}
	retHandlers := make([]kubecontainer.RuntimeHandler, len(handlers))
	for i, h := range handlers {
		supportsRRO := false
		supportsUserns := false
		if h.Features != nil {
			supportsRRO = h.Features.RecursiveReadOnlyMounts
			supportsUserns = h.Features.UserNamespaces
		}
		retHandlers[i] = kubecontainer.RuntimeHandler{
			Name:                            h.Name,
			SupportsRecursiveReadOnlyMounts: supportsRRO,

		if !utilfeature.DefaultFeatureGate.Enabled(features.RecursiveReadOnlyMounts) {
			return nil
		}
		handlers := fn()
		node.Status.RuntimeHandlers = make([]v1.NodeRuntimeHandler, len(handlers))
		for i, h := range handlers {
			node.Status.RuntimeHandlers[i] = v1.NodeRuntimeHandler{
				Name: h.Name,
				Features: &v1.NodeRuntimeHandlerFeatures{
					RecursiveReadOnlyMounts: &h.SupportsRecursiveReadOnlyMounts,
				},
			}

	SELinuxMount featuregate.Feature = "SELinuxMount"

	// owner: @AkihiroSuda
	// kep: https://kep.k8s.io/3857
	// alpha: v1.30
	//
	// Allows recursive read-only mounts.
	RecursiveReadOnlyMounts featuregate.Feature = "RecursiveReadOnlyMounts"

	// owner: @everpeace
	// kep: https://kep.k8s.io/3619
	// alpha: v1.31
	//
	// Enable SupplementalGroupsPolicy feature in PodSecurityContext

			podSpec.InitContainers[i].RestartPolicy = nil
		}
		// For other types of containers, validateContainers will handle them.
	}

	if !utilfeature.DefaultFeatureGate.Enabled(features.RecursiveReadOnlyMounts) && !rroInUse(oldPodSpec) {
		for i := range podSpec.Containers {
			for j := range podSpec.Containers[i].VolumeMounts {
				podSpec.Containers[i].VolumeMounts[j].RecursiveReadOnly = nil
			}
		}