profilealloc(mp, x, fullSize)
		}
	}
	mp.mallocing = 0
	releasem(mp)

#### Docker runtime Known Issues

- Kernel crash with Aufs storage driver on Debian Jessie ([#27885](https://github.com/kubernetes/kubernetes/issues/27885))
  - Consider running the *new* [kubernetes node problem detector](https://github.com/kubernetes/node-problem-detector) to identify this (and other) kernel issues automatically.

- File descriptors are leaked in docker v1.11 ([#275](https://github.com/docker/containerd/issues/275))