anchor.diff:      Where `YOUR-PROJECT-ID` is your project ID.
   
   1. Create a JSON key file and associate it with the service account by running:
  -  
  +
       ```
       gcloud iam service-accounts keys create key.json --iam-account=YOUR-ACCOUNT@YOUR-PROJECT-ID.iam.gserviceaccount.com
       ```
  
positive.code: 
  * `USER` is the username to use for authentication with the registry.
  
  <p class="note"><strong>Note:</strong> If container registry credentials change the application have to be pushed with the new credentials. Otherwise Cloud Foundry will fail to start the application because during start access to the container registry is required. For container credentials rotation we recommend a set of two credentials (old/new) where the <code>old</code> credentials can be deactivated after all application have been pushed with the <code>new</code> credentials.</p>
  
  ### <a id='ecr'></a> Amazon Elastic Container Registry (ECR)
  
  
negative.code: When configuring a Docker image for <%= vars.app_runtime_abbr %>, you can control the exposed port and the corresponding value of `PORT` by specifying the `EXPOSE` directive in the image Dockerfile. If you specify the `EXPOSE` directive, then the corresponding app pushed to <%= vars.app_runtime_abbr %> listens on that exposed port. For example, if you set `EXPOSE` to `7070`, then the app listens for connections on port 7070.
  
  If you do not specify a port in the `EXPOSE` directive, then the app listens on the value of the `PORT` environment variable as determined by <%= vars.app_runtime_abbr %>.
  
  If you set the `PORT` environment variable via an `ENV` directive in a Dockerfile, <%= vars.app_runtime_abbr %> overrides the value with the system-determined value.
  
  <%= vars.app_runtime_abbr %> supports only one exposed port on the image.
  