anchor.diff:  
   [NOTE]
   ====
  -In order to preserve customized SCCs during upgrades editing settings on the default SCCs
  -other than priority, users, and groups is not recommended.
  +In order to preserve customized SCCs during upgrades, do not edit settings on
  +the default SCCs other than priority, users, and groups.
   ====
   
   . Edit the *restricted* SCC:
  
positive.code: 
  [[enable-dockerhub-images-that-require-root]]
  
  === Enable dockerhub images that require root
  
  Some Dockerhub images (examples: `postgres` and `redis`) require root access and have certain
  expectations about how volumes are owned.  For these images, add the service account to the
  `anyuid` SCC.
  
  ----
  $ oadm policy add-scc-to-user anyuid system:serviceaccount:myproject:mysvcacct
  
negative.code: 
  === Use the hostPath Volume Plug-in
  
  To relax the security in your cluster so that pods are allowed to use the
  `hostPath` volume plug-in without granting everyone access to the *privileged*
  SCC:
  
  . Edit the *restricted* SCC:
  +
  