anchor.diff:  
   ====
   
  +[[grant-a-service-account-access-to-the-privileged-scc]]
  +
  +=== Grant a Service Account Access to the Privileged SCC
  +
  +First, create a link:../dev_guide/service_accounts.html[service account].
  +For example, to create service account `My_SVCACCT` in project `My_Project`:
  +
  +====
  +----
  +$ cat <<EOF | oc create -n My_Project -f -
  +kind: ServiceAccount
  +apiVersion: v1
  +metadata:
  +  name: My_SVCACCT <1>
  +EOF
  +----
  +====
  +
  +Then, add the service account to the `privileged` SCC.
  +
  +----
  +$ oc edit scc privileged
  +----
  +
  +Add the following under `users`:
  +
  +----
  +   - system:serviceaccount:My_Project:My_SVCACCT
  +----
  +
   [[enable-images-to-run-with-user-in-the-dockerfile]]
   
   === Enable Images to Run with USER in the Dockerfile
  
positive.code: restricted   false     []        false     MustRunAs   MustRunAsRange
  ----
  ====
  
  [[creating-new-security-context-constraints]]
  
  
negative.code: 
  == Overview
  Security context constraints allow administrators to control permissions for pods.  To learn
  more about this API type please refer to the
  link:../architecture/additional_concepts/authorization.html#security-context-constraints[security
  context constraints] (SCCs) architecture documentation.  You may manage SCCs in your instance as normal API
  link:../architecture/core_concepts/overview.html[objects] using
  