code: func applySandboxSecurityContext(lc *runtimeapi.LinuxPodSandboxConfig, config *dockercontainer.Config, hc *dockercontainer.HostConfig, network *knetwork.PluginManager, separator rune) error {
  	if lc == nil {
  		return nil
  	}
  
  	var sc *runtimeapi.LinuxContainerSecurityContext
  	if lc.SecurityContext != nil {
  		sc = &runtimeapi.LinuxContainerSecurityContext{
  			SupplementalGroups: lc.SecurityContext.SupplementalGroups,
  			RunAsUser:          lc.SecurityContext.RunAsUser,
  			RunAsGroup:         lc.SecurityContext.RunAsGroup,
  			ReadonlyRootfs:     lc.SecurityContext.ReadonlyRootfs,
  			SelinuxOptions:     lc.SecurityContext.SelinuxOptions,
  			NamespaceOptions:   lc.SecurityContext.NamespaceOptions,
  		}
  	}
  
  	err := modifyContainerConfig(sc, config)
  	if err != nil {
  		return err
  	}
  
  	if err := modifyHostConfig(sc, hc, separator); err != nil {
  		return err
  	}
  	modifySandboxNamespaceOptions(sc.GetNamespaceOptions(), hc, network)
  	return nil
  }
docs: // applySandboxSecurityContext updates docker sandbox options according to security context.