Explanation
The strategy will not successfully accomplish mounting the /data directory on your laptop into a container.
The containers. Mounts. hostBinding: /data is not a valid syntax for specifying a bind mount in a Kubernetes container specification. According tothe Kubernetes documentation), the correct way to mount a host directory into a container is to use a hostPath volume, which takes a path parameter that specifies the location on the host. For example, to mount the /data directory on your laptop into a container at /var/data, you can use the following YAML snippet:
spec:
containers:
-name:my-container
image:my-image
volumeMounts:
-name:data-volume
mountPath:/var/data
volumes:
-name:data-volume
hostPath:
path:/data
References: Volumes), Use bind mounts)

Explanation
This does describe the role of Control Groups (cgroups) when used with a Docker container, because accounting and limiting of resources is one of the main functions of cgroups. According to the official documentation, cgroups are a Linux kernel feature that limits and isolates the resource usage of a group of processes, such as CPU, memory, disk I/O, network, etc. Docker can use cgroups to share available hardware resources to containers and optionally enforce limits and constraints.
References: https://docs.docker.com/config/containers/runmetrics/
https://bikramat.medium.com/namespace-vs-cgroup-60c832c6b8c8

Explanation
Adding a volume to the pod that sets hostPath.path: /data, and then mounting this volume into the pod's containers as desired is a strategy that successfully accomplishes this. A hostPath volume mounts a file or directory from the host node's filesystem into a pod. It can be used to access files on the host from a container, such as configuration files, logs, binaries, etc. However, this type of volume is not portable across nodes and should be used with caution. References: https://kubernetes.io/docs/concepts/storage/volumes/#hostpath,
https://kubernetes.io/docs/tasks/configure-pod-container/configure-volume-storage/

Explanation
= A DTR security scan will detect private keys copied to the image. DTR security scan is a feature of Docker Trusted Registry (DTR) that scans images to detect any security vulnerability1. DTR security scan uses the open source tool SecretScanner2 to find unprotected secrets in container images or file systems. SecretScanner can match the contents of images against a database of approximately 140 secret types, including private keys3. Therefore, if an image contains private keys, DTR security scan will report them as potential secrets and alert the user to remove them from the image. References:
* Scan images for vulnerabilities | Docker Docs
* GitHub - deepfence/SecretScanner: :unlock: Find secrets and passwords ...
* SecretScanner/deepfence_secret_scanner.py at main deepfence/SecretScanner