code: func (kl *Kubelet) enableHostUserNamespace(pod *v1.Pod) bool {
  	if kubecontainer.HasPrivilegedContainer(pod) || hasHostNamespace(pod) ||
  		hasHostVolume(pod) || hasNonNamespacedCapability(pod) || kl.hasHostMountPVC(pod) {
  		return true
  	}
  	return false
  }
docs: // enableHostUserNamespace determines if the host user namespace should be used by the container runtime.
  // Returns true if the pod is using a host pid, pic, or network namespace, the pod is using a non-namespaced
  // capability, the pod contains a privileged container, or the pod has a host path volume.
  //
  // NOTE: when if a container shares any namespace with another container it must also share the user namespace
  // or it will not have the correct capabilities in the namespace.  This means that host user namespace
  // is enabled per pod, not per container.