<!-- TODO(cpovirk): Enable NullArgumentForNonNullParameter for
                   prod code. It's disabled automatically for "test code"
                   (which is good: our tests have intentional violations), but
                   Error Prone doesn't know it's building test code unless we
                   pass -XepCompilingTestOnlyCode, and that argument needs to

              <!-- TODO(cpovirk): Enable NullArgumentForNonNullParameter for
                   prod code. It's disabled automatically for "test code"
                   (which is good: our tests have intentional violations), but
                   Error Prone doesn't know it's building test code unless we
                   pass -XepCompilingTestOnlyCode, and that argument needs to

        // Create a completely isolated context to avoid handle reuse issues on Linux Docker
        try {
            // Create a new context with fresh configuration each time
            // This ensures complete isolation between operations
            Properties props = new Properties();
            props.setProperty("jcifs.smb.client.minVersion", "SMB202");
            props.setProperty("jcifs.smb.client.maxVersion", "SMB311");

  5. A program that contains no derivative of any portion of the
Library, but is designed to work with the Library by being compiled or
linked with it, is called a "work that uses the Library".  Such a
work, in isolation, is not a derivative work of the Library, and
therefore falls outside the scope of this License.

  However, linking a "work that uses the Library" with the Library

            closeableContext.close();
            closeableContext.close(); // Second call
            closeableContext.close(); // Third call
        });
    }

    @Test
    @DisplayName("Should maintain key isolation between instances")
    void testKeyIsolationBetweenInstances() {
        // Given
        byte[] key1 = new byte[16];
        byte[] key2 = new byte[16];
        new SecureRandom().nextBytes(key1);

### Promoted Local Ephemeral Storage Capacity Isolation to Stable

extensions/v1beta1 to the new networking.k8s.io/v1 API group. The structure remains unchanged from the v1beta1 API. The net.beta.kubernetes.io/network-policy annotation on Namespaces (used to opt in to isolation) has been removed. Instead, isolation is now determined on a per-pod basis. A NetworkPolicy may target a pod for isolation by including the pod in its spec.podSelector. Targeted Pods accept the traffic specified in the respective NetworkPolicy (and nothing else). Pods not targeted by any NetworkPolicy accept...

    * The pod annotation  `security.alpha.kubernetes.io/unsafe-sysctls` allows customization of namespaced sysctls where isolation is unclear. Unsafe sysctls must be enabled at-your-own-risk on the kubelet with the `--experimental-allowed-unsafe-sysctls` flag. Future versions will improve on resource isolation and more sysctls will be considered safe.

- Replaced *_admission_latencies_milliseconds_summary and *_admission_latencies_milliseconds metrics because they were reporting seconds rather than milliseconds. They were also subject to multiple naming guideline violations (units should be in base units and "duration" is the best practice labelling to measure the time a request takes). Please convert to use *_admission_duration_seconds and *_admission_duration_seconds_summary, as these now report the unit as described,...

physical memory on windows nodes. ([#57124](https://github.com/kubernetes/kubernetes/pull/57124), [@JiangtianLi](https://github.com/JiangtianLi))

* Windows containers now support experimental Hyper-V isolation by setting annotation `experimental.windows.kubernetes.io/isolation-type=hyperv` and feature gates HyperVContainer. At the moment this function only supports one container per pod. ([#58751](https://github.com/kubernetes/kubernetes/pull/58751), [@feiskyer](https://github.com/feiskyer))...