code: func removeConfigs(flags *pflag.FlagSet, spec *swarm.ContainerSpec, credSpecName, credSpecID string) []*swarm.ConfigReference {
  	keepConfigs := []*swarm.ConfigReference{}
  
  	toRemove := buildToRemoveSet(flags, flagConfigRemove)
  	// all configs in spec.Configs should have both a Name and ID, because
  	// they come from an already-accepted spec.
  	for _, config := range spec.Configs {
  		// if the config is a Runtime target, make sure it's still in use right
  		// now, the only use for Runtime target is credential specs.  if, in
  		// the future, more uses are added, then this check will need to be
  		// made more intelligent.
  		if config.Runtime != nil {
  			// if we're carrying over a credential spec explicitly (because the
  			// user passed --credential-spec with the same config name) then we
  			// should match on credSpecName. if we're carrying over a
  			// credential spec implicitly (because the user did not pass any
  			// --credential-spec flag) then we should match on credSpecID. in
  			// either case, we're keeping the config that already exists.
  			if config.ConfigName == credSpecName || config.ConfigID == credSpecID {
  				keepConfigs = append(keepConfigs, config)
  			}
  			// continue the loop, to skip the part where we check if the config
  			// is in toRemove.
  			continue
  		}
  
  		if _, exists := toRemove[config.ConfigName]; !exists {
  			keepConfigs = append(keepConfigs, config)
  		}
  	}
  
  	return keepConfigs
  }
docs: // removeConfigs figures out which configs in the existing spec should be kept
  // after the update.