anchor.diff:  resource usage.
   These are common kernel resource isolation features used by all Linux 
   containers.
  +
  +<%= vars.garden_runc %>
   
   Before Garden-runC creates a Linux container, it creates a file system that is 
   mounted as the root file system of the container.
  
positive.code: The Cloud Controller always runs Docker containers on Diego with user 
  namespaces enabled.
  This security restriction prevents certain features, such as the ability to mount FuseFS devices, from working in Docker containers.
  Docker applications can use fuse mounts through [volume services](#volume), but they cannot directly mount fuse devices from within the container.
  
  To mitigate security concerns, Cloud Foundry recommends that you run only 
  trusted Docker containers on the platform.
  By default, the Cloud Controller does not allow Docker-based applications to 
  run on the platform.
  
  To allow Docker-based applications to run, a Cloud Controller administrator can 
  enable the `diego_docker` feature flag with the following command:
  <pre class='terminal'>
  $ cf enable-feature-flag diego_docker
  </pre>
  
  To disallow Docker-based applications, a Cloud Controller administrator can run 
  the following command:
  
  <pre class='terminal'>
  $ cf disable-feature-flag diego_docker
  </pre>
  
  <p class='note'><strong>Note</strong>: Disabling the <code>diego_docker</code> feature flag stops all Docker-based apps in your deployment within a few convergence cycles, on the order of a minute.</p>
  
  ##<a id='push-docker'></a>Push a Docker Image
  
  Follow these instructions to deploy updated or new Docker images using the 
  [Cloud Foundry Command Line Interface (cf CLI)](../cf-cli/install-go-cli.html).
  
  When pushing an app, you specify either a Docker image on Docker Hub or the URI 
  to a Docker registry. <% vars.docker_auth1 %> 
  
  Also, when using a Docker image with Cloud Foundry, you must use a registry that does the following:
  
  * Supports the [Docker Registry API V2](https://docs.docker.com/registry/spec/api/)
  * Presents a valid certificate for HTTPS traffic
  
  ###<a id='public'></a>Push a Docker Image Using Docker Hub
  
  To deploy a Docker image using Docker Hub, run the following command:
  
  <pre class='terminal'>$ cf push APP-NAME --docker-image REPO/IMAGE</pre>
  
  Replace the following values in the command above:
  
  * `APP-NAME`: the name of the app being pushed
  * `REPO`: the name of the repository where the image is stored
  * `IMAGE`: the name of an image from Docker Hub
  
  For example, the following command pushes the `my-image` image from Docker Hub to a Cloud Foundry app:
  
  <pre class='terminal'>$ cf push my-app --docker-image cloudfoundry/my-image</pre>
  
  ###<a id='private'></a>Push a Docker Image from Another Registry
  
  As an alternative to Docker Hub, you can use any Docker image registry that presents a valid certificate for HTTPS traffic.
  
  To deploy a Docker image using a specified Docker registry, run the following command:
  
  <pre class='terminal'>$ cf push APP-NAME --docker-image MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO/IMAGE:TAG
  </pre>
  
  Replace the following values in the command above:
  
  * `APP-NAME`: the name of the app being pushed
  * `MY-PRIVATE-REGISTRY.DOMAIN`: the path to the Docker registry
  * `PORT`: the port where the registry serves traffic
  * `REPO`: the name of the repository where the image is stored
  * `IMAGE`: the name of the image being pushed
  * `TAG`: the tag or version for the image
  
  For example:
   
  <pre class='terminal'>$ cf push my-app --docker-image internal-registry.example.com:5000/my-repo/my-image:v2
  </pre>
  
  ###<a id='private-repo'></a>Push a Private Docker Image
  
  Most Docker registries support authentication mechanisms in order to control access to Docker images.
  
  To deploy a Private Docker image, run the following command:
  
  <pre class='terminal'>$ cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username USER
  </pre>
  
  Replace the following values in the command above:
  
  * `APP-NAME`: the name of the app being pushed
  * `REPO`: the name of the repository where the image is stored
  * `IMAGE`: the name of the image being pushed
  * `USER`: the username that should be used for the authentication with the registry
  * `TAG`: the tag or version for the image
  
  A password for `USER` must also be provided by specifying the `CF_DOCKER_PASSWORD` environment variable. 
  For example:
  
  <pre class='terminal'>$ export CF_DOCKER_PASSWORD=yourpassword</pre>
  
  To deploy a private Docker image using a specified Docker registry, run the following command:
  
  <pre class='terminal'>$ cf push APP-NAME --docker-image MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO/IMAGE:TAG --docker-username USER
  </pre>
  
  See [the previous section](#private) for replacing `MY-PRIVATE-REGISTRY.DOMAIN` and `PORT` with the appropriate values.
  
  ###<a id='volume'></a> Docker Volume Support
  
  Diego supports Docker volumes. 
  For more information about enabling volume support, see the [Using an External File System (Volume Services)](../devguide/services/using-vol-services.html) topic.
  For information about the limitations of NFS volumes, see the [NFS Bosh Volume Release](https://github.com/cloudfoundry-incubator/nfs-volume-release#special-notes-for-docker-image-based-apps).
  
  
  
negative.code: 
  These actions produce a container whose contents exactly match the contents of 
  the associated Docker image.
  
  Earlier 
  versions of Diego used Garden-Linux. For more information, see the 
  [Garden](../concepts/architecture/garden.html) topic.
  
  ##<a id='run-monitor'></a>How Diego Runs and Monitors Processes ##
  
  