[chupasaurus]

> A user of the CRI should not have to care about this implementation detail.

This detail is implemented by K8s, not a container runtime. User has to care about the source of it due to supply chain attacks, though.

> Any CRI that needs a pause executable should come with one.

Which would introduce a simultaneous update across different projects, which is a problem harder than a line of config.