anchor.diff:  <pre class='terminal'>$ cf push my-app --docker-image internal-registry.example.com:5000/my-repo/my-image:v2
   </pre>
   
  -##<a id='private-repo'></a>Push a Docker Image From a Registry with Authentication
  -
  -Many Docker registries control access to Docker images by authenticating with a username and password. Follow the steps below to deploy a Docker image with registry authentication:
  -
  -1. Make sure the `CF_DOCKER_PASSWORD` environment variable is set to the Docker registry user password.
  -1. Run the following command: `$ CF_DOCKER_PASSWORD=YOUR-PASSWORD cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username USER` 
  -<br>Replace the placeholder values in the command as follows:
  -  - `YOUR-PASSWORD`: The password to use for authentication with the registry
  -  - `APP-NAME`: The name of the app being pushed
  -  - `REPO`: The repository where the image is stored:
  -      - For Docker Hub, this is just the repository name
  -      - For a private registry, this includes the registry address and port, as described in [Push a Docker Image from a Private Registry](#private), in the format: `MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO`
  -  - `IMAGE`: The name of the image being pushed
  -  - `TAG`: (Optional, but recommended) The tag or version for the image
  -  - `USER`: The username to use for authentication with the registry
  -
  -##<a id='gcr'></a>Push a Docker Image From Google Container Registry (GCR)
  +###<a id='private-repo'></a>Private Container Registry with Basic Authentication
  +
  +Many Docker registries control access to Docker images by authenticating with a username and password.
  +
  +* To push an app as a Docker image from a registry that uses basic username and password authentication, run the following command:
  +
  +    ```
  +    $ CF_DOCKER_PASSWORD=YOUR-PASSWORD cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username USER
  +    ```
  +
  +    Where:
  +    - `YOUR-PASSWORD`: The password to use for authentication with the Docker registry
  +        - Setting `CF_DOCKER_PASSWORD` prepended to the `cf push --docker-image` makes the value temporary, which is more secure than setting the environment variable indefinitely with `export`
  +    - `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
  +    - `REPO`: The repository where the image is stored:
  +        - For Docker Hub, this is just the repository name
  +        - For a private registry, this includes the registry address and port, as described in [Push a Docker Image from a Private Registry](#private), in the format: `MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO`
  +    - `IMAGE`: The name of the app image being pushed
  +    - `TAG`: (Optional, but recommended) The tag or version for the image
  +    - `USER`: The username to use for authentication with the registry
  +
  +###<a id='ecr'></a>Amazon Elastic Container Registry (ECR)
  +
  +<%= vars.app_runtime_abbr %> supports pushing apps from images hosted on Amazon Web Services ECR, which authenticates with temporary password tokens.
  +
  +* To push an app as a Docker image from ECR:
  +
  +    ```
  +    $ CF_DOCKER_PASSWORD=AWS-SECRET-ACCESS-KEY cf push APP-NAME --docker-image REPO/IMAGE:TAG --docker-username AWS-ACCESS-KEY-ID
  +    ```
  +
  +    Where:
  +    - `AWS-SECRET-ACCESS-KEY`: the AWS Secret Access Key for the IAM user accessing the ECR registry
  +        - Setting `CF_DOCKER_PASSWORD` prepended to the `cf push --docker-image` makes the value temporary, which is more secure than setting the environment variable indefinitely with `export`
  +    - `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
  +    - `REPO`: The ECR repository containing the image being pushed
  +    - `IMAGE`: The name of the app image being pushed
  +    - `TAG`: (Optional, but recommended) The tag or version for the image
  +    - `AWS-ACCESS-KEY-ID`: The AWS Access Key ID for the IAM user accessing the ECR registry
  +
  +**How it Works**: Running `cf push` with an ECR registry triggers <%= vars.app_runtime_abbr %> to:
  +
  +  1. Use the AWS Secret Access Key and Access Key ID to retrieve the temporary ECR username and password.
  +  1. Use the temporary tokens to retrieve the image.
  +
  +###<a id='gcr'></a>Google Container Registry (GCR)
   
   <%= vars.product_name %> supports pushing apps from images hosted on Google Container Registry (GCR) service. This feature requires that you use [json_key based authentication](https://cloud.google.com/container-registry/docs/advanced-authentication#using_a_json_key_file).
   
  -### Step 1: Authenticate with GCR
  +#### Step 1: Authenticate with GCR
   
   To authenticate with GCR using <%= vars.product_name %>, you must create a JSON key file and associate it with your project:
   
  
positive.code:   gcloud projects add-iam-policy-binding MY-PROJECT --member serviceAccount:MY-ACCOUNT<span>@</span>MY-PROJECT-ID.iam.gserviceaccount.com --role roles/storage.objectViewer
    </pre>
  
  ### Step 2: Deploy the GCP Image
  
  Run the following command to deploy your GCR image using the cf CLI: 
  `CF_DOCKER_PASSWORD="$(cat key.json)" cf push APP-NAME --docker-image docker://MY-REGISTRY-URL/MY-PROJECT/MY-IMAGE-NAME --docker-username _json_key`
  
negative.code: For more information about command-line parameters for `docker start`, see [docker
  start](https://docs.docker.com/engine/reference/commandline/start/) in the Docker Documentation.
  
  ##<a id='registry'></a>Push a Docker Image from a Registry
  
  <%= vars.app_runtime_full %> (<%= vars.app_runtime_abbr %>) supports pushing apps from container registries such as Docker Hub, Google Container Registry (GCR), and Amazon Elastic Container Registry (ECR).
  
  How you run `cf push` with apps stored in container registries depends on which registry you use and how it authenticates requests for the container image.
  
  The sections below explain how to push apps under different container registry scenarios.
  
  ###<a id='public'></a>Docker Hub
  
  To deploy a Docker image from a Docker Hub repository, run `cf push APP-NAME --docker-image REPO/IMAGE:TAG`. Replace the placeholder values in the command as follows:
  
  * `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
  * `REPO`: The name of the repository where the image is stored
  * `IMAGE`: The name of the app image on Docker Hub
  * `TAG`: (Optional, recommended) The tag or version for the image
  
  For example, the following command pushes the `my-image` image from Docker Hub to a Cloud Foundry app:
  
  <pre class='terminal'>$ cf push my-app --docker-image cloudfoundry/my-image</pre>
  
  ###<a id='private'></a>Private Container Registry without Authentication
  
  As an alternative to Docker Hub, you can use any Docker image registry that presents a valid certificate for HTTPS traffic, such as a company-internal Docker registry.
  
  To push an app as a Docker image using a specified Docker registry, run `cf push APP-NAME --docker-image MY-PRIVATE-REGISTRY.DOMAIN:PORT/REPO/IMAGE:TAG`. Replace the placeholder values in the command as follows:
  
  * `APP-NAME`: The name to give the pushed app on <%= vars.app_runtime_abbr %>
  * `MY-PRIVATE-REGISTRY.DOMAIN`: The path to the Docker registry
  * `PORT`: The port where the registry serves traffic
  * `REPO`: The name of the repository where the image is stored
  * `IMAGE`: The name of the app image being pushed
  * `TAG`: (Optional, but recommended) The tag or version for the image
  
  For example, the following command pushes the `v2` version of the `my-image` image from the `my-repo` repository of the `internal-registry.example.com` registry on port `5000`:
  