anchor.diff:  
   To authenticate with GCR using <%= vars.product_name %>, you must create a JSON key file and associate it with your project:
   
  -1. Create a GCP service account. See [Creating and Enabling Service Accounts for Instances](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances).
  +1. Create a GCP service account. See [Creating and Enabling Service Accounts for Instances](https://cloud.google.com/compute/docs/access/create-enable-service-accounts-for-instances). 
     <pre class="terminal">
     $ gcloud iam service-accounts create MY-ACCOUNT --display-name "MY DISPLAY NAME"
     </pre>
  
positive.code: 
  ###<a id='cf-ssh'></a>Requirement for cf ssh Support
  
  If you want to log in to your app container using the <code>cf ssh</code> command, you must make a shell such as <code>sh</code> or <code>bash</code> available in the container.
  
  The SSH server in the container looks for the following executables in absolute locations or the <code>PATH</code> environment variable:
  <ul>
  
negative.code: 
  <%= vars.app_runtime_abbr %> supports pushing apps from images hosted on Amazon Web Services ECR, which authenticates with temporary password tokens.
  
  * To push an app as a Docker image from ECR:
  
      ```
      $ CF_DOCKER_PASSWORD=AWS_ECR_PASSWORD cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username AWS_ECR_USER
      ```
  
      Where:
      - `AWS_ECR_USER`: the user returned by the `aws ecr get-login --no-include-email` command. It usually is `AWS`
          - Setting `CF_DOCKER_PASSWORD` prepended to the `cf push --docker-image` makes the value temporary, which is more secure than setting the environment variable indefinitely with `export`
      - `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
      - `REPO`: The ECR repository containing the image being pushed
      - `IMAGE`: The name of the app image being pushed
      - `TAG`: (Optional, but recommended) The tag or version for the image
      - `AWS_ECR_PASSWORD`: the long password returned by the `aws ecr get-login --no-include-email` command. 
  
  **How it Works**: Running `cf push` with an ECR registry triggers <%= vars.app_runtime_abbr %> to:
  
  