code: func mountContainerV1Cgroups(m fs.Mounter, p *stage1commontypes.Pod, enabledCgroups map[int][]string, subcgroup string, serviceNames []string) error {
  	mountContext := os.Getenv(common.EnvSELinuxMountContext)
  	stage1Root := common.Stage1RootfsPath(p.Root)
  	if err := v1.CreateCgroups(m, stage1Root, enabledCgroups, mountContext); err != nil {
  		return errwrap.Wrap(errors.New("error creating container cgroups"), err)
  	}
  
  	if err := v1.RemountCgroups(m, stage1Root, enabledCgroups, subcgroup, p.InsecureOptions.DisablePaths); err != nil {
  		return errwrap.Wrap(errors.New("error restricting container cgroups"), err)
  	}
  
  	return nil
  }
docs: // mountContainerV1Cgroups mounts the cgroup controllers hierarchy in the container's
  // namespace read-only, leaving the needed knobs in the subcgroup for each-app
  // read-write so systemd inside stage1 can apply isolators to them