Merge pull request #11669 from pweil-/sc-nonroot

add non-root directive to SC and kubelet checking

pkg/kubelet/rkt/rkt.go

@@ -856,6 +856,8 @@ func (r *runtime) SyncPod(pod *api.Pod, runningPod kubecontainer.Pod, podStatus
 			continue
 		}
 
+		// TODO: check for non-root image directives.  See ../docker/manager.go#SyncPod
+
 		// TODO(yifan): Take care of host network change.
 		containerChanged := c.Hash != 0 && c.Hash != expectedHash
 		if containerChanged {