Join makes sure that the concatenation of path and subpath doesn't resolve to a path outside of path and returns a path to a temporary file that is a bind mount to the exact same file/directory that was validated.

ErrEscapesBase is returned by Join when the resulting concatenation would point outside of the specified base directory.

ErrNotAccessible is returned by Join when the resulting path doesn't exist, is not accessible, or any of the path components was replaced with a symlink during the path traversal.