code: func ensureSystemCgroups(rootCgroupPath string, manager *fs.Manager) error {
  	// Move non-kernel PIDs to the system container.
  	attemptsRemaining := 10
  	var errs []error
  	for attemptsRemaining >= 0 {
  		// Only keep errors on latest attempt.
  		errs = []error{}
  		attemptsRemaining--
  
  		allPids, err := cmutil.GetPids(rootCgroupPath)
  		if err != nil {
  			errs = append(errs, fmt.Errorf("failed to list PIDs for root: %v", err))
  			continue
  		}
  
  		// Remove kernel pids and other protected PIDs (pid 1, PIDs already in system & kubelet containers)
  		pids := make([]int, 0, len(allPids))
  		for _, pid := range allPids {
  			if pid == 1 || isKernelPid(pid) {
  				continue
  			}
  
  			pids = append(pids, pid)
  		}
  		klog.Infof("Found %d PIDs in root, %d of them are not to be moved", len(allPids), len(allPids)-len(pids))
  
  		// Check if we have moved all the non-kernel PIDs.
  		if len(pids) == 0 {
  			break
  		}
  
  		klog.Infof("Moving non-kernel processes: %v", pids)
  		for _, pid := range pids {
  			err := manager.Apply(pid)
  			if err != nil {
  				errs = append(errs, fmt.Errorf("failed to move PID %d into the system container %q: %v", pid, manager.Cgroups.Name, err))
  			}
  		}
  
  	}
  	if attemptsRemaining < 0 {
  		errs = append(errs, fmt.Errorf("ran out of attempts to create system containers %q", manager.Cgroups.Name))
  	}
  
  	return utilerrors.NewAggregate(errs)
  }
docs: // Ensures the system container is created and all non-kernel threads and process 1
  // without a container are moved to it.
  //
  // The reason of leaving kernel threads at root cgroup is that we don't want to tie the
  // execution of these threads with to-be defined /system quota and create priority inversions.
  //