Constant NESTED_SANDBOX_ANNOTATION 

pub const NESTED_SANDBOX_ANNOTATION: &str = "yah.sandbox";

Annotation key requesting the capabilities a workload needs to stand up an unprivileged container sandbox of its own. See WorkloadSpec::wants_nested_sandbox.