code: func (daemon *Daemon) createSecretsDir(c *container.Container) error {
  	// retrieve possible remapped range start for root UID, GID
  	rootIDs := daemon.idMapping.RootPair()
  	dir, err := c.SecretMountPath()
  	if err != nil {
  		return errors.Wrap(err, "error getting container secrets dir")
  	}
  
  	// create tmpfs
  	if err := idtools.MkdirAllAndChown(dir, 0700, rootIDs); err != nil {
  		return errors.Wrap(err, "error creating secret local mount path")
  	}
  
  	tmpfsOwnership := fmt.Sprintf("uid=%d,gid=%d", rootIDs.UID, rootIDs.GID)
  	if err := mount.Mount("tmpfs", dir, "tmpfs", "nodev,nosuid,noexec,"+tmpfsOwnership); err != nil {
  		return errors.Wrap(err, "unable to setup secret mount")
  	}
  	return nil
  }
docs: // createSecretsDir is used to create a dir suitable for storing container secrets.
  // In practice this is using a tmpfs mount and is used for both "configs" and "secrets"