code: func modifyHostConfig(sc *runtimeapi.LinuxContainerSecurityContext, hostConfig *dockercontainer.HostConfig, separator rune) error {
  	if sc == nil {
  		return nil
  	}
  
  	// Apply supplemental groups.
  	for _, group := range sc.SupplementalGroups {
  		hostConfig.GroupAdd = append(hostConfig.GroupAdd, strconv.FormatInt(group, 10))
  	}
  
  	// Apply security context for the container.
  	hostConfig.Privileged = sc.Privileged
  	hostConfig.ReadonlyRootfs = sc.ReadonlyRootfs
  	if sc.Capabilities != nil {
  		hostConfig.CapAdd = sc.GetCapabilities().AddCapabilities
  		hostConfig.CapDrop = sc.GetCapabilities().DropCapabilities
  	}
  	if sc.SelinuxOptions != nil {
  		hostConfig.SecurityOpt = addSELinuxOptions(
  			hostConfig.SecurityOpt,
  			sc.SelinuxOptions,
  			separator,
  		)
  	}
  
  	// Apply apparmor options.
  	apparmorSecurityOpts, err := getApparmorSecurityOpts(sc, separator)
  	if err != nil {
  		return fmt.Errorf("failed to generate apparmor security options: %v", err)
  	}
  	hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, apparmorSecurityOpts...)
  
  	if sc.NoNewPrivs {
  		hostConfig.SecurityOpt = append(hostConfig.SecurityOpt, "no-new-privileges")
  	}
  
  	if !hostConfig.Privileged {
  		hostConfig.MaskedPaths = sc.MaskedPaths
  		hostConfig.ReadonlyPaths = sc.ReadonlyPaths
  	}
  
  	return nil
  }
docs: // modifyHostConfig applies security context config to dockercontainer.HostConfig.