code: func (s *nonRoot) Validate(scPath *field.Path, _ *api.Pod, _ *api.Container, runAsNonRoot *bool, runAsUser *int64) field.ErrorList {
  	allErrs := field.ErrorList{}
  	if runAsNonRoot == nil && runAsUser == nil {
  		allErrs = append(allErrs, field.Required(scPath.Child("runAsNonRoot"), "must be true"))
  		return allErrs
  	}
  	if runAsNonRoot != nil && *runAsNonRoot == false {
  		allErrs = append(allErrs, field.Invalid(scPath.Child("runAsNonRoot"), *runAsNonRoot, "must be true"))
  		return allErrs
  	}
  	if runAsUser != nil && *runAsUser == 0 {
  		allErrs = append(allErrs, field.Invalid(scPath.Child("runAsUser"), *runAsUser, "running with the root UID is forbidden"))
  		return allErrs
  	}
  	return allErrs
  }
docs: // Validate ensures that the specified values fall within the range of the strategy.  Validation
  // of this will pass if either the UID is not set, assuming that the image will provided the UID
  // or if the UID is set it is not root.  Validation will fail if RunAsNonRoot is set to false.
  // In order to work properly this assumes that the kubelet performs a final check on runAsUser
  // or the image UID when runAsUser is nil.