code: func verifyRunAsNonRoot(pod *v1.Pod, container *v1.Container, uid *int64, username string) error {
  	effectiveSc := securitycontext.DetermineEffectiveSecurityContext(pod, container)
  	// If the option is not set, or if running as root is allowed, return nil.
  	if effectiveSc == nil || effectiveSc.RunAsNonRoot == nil || !*effectiveSc.RunAsNonRoot {
  		return nil
  	}
  
  	if effectiveSc.RunAsUser != nil {
  		if *effectiveSc.RunAsUser == 0 {
  			return fmt.Errorf("container's runAsUser breaks non-root policy")
  		}
  		return nil
  	}
  
  	switch {
  	case uid != nil && *uid == 0:
  		return fmt.Errorf("container has runAsNonRoot and image will run as root")
  	case uid == nil && len(username) > 0:
  		return fmt.Errorf("container has runAsNonRoot and image has non-numeric user (%s), cannot verify user is non-root", username)
  	default:
  		return nil
  	}
  }
docs: // verifyRunAsNonRoot verifies RunAsNonRoot.