anchor.diff:  
   ##<a id='push-docker'></a>Push a Docker Image with the cf CLI
   
  -Follow these instructions to deploy updated or new Docker images using the Cloud Foundry Command Line Interface (cf CLI).
  +Follow these instructions to deploy updated or new Docker images using the 
  +Cloud Foundry Command Line Interface (cf CLI).
   
  -To perform the procedures in this topic, you must install cf CLI v6.13.0 or later. See <a href="../cf-cli/install-go-cli.html">Installing the cf CLI</a> for more information.
  -For information about pushing a Docker image with a previous version of the cf CLI, see <a href= 'https://github.com/cloudfoundry-incubator/diego-design-notes/blob/master/docker-support.md'>Docker Support in CF + Diego</a>.
  +To perform the procedures in this topic, you must install cf CLI v6.13.0 or 
  +later. 
  +See <a href="../cf-cli/install-go-cli.html">Installing the cf CLI</a> for more 
  +information.
  +For information about pushing a Docker image with a previous version of the cf 
  +CLI, see <a href= 'https://github.com/cloudfoundry-incubator/diego-design-notes/blob/master/docker-support.md'>Docker Support in CF + Diego</a>.
   
  -When pushing an app, you specify either a Docker image on Docker Hub or a URI to a trusted Docker registry. Diego does not support using private registries.
  +When pushing an app, you specify either a Docker image on Docker Hub or a URI 
  +to a trusted Docker registry. 
  +Diego does not support using private registries.
   Also, when using Diego, you must use a registry that supports the <a href="https://docs.docker.com/registry/spec/api/">Docker Registry API V2</a>.
   
   ###<a id='public'></a>Push a Docker Image Using Docker Hub
   
  -Run `cf push test-app -o cloudfoundry/MY-DOCKER-IMAGE` to deploy a Docker image. Replace `MY-DOCKER-IMAGE` with the name of an image from an accessible Docker Registry.
  +Run `cf push test-app -o cloudfoundry/MY-DOCKER-IMAGE` to deploy a Docker 
  +image. 
  +Replace `MY-DOCKER-IMAGE` with the name of an image from an accessible Docker 
  +Registry.
   
  -For example, the following command pushes the `test-app` on Docker Hub to Cloud Foundry:
  +For example, the following command pushes the `test-app` on Docker Hub to Cloud 
  +Foundry:
   
   <pre class='terminal'>$ cf push test-app -o cloudfoundry/test-app</pre>
   
  
positive.code: 
  ##<a id='multi-tenant'></a>Docker Security Concerns in a Multi-Tenant Environment##
  
  The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application
  because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
  
  Garden-runC provides features that allow the platform to run Docker images more securely in a multi-tenant context.
  In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that users cannot gain escalated privileges on the host even if they escalate privileges within a container.
  
  The Cloud Controller always runs Docker containers on Diego with user namespaces enabled.
  This security restriction prevents certain features, such as the ability to mount FuseFS devices, from working in Docker containers.  It is possible for Docker applications to use fuse mounts via <a href="#volume">volume services</a>, but not possible to directly mount fuse devices from within the container.
  
  To mitigate security concerns, Cloud Foundry recommends that you run only trusted Docker containers on the platform.
  By default, the Cloud Controller does not allow Docker-based applications to run on the platform.
  
  To allow Docker-based applications to run, a Cloud Controller administrator can enable the `diego_docker` feature flag with the following command:
  <pre class='terminal'>
  $ cf enable-feature-flag diego_docker
  </pre>
  
  To disallow Docker-based applications, a Cloud Controller administrator can run the following command:
  
  <pre class='terminal'>
  $ cf disable-feature-flag diego_docker
  
negative.code: This topic provides information about how Docker works in Cloud Foundry and describes how to push an application with a Docker image.
  For information about Diego, see the [Diego Architecture](../concepts/diego/diego-architecture.html) topic.
  
  In addition to the default Linux environment provided by Cloud Foundry, 
  operators can specify a Docker image that provides the file system used by the 
  container.
  When pushing an app, you can specify the location of the docker image you want 
  to use.
  
  A Docker image consists of a collection of layers.
  Each layer consists of one or both of the following:
  