anchor.diff:    verbs:
     - create
   ----
  -
  -
  -As cluster administrator, create the cluster role:
  -
  +====
  ++
  +As cluster administrator, create the new cluster role:
  ++
  +====
   ----
  -$ oc create -f  dockerstrategy.yaml
  +$ oc create -f dockerstrategy.yaml
   ----
  -
   ====
   
  -1. Assign the cluster role to an individual user
  +. Assign the new cluster role to a specific user. For example, to add the new *dockerbuilder* cluster role to the user *devuser*:
   +
  -.Assign role dockerbuilder to devuser
   ====
   
   ----
   $ oadm policy add-cluster-role-to-user dockerbuilder devuser
   ----
  -
   ====
  -
   
   [WARNING]
   ====
  -Granting access to a user a cluster level to the builds/docker subresource means that the user
  -will be able to create builds with the Docker strategy in any project in which they can create builds.
  -
  +Granting a user access at the cluster level to the *builds/docker* subresource
  +means that the user will be able to create builds with the Docker strategy in
  +any project in which they can create builds.
   ====
   
  +[[restricting-build-strategies-to-a-user-within-a-project]]
   
  -== Allowing only certain users in a specific project to create builds with a particular strategy
  +== Restricting Build Strategies to a User Within a Project
   
  -Similar to granting the build strategy role to a user globally:
  +Similar to granting the build strategy role to a user globally, to allow only a
  +set of specific users within a project to create builds with a particular
  +strategy:
   
  -1. link:#disabling-a-build-strategy-globally[Remove the build strategy resource from the default admin and edit roles].
  -1. link:#create-separate-role[Create a separate role for that build strategy]
  -1. Assign the role to an individual user in a project
  +. link:#disabling-a-build-strategy-globally[Remove the build strategy resource
  +from the default *admin* and *edit* roles].
  +. link:#create-separate-role[Create a separate role for that build strategy.]
  +. Assign the role to a specific user within a project. For example, to add the
  +new *dockerbuilder* role within the project *devproject* to the user *devuser*:
   +
  -.Assign role dockerbuilder to devuser in project devproject
   ====
   
   ----
   $ oadm policy add-role-to-user dockerbuilder devuser -n devproject
   ----
  -
   ====
  
positive.code:   - pods/portforward
  
  ...
  
  ----
  <1> Delete this line to disable Docker builds globally for users with the admin role.
  
  =====
  
  
  == Allowing only certain users to create builds with a particular strategy
  
  To allow only a set of specific users to create builds with a particular strategy:
  
  1. link:#disabling-a-build-strategy-globally[Remove the build strategy resource from the default admin and edit roles].
  1. Create a separate role for that build strategy
  +
  [#create-separate-role]
  .Create a separate role for the docker build strategy
  ====
  
  Create a file that defines the new cluster role (dockerstrategy.yaml):
  
  ----
  kind: ClusterRole
  apiVersion: v1
  
negative.code: 
  == Overview
  
  link:../architecture/core_concepts/builds_and_image_streams.html#builds[Builds]
  in OpenShift are run in
  link:install/prerequisites.html#security-warning[privileged containers] that
  have access to the Docker daemon socket. As a security measure, it is
  recommended to limit who can run builds and the strategy that is used for those
  builds.
  link:../architecture/core_concepts/builds_and_image_streams.html#docker-build[Docker
  builds] and
  link:../architecture/core_concepts/builds_and_image_streams.html#custom-build[Custom
  builds] are inherently less safe than
  link:../architecture/core_concepts/builds_and_image_streams.html#source-build[Source
  builds], given that they can execute any code in the build with potentially full
  access to the node's Docker socket.
  
  By default, project administrators (the
  link:../architecture/additional_concepts/authorization.html#roles[*admin* role])
  and project editors (the
  link:../architecture/additional_concepts/authorization.html#roles[*edit* role])
  are granted permission to use all build strategies (Docker, Source-to-Image, and
  Custom).
  
  You can control who can build with what build strategy using an
  link:../architecture/additional_concepts/authorization.html[authorization
  policy]. Each build strategy has a corresponding build subresource. Granting
  permission to *create* on the build subresource allows the user to create builds
  of that type.
  
  .Build Strategy Subresources
  [cols="1,1",options="header"]
  |===
  
  |Strategy |Subresource
  
  |Docker
  |builds/docker
  
  |Source-to-Image
  |builds/source
  
  |Custom
  