lock and sync container before checking mountpoint

when checking for a container's mountpoint, you must lock and sync
the container or the result may be "".

Fixes: containers#2304

Signed-off-by: baude <bbaude@redhat.com>

libpod/kube.go

@@ -421,7 +421,13 @@ func generateKubeSecurityContext(c *Container) (*v1.SecurityContext, error) {
 	}
 
 	if c.User() != "" {
-		// It is *possible* that
+		if !c.batched {
+			c.lock.Lock()
+			defer c.lock.Unlock()
+		}
+		if err := c.syncContainer(); err != nil {
+			return nil, errors.Wrapf(err, "unable to sync container during YAML generation")
+		}
 		logrus.Debugf("Looking in container for user: %s", c.User())
 		u, err := lookup.GetUser(c.state.Mountpoint, c.User())
 		if err != nil {