anchor.diff:    - pods/portforward
   
   ...
  -
   ----
  -<1> Delete this line to disable Docker builds globally for users with the admin role.
  -
  +<1> Delete this line to disable Docker builds globally for users with the
  +*admin* role.
   =====
   
  +[[restricting-build-strategies-to-a-user-globally]]
   
  -== Allowing only certain users to create builds with a particular strategy
  +== Restricting Build Strategies to a User Globally
   
  -To allow only a set of specific users to create builds with a particular strategy:
  +To allow only a set of specific users to create builds with a particular
  +strategy:
   
  -1. link:#disabling-a-build-strategy-globally[Remove the build strategy resource from the default admin and edit roles].
  -1. Create a separate role for that build strategy
  +. link:#disabling-a-build-strategy-globally[Remove the build strategy
  +subresource from the default *admin* and *edit* roles].
  +
  +. [[create-separate-role]]Create a separate role for the build strategy. For
  +example, create a *_dockerstrategy.yaml_* file that defines a separate role for
  +the Docker build strategy:
   +
  -[#create-separate-role]
  -.Create a separate role for the docker build strategy
   ====
   
  -Create a file that defines the new cluster role (dockerstrategy.yaml):
  -
  +[source,yaml]
   ----
   kind: ClusterRole
   apiVersion: v1
  
positive.code: = Securing Builds by Build Strategy
  {product-author}
  {product-version}
  :data-uri:
  
negative.code:   verbs:
    - create
  ----
  ====
  +
  As cluster administrator, create the new cluster role:
  +
  ====
  ----
  $ oc create -f dockerstrategy.yaml
  ----
  ====
  
  . Assign the new cluster role to a specific user. For example, to add the new *dockerbuilder* cluster role to the user *devuser*:
  +
  ====
  
  ----
  $ oadm policy add-cluster-role-to-user dockerbuilder devuser
  ----
  ====
  
  [WARNING]
  ====
  Granting a user access at the cluster level to the *builds/docker* subresource
  means that the user will be able to create builds with the Docker strategy in
  any project in which they can create builds.
  ====
  
  [[restricting-build-strategies-to-a-user-within-a-project]]
  
  == Restricting Build Strategies to a User Within a Project
  
  Similar to granting the build strategy role to a user globally, to allow only a
  set of specific users within a project to create builds with a particular
  strategy:
  
  . link:#disabling-a-build-strategy-globally[Remove the build strategy resource
  from the default *admin* and *edit* roles].
  . link:#create-separate-role[Create a separate role for that build strategy.]
  . Assign the role to a specific user within a project. For example, to add the
  new *dockerbuilder* role within the project *devproject* to the user *devuser*:
  +
  ====
  
  ----
  $ oadm policy add-role-to-user dockerbuilder devuser -n devproject
  ----
  ====
  