// no additional groups are added to any container. Note that group memberships
  // defined in the container image for the uid of the container process are still effective,
  // even if they are not included in this list.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  repeated int64 supplementalGroups = 4;