Without K3D_FIX_MOUNTS=1, the following mount error is produced when istio-cni is scheduled:

Error: failed to generate container "667e605ba636efcce61e601834ade912448cbc6a212c75a5f12b7aeb08590f6f" spec: failed to generate spec: path "/var/run/netns" is mounted on "/var/run" but it is not a shared or slave mount

Have one report of this on linux with Docker 24.0.9, but have not managed to repro the above with these versions of Docker and k3d:

Docker: 27.1.2
k3d: 5.6.3

This scenario would affect sidecar repair as well as ambient. It looks like k3d-io/k3d#1268 Cilium would also be affected, so this probably deserves updating in both the ambient and sidecar k3d platform notes.