if (profileProp != null) {
                ActivationProperty prop = new ActivationProperty();

                prop.setName(profileProp.getName());
                prop.setValue(profileProp.getValue());

                activation.setProperty(prop);
            }

            ActivationOS profileOs = profileActivation.getOs();

            if (profileOs != null) {

  // that should be running the daemon pod (i.e. status.desiredNumberScheduled)
  // can have their a new pod created before the old pod is marked as deleted.
  // The update starts by launching new pods on 30% of nodes. Once an updated
  // pod is available (Ready for at least minReadySeconds) the old DaemonSet pod
  // on that node is marked deleted. If the old pod becomes unavailable for any

	const maxStaleRetries = 10
	const msInterval = 10
	retries := 0
	var ambientPod *corev1.Pod
	var err error

	// The plugin already consulted the k8s API - but on this end handler caches may be stale, so retry a few times if we get no pod.
	// if err is returned, we couldn't find the pod
	// if nil is returned, we found it but ambient is not enabled

    }
  });

  $("#searchOptionsClearButton").on("click", function(e) {
    $("#labelTypeSearchOption").prop("selectedIndex", -1);
    $("#langSearchOption").prop("selectedIndex", 0);
    $("#sortSearchOption").prop("selectedIndex", 0);
    $("#numSearchOption").prop("selectedIndex", 0);
    return false;
  });

  if (typeof $.fn.suggestor === "function") {
    $("#query").suggestor({
      ajaxinfo: {

wget https://dl.min.io/server/minio/release/linux-amd64/minio -O /mnt/export/${USER}/bin/minio
chmod +x /mnt/export/${USER}/bin/minio
```

Bind your `proc` mount to the target chroot directory

```
sudo mount --bind /proc /mnt/export/${USER}/proc
```

## 3. Run Standalone MinIO in Chroot

### GNU/Linux

```sh

An alternative flow is when a pod is enrolled into ambient mode after it starts up.
In this case, the CNI Agent is watching for Pod events from the API server directly and performing the same setup.
Note this is done while the Pod is running, unlike the CNI plugin flow which occurs before the Pod starts.

Once the network is configured, the CNI Agent will signal to Ztunnel to start running within the Pod.

            this.maxVersion = this.minVersion;
        }
    }


    protected void initDisallowCompound ( String prop ) {
        if ( prop == null ) {
            return;
        }
        Set<String> disallow = new HashSet<>();
        StringTokenizer st = new StringTokenizer(prop, ",");
        while ( st.hasMoreTokens() ) {
            disallow.add(st.nextToken().trim());
        }

- one end of the socket is in the application pod
- and the other end is in ztunnel's pod

and setting up iptables rules to funnel traffic thru that socket "tube" to ztunnel and back.

This effectively behaves like ztunnel is an in-pod sidecar, without actually requiring the injection of ztunnel as a sidecar into the pod manifest, or mutatating the application pod in any way.

  // +optional
  optional ImageReviewStatus status = 3;
}

// ImageReviewContainerSpec is a description of a container within the pod creation request.
message ImageReviewContainerSpec {
  // This can be in the form image:tag or image@SHA:012345679abcdef.
  // +optional
  optional string image = 1;
}

// ImageReviewSpec is a description of the pod creation request.

  // in a pod.
  // The Handler must be lowercase, conform to the DNS Label (RFC 1123) requirements,
  // and is immutable.
  optional string handler = 2;

  // overhead represents the resource overhead associated with running a pod for a
  // given RuntimeClass. For more details, see
  //  https://kubernetes.io/docs/concepts/scheduling-eviction/pod-overhead/
  // +optional