anchor.diff:  The calculation of the CPU usage based on the percentage of the total CPU power available is quite sophisticated and is performed regularly as the CPU demands of the various containers fluctuates. Specifically, the percentage of CPU cycles a cgroup gets can be calculated by dividing the `cpu.shares` it holds by the sum of the `cpu.shares` of all the cgroups that are currently doing CPU activity, as shown in the following calculation:
   
   ```
  -process\_cpu\_share\_percent = cpu.shares / sum\_cpu\_shares * 100
  +process_cpu_share_percent = cpu.shares / sum_cpu_shares * 100
   ```
   
   In <%= vars.app_runtime_abbr %>, cgroup shares range from 10 to 1024, with 1024 being the default. The actual amount of shares a cgroup gets can be read from the `cpu.shares` file of the cgroup configurations pseudo-file-system available in the container at `/sys/fs/cgroup/cpu`.
  
positive.code: 
  * Running app instances in unprivileged containers by default. For more information, see [Types](#types).
  
  * [Hardening](#hardening) containers by limiting functionality and access rights. For more information, see [Hardening](#hardening).
  
  * <%= vars.app_sec_groups_default %> <%= vars.app_sec_groups_link %>
  
  
negative.code: 
  * [Container Mechanics](#mechanics) provides an overview of container isolation.
  
  * [Inbound and Outbound Traffic from <%= vars.app_runtime_abbr %>](#networking) provides an overview of container networking and describes how <%= vars.app_runtime_abbr %> admins customize container network traffic rules for their deployment.
  
  * [Container Security](#security) describes how <%= vars.app_runtime_abbr %> secures containers by running app instances in unprivileged containers and by hardening them.
  
  