code: func ValidateSecurityContext(sc *api.SecurityContext, fldPath *field.Path) field.ErrorList {
  	allErrs := field.ErrorList{}
  	//this should only be true for testing since SecurityContext is defaulted by the api
  	if sc == nil {
  		return allErrs
  	}
  
  	if sc.Privileged != nil {
  		if *sc.Privileged && !capabilities.Get().AllowPrivileged {
  			allErrs = append(allErrs, field.Forbidden(fldPath.Child("privileged"), "disallowed by policy"))
  		}
  	}
  
  	if sc.RunAsUser != nil {
  		if *sc.RunAsUser < 0 {
  			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *sc.RunAsUser, isNegativeErrorMsg))
  		}
  	}
  	return allErrs
  }
docs: // ValidateSecurityContext ensure the security context contains valid settings