iferr:=ValidateRestorePodSpec(podSpec,storage,DefaultSeccompLocalhostProfile);err==nil||err.Error()!="restore target must include a worker container named main"{
t.Fatalf("expected multi-container restore target without main to be rejected, got %v",err)
// Containers[0] is always the worker, regardless of name