Function container_mounting_claim 

pub fn container_mounting_claim<'a>(
    pod: &'a Pod,
    claim_name: &str,
) -> Option<&'a Container>

The container within pod that mounts claim_name: resolve the pod volume(s) backed by the claim, then find the container whose volumeMounts reference one.

pod_mounts_claim is pod-level and cannot answer “which container is the app?” — a question that matters because inheritSecurityContextFrom copies ONE container’s securityContext. Falling back to the pod’s first container picks whatever the manifest or a sidecar injector listed first, which on an istio-injected pod is istio-proxy (uid 1337), not the app. The container actually mounting the data is a far better guess at whose identity wrote it.

Returns None when nothing mounts the claim or when several containers do — ambiguous is not a guess worth making, and the caller falls back to the first container as before. Init containers are excluded: they are not the long-running writer.