You are an expert in writing code in many different languages. Your goal is to perform code completion for the following code, keeping in mind the rest of the code and the file meta data.
    Metadata details:
    filename: container.go
    path of file: ./repos/kubernetes/vendor/sigs.k8s.io/kustomize/kyaml/fn/runtime/container
    
    the code of the file until where you have to start completion: // Copyright 2019 The Kubernetes Authors.
// SPDX-License-Identifier: Apache-2.0

package container

import (
	"fmt"
	"os"
	"path/filepath"

	"sigs.k8s.io/kustomize/kyaml/errors"
	runtimeexec "sigs.k8s.io/kustomize/kyaml/fn/runtime/exec"
	"sigs.k8s.io/kustomize/kyaml/fn/runtime/runtimeutil"
	"sigs.k8s.io/kustomize/kyaml/yaml"
)

// Filter filters Resources using a container image.
// The container must start a process that reads the list of
// input Resources from stdin, reads the Configuration from the env
// API_CONFIG, and writes the filtered Resources to stdout.
// 
    
func (c *Filter) getCommand() (string, []string) {
	network := runtimeutil.NetworkNameNone
	if c.ContainerSpec.Network {
		network = runtimeutil.NetworkNameHost
	}
	// run the container using docker.  this is simpler than using the docker
	// libraries, and ensures things like auth work the same as if the container
	// was run from the cli.
	args := []string{"run",
		"--rm",                                              // delete the container afterward
		"-i", "-a", "STDIN", "-a", "STDOUT", "-a", "STDERR", // attach stdin, stdout, stderr
		"--network", string(network),

		// added security options
		"--user", c.UIDGID,
		"--security-opt=no-new-privileges", // don't allow the user to escalate privileges
		// note: don't make fs readonly because things like heredoc rely on writing tmp files
	}

	for _, storageMount := range c.StorageMounts {
		// convert declarative relative paths to absolute (otherwise docker will throw an error)
		if !filepath.IsAbs(storageMount.Src) {
			storageMount.Src = filepath.Join(c.Exec.WorkingDir, storageMount.Src)
		}
		args = append(args, "--mount", storageMount.String())
	}

	args = append(args, runtimeutil.NewContainerEnvFromStringSlice(c.Env).GetDockerFlags()...)
	a := append(args, c.Image) //nolint:gocritic
	return "docker", a
}