code: func canRunPod(pod *v1.Pod) error {
  	if !capabilities.Get().AllowPrivileged {
  		for _, container := range pod.Spec.Containers {
  			if securitycontext.HasPrivilegedRequest(&container) {
  				return fmt.Errorf("pod with UID %q specified privileged container, but is disallowed", pod.UID)
  			}
  		}
  		for _, container := range pod.Spec.InitContainers {
  			if securitycontext.HasPrivilegedRequest(&container) {
  				return fmt.Errorf("pod with UID %q specified privileged init container, but is disallowed", pod.UID)
  			}
  		}
  	}
  
  	if pod.Spec.HostNetwork {
  		allowed, err := allowHostNetwork(pod)
  		if err != nil {
  			return err
  		}
  		if !allowed {
  			return fmt.Errorf("pod with UID %q specified host networking, but is disallowed", pod.UID)
  		}
  	}
  
  	if pod.Spec.HostPID {
  		allowed, err := allowHostPID(pod)
  		if err != nil {
  			return err
  		}
  		if !allowed {
  			return fmt.Errorf("pod with UID %q specified host PID, but is disallowed", pod.UID)
  		}
  	}
  
  	if pod.Spec.HostIPC {
  		allowed, err := allowHostIPC(pod)
  		if err != nil {
  			return err
  		}
  		if !allowed {
  			return fmt.Errorf("pod with UID %q specified host ipc, but is disallowed", pod.UID)
  		}
  	}
  
  	return nil
  }
docs: // Check whether we have the capabilities to run the specified pod.