anchor.diff:  
   ### <a id='overview'></a> Overview
   
  -Container-to-container networking integrates with [Garden-runC](./architecture/garden.html#garden-runc) in a [Diego](./diego/diego-architecture.html) deployment. The [CF Networking Release](https://github.com/cloudfoundry-incubator/cf-networking-release) includes several core components, as well as swappable components. 
  +Container-to-container networking integrates with [Garden-runC] in a Diego deployment. The CF Networking Release includes several core components, as well as swappable components. For more information about Garden-runC, see [Garden-runC](./architecture/garden.html#garden-runc) in _Garden_. For more information about Diego, see [Diego Components and Architecture](./diego/diego-architecture.html). For more information about the CF Networking release, see [CF Networking Release](https://github.com/cloudfoundry-incubator/cf-networking-release) on GitHub.
   
   To understand the components and how they work, see the diagram and tables below. The diagram highlights <%= vars.app_runtime_abbr %> components in blue and green. The diagram also highlights swappable components in red.
   
  
positive.code:     <td>Policy Server</td>
      <td>A central management node that:
        <ul>
          <li>Maintains a database of policies for traffic between apps. 
              The cf CLI calls an API to create or update a record in the policy database whenever you create or remove a policy.</li>
          <li>Exposes a JSON REST API used by the cf CLI. This API serves traffic using TLS.</li>
        </ul></td>
    </tr>
    <tr>
      <td>Garden External Networker</td>
      <td> 
        A Garden-runC add-on deployed to every Diego Cell that:
        <ul>
          <li>Invokes the CNI plugin component to set up the network for each app.</li>
          <li>Forwards ports to support incoming connections from the Gorouter, TCP Router, and Diego SSH Proxy. This keeps apps externally reachable.</li>
          <li>Installs outbound whitelist rules to support Application Security Groups (ASGs).</li>
        </ul>
      </td>
    </tr>
  
negative.code:     <th>Function</th>
    </tr>
    <tr>
      <td>Silk CNI plugin<br></td>
      <td>A plugin that provides IP address management and network connectivity to app instances as follows:
        <ul>
          <li>Uses a shared VXLAN overlay network to assign each container a unique IP address.</li>
          <li>Installs network interface in container using the Silk VXLAN back end. This is a shared, flat L3 network.</li>
        </ul>
      </td>
    </tr>
    <tr>
      <td>VXLAN Policy Agent<br></td>
      <td>Enforces network policy for traffic between apps as follows:
        <ul>
          <li>Discovers desired network policies from the Policy Server Internal API.</li>
          <li>Updates iptables rules on the Diego Cell to allow approved inbound traffic.</li>
          <li>Tags outbound traffic with the unique identifier of the source app using the VXLAN Group-Based Policy (GBP) header.</li>
        </ul>
      </td>
    </tr>
  </table>
  
  
  ## <a id='app-comm'></a> App Instance Communication
  
  The diagram below illustrates how app instances communicate in a deployment with container-to-container networking enabled. In this example, the operator creates two policies to regulate the flow of traffic between **App A**, **App B**, and **App C**.
  
  * Allow traffic from **App A** to **App B**
  * Allow traffic from **App A** to **App C**
  