code: func (container *Container) GetRootResourcePath(path string) (string, error) {
  	// IMPORTANT - These are paths on the OS where the daemon is running, hence
  	// any filepath operations must be done in an OS agnostic way.
  	cleanPath := filepath.Join(string(os.PathSeparator), path)
  	return symlink.FollowSymlinkInScope(filepath.Join(container.Root, cleanPath), container.Root)
  }
docs: // GetRootResourcePath evaluates `path` in the scope of the container's root, with proper path
  // sanitisation. Symlinks are all scoped to the root of the container, as
  // though the container's root was `/`.
  //
  // The root of a container is the host-facing configuration metadata directory.
  // Only use this method to safely access the container's `container.json` or
  // other metadata files. If in doubt, use container.GetResourcePath.
  //
  // NOTE: The returned path is *only* safely scoped inside the container's root
  //       if no component of the returned path changes (such as a component
  //       symlinking to a different path) between using this method and using the
  //       path. See symlink.FollowSymlinkInScope for more details.