anchor.diff:  
   <p class='note'><strong>Note</strong>: When launching an application on Diego, the Cloud Controller honors any user-specified overrides such as a custom start command or custom environment variables.</p>
   
  -##<a id='multi-tenant'></a>Docker in a Multi-Tenant World ##
  +##<a id='multi-tenant'></a>Docker Security Concerns in a Multi-Tenant Environment##
   
  -Since Docker allow users to fully specify the contents of their root file systems, the attack surface area for a Docker-based container running on Diego is somewhat higher than that of a buildpack application, which runs on a trusted root filesystem.
  +The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
   
   The Garden-Linux team has implemented a host of features to allow the platform to run Docker images more securely in a multi-tenant context. In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that uses cannot gain escalated privileges on the host even if they escalate privileges within a container.
   
  
positive.code: 
  This process yields a container with contents that exactly match the contents of the associated Docker image.
  
  ##<a id='run-monitor'></a>Running and Monitoring Processes with Diego ##
  
  Once Garden-Linux creates a container, Diego runs and monitors the processes inside of it.
  
  
negative.code: 
  * Diego does not currently support fetching images from private repositories.
  
  * Diego currently requires that the source registry for a Docker image be available when creating new application instances. If the registry is unavailable, Diego cannot start or restart applications.
  
  
  