code: func lockAndCheckSubPath(volumePath, hostPath string) ([]uintptr, error) {
  	if len(volumePath) == 0 || len(hostPath) == 0 {
  		return []uintptr{}, nil
  	}
  
  	finalSubPath, err := filepath.EvalSymlinks(hostPath)
  	if err != nil {
  		return []uintptr{}, fmt.Errorf("cannot read link %s: %s", hostPath, err)
  	}
  	finalVolumePath, err := filepath.EvalSymlinks(volumePath)
  	if err != nil {
  		return []uintptr{}, fmt.Errorf("cannot read link %s: %s", volumePath, err)
  	}
  
  	return lockAndCheckSubPathWithoutSymlink(finalVolumePath, finalSubPath)
  }
docs: // check whether hostPath is within volume path
  // this func will lock all intermediate subpath directories, need to close handle outside of this func after container started