code: func applyContainerSecurityContext(lc *runtimeapi.LinuxContainerConfig, podSandboxID string, config *dockercontainer.Config, hc *dockercontainer.HostConfig, separator rune) error {
  	if lc == nil {
  		return nil
  	}
  
  	err := modifyContainerConfig(lc.SecurityContext, config)
  	if err != nil {
  		return err
  	}
  	if err := modifyHostConfig(lc.SecurityContext, hc, separator); err != nil {
  		return err
  	}
  	modifyContainerNamespaceOptions(lc.SecurityContext.GetNamespaceOptions(), podSandboxID, hc)
  	return nil
  }
docs: // applyContainerSecurityContext updates docker container options according to security context.