anchor.diff:  
   When pushing an app, you specify either a Docker image on Docker Hub or a URI to a trusted Docker registry. Diego does not support using private registries.
   
  -###<a id='public'></a>Push a Docker Image using Docker Hub
  +###<a id='public'></a>Push a Docker Image Using Docker Hub
   
   Run `cf push test-app -o cloudfoundry/MY-DOCKER-IMAGE` to deploy a Docker image. Replace `MY-DOCKER-IMAGE` with the name of an image from an accessible Docker Registry.
   
  
positive.code: 
  <strong><%= modified_date %></strong>
  
  This topic provides information on how Docker works in Clouf Foundry and describes how to push an application with a Docker image. For information about Diego, see the [Diego Architecture](../concepts/diego/diego-architecture.html) topic.
  
  In addition to the default Linux environment provided by Cloud Foundry, operators can specify a Docker image that provides the file system used by the container. When pushing an app, you can specify the location of the docker image you want to use.
  
  A Docker image consists of a collection of layers. Each layer consists of one or both of the following:
  
  * Raw bits to download and mount. These bits form the file system.
  * Metadata that describes commands, users, and environment for the layer. This metadata includes the `ENTRYPOINT` and `CMD` directives, and is specified in the Dockerfile.
  
  ##<a id='create-container'></a>How Garden-Linux Creates Containers##
  
  Diego uses Garden-runC to construct Linux containers. Garden-runC uses OCI runC to build Linux containers with the same kernel resource isolation features used by all Linux containers: namespaces and cgroups. runC is also used by Docker Engine internally to build Linux containers.
  
  Linux container creation requires that a file system is mounted as the root file system of the container. Garden-runC supports mounting Docker images as root file systems for the containers it constructs. Garden-runC fetches and caches the individual layers associated with a Docker image, then combines and mounts them as the root file system, using the same libraries that power Docker.
  
  This process yields a container with contents that exactly match the contents of the associated Docker image.
  
  
negative.code: 
  <pre class='terminal'>$ cf push test-app -o cloudfoundry/test-app</pre>
  
  ###<a id='private'></a>Push a Docker Image Using Docker Trusted Registries
  
  To deploy a Docker image using Docker trusted registries, run:
  
   <pre class='terminal'>$ cf push my-app -o MY-PRIVATE-REGISTRY.DOMAIN:5000/image/name:v2</pre> 
  
  