code: func (sp *subpath) PrepareSafeSubpath(subPath Subpath) (newHostPath string, cleanupAction func(), err error) {
  	handles, err := lockAndCheckSubPath(subPath.VolumePath, subPath.Path)
  
  	// Unlock the directories when the container starts
  	cleanupAction = func() {
  		unlockPath(handles)
  	}
  	return subPath.Path, cleanupAction, err
  }
docs: // Lock all directories in subPath and check they're not symlinks.