code: func openContainerFile(rootfs string, path string) (io.ReadCloser, error) {
  	fp, err := symlink.FollowSymlinkInScope(filepath.Join(rootfs, path), rootfs)
  	if err != nil {
  		return nil, err
  	}
  	return os.Open(fp)
  }
docs: // openContainerFile opens a file inside a container rootfs safely