code: func (m *podContainerManagerImpl) EnsureExists(pod *v1.Pod) error {
  	podContainerName, _ := m.GetPodContainerName(pod)
  	// check if container already exist
  	alreadyExists := m.Exists(pod)
  	if !alreadyExists {
  		// Create the pod container
  		containerConfig := &CgroupConfig{
  			Name:               podContainerName,
  			ResourceParameters: ResourceConfigForPod(pod, m.enforceCPULimits, m.cpuCFSQuotaPeriod),
  		}
  		if utilfeature.DefaultFeatureGate.Enabled(kubefeatures.SupportPodPidsLimit) && m.podPidsLimit > 0 {
  			containerConfig.ResourceParameters.PidsLimit = &m.podPidsLimit
  		}
  		if err := m.cgroupManager.Create(containerConfig); err != nil {
  			return fmt.Errorf("failed to create container for %v : %v", podContainerName, err)
  		}
  	}
  	// Apply appropriate resource limits on the pod container
  	// Top level qos containers limits are not updated
  	// until we figure how to maintain the desired state in the kubelet.
  	// Because maintaining the desired state is difficult without checkpointing.
  	if err := m.applyLimits(pod); err != nil {
  		return fmt.Errorf("failed to apply resource limits on container for %v : %v", podContainerName, err)
  	}
  	return nil
  }
docs: // EnsureExists takes a pod as argument and makes sure that
  // pod cgroup exists if qos cgroup hierarchy flag is enabled.
  // If the pod level container doesn't already exist it is created.