code: func (p *Pod) SandboxManifest() (*schema.PodManifest, error) {
  	_, pm, err := p.PodManifest() // this takes the lock fd to load the manifest, hence path is not needed here
  	if err != nil {
  		return nil, errwrap.Wrap(errors.New("error loading pod manifest"), err)
  	}
  
  	ms, ok := pm.Annotations.Get("coreos.com/rkt/stage1/mutable")
  	if ok {
  		p.mutable, err = strconv.ParseBool(ms)
  		if err != nil {
  			return nil, errwrap.Wrap(errors.New("error parsing mutable annotation"), err)
  		}
  	}
  
  	if !p.mutable {
  		return nil, ErrImmutable
  	}
  
  	return pm, nil
  }
docs: // SandboxManifest loads the underlying pod manifest and checks whether mutable operations are allowed.
  // It returns ErrImmutable if the pod does not allow mutable operations or any other error if the operation failed.
  // Upon success a reference to the pod manifest is returned and mutable operations are possible.