anchor.diff:  specific to individual containers (or both). A user ID is supplied as shown in
   the pod definition fragment below:
   
  -[[pod-user-id-65534]]
  +[[pod-user-id-1000100001]]
   ====
   [source,yaml]
   ----
  
positive.code: group *5555*) will be members of the group *5555* and have access to the volume,
  regardless of the container's user ID. However, the assumption above is
  critical. Sometimes, the SCC does not define a range of allowable group IDs but
  requires group ID validation (due to `*supplementalGroups*` set to *MustRunAs*;
  note this is not the case for the *restricted* SCC). The project will not likely
  allow a group ID of *5555*, unless the project has been customized for access to
  this NFS export. So in this scenario, the above pod will fail because its group
  ID of *5555* is not within the SCC's or the project's range of allowed group
  IDs.
  
  
negative.code:   containers:
    - name: ...
      securityContext:
        runAsUser: 1000100001
  ----
  ====
  
  ID 1000100001 in the above is container-specific and matches the owner ID on the
  export. If the NFS export's owner ID was *54321*, then that number would be used
  in the pod definition. Specifying `*securityContext*` outside of the container
  definition makes the ID global to all containers in the pod.
  