code: func safeOpenSubPath(mounter mount.Interface, subpath Subpath) (int, error) {
  	if !mount.PathWithinBase(subpath.Path, subpath.VolumePath) {
  		return -1, fmt.Errorf("subpath %q not within volume path %q", subpath.Path, subpath.VolumePath)
  	}
  	fd, err := doSafeOpen(subpath.Path, subpath.VolumePath)
  	if err != nil {
  		return -1, fmt.Errorf("error opening subpath %v: %v", subpath.Path, err)
  	}
  	return fd, nil
  }
docs: // This implementation is shared between Linux and NsEnter