anchor.diff:  * Raw bits to download and mount. These bits form the file system.
   * Metadata that describes commands, users, and environment for the layer. This metadata includes the `ENTRYPOINT` and `CMD` directives, and is specified in the Dockerfile.
   
  -##<a id='create-container'></a>Creating Containers with Garden-Linux ##
  +##<a id='create-container'></a>Understanding How Garden-Linux Creates Containers##
   
   Diego uses [Garden-Linux](https://github.com/cloudfoundry-incubator/garden-linux) to construct Linux containers. Garden-Linux builds Linux containers with the same kernel resource isolation features used by all Linux containers: **namespaces** and **cgroups**.
   
  
positive.code: 
  This process yields a container with contents that exactly match the contents of the associated Docker image.
  
  ##<a id='run-monitor'></a>Running and Monitoring Processes with Diego ##
  
  Once Garden-Linux creates a container, Diego runs and monitors the processes inside of it.
  
  
negative.code: 
  <p class='note'><strong>Note</strong>: When launching an application on Diego, the Cloud Controller honors any user-specified overrides such as a custom start command or custom environment variables.</p>
  
  ##<a id='multi-tenant'></a>Docker Security Concerns in a Multi-Tenant Environment##
  
  The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
  
  The Garden-Linux team has implemented a host of features to allow the platform to run Docker images more securely in a multi-tenant context. In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that uses cannot gain escalated privileges on the host even if they escalate privileges within a container.
  
  