anchor.diff:  
   * <%= vars.app_runtime_abbr %> allows admins to rate limit the maximum bandwidth consumed by single-app containers, configuring `rate` and `burst` properties on the `silk-cni` job.
   
  -* <%= vars.app_runtime_abbr %> limits access to devices using cgroups but explicitly whitelists the following safe device nodes:
  +* <%= vars.app_runtime_abbr %> limits access to devices using cgroups but explicitly allows the following safe device nodes:
   	* `/dev/full`
   	* `/dev/fuse`
   	* `/dev/null`
  
positive.code: The calculation of the CPU usage based on the percentage of the total CPU power available is quite sophisticated and is performed regularly as the CPU demands of the various containers fluctuates. Specifically, the percentage of CPU cycles a cgroup gets can be calculated by dividing the `cpu.shares` it holds by the sum of the `cpu.shares` of all the cgroups that are currently doing CPU activity, as shown in the following calculation:
  
  ```
  process\_cpu\_share\_percent = cpu.shares / sum\_cpu\_shares * 100
  ```
  
  In <%= vars.app_runtime_abbr %>, cgroup shares range from 10 to 1024, with 1024 being the default. The actual amount of shares a cgroup gets can be read from the `cpu.shares` file of the cgroup configurations pseudo-file-system available in the container at `/sys/fs/cgroup/cpu`.
  
negative.code: 
  ## <a id='networking'></a> Inbound and Outbound Traffic from <%= vars.app_runtime_abbr %>
  
  This section provides an overview of container networking and describes how <%= vars.app_runtime_abbr %> admins customize container network traffic rules for their deployment.
  
  ### <a id='net-overview'></a> Networking Overview
  
  A host VM has a single IP address. If you configure the deployment with the cluster on a VLAN, as <%= vars.company_name %> recommends, then all traffic goes through the following levels of network address translation, as shown in the diagram below.
  