anchor.diff:  
   ##<a id='multi-tenant'></a>Docker Security Concerns in a Multi-Tenant Environment##
   
  -The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application
  -because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
  +The attack surface area for a Docker-based container running on Diego remains 
  +somewhat higher than that of a buildpack application because Docker allows 
  +users to fully specify the contents of their root file systems. 
  +A buildpack application runs on a trusted root filesystem.
   
  -Garden-runC provides features that allow the platform to run Docker images more securely in a multi-tenant context.
  -In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that users cannot gain escalated privileges on the host even if they escalate privileges within a container.
  +Garden-runC provides features that allow the platform to run Docker images more 
  +securely in a multi-tenant context.
  +In particular, Cloud Foundry uses the `user-namespacing` feature found on 
  +modern Linux kernels to ensure that users cannot gain escalated privileges on 
  +the host even if they escalate privileges within a container.
   
  -The Cloud Controller always runs Docker containers on Diego with user namespaces enabled.
  -This security restriction prevents certain features, such as the ability to mount FuseFS devices, from working in Docker containers.  It is possible for Docker applications to use fuse mounts via <a href="#volume">volume services</a>, but not possible to directly mount fuse devices from within the container.
  +The Cloud Controller always runs Docker containers on Diego with user 
  +namespaces enabled.
  +This security restriction prevents certain features, such as the ability to mount FuseFS devices, from working in Docker containers.
  +It is possible for Docker applications to use fuse mounts via <a href="#volume">volume services</a>, but not possible to directly mount fuse 
  +devices from within the container.
   
  -To mitigate security concerns, Cloud Foundry recommends that you run only trusted Docker containers on the platform.
  -By default, the Cloud Controller does not allow Docker-based applications to run on the platform.
  +To mitigate security concerns, Cloud Foundry recommends that you run only 
  +trusted Docker containers on the platform.
  +By default, the Cloud Controller does not allow Docker-based applications to 
  +run on the platform.
   
  -To allow Docker-based applications to run, a Cloud Controller administrator can enable the `diego_docker` feature flag with the following command:
  +To allow Docker-based applications to run, a Cloud Controller administrator can 
  +enable the `diego_docker` feature flag with the following command:
   <pre class='terminal'>
   $ cf enable-feature-flag diego_docker
   </pre>
   
  -To disallow Docker-based applications, a Cloud Controller administrator can run the following command:
  +To disallow Docker-based applications, a Cloud Controller administrator can run 
  +the following command:
   
   <pre class='terminal'>
   $ cf disable-feature-flag diego_docker
  
positive.code: 
  ##<a id='create-container'></a>How Garden-runC Creates Containers##
  
  Diego currently uses Garden-runC to construct Linux containers. Earlier versions of Diego used Garden-Linux. For more information, see the [Garden](../concepts/architecture/garden.html) topic.
  
  <%= vars.garden_runc %>
  
  Both Docker and Garden-runC use libraries from the [Open Container Initiative (OCI)](https://www.opencontainers.org/) to build Linux containers.
  After creation, these containers use name space isolation, or *namespaces*, and control groups, or *cgroups*, to isolate processes in containers and limit resource usage.
  These are common kernel resource isolation features used by all Linux containers.
  
  Before Garden-runC creates a Linux container, it creates a file system that is mounted as the root file system of the container.
  Garden-runC supports mounting Docker images as the root file systems for the containers it creates.
  
  When creating a container, both Docker and Garden-runC perform the following actions:
  
  * Fetch and cache the individual layers associated with a Docker image
  * Combine and mount the layers as the root file system
  
  These actions produce a container whose contents exactly match the contents of the associated Docker image.
  
  ##<a id='run-monitor'></a>How Diego Runs and Monitors Processes ##
  
  After Garden-runC creates a container, Diego runs and monitors the processes inside of it.
  
  To determine which processes to run, the [Cloud Controller](../concepts/architecture/cloud-controller.html)
  fetches and stores the metadata associated with the Docker image.
  
negative.code: 
  ##<a id='push-docker'></a>Push a Docker Image with the cf CLI
  
  Follow these instructions to deploy updated or new Docker images using the 
  Cloud Foundry Command Line Interface (cf CLI).
  
  To perform the procedures in this topic, you must install cf CLI v6.13.0 or 
  later. 
  See <a href="../cf-cli/install-go-cli.html">Installing the cf CLI</a> for more 
  information.
  For information about pushing a Docker image with a previous version of the cf 
  CLI, see <a href= 'https://github.com/cloudfoundry-incubator/diego-design-notes/blob/master/docker-support.md'>Docker Support in CF + Diego</a>.
  
  When pushing an app, you specify either a Docker image on Docker Hub or a URI 
  to a trusted Docker registry. 
  Diego does not support using private registries.
  Also, when using Diego, you must use a registry that supports the <a href="https://docs.docker.com/registry/spec/api/">Docker Registry API V2</a>.
  
  ###<a id='public'></a>Push a Docker Image Using Docker Hub
  
  Run `cf push test-app -o cloudfoundry/MY-DOCKER-IMAGE` to deploy a Docker 
  image. 
  Replace `MY-DOCKER-IMAGE` with the name of an image from an accessible Docker 
  Registry.
  
  For example, the following command pushes the `test-app` on Docker Hub to Cloud 
  Foundry:
  
  <pre class='terminal'>$ cf push test-app -o cloudfoundry/test-app</pre>
  
  