// +optional
  optional string rule = 1;

  // ranges are the allowed ranges of fs groups.  If you would like to force a single
  // fs group then supply a single range with the same start and end. Required for MustRunAs.
  // +optional
  repeated IDRange ranges = 2;
}

// HostPortRange defines a range of host ports that will be enabled by a policy

// are set, the values in SecurityContext take precedence.
message SecurityContext {
  // The capabilities to add/drop when running containers.
  // Defaults to the default set of capabilities granted by the container runtime.
  // Note that this field cannot be set when spec.os.name is windows.
  // +optional
  optional Capabilities capabilities = 1;

  // Run container in privileged mode.