anchor.diff:  - ID range checking is enforced, and
   - the group ID of *5555* is allowed.
   
  -It is better to create new SCCs versus modifying a predefined SCC, or changing
  -the range of allowed IDs in the predefined projects.
  +It is often better to create a new SCC rather than modifying a predefined SCC, or
  +changing the range of allowed IDs in the predefined projects.
   
   The easiest way to create a new SCC is to export an existing SCC and customize
   the YAML file to meet the requirements of the new SCC. For example:
  
positive.code: ====
  
  When the same pod shown earlier runs against this new SCC (assuming, of course,
  the pod has access to the new SCC), it will start because the group *5555*,
  supplied in the pod definition, is now allowed by the custom SCC.
  
  [[fsgroup]]
  
negative.code: perform range checking, thus allowing any group ID, and produces no default
  groups.
  <7> *MustRunAsRange* enforces user ID range checking and provides a UID default.
  Based on this SCC, the default UID is 1000100000 (the minimum value). If the minimum
  and maximum range were omitted from the SCC, the default user ID would be
  1000000000 (derived from the project). *MustRunAsNonRoot* and *RunAsAny* are
  the other supported types. The range of allowed IDs can be defined to include
  any user IDs required for the target storage.
  <8> When set to *MustRunAs*, the container is created with the SCC's SELinux
  options, or the MCS default defined in the project. A type of *RunAsAny*
  indicates that SELinux context is not required, and, if not defined in the pod,
  