code: func parseSeccompArgs(patchSeccompMode string, patchSeccompSet string) (*types.Isolator, error) {
  	// Parse mode flag and additional keyed arguments.
  	var errno, mode string
  	args := strings.Split(patchSeccompMode, ",")
  	for _, a := range args {
  		kv := strings.Split(a, "=")
  		switch len(kv) {
  		case 1:
  			// mode, either "remove" or "retain"
  			mode = kv[0]
  		case 2:
  			// k=v argument, only "errno" allowed for now
  			if kv[0] == "errno" {
  				errno = kv[1]
  			} else {
  				return nil, fmt.Errorf("invalid seccomp-mode optional argument: %s", a)
  			}
  		default:
  			return nil, fmt.Errorf("cannot parse seccomp-mode argument: %s", a)
  		}
  	}
  
  	// Instantiate an Isolator with the content specified by the --seccomp-set parameter.
  	var err error
  	var seccomp types.AsIsolator
  	switch mode {
  	case "remove":
  		seccomp, err = types.NewLinuxSeccompRemoveSet(errno, strings.Split(patchSeccompSet, ",")...)
  	case "retain":
  		seccomp, err = types.NewLinuxSeccompRetainSet(errno, strings.Split(patchSeccompSet, ",")...)
  	default:
  		err = fmt.Errorf("unknown seccomp mode %s", mode)
  	}
  	if err != nil {
  		return nil, fmt.Errorf("cannot parse seccomp isolator: %s", err)
  	}
  	seccompIsolator, err := seccomp.AsIsolator()
  	if err != nil {
  		return nil, err
  	}
  	return seccompIsolator, nil
  }
docs: // parseSeccompArgs parses seccomp mode and set CLI flags, preparing an
  // appropriate seccomp isolator.