code: func generateSeccompFilter(p *stage1commontypes.Pod, pa *preparedApp) (*seccompFilter, error) {
  	sf := seccompFilter{}
  	seenIsolators := 0
  	for _, i := range pa.app.App.Isolators {
  		var flag string
  		var err error
  		if seccomp, ok := i.Value().(types.LinuxSeccompSet); ok {
  			seenIsolators++
  			// By appc spec, only one seccomp isolator per app is allowed
  			if seenIsolators > 1 {
  				return nil, ErrTooManySeccompIsolators
  			}
  			switch i.Name {
  			case types.LinuxSeccompRemoveSetName:
  				sf.mode = ModeBlacklist
  				sf.syscalls, flag, err = parseLinuxSeccompSet(p, seccomp)
  				if err != nil {
  					return nil, err
  				}
  				if flag == "empty" {
  					// we interpret "remove @empty" to mean "default whitelist"
  					sf.mode = ModeWhitelist
  					sf.syscalls = RktDefaultSeccompWhitelist
  				}
  			case types.LinuxSeccompRetainSetName:
  				sf.mode = ModeWhitelist
  				sf.syscalls, flag, err = parseLinuxSeccompSet(p, seccomp)
  				if err != nil {
  					return nil, err
  				}
  				if flag == "all" {
  					// Opt-out seccomp filtering
  					return nil, nil
  				}
  			}
  			sf.errno = string(seccomp.Errno())
  		}
  	}
  
  	// If unset, use rkt default whitelist
  	if seenIsolators == 0 {
  		sf.mode = ModeWhitelist
  		sf.syscalls = RktDefaultSeccompWhitelist
  	}
  
  	// Non-priv apps *must* have NoNewPrivileges set if they have seccomp
  	sf.forceNoNewPrivileges = (pa.uid != 0)
  
  	return &sf, nil
  }
docs: // generateSeccompFilter computes the concrete seccomp filter from the isolators