code: func NewMustRunAs(options *policy.RunAsUserStrategyOptions) (RunAsUserStrategy, error) {
  	if options == nil {
  		return nil, fmt.Errorf("MustRunAs requires run as user options")
  	}
  	if len(options.Ranges) == 0 {
  		return nil, fmt.Errorf("MustRunAs requires at least one range")
  	}
  	return &mustRunAs{
  		opts: options,
  	}, nil
  }
docs: // NewMustRunAs provides a strategy that requires the container to run as a specific UID in a range.