anchor.diff:  
   This process yields a container with contents that exactly match the contents of the associated Docker image.
   
  -##<a id='run-monitor'></a>How Diego Process Determination and Monitoring ##
  +##<a id='run-monitor'></a>How Diego Runs and Monitors Processes ##
   
   After Garden-runC creates a container, Diego runs and monitors the processes inside of it.
   
   To determine which processes to run, the [Cloud Controller](../concepts/architecture/cloud-controller.html) fetches the metadata associated with the Docker image and returns it to the Cloud Controller. 
   The Cloud Controller uses this metadata to perform the following actions:
   
  -  * Runs the start command as the user specified in the Docker image
  -  * Instructs Diego and the [Gorouter](../concepts/architecture/router.html) to route traffic to the lowest-numbered port exposed in the Docker image
  +  * Runs the start command as the user specified in the Docker image.
  +  * Instructs Diego and the [Gorouter](../concepts/architecture/router.html) to route traffic to the lowest-numbered port exposed in the Docker image.
   
   <p class='note'><strong>Note</strong>: When launching an application on Diego, the Cloud Controller honors any user-specified overrides such as a custom start command or custom environment variables.</p>
   
  
positive.code: The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application 
  because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
  
  The Garden-runC provides features that allow the platform to run Docker images more securely in a multi-tenant context. 
  In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that users cannot gain escalated privileges on the host even if they escalate privileges within a container.
  
  The Cloud Controller always runs Docker containers on Diego with user namespaces enabled. 
  
negative.code: 
  ##<a id='push-docker'></a>Push a Docker Image with the Cloud Foundry Command Line Interface (cf CLI)
  
  Follow these instructions to deploy updated or new Docker images using the Cloud Foundry Command Line Interface (cf CLI).
  
  To perform the procedures in this topic, you must install cf CLI v6.13.0 or later. See <a href="../cf-cli/install-go-cli.html">Installing the cf CLI</a> for more information. For information about pushing a Docker image with a previous version of the cf CLI, see <a href= 'https://github.com/cloudfoundry-incubator/diego-design-notes/blob/master/docker-support.md'>Docker Support in CF + Diego</a>.
  
  When pushing an app, you specify either a Docker image on Docker Hub or a URI to a trusted Docker registry. Diego does not support using private registries.
  
  