anchor.diff:  
   <%= vars.app_runtime_abbr %> creates container filesystems using the Garden Rootfs (GrootFS) tool. It stacks the following using OverlayFS:
   
  -* A **read-only base filesystem**: This filesystem has the minimal set of operating system packages and Garden-specific modifications common to all containers.
  -Containers can share the same read-only base filesystem because all writes are applied to the read-write layer.
  -* A **container-specific read-write layer**: This layer is unique to each container and its size is limited by XFS project quotas.
  -The quotas prevent the read-write layer from overflowing into unallocated space.
  +* A **read-only base filesystem**: This filesystem has the minimal set of operating system packages and Garden-specific modifications common to all containers. Containers can share the same read-only base filesystem because all writes are applied to the read-write layer.
  +
  +* A **container-specific read-write layer**: This layer is unique to each container and its size is limited by XFS project quotas. The quotas prevent the read-write layer from overflowing into unallocated space.
   
   For more information about GrootFS, see [Garden RootFS (GrootFS)](./architecture/garden.html#garden-rootfs) in _Garden_.
   
  
positive.code: The amount of shares given to an apps cgroup depends on the amount of memory the app declares to need in the manifest. <%= vars.app_runtime_abbr %> scales the number of allocated shares linearly with the amount of memory, with an app instance requesting 8&nbsp;GB of memory getting the upper limit of 1024 shares, as shown in the following calculation:
  
  ```
  process\_cpu.shares = min( 1024*(application\_memory / 8 GB), 1024)
  ```
  
  The next example helps to illustrate this better. Consider three processes: P1, P2 and P3, which are assigned `cpu.shares` of 5, 20 and 30, respectively.
  
negative.code: 
  * <%= vars.app_runtime_abbr %> allows admins to rate limit the maximum bandwidth consumed by single-app containers, configuring `rate` and `burst` properties on the `silk-cni` job.
  
  * <%= vars.app_runtime_abbr %> limits access to devices using cgroups but explicitly allows the following safe device nodes:
  	* `/dev/full`
  	* `/dev/fuse`
  	* `/dev/null`
  