pub const NESTED_SANDBOX_VALUE: &str = "nested";Expand description
Annotation value (for NESTED_SANDBOX_ANNOTATION) requesting the
nested-sandbox grant (CAP_SETUID + CAP_SETGID, no_new_privs off).
Any other value leaves the workload on the baseline sandbox.