code: func readCredentialSpecFile(id, root, location string) (string, error) {
  	if filepath.IsAbs(location) {
  		return "", fmt.Errorf("invalid credential spec - file:// path cannot be absolute")
  	}
  	base := filepath.Join(root, credentialSpecFileLocation)
  	full := filepath.Join(base, location)
  	if !strings.HasPrefix(full, base) {
  		return "", fmt.Errorf("invalid credential spec - file:// path must be under %s", base)
  	}
  	bcontents, err := ioutil.ReadFile(full)
  	if err != nil {
  		return "", errors.Wrapf(err, "credential spec for container %s could not be read from file %q", id, full)
  	}
  	return string(bcontents[:]), nil
  }
docs: // readCredentialSpecFile is a helper function to read a credential spec from
  // a file. If not found, we return an empty string and warn in the log.
  // This allows for staging on machines which do not have the necessary components.