runtime.ExitSyscall()
	if int64(r0) == -1 {
		err = errnoErr2(e1, e2)
	}
	return
}

//go:nosplit
func get_SetnsAddr() *(func(fd int, nstype int) (err error))

var Setns = enter_Setns

func enter_Setns(fd int, nstype int) (err error) {
	funcref := get_SetnsAddr()
	if funcptrtest(GetZosLibVec()+SYS_SETNS<<4, "") == 0 {
		*funcref = impl_Setns
	} else {

	path string
}

func (ns *mockNetNs) Do(toRun func(ns.NetNS) error) error {
	return toRun(ns)
}

func (*mockNetNs) Set() error {
	return nil
}

func (ns *mockNetNs) Path() string {
	return ns.path
}

func (*mockNetNs) Fd() uintptr {
	return 0
}

func (*mockNetNs) Close() error {
	return nil
}

type netNsFunc func(nspath string) (ns.NetNS, error)

//sys	Setegid(egid int) (err error) = SYS_SETEGID
//sys	Seteuid(euid int) (err error) = SYS_SETEUID
//sys	Sethostname(p []byte) (err error) = SYS___SETHOSTNAME_A
//sys   Setns(fd int, nstype int) (err error) = SYS_SETNS
//sys	Setpriority(which int, who int, prio int) (err error)
//sysnb	Setpgid(pid int, pgid int) (err error) = SYS_SETPGID
//sysnb	Setrlimit(resource int, lim *Rlimit) (err error)

	if existing := p.currentPodCache[uid]; existing.Netns != nil {
		if existing.Netns.Inode() == workload.Netns.Inode() {
			workload.Netns.Close()
			// Replace the workload, but keep the old Netns
			p.currentPodCache[uid] = WorkloadInfo{
				Workload: workload.Workload,
				Netns:    existing.Netns,
			}
			// already in cache
			return existing.Netns
		}
		log.Debug("netns inode mismatch, using the new one")
	}

	// in that case, try finding the netns using procfs.
	filter := map[types.UID]*corev1.Pod{
		pod.UID: pod,
	}
	return s.scanProcForPodsAndCache(filter)
}

func (s *NetServer) getOrOpenNetns(pod *corev1.Pod, netNs string) (Netns, error) {
	if netNs == "" {
		return s.getNetns(pod)
	}
	return s.openNetns(pod, netNs)
}

func (s *NetServer) openNetns(pod *corev1.Pod, netNs string) (Netns, error) {

		return nil, nil
	}

	netns, err := proc.Open(netnsName)
	if err != nil {
		return nil, err
	}
	fd, err := GetFd(netns)
	if err != nil {
		netns.Close()
		return nil, err
	}
	netnsObserved[inode] = struct{}{}
	log.Debugf("found pod to netns: %s %d", uid, inode)

	return &PodNetnsEntry{
		uid:     uid,
		netns:   netns,
		netnsfd: fd,
		inode:   inode,
	}, nil
}

	valid := CNIPluginAddEvent{
		Netns:        "/var/netns/foo",
		PodName:      "pod-bingo",
		PodNamespace: "funkyns",
	}

	payload, _ := json.Marshal(valid)

	addEvent, err := processAddEvent(payload)

	assert.NoError(t, err)
	assert.Equal(t, valid, addEvent)
}

func TestProcessAddEventBadPayload(t *testing.T) {
	valid := CNIPluginAddEvent{
		Netns:        "/var/netns/foo",
		PodName:      "pod-bingo",

	nspath1 := "/path/to/netns/1"
	nspath2 := "/path/to/netns/2"

	netns1, err := p.UpsertPodCache(pod, nspath1)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	netns2, err := p.UpsertPodCache(pod, nspath2)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	if !reflect.DeepEqual(netns1, netns2) {
		t.Fatalf("Expected the same Netns for the same uid, got %v and %v", netns1, netns2)

	var sandboxed string

	originalNetNS, err := netns.Get()
	assert.NoError(t, err)
	var sandboxedNetNS netns.NsHandle

	// Due to unshare-go imports above, this can run
	assert.NoError(t, runInSandbox("", func() error {
		// We should have overwritten this file with /dev/null
		sandboxed = file.AsStringOrFail(t, "/etc/nsswitch.conf")
		sandboxedNetNS, err = netns.Get()
		assert.NoError(t, err)
		return nil
	}))

| ------------- | ------------- | ------------- |
| from CNI plugin (sidecar) | host $PATH  | pod netns context |
| from init container  (sidecar) | init container $PATH  | pod netns context |
| from CNI agent (ambient) | CNI container $PATH  | pod netns context |
| from CNI agent (ambient) | CNI container $PATH  | host netns context |