String result;
    if (state == DONE) {
      result = "running=[DONE]";
    } else if (state instanceof Blocker) {
      result = "running=[INTERRUPTED]";
    } else if (state instanceof Thread) {
      // getName is final on Thread, no need to worry about exceptions
      result = "running=[RUNNING ON " + ((Thread) state).getName() + "]";
    } else {
      result = "running=[NOT STARTED YET]";
    }

And the **container** itself (in contrast to the **container image**) is the actual running instance of the image, comparable to a **process**. In fact, a container is running only when it has a **process running** (and normally it's only a single process). The container stops when there's no process running in it.

## Container Images

     * State#RUNNING RUNNING}. This occurs when a service has successfully started.
     */
    public void running() {}

    /**
     * Called when the service transitions to the {@linkplain State#STOPPING STOPPING} state. The
     * only valid values for {@code from} are {@linkplain State#STARTING STARTING} or {@linkplain
     * State#RUNNING RUNNING}. This occurs when {@link Service#stopAsync} is called.

	openNetns := s.currentPodSnapshot.Get(string(pod.UID))
	if openNetns != nil {
		return openNetns, nil
	}
	log.Debug("pod netns was not found, trying to find it using procfs")
	// this can happen if the pod was dynamically added to the mesh after it was created.
	// in that case, try finding the netns using procfs.
	if err := s.rescanPod(pod); err != nil {
		log.Errorf("error scanning proc: error was %s", err)
		return nil, err
	}

  // The total number of nodes that should be running the daemon
  // pod (including nodes correctly running the daemon pod).
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
  optional int32 desiredNumberScheduled = 3;

  // numberReady is the number of nodes that should be running the daemon pod and have one
  // or more of the daemon pod running with a Ready Condition.
  optional int32 numberReady = 4;

* There can be **multiple processes** of the **same program** running at the same time.

If you check out the "task manager" or "system monitor" (or similar tools) in your operating system, you will be able to see many of those processes running.

      new ListenerCallQueue.Event<Listener>() {
        @Override
        public void call(Listener listener) {
          listener.running();
        }

        @Override
        public String toString() {
          return "running()";
        }
      };
  private static final ListenerCallQueue.Event<Listener> STOPPING_FROM_STARTING_EVENT =
      stoppingEvent(STARTING);

     * <p>The default {@link AbstractFuture} implementation throws {@code InterruptedException} if
     * the current thread is interrupted before or during the call, even if the value is already
     * available.
     *
     * @throws InterruptedException if the current thread was interrupted before or during the call
     *     (optional but recommended).
     * @throws CancellationException {@inheritDoc}
     */
    @CanIgnoreReturnValue

  // The total number of nodes that should be running the daemon
  // pod (including nodes correctly running the daemon pod).
  // More info: https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/
  optional int32 desiredNumberScheduled = 3;

  // Total number of nodes that should be running the daemon pod and have one
  // or more of the daemon pod running with a Ready Condition by passing the readinessProbe.

This is done by an HTTP server running on `/var/run/istio-cni/pluginevent.sock`.

An alternative flow is when a pod is enrolled into ambient mode after it starts up.
In this case, the CNI Agent is watching for Pod events from the API server directly and performing the same setup.
Note this is done while the Pod is running, unlike the CNI plugin flow which occurs before the Pod starts.