code: func (p *Pod) ExclusiveLockManifest() error {
  	if p.manifestLock != nil {
  		return p.manifestLock.ExclusiveLock() // This is idempotent
  	}
  
  	l, err := lock.ExclusiveLock(common.PodManifestLockPath(p.Path()), lock.RegFile)
  	if err != nil {
  		return err
  	}
  
  	p.manifestLock = l
  	return nil
  }
docs: // ExclusiveLockManifest gets an exclusive lock on only the pod manifest in the app sandbox.
  // Since the pod might already be running, we can't just get an exclusive lock on the pod itself.