Docker uses this workaround: https://github.com/opencontainers/runc/tree/master/libcontainer/nsenter https://github.com/opencontainers/runc/tree/master/libconta

Docker uses this workaround: https://github.com/opencontainers/runc/tree/master/libcontainer/nsenter https://github.com/opencontainers/runc/tree/master/libcontai... "The nsenter package registers a special init constructor that is called before the Go runtime has a chance to boot." Kubernetes relies on CNI drivers which exit very soon after changing namespace; essentially they cross fingers and hope the problem won't strike.