Since #1008, config.md states [my bold]:

The definition of createRuntime hooks is currently underspecified and hooks authors, should only expect from the runtime that the mount namespace have been created and the mount operations performed. Other operations such as cgroups and SELinux/AppArmor labels might not have been performed by the runtime.

as well as [my bold]:

The definition of createContainer hooks is currently underspecified and hooks authors, should only expect from the runtime that the mount namespace and different mounts will be setup. Other operations such as cgroups and SELinux/AppArmor labels might not have been performed by the runtime.

This was seen - AFAIU - as a necessary compromise to finally finish #1008 and unblock runc-1.0.0. Now that runtime-spec-1.0.2 is out, we should at least track this state of under-specification somewhere though, hence this issue.