anchor.diff:  
   <strong><%= modified_date %></strong>
   
  -This topic describes Docker image support in Cloud Foundry with Diego and outlines how Cloud Foundry uses Diego to run Docker images. For more information about Diego, see the [Diego Architecture](../concepts/diego/diego-architecture.html) topic.
  +This topic provides information on how Docker works in Clouf Foundry and describes how to push an application with a Docker image. For information about Diego, see the [Diego Architecture](../concepts/diego/diego-architecture.html) topic.
  +
  +In addition to the default Linux environment provided by Cloud Foundry, operators can specify a Docker image that provides the file system used by the container. When pushing an app, you can specify the location of the docker image you want to use.
   
   A Docker image consists of a collection of layers. Each layer consists of one or both of the following:
   
   * Raw bits to download and mount. These bits form the file system.
   * Metadata that describes commands, users, and environment for the layer. This metadata includes the `ENTRYPOINT` and `CMD` directives, and is specified in the Dockerfile.
   
  -##<a id='create-container'></a>Understanding How Garden-Linux Creates Containers##
  +##<a id='create-container'></a>How Garden-Linux Creates Containers##
   
  -Diego uses [Garden-Linux](https://github.com/cloudfoundry-incubator/garden-linux) to construct Linux containers. Garden-Linux builds Linux containers with the same kernel resource isolation features used by all Linux containers: **namespaces** and **cgroups**.
  +Diego uses Garden-runC to construct Linux containers. Garden-runC uses OCI runC to build Linux containers with the same kernel resource isolation features used by all Linux containers: namespaces and cgroups. runC is also used by Docker Engine internally to build Linux containers.
   
  -Linux container creation requires that a file system is mounted as the root file system of the container. Garden-Linux supports mounting Docker images as root file systems for the containers it constructs. Garden-Linux fetches and caches the individual layers associated with a Docker image, then combines and mounts them as the root file system, using the same libraries that power Docker.
  +Linux container creation requires that a file system is mounted as the root file system of the container. Garden-runC supports mounting Docker images as root file systems for the containers it constructs. Garden-runC fetches and caches the individual layers associated with a Docker image, then combines and mounts them as the root file system, using the same libraries that power Docker.
   
   This process yields a container with contents that exactly match the contents of the associated Docker image.
   
  -##<a id='run-monitor'></a>Understanding Diego Process Determination and Monitoring ##
  +##<a id='run-monitor'></a>How Diego Process Determination and Monitoring ##
   
  -Once Garden-Linux creates a container, Diego runs and monitors the processes inside of it.
  +After Garden-runC creates a container, Diego runs and monitors the processes inside of it.
   
   To determine which processes to run, the [Cloud Controller](../concepts/architecture/cloud-controller.html) fetches the metadata associated with the Docker image and returns it to the Cloud Controller. The Cloud Controller uses this metadata to perform the following actions:
   
  
positive.code: 
  <pre class='terminal'>$ cf push test-app -o cloudfoundry/test-app</pre>
  
  ###<a id='private'></a>Pushing a Docker image using Docker Trusted Registries
  
  To deploy a Docker image using Docker Trusted Registries, run:
  
   <pre class='terminal'>$ cf push my-app -o MY-PRIVATE-REGISTRY.DOMAIN:5000/image/name:v2</pre> 
  
   Replace `MY-PRIVATE-REGISTRY.DOMAIN` with your domain name, which resolves to the private registry. In this example, 5000 is the port on which your private registry serves traffic. `image/name` is the name of the Docker image repository. `v2` is a tag in that repository that refers to a specific image.
  
  ##<a id='caveats'></a>Docker Caveats ##
  
  This section contains known issues and limitations with running Docker images in Cloud Foundry.
  
  * Diego supports running Docker images only from Docker registries that present the v2 registry API.
  
  * Diego does not currently support fetching images from private repositories.
  
  * Diego currently requires that the source registry for a Docker image be available when creating new application instances. If the registry is unavailable, Diego cannot start or restart applications.
  
negative.code: 
  <p class='note'><strong>Note</strong>: Disabling the <code>diego_docker</code> feature flag stops all Docker-based apps in your deployment within a few convergence cycles, on the order of a minute.</p>
  
  ##<a id='push-docker'></a>Push a Docker Image with the Cloud Foundry Command Line Interface (cf CLI)
  
  Follow these instructions to deploy updated or new Docker images using Cloud Foundry Command Line Interface (cf CLI).
  
  To perform the procedures in this topic, you must install cf CLI v6.13.0 or later. See <a href="cf-cli/install-go-cli.html">Installing the cf CLI</a> for more information. For information about pushing a docker image with an previous version of the cf CLI, see <a href= 'https://github.com/cloudfoundry-incubator/diego-design-notes/blob/master/docker-support.md'>Docker Support in CF + Diego</a>.
  
  When pushing an app, you specify either a Docker image on Docker Hub or a URI to a trusted Docker registry. Diego does not support using private registries.
  
  ###<a id='public'></a>Push a Docker Image using Docker Hub
  
  Run `cf push test-app -o cloudfoundry/MY-DOCKER-IMAGE` to deploy a Docker image. Replace `MY-DOCKER-IMAGE` with the name of an image from an accessible Docker Registry.
  
  