anchor.diff:  
   ====
   
  +[[grant-a-service-account-access-to-the-privileged-scc]]
  +
  +=== Grant a Service Account Access to the Privileged SCC
  +
  +First, create a link:../dev_guide/service_accounts.html[service account].
  +For example, to create service account `My_SVCACCT` in project `My_Project`:
  +
  +====
  +----
  +$ cat <<EOF | oc create -n My_Project -f -
  +kind: ServiceAccount
  +apiVersion: v1
  +metadata:
  +  name: My_SVCACCT <1>
  +EOF
  +----
  +====
  +
  +Then, add the service account to the `privileged` SCC.
  +
  +----
  +$ oc edit scc privileged
  +----
  +
  +Add the following under `users`:
  +
  +----
  +   - system:serviceaccount:My_Project:My_SVCACCT
  +----
  +
   [[enable-images-to-run-with-user-in-the-dockerfile]]
   
   === Enable Images to Run with USER in the Dockerfile
  
positive.code: groups:
  - my-admin-group
  ----
  ====
  
  Then, run `oc create` passing the file to create it:
  
negative.code: restricted   false     []        false     MustRunAs   MustRunAsRange
  ----
  ====
  
  [[examining-a-security-context-constraints-object]]
  
  == Examining a Security Context Constraints Object
  
  To examine a particular SCC, use `oc get`, `oc describe`, `oc export`, or `oc edit`.
  
  ====
  ----
  $ oc edit scc restricted
  allowHostDirVolumePlugin: false
  allowHostNetwork: false
  allowHostPorts: false
  allowPrivilegedContainer: false
  allowedCapabilities: null
  apiVersion: v1
  groups:
  - system:authenticated
  kind: SecurityContextConstraints
  metadata:
    creationTimestamp: 2015-09-08T07:37:54Z
    name: restricted <1>
    resourceVersion: "58"
    selfLink: /api/v1/securitycontextconstraints/restricted
    uid: 849d9228-55fc-11e5-976b-080027c5bfa9
  runAsUser:
    type: MustRunAsRange
  seLinuxContext:
    type: MustRunAs
  ----
  <1> The SCC name specified in the `oc edit` command.
  ====
  
  
  [[creating-new-security-context-constraints]]
  
  