code: func Restrict(secrets exec.SecretGetter, t *api.Task) exec.SecretGetter {
  	sids := map[string]struct{}{}
  
  	container := t.Spec.GetContainer()
  	if container != nil {
  		for _, ref := range container.Secrets {
  			sids[ref.SecretID] = struct{}{}
  		}
  	}
  
  	return &taskRestrictedSecretsProvider{secrets: secrets, secretIDs: sids, taskID: t.ID}
  }
docs: // Restrict provides a getter that only allows access to the secrets
  // referenced by the task.