anchor.diff:  
   == Overview
   
  -Builds in OpenShift are run in privileged containers that have access to the Docker daemon socket. As a security
  -measure, it is recommended to limit who can run builds and the strategy that is used for those builds. Docker and Custom
  -builds are inherently less safe than Source builds, given that they can execute any code in the build with
  -potentially full access to the node's Docker socket.
  +link:../architecture/core_concepts/builds_and_image_streams.html#builds[Builds]
  +in OpenShift are run in
  +link:install/prerequisites.html#security-warning[privileged containers] that
  +have access to the Docker daemon socket. As a security measure, it is
  +recommended to limit who can run builds and the strategy that is used for those
  +builds.
  +link:../architecture/core_concepts/builds_and_image_streams.html#docker-build[Docker
  +builds] and
  +link:../architecture/core_concepts/builds_and_image_streams.html#custom-build[Custom
  +builds] are inherently less safe than
  +link:../architecture/core_concepts/builds_and_image_streams.html#source-build[Source
  +builds], given that they can execute any code in the build with potentially full
  +access to the node's Docker socket.
   
  -By default, project administrators (`admin` role) and project editors (`edit` role) are granted
  -permission to use all build strategies (Docker, Source-to-Image, and Custom).
  +By default, project administrators (the
  +link:../architecture/additional_concepts/authorization.html#roles[*admin* role])
  +and project editors (the
  +link:../architecture/additional_concepts/authorization.html#roles[*edit* role])
  +are granted permission to use all build strategies (Docker, Source-to-Image, and
  +Custom).
   
  -Who can build with what build strategy can be controlled via an
  -link:../architecture/additional_concepts/authorization.html[authorization policy].
  -Each build strategy has a corresponding build subresource. Granting permission to `create` on the
  -build subresource will allow the user to create builds of that type.
  +You can control who can build with what build strategy using an
  +link:../architecture/additional_concepts/authorization.html[authorization
  +policy]. Each build strategy has a corresponding build subresource. Granting
  +permission to *create* on the build subresource allows the user to create builds
  +of that type.
   
  -.Build strategy subresources
  +.Build Strategy Subresources
   [cols="1,1",options="header"]
   |===
   
  -|Strategy |Resource
  +|Strategy |Subresource
   
   |Docker
   |builds/docker
   
  -|Source-To-Image
  +|Source-to-Image
   |builds/source
   
   |Custom
  
positive.code:   - pods/portforward
  
  ...
  
  ----
  <1> Delete this line to disable Docker builds globally for users with the admin role.
  
  =====
  
  
  == Allowing only certain users to create builds with a particular strategy
  
  To allow only a set of specific users to create builds with a particular strategy:
  
  1. link:#disabling-a-build-strategy-globally[Remove the build strategy resource from the default admin and edit roles].
  1. Create a separate role for that build strategy
  +
  [#create-separate-role]
  .Create a separate role for the docker build strategy
  ====
  
  Create a file that defines the new cluster role (dockerstrategy.yaml):
  
  ----
  kind: ClusterRole
  apiVersion: v1
  
negative.code: 
  For each role, remove the line that corresponds to the resource of the strategy to disable:
  
  .Disable the Docker Build Strategy for *admin*
  =====
  
  ----
  