type: typeValue
          capabilities:
            add:
            - addValue
            drop:
            - dropValue
          privileged: true
          procMount: procMountValue
          readOnlyRootFilesystem: true
          runAsGroup: 8
          runAsNonRoot: true
          runAsUser: 4
          seLinuxOptions:
            level: levelValue

		}
	}

	if sc.ProcMount != nil {
		if err := ValidateProcMountType(fldPath.Child("procMount"), *sc.ProcMount); err != nil {
			allErrs = append(allErrs, err)
		}
		if hostUsers && *sc.ProcMount == core.UnmaskedProcMount {
			allErrs = append(allErrs, field.Invalid(fldPath.Child("procMount"), sc.ProcMount, "`hostUsers` must be false to use `Unmasked`"))
		}

	}

	}
	if in.AllowPrivilegeEscalation != nil {
		in, out := &in.AllowPrivilegeEscalation, &out.AllowPrivilegeEscalation
		*out = new(bool)
		**out = **in
	}
	if in.ProcMount != nil {
		in, out := &in.ProcMount, &out.ProcMount
		*out = new(ProcMountType)
		**out = **in
	}
	if in.SeccompProfile != nil {
		in, out := &in.SeccompProfile, &out.SeccompProfile
		*out = new(SeccompProfile)

	}
	if in.AllowPrivilegeEscalation != nil {
		in, out := &in.AllowPrivilegeEscalation, &out.AllowPrivilegeEscalation
		*out = new(bool)
		**out = **in
	}
	if in.ProcMount != nil {
		in, out := &in.ProcMount, &out.ProcMount
		*out = new(ProcMountType)
		**out = **in
	}
	if in.SeccompProfile != nil {
		in, out := &in.SeccompProfile, &out.SeccompProfile
		*out = new(SeccompProfile)

	// procMount denotes the type of proc mount to use for the containers.
	// The default is DefaultProcMount which uses the container runtime defaults for
	// readonly paths and masked paths.
	// This requires the ProcMountType feature flag to be enabled.
	// Note that this field cannot be set when spec.os.name is windows.
	// +optional

	out.ReadOnlyRootFilesystem = (*bool)(unsafe.Pointer(in.ReadOnlyRootFilesystem))
	out.AllowPrivilegeEscalation = (*bool)(unsafe.Pointer(in.AllowPrivilegeEscalation))
	out.ProcMount = (*core.ProcMountType)(unsafe.Pointer(in.ProcMount))
	out.SeccompProfile = (*core.SeccompProfile)(unsafe.Pointer(in.SeccompProfile))
	out.AppArmorProfile = (*core.AppArmorProfile)(unsafe.Pointer(in.AppArmorProfile))
	return nil
}

	// +optional
	AllowPrivilegeEscalation *bool
	// ProcMount denotes the type of proc mount to use for the containers.
	// The default is DefaultProcMount which uses the container runtime defaults for
	// readonly paths and masked paths.
	// Note that this field cannot be set when spec.os.name is windows.
	// +optional
	ProcMount *ProcMountType
	// The seccomp options to use by this container. If seccomp options are

	"procMount":                "procMount denotes the type of proc mount to use for the containers. The default is DefaultProcMount which uses the container runtime defaults for readonly paths and masked paths. This requires the ProcMountType feature flag to be enabled. Note...

	noRunAsUser := fullValidSC()
	noRunAsUser.RunAsUser = nil

	procMountSet := fullValidSC()
	defPmt := core.DefaultProcMount
	procMountSet.ProcMount = &defPmt

	umPmt := core.UnmaskedProcMount
	procMountUnmasked := fullValidSC()
	procMountUnmasked.ProcMount = &umPmt

	successCases := map[string]struct {
		sc        *core.SecurityContext
		hostUsers bool
	}{

  // - spec.containers[*].securityContext.readOnlyRootFilesystem
  // - spec.containers[*].securityContext.privileged
  // - spec.containers[*].securityContext.allowPrivilegeEscalation
  // - spec.containers[*].securityContext.procMount
  // - spec.containers[*].securityContext.runAsUser
  // - spec.containers[*].securityContext.runAsGroup
  // +optional
  optional PodOS os = 36;

  // Use the host's user namespace.