anchor.diff:  
   == Unit configuration
   
  -See http://0pointer.de/public/systemd-man/systemd.exec.html[systemd.exec].
  +See https://www.freedesktop.org/software/systemd/man/systemd.exec.html[systemd.exec].
   
   [source,shell]
   ----
  
positive.code: <6> "Controls which capabilities to include in the capability bounding set for the executed process."
  <7> "If true, sets up a new /dev namespace for the executed processes and only adds API pseudo devices such as /dev/null, /dev/zero or /dev/random (as well as the pseudo TTY subsystem) to it"
  <8> "Sets the Unix user or group that the processes are executed as, respectively"
  
  === /etc/systemd/system/nginx.service example
  
  
negative.code: CapabilityBoundingSet= // <6>
  PrivateDevices= // <7>
  User=, Group= // <8>
  DynamicUser= // <9>
  ----
  
  <1> "sets up a new file system namespace for the executed processes and mounts private /tmp and /var/tmp directories inside it that is not shared by processes outside of the namespace."
  