code: func ensureSandboxImageExists(client libdocker.Interface, image string) error {
  	_, err := client.InspectImageByRef(image)
  	if err == nil {
  		return nil
  	}
  	if !libdocker.IsImageNotFoundError(err) {
  		return fmt.Errorf("failed to inspect sandbox image %q: %v", image, err)
  	}
  
  	repoToPull, _, _, err := parsers.ParseImageName(image)
  	if err != nil {
  		return err
  	}
  
  	keyring := credentialprovider.NewDockerKeyring()
  	creds, withCredentials := keyring.Lookup(repoToPull)
  	if !withCredentials {
  		klog.V(3).Infof("Pulling image %q without credentials", image)
  
  		err := client.PullImage(image, dockertypes.AuthConfig{}, dockertypes.ImagePullOptions{})
  		if err != nil {
  			return fmt.Errorf("failed pulling image %q: %v", image, err)
  		}
  
  		return nil
  	}
  
  	var pullErrs []error
  	for _, currentCreds := range creds {
  		authConfig := dockertypes.AuthConfig(credentialprovider.LazyProvide(currentCreds, repoToPull))
  		err := client.PullImage(image, authConfig, dockertypes.ImagePullOptions{})
  		// If there was no error, return success
  		if err == nil {
  			return nil
  		}
  
  		pullErrs = append(pullErrs, err)
  	}
  
  	return utilerrors.NewAggregate(pullErrs)
  }
docs: // ensureSandboxImageExists pulls the sandbox image when it's not present.