code: func validateMountPropagation(mountPropagation *core.MountPropagationMode, container *core.Container, fldPath *field.Path) field.ErrorList {
  	allErrs := field.ErrorList{}
  
  	if mountPropagation == nil {
  		return allErrs
  	}
  
  	supportedMountPropagations := sets.NewString(string(core.MountPropagationBidirectional), string(core.MountPropagationHostToContainer), string(core.MountPropagationNone))
  	if !supportedMountPropagations.Has(string(*mountPropagation)) {
  		allErrs = append(allErrs, field.NotSupported(fldPath, *mountPropagation, supportedMountPropagations.List()))
  	}
  
  	if container == nil {
  		// The container is not available yet, e.g. during validation of
  		// PodPreset. Stop validation now, Pod validation will refuse final
  		// Pods with Bidirectional propagation in non-privileged containers.
  		return allErrs
  	}
  
  	privileged := container.SecurityContext != nil && container.SecurityContext.Privileged != nil && *container.SecurityContext.Privileged
  	if *mountPropagation == core.MountPropagationBidirectional && !privileged {
  		allErrs = append(allErrs, field.Forbidden(fldPath, "Bidirectional mount propagation is available only to privileged containers"))
  	}
  	return allErrs
  }
docs: // validateMountPropagation verifies that MountPropagation field is valid and
  // allowed for given container.