code: func (s *strategy) ValidateContainer(pod *api.Pod, container *api.Container) field.ErrorList {
  	allErrs := field.ErrorList{}
  	fieldPath := field.NewPath("pod", "metadata", "annotations").Key(api.SeccompContainerAnnotationKeyPrefix + container.Name)
  	containerProfile := profileForContainer(pod, container)
  
  	if !s.allowAnyProfile && len(s.allowedProfiles) == 0 && containerProfile != "" {
  		allErrs = append(allErrs, field.Forbidden(fieldPath, "seccomp may not be set"))
  		return allErrs
  	}
  
  	if !s.profileAllowed(containerProfile) {
  		msg := fmt.Sprintf("%s is not an allowed seccomp profile. Valid values are %v", containerProfile, s.allowedProfilesString)
  		allErrs = append(allErrs, field.Forbidden(fieldPath, msg))
  	}
  
  	return allErrs
  }
docs: // ValidateContainer ensures that the specified values on the container fall within
  // the range of the strategy.