anchor.diff:      image: {docker-image}
       command: >
         bash -c '
  -        if [[ ! -d config/certificates/certs ]]; then
  -          mkdir config/certificates/certs;
  +        yum install -y -q -e 0 unzip;
  +        if [[ ! -f /certs/bundle.zip ]]; then
  +          bin/elasticsearch-certutil cert --silent --pem --in config/certificates/instances.yml -out /certs/bundle.zip;
  +          unzip /certs/bundle.zip -d /certs; <1>
           fi;
  -        if [[ ! -f /local/certs/bundle.zip ]]; then
  -          bin/elasticsearch-certgen --silent --in config/certificates/instances.yml --out config/certificates/certs/bundle.zip;
  -          unzip config/certificates/certs/bundle.zip -d config/certificates/certs; <1>
  -        fi;
  -        chgrp -R 0 config/certificates/certs
  +        chown -R 1000:0 /certs
         '
  -    user: $\{UID:-1000\}
  +    user: "0"
       working_dir: /usr/share/elasticsearch
  -    volumes: ['.:/usr/share/elasticsearch/config/certificates']
  -----
  -
  -<1> The new node certificates and CA certificate+key are placed under the local directory `certs`.
  +    volumes: ['certs:/certs', '.:/usr/share/elasticsearch/config/certificates']
  +
  +volumes: {"certs"}
  +----
  +
  +<1> The new node certificates and CA certificate+key are placed in a docker volume `es_certs`.
   endif::[]
   
   [[getting-starter-tls-create-docker-compose]]
  
positive.code: --
  ["source","sh"]
  ----
  docker-compose -f create-certs.yml up
  ----
  --
  . Start two {es} nodes configured for SSL/TLS:
  
negative.code:       - xpack.security.transport.ssl.certificate_authorities=$CERTS_DIR/ca/ca.crt
        - xpack.security.transport.ssl.certificate=$CERTS_DIR/es01/es01.crt
        - xpack.security.transport.ssl.key=$CERTS_DIR/es01/es01.key
      volumes: ['data01:/usr/share/elasticsearch/data', 'certs:$CERTS_DIR']
      ports:
        - 9200:9200
      healthcheck:
  