code: func hasNonNamespacedCapability(pod *v1.Pod) bool {
  	for _, c := range pod.Spec.Containers {
  		if c.SecurityContext != nil && c.SecurityContext.Capabilities != nil {
  			for _, cap := range c.SecurityContext.Capabilities.Add {
  				if cap == "MKNOD" || cap == "SYS_TIME" || cap == "SYS_MODULE" {
  					return true
  				}
  			}
  		}
  	}
  
  	return false
  }
docs: // hasNonNamespacedCapability returns true if MKNOD, SYS_TIME, or SYS_MODULE is requested for any container.