code: func ValidateSecurityContext(sc *core.SecurityContext, fldPath *field.Path) field.ErrorList {
  	allErrs := field.ErrorList{}
  	//this should only be true for testing since SecurityContext is defaulted by the core
  	if sc == nil {
  		return allErrs
  	}
  
  	if sc.Privileged != nil {
  		if *sc.Privileged && !capabilities.Get().AllowPrivileged {
  			allErrs = append(allErrs, field.Forbidden(fldPath.Child("privileged"), "disallowed by cluster policy"))
  		}
  	}
  
  	if sc.RunAsUser != nil {
  		for _, msg := range validation.IsValidUserID(*sc.RunAsUser) {
  			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsUser"), *sc.RunAsUser, msg))
  		}
  	}
  
  	if sc.RunAsGroup != nil {
  		for _, msg := range validation.IsValidGroupID(*sc.RunAsGroup) {
  			allErrs = append(allErrs, field.Invalid(fldPath.Child("runAsGroup"), *sc.RunAsGroup, msg))
  		}
  	}
  
  	if sc.ProcMount != nil {
  		if err := ValidateProcMountType(fldPath.Child("procMount"), *sc.ProcMount); err != nil {
  			allErrs = append(allErrs, err)
  		}
  	}
  
  	if sc.AllowPrivilegeEscalation != nil && !*sc.AllowPrivilegeEscalation {
  		if sc.Privileged != nil && *sc.Privileged {
  			allErrs = append(allErrs, field.Invalid(fldPath, sc, "cannot set `allowPrivilegeEscalation` to false and `privileged` to true"))
  		}
  
  		if sc.Capabilities != nil {
  			for _, cap := range sc.Capabilities.Add {
  				if string(cap) == "CAP_SYS_ADMIN" {
  					allErrs = append(allErrs, field.Invalid(fldPath, sc, "cannot set `allowPrivilegeEscalation` to false and `capabilities.Add` CAP_SYS_ADMIN"))
  				}
  			}
  		}
  	}
  
  	return allErrs
  }
docs: // ValidateSecurityContext ensure the security context contains valid settings