code: func (ds *dockerService) applySandboxLinuxOptions(hc *dockercontainer.HostConfig, lc *runtimeapi.LinuxPodSandboxConfig, createConfig *dockertypes.ContainerCreateConfig, image string, separator rune) error {
  	if lc == nil {
  		return nil
  	}
  	// Apply security context.
  	if err := applySandboxSecurityContext(lc, createConfig.Config, hc, ds.network, separator); err != nil {
  		return err
  	}
  
  	// Set sysctls.
  	hc.Sysctls = lc.Sysctls
  	return nil
  }
docs: // applySandboxLinuxOptions applies LinuxPodSandboxConfig to dockercontainer.HostConfig and dockercontainer.ContainerCreateConfig.