code: func parseSystemPaths(securityOpts []string) (filtered, maskedPaths, readonlyPaths []string) {
  	filtered = securityOpts[:0]
  	for _, opt := range securityOpts {
  		if opt == "systempaths=unconfined" {
  			maskedPaths = []string{}
  			readonlyPaths = []string{}
  		} else {
  			filtered = append(filtered, opt)
  		}
  	}
  
  	return filtered, maskedPaths, readonlyPaths
  }
docs: // parseSystemPaths checks if `systempaths=unconfined` security option is set,
  // and returns the `MaskedPaths` and `ReadonlyPaths` accordingly. An updated
  // list of security options is returned with this option removed, because the
  // `unconfined` option is handled client-side, and should not be sent to the
  // daemon.