code: func GeneratePasswd(uid, gid uint32, rootfs, rundir string) (string, error) {
  	// if UID exists inside of container rootfs /etc/passwd then
  	// don't generate passwd
  	if _, err := lookup.GetUser(rootfs, strconv.Itoa(int(uid))); err == nil {
  		return "", nil
  	}
  	passwdFile := filepath.Join(rundir, "passwd")
  	originPasswdFile, err := symlink.FollowSymlinkInScope(filepath.Join(rootfs, "/etc/passwd"), rootfs)
  	if err != nil {
  		return "", errors.Wrapf(err, "unable to follow symlinks to passwd file")
  	}
  	orig, err := ioutil.ReadFile(originPasswdFile)
  	if err != nil {
  		// If no /etc/passwd in container ignore and return
  		if os.IsNotExist(err) {
  			return "", nil
  		}
  		return "", errors.Wrapf(err, "unable to read passwd file %s", originPasswdFile)
  	}
  
  	pwd := fmt.Sprintf("%s%d:x:%d:%d:container user:%s:/bin/sh\n", orig, uid, uid, gid, "/")
  	if err := ioutil.WriteFile(passwdFile, []byte(pwd), 0644); err != nil {
  		return "", errors.Wrapf(err, "failed to create temporary passwd file")
  	}
  	return passwdFile, nil
  }
docs: // GeneratePasswd generates a container specific passwd file,
  // iff uid is not defined in the containers /etc/passwd