code: func modifyContainerConfig(sc *runtimeapi.LinuxContainerSecurityContext, config *dockercontainer.Config) error {
  	if sc == nil {
  		return nil
  	}
  	if sc.RunAsUser != nil {
  		config.User = strconv.FormatInt(sc.GetRunAsUser().Value, 10)
  	}
  	if sc.RunAsUsername != "" {
  		config.User = sc.RunAsUsername
  	}
  
  	user := config.User
  	if sc.RunAsGroup != nil {
  		if user == "" {
  			return fmt.Errorf("runAsGroup is specified without a runAsUser.")
  		}
  		user = fmt.Sprintf("%s:%d", config.User, sc.GetRunAsGroup().Value)
  	}
  
  	config.User = user
  
  	return nil
  }
docs: // modifyContainerConfig applies container security context config to dockercontainer.Config.