anchor.diff:  For more information about command-line parameters for `docker start`, see [docker
   start](https://docs.docker.com/engine/reference/commandline/start/) in the Docker Documentation.
   
  -##<a id='public'></a>Push a Docker Image From Docker Hub
  +##<a id='registry'></a>Push a Docker Image from a Registry
  +
  +<%= vars.app_runtime_full %> (<%= vars.app_runtime_abbr %>) supports pushing apps from container registries such as Docker Hub, Google Container Registry (GCR), and Amazon Elastic Container Registry (ECR).
  +
  +How you run `cf push` with apps stored in container registries depends on which registry you use and how it authenticates requests for the container image.
  +
  +The sections below explain how to push apps under different container registry scenarios.
  +
  +###<a id='public'></a>Docker Hub
   
   To deploy a Docker image from a Docker Hub repository, run `cf push APP-NAME --docker-image REPO/IMAGE:TAG`. Replace the placeholder values in the command as follows:
   
  -* `APP-NAME`: The name of the app being pushed
  +* `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
   * `REPO`: The name of the repository where the image is stored
  -* `IMAGE`: The name of an image from Docker Hub
  +* `IMAGE`: The name of the app image on Docker Hub
   * `TAG`: (Optional, recommended) The tag or version for the image
   
   For example, the following command pushes the `my-image` image from Docker Hub to a Cloud Foundry app:
   
   <pre class='terminal'>$ cf push my-app --docker-image cloudfoundry/my-image</pre>
   
  -##<a id='private'></a>Push a Docker Image from a Private Registry
  +###<a id='private'></a>Private Container Registry without Authentication
   
   As an alternative to Docker Hub, you can use any Docker image registry that presents a valid certificate for HTTPS traffic, such as a company-internal Docker registry.
   
  -To deploy a Docker image using a specified Docker registry, run `cf push APP-NAME --docker-image MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO/IMAGE:TAG`. Replace the placeholder values in the command as follows:
  -
  -* `APP-NAME`: The name of the app being pushed
  +To push an app as a Docker image using a specified Docker registry, run `cf push APP-NAME --docker-image MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO/IMAGE:TAG`. Replace the placeholder values in the command as follows:
  +
  +* `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
   * `MY-PRIVATE-REGISTRY.DOMAIN`: The path to the Docker registry
   * `PORT`: The port where the registry serves traffic
   * `REPO`: The name of the repository where the image is stored
  -* `IMAGE`: The name of the image being pushed
  +* `IMAGE`: The name of the app image being pushed
   * `TAG`: (Optional, but recommended) The tag or version for the image
   
   For example, the following command pushes the `v2` version of the `my-image` image from the `my-repo` repository of the `internal-registry.example.com` registry on port `5000`:
  
positive.code:   gcloud projects add-iam-policy-binding MY-PROJECT --member serviceAccount:MY-ACCOUNT<span>@</span>MY-PROJECT-ID.iam.gserviceaccount.com --role roles/storage.objectViewer
    </pre>
  
  ### Step 2: Deploy the GCP Image
  
  Run the following command to deploy your GCR image using the cf CLI: 
  `CF_DOCKER_PASSWORD="$(cat key.json)" cf push APP-NAME --docker-image docker://MY-REGISTRY-URL/MY-PROJECT/MY-IMAGE-NAME --docker-username _json_key`
  
negative.code: <pre class='terminal'>$ cf push my-app --docker-image internal-registry.example.com:5000/my-repo/my-image:v2
  </pre>
  
  ###<a id='private-repo'></a>Private Container Registry with Basic Authentication
  
  Many Docker registries control access to Docker images by authenticating with a username and password.
  
  * To push an app as a Docker image from a registry that uses basic username and password authentication, run the following command:
  
      ```
      $ CF_DOCKER_PASSWORD=YOUR-PASSWORD cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username USER
      ```
  
      Where:
      - `YOUR-PASSWORD`: The password to use for authentication with the Docker registry
          - Setting `CF_DOCKER_PASSWORD` prepended to the `cf push --docker-image` makes the value temporary, which is more secure than setting the environment variable indefinitely with `export`
      - `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
      - `REPO`: The repository where the image is stored:
          - For Docker Hub, this is just the repository name
          - For a private registry, this includes the registry address and port, as described in [Push a Docker Image from a Private Registry](#private), in the format: `MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO`
      - `IMAGE`: The name of the app image being pushed
      - `TAG`: (Optional, but recommended) The tag or version for the image
      - `USER`: The username to use for authentication with the registry
  
  ###<a id='ecr'></a>Amazon Elastic Container Registry (ECR)
  
  <%= vars.app_runtime_abbr %> supports pushing apps from images hosted on Amazon Web Services ECR, which authenticates with temporary password tokens.
  
  * To push an app as a Docker image from ECR:
  
      ```
      $ CF_DOCKER_PASSWORD=AWS-SECRET-ACCESS-KEY cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username AWS-ACCESS-KEY-ID
      ```
  
      Where:
      - `AWS-SECRET-ACCESS-KEY`: the AWS Secret Access Key for the IAM user accessing the ECR registry
          - Setting `CF_DOCKER_PASSWORD` prepended to the `cf push --docker-image` makes the value temporary, which is more secure than setting the environment variable indefinitely with `export`
      - `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
      - `REPO`: The ECR repository containing the image being pushed
      - `IMAGE`: The name of the app image being pushed
      - `TAG`: (Optional, but recommended) The tag or version for the image
      - `AWS-ACCESS-KEY-ID`: The AWS Access Key ID for the IAM user accessing the ECR registry
  
  **How it Works**: Running `cf push` with an ECR registry triggers <%= vars.app_runtime_abbr %> to:
  
    1. Use the AWS Secret Access Key and Access Key ID to retrieve the temporary ECR username and password.
    1. Use the temporary tokens to retrieve the image.
  
  ###<a id='gcr'></a>Google Container Registry (GCR)
  
  <%= vars.product_name %> supports pushing apps from images hosted on Google Container Registry (GCR) service. This feature requires that you use [json_key based authentication](https://cloud.google.com/container-registry/docs/advanced-authentication#using_a_json_key_file).
  
  #### Step 1: Authenticate with GCR
  
  To authenticate with GCR using <%= vars.product_name %>, you must create a JSON key file and associate it with your project:
  
  