anchor.diff:       max: 6000
   ...
   ----
  -<1> The `allow*` bools are the same as for the *restricted* SCC.
  +<1> The `allow` booleans are the same as for the *restricted* SCC.
   <2> Name of the new SCC.
   <3> Numerically larger numbers have greater priority. Nil or omitted is the lowest
   priority. Higher priority SCCs sort before lower priority SCCs and thus have a
   better chance of matching a new pod.
  -<4> `*supplementalGroups*` is a strategy and it is set to *MustRunAs*, which means
  +<4> `supplementalGroups` is a strategy and it is set to *MustRunAs*, which means
   group ID checking is required.
   <5> Multiple ranges are supported. The allowed group ID range here is 5000 through
   5999, with the default supplemental group being 5000.
  
positive.code: are applied to the actual, physical block device. Typically, block storage is
  not shared.
  
  A `*fsGroup*` definition is shown below in the following pod definition
  fragment:
  
  ====
  
negative.code: <3> Numerically larger numbers have greater priority. Nil or omitted is the lowest
  priority. Higher priority SCCs sort before lower priority SCCs, and thus have a
  better chance of matching a new pod.
  <4> The `runAsUser` strategy is set to *MustRunAsRange*, which means UID range
  checking is enforced.
  <5> The UID range is 1000100001 through 1000100001 (a range of one value).
  
  Now, with `runAsUser: 1000100001` shown in the previous pod definition fragment,
  the pod matches the new *nfs-scc* and is able to run with a UID of 1000100001.
  
  [[selinuxoptions]]
  == SELinux Options
  
  All predefined SCCs, except for the *privileged* SCC, set the `seLinuxContext`
  to *MustRunAs*. So the SCCs most likely to match a pod's requirements will force
  the pod to use an SELinux policy. The SELinux policy used by the pod can be
  defined in the pod itself, in the image, in the SCC, or in the project (which
  provides the default).
  
  SELinux labels can be defined in a pod's `securityContext.seLinuxOptions`
  section, and supports `user`, `role`, `type`, and `level`:
  
  [NOTE]
  ====
  Level and MCS label are used interchangeably in this topic.
  ====
  
  ----
  ...
   securityContext: <1>
  