anchor.diff:  
   After Garden-runC creates a container, Diego runs and monitors the processes inside of it.
   
  -To determine which processes to run, the [Cloud Controller](../concepts/architecture/cloud-controller.html) fetches the metadata associated with the Docker image and returns it to the Cloud Controller. The Cloud Controller uses this metadata to perform the following actions:
  +To determine which processes to run, the [Cloud Controller](../concepts/architecture/cloud-controller.html) fetches the metadata associated with the Docker image and returns it to the Cloud Controller. 
  +The Cloud Controller uses this metadata to perform the following actions:
   
     * Runs the start command as the user specified in the Docker image
     * Instructs Diego and the [Gorouter](../concepts/architecture/router.html) to route traffic to the lowest-numbered port exposed in the Docker image
  
positive.code: 
  <strong><%= modified_date %></strong>
  
  This topic provides information on how Docker works in Clouf Foundry and describes how to push an application with a Docker image. For information about Diego, see the [Diego Architecture](../concepts/diego/diego-architecture.html) topic.
  
  In addition to the default Linux environment provided by Cloud Foundry, operators can specify a Docker image that provides the file system used by the container. When pushing an app, you can specify the location of the docker image you want to use.
  
  A Docker image consists of a collection of layers. Each layer consists of one or both of the following:
  
  * Raw bits to download and mount. These bits form the file system.
  * Metadata that describes commands, users, and environment for the layer. This metadata includes the `ENTRYPOINT` and `CMD` directives, and is specified in the Dockerfile.
  
  ##<a id='create-container'></a>How Garden-Linux Creates Containers##
  
  Diego uses Garden-runC to construct Linux containers. Garden-runC uses OCI runC to build Linux containers with the same kernel resource isolation features used by all Linux containers: namespaces and cgroups. runC is also used by Docker Engine internally to build Linux containers.
  
  Linux container creation requires that a file system is mounted as the root file system of the container. Garden-runC supports mounting Docker images as root file systems for the containers it constructs. Garden-runC fetches and caches the individual layers associated with a Docker image, then combines and mounts them as the root file system, using the same libraries that power Docker.
  
  This process yields a container with contents that exactly match the contents of the associated Docker image.
  
  
negative.code: 
  ##<a id='multi-tenant'></a>Docker Security Concerns in a Multi-Tenant Environment##
  
  The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application 
  because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
  
  The Garden-runC provides features that allow the platform to run Docker images more securely in a multi-tenant context. 
  In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that users cannot gain escalated privileges on the host even if they escalate privileges within a container.
  
  The Cloud Controller always runs Docker containers on Diego with user namespaces enabled. 
  This security restriction prevents certain features, such as the ability to mount FuseFS devices, from working in Docker containers.
  
  To mitigate security concerns, Cloud Foundry recommends that you run only trusted Docker containers on the platform. 
  By default, the Cloud Controller does not allow Docker-based applications to run on the platform.
  
  To allow Docker-based applications to run, a Cloud Controller administrator can enable the `diego_docker` feature flag with the following command:
  <pre class='terminal'>
  