code: func Restrict(configs exec.ConfigGetter, t *api.Task) exec.ConfigGetter {
  	cids := map[string]struct{}{}
  
  	container := t.Spec.GetContainer()
  	if container != nil {
  		for _, configRef := range container.Configs {
  			cids[configRef.ConfigID] = struct{}{}
  		}
  	}
  
  	return &taskRestrictedConfigsProvider{configs: configs, configIDs: cids}
  }
docs: // Restrict provides a getter that only allows access to the configs
  // referenced by the task.