code: func finalizeNamespace(config *initConfig) error {
  	// Ensure that all unwanted fds we may have accidentally
  	// inherited are marked close-on-exec so they stay out of the
  	// container
  	if err := utils.CloseExecFrom(config.PassedFilesCount + 3); err != nil {
  		return err
  	}
  
  	capabilities := config.Config.Capabilities
  	if config.Capabilities != nil {
  		capabilities = config.Capabilities
  	}
  	w, err := newCapWhitelist(capabilities)
  	if err != nil {
  		return err
  	}
  	// drop capabilities in bounding set before changing user
  	if err := w.dropBoundingSet(); err != nil {
  		return err
  	}
  	// preserve existing capabilities while we change users
  	if err := system.SetKeepCaps(); err != nil {
  		return err
  	}
  	if err := setupUser(config); err != nil {
  		return err
  	}
  	if err := system.ClearKeepCaps(); err != nil {
  		return err
  	}
  	// drop all other capabilities
  	if err := w.drop(); err != nil {
  		return err
  	}
  	if config.Cwd != "" {
  		if err := syscall.Chdir(config.Cwd); err != nil {
  			return err
  		}
  	}
  	return nil
  }
docs: // finalizeNamespace drops the caps, sets the correct user
  // and working dir, and closes any leaked file descriptors
  // before executing the command inside the namespace