The section Selecting stage1 at runtime has a broken link:

Selecting stage1 at runtime

If you want to run software that requires hypervisor isolation along with trusted software that only needs container isolation, you can choose which stage1.aci to use at runtime.

The "Use a custom stage 1" section is currently in the "rkt enter" command documentation:
https://github.com/coreos/rkt/blob/master/Documentation/subcommands/enter.md#use-a-custom-stage-1

The section should be moved elsewhere, probably in the "rkt run" command documentation. The broken link should be fixed too.