anchor.diff:  
   <pre class='terminal'>$ cf push test-app -o cloudfoundry/test-app</pre>
   
  -###<a id='private'></a>Pushing a Docker image using Docker Trusted Registries
  +###<a id='private'></a>Push a Docker Image using Docker Trusted Registries
   
   To deploy a Docker image using Docker Trusted Registries, run:
   
    <pre class='terminal'>$ cf push my-app -o MY-PRIVATE-REGISTRY.DOMAIN:5000/image/name:v2</pre> 
   
    Replace `MY-PRIVATE-REGISTRY.DOMAIN` with your domain name, which resolves to the private registry. In this example, 5000 is the port on which your private registry serves traffic. `image/name` is the name of the Docker image repository. `v2` is a tag in that repository that refers to a specific image.
  -
  -##<a id='caveats'></a>Docker Caveats ##
  -
  -This section contains known issues and limitations with running Docker images in Cloud Foundry.
  -
  -* Diego supports running Docker images only from Docker registries that present the v2 registry API.
  -
  -* Diego does not currently support fetching images from private repositories.
  -
  -* Diego currently requires that the source registry for a Docker image be available when creating new application instances. If the registry is unavailable, Diego cannot start or restart applications.
  
positive.code: 
  <p class='note'><strong>Note</strong>: Disabling the <code>diego_docker</code> feature flag stops all Docker-based apps in your deployment within a few convergence cycles, on the order of a minute.</p>
  
  ##<a id='push-docker'></a>Pushing a Docker Image with the Cloud Foundry Command Line Interface (cf CLI)
  
  Follow these instructions to deploy updated or new Docker images using Cloud Foundry Command Line Interface (cf CLI).
  
  Ensure that you are running cf CLI 6.13.0 or a later version. See [Installing the cf CLI](../cf-cli/install-go-cli.html) for installation instructions.
  
  <p class='note'><strong>Note</strong>: See <a href= 'https://github.com/cloudfoundry-incubator/diego-design-notes/blob/master/docker-support.md'>Docker Support in CF + Diego</a> for information about pushing a docker image with an earlier version of the cf CLI.</p>
  
  ###<a id='public'></a>Pushing a Docker image using Docker Hub
  
  Run `cf push test-app -o cloudfoundry/MY-DOCKER-IMAGE` to deploy a Docker image. Replace `MY-DOCKER-IMAGE` with the name of an image from an accessible Docker Registry.
  
  
negative.code: 
  The attack surface area for a Docker-based container running on Diego remains somewhat higher than that of a buildpack application because Docker allows users to fully specify the contents of their root file systems. A buildpack application runs on a trusted root filesystem.
  
  The Garden-runC provides features that allow the platform to run Docker images more securely in a multi-tenant context. In particular, Cloud Foundry uses the `user-namespacing` feature found on modern Linux kernels to ensure that users cannot gain escalated privileges on the host even if they escalate privileges within a container.
  
  The Cloud Controller always runs Docker containers on Diego with user namespaces enabled. This security restriction prevents certain features, such as the ability to mount FuseFS devices, from working in Docker containers.
  
  