// We want the pause container, as the istio-validation one may exit before we are done.
	// We do this by detecting the longest running process. We could look at `cmdline`, but is likely more reliable to weird platforms.
	for _, p := range procs {
		match := false
		ns := getPidNamespace(p.PID)

		err := netns.WithNetNSPath(ns, func(_ netns.NetNS) error {
			var err error

        // We can filter out "unsupported" classes without checking the manifest beforehand.
        // Even if this JAR isn't multi-release per manifest, classes in META-INF/ cannot be loaded, so they are just weird resources.
        // The agent-based instrumentation doesn't load resources from the instrumented JAR, but from the original.

   *   mutation, which is not an actual risk because we use `synchronized`.
   * - Make `remaining` require a non-null `seq` argument. But this is a bit weird because the
   *   method, while it would avoid the instance field `seq` would still access the instance field
   *   `pos`.
   */

  @Override
  public synchronized int read(CharBuffer target) throws IOException {

   *   mutation, which is not an actual risk because we use `synchronized`.
   * - Make `remaining` require a non-null `seq` argument. But this is a bit weird because the
   *   method, while it would avoid the instance field `seq` would still access the instance field
   *   `pos`.
   */

  @Override
  public synchronized int read(CharBuffer target) throws IOException {

	// length in octets of the RSA modulus n." 🙄
	//
	// This is extremely annoying, as all other encrypt and decrypt inputs are
	// always the exact same size as the modulus. Since it only happens for
	// weird modulus sizes, fix it by padding inefficiently.
	if emLen, k := len(em), priv.Size(); emLen < k {
		emNew := make([]byte, k)
		copy(emNew[k-emLen:], em)
		em = emNew
	}

	return decrypt(priv, em, withCheck)

	}(&x)
}

func ClosureCallArgs5() {
	x := 0 // ERROR "moved to heap: x"
	// TODO(mdempsky): We get "leaking param: p" here because the new escape analysis pass
	// can tell that p flows directly to sink, but it's a little weird. Re-evaluate.
	sink = func(p *int) *int { // ERROR "leaking param: p" "func literal does not escape"
		return p
	}(&x)
}

func ClosureCallArgs6() {
	x := 0         // ERROR "moved to heap: x"

        throw new UnsupportedOperationException();
      }

      // Mostly safe: We check contains(u) before calling successors(u), so we perform unsafe
      // operations only in weird cases like checking for an EndpointPair<ArrayList> in a
      // Graph<LinkedList>.
      @SuppressWarnings("unchecked")
      @Override
      public boolean contains(@CheckForNull Object obj) {

      if (useBarriers) {
        firstBarrier.await();
        secondBarrier.await();
      }
    }

    @Override
    protected ScheduledExecutorService executor() {
      // use a bunch of threads so that weird overlapping schedules are more likely to happen.
      return Executors.newScheduledThreadPool(10);
    }

    @Override
    protected Scheduler scheduler() {
      return new CustomScheduler() {

      if (useBarriers) {
        firstBarrier.await();
        secondBarrier.await();
      }
    }

    @Override
    protected ScheduledExecutorService executor() {
      // use a bunch of threads so that weird overlapping schedules are more likely to happen.
      return Executors.newScheduledThreadPool(10);
    }

    @Override
    protected Scheduler scheduler() {
      return new CustomScheduler() {

func (s *ServerRunOptions) Flags() (fss cliflag.NamedFlagSets) {
	s.Options.AddFlags(&fss)
	s.CloudProvider.AddFlags(fss.FlagSet("cloud provider"))

	// Note: the weird ""+ in below lines seems to be the only way to get gofmt to
	// arrange these text blocks sensibly. Grrr.
	fs := fss.FlagSet("misc")

	fs.BoolVar(&s.AllowPrivileged, "allow-privileged", s.AllowPrivileged,