anchor.diff:  
   * Diego does not currently support fetching images from private repositories.
   
  -* Diego currently requires that the source registry for a Docker image is  available when creating new application instances. If the registry is unavailable, Diego cannot start or restart applications.
  +* Diego currently requires that the source registry for a Docker image be available when creating new application instances. If the registry is unavailable, Diego cannot start or restart applications.
   
   
  
positive.code: 
  <p class='note'><strong>Note</strong>: When launching an application on Diego, the Cloud Controller honors any user-specified overrides such as a custom start command or custom environment variables.</p>
  
  ##<a id='multi-tenant'></a>Docker in a Multi-Tenant World ##
  
  Since Docker allow users to fully specify the contents of their root file systems, the attack surface area for a Docker-based container running on Diego is somewhat higher than that of a buildpack application, which runs on a trusted root filesystem.
  
  The Garden-Linux team has implemented a host of features to allow the platform to run Docker images more securely in a multi-tenant context. In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that uses cannot gain escalated privileges on the host even if they escalate privileges within a container.
  
  
negative.code: * Raw bits to download and mount. These bits form the file system.
  * Metadata that describes commands, users, and environment for the layer. This metadata includes the `ENTRYPOINT` and `CMD` directives, and is specified in the Dockerfile.
  
  ##<a id='create-container'></a>Understanding How Garden-Linux Creates Containers##
  
  Diego uses [Garden-Linux](https://github.com/cloudfoundry-incubator/garden-linux) to construct Linux containers. Garden-Linux builds Linux containers with the same kernel resource isolation features used by all Linux containers: **namespaces** and **cgroups**.
  
  