anchor.diff:  	* `CAP_SYSLOG`
   	* `CAP_WAKE_ALARM`
   	* `CAP_BLOCK_SUSPEND`
  -	* `CAP_SYS_ADMIN` (for unprivileged containers)
  +	* `CAP_SYS_ADMIN` for unprivileged containers
     <br>
     <br>
     For more information about Linux capabilities, see [capabilities - overview of Linux capabilities](http://manpages.ubuntu.com/manpages/xenial/en/man7/capabilities.7.html) in the Ubuntu documentation.
  
positive.code: 
  ## <a id='networking'></a> Inbound and Outbound Traffic from <%= vars.app_runtime_abbr %>
  
  ### <a id='net-overview'></a> Networking Overview
  
  A host VM has a single IP address. If you configure the deployment with the cluster on a VLAN, as <%= vars.company_name %> recommends, then all traffic goes through the following levels of network address translation, as shown in the diagram below.
  
negative.code: 
  * Running app instances in unprivileged containers by default. For more information, see [Types](#types).
  
  * Hardening containers by limiting functionality and access rights. For more information, see [Hardening](#hardening).
  
  * <%= vars.app_sec_groups_default %> <%= vars.app_sec_groups_link %>
  
  