code: func maskFile(path string) error {
  	if err := syscall.Mount("/dev/null", path, "", syscall.MS_BIND, ""); err != nil && !os.IsNotExist(err) {
  		return err
  	}
  	return nil
  }
docs: // maskFile bind mounts /dev/null over the top of the specified path inside a container
  // to avoid security issues from processes reading information from non-namespace aware mounts ( proc/kcore ).