anchor.diff:                "SSL_CERT_FILE=${releng_pkgs.pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
               ] ++ dockerEnv;
               Cmd = dockerCmd;
  -            User = dockerUser;
               WorkingDir = "/";
             };
  -        runAsRoot = if dockerUser == null then null else ''
  -          #!${stdenv.shell}
  -          ${dockerTools.shadowSetup}
  -          groupadd --gid ${toString dockerGroupId} ${dockerGroup}
  -          useradd --gid ${dockerGroup} --uid ${toString dockerUserId} --home-dir /app ${dockerUser}
  -          # gunicorn requires /tmp, /var/tmp, or /usr/tmp
  -          mkdir -p --mode=1777 /tmp
  -          mkdir -p /app
  -          cp -a ${self.src}/. /app/
  -        '';
  +      self_docker = mkDocker {
  +        inherit name version;
  +        contents = [ busybox self ] ++ dockerContents;
  +        config = self_docker_config;
         };
   
         githubCommit = builtins.getEnv "GITHUB_COMMIT";
  
positive.code:         inherit name;
          tag = version;
          fromImage = self_docker;
          runAsRoot = ''
            cp -a ${self.src}/* /app
            cat > /app/version.json  <<EOF
            ${builtins.toJSON version_json}
  
negative.code:     , version
      , config ? {}
      , contents ? []
      , runAsRoot ? null
      }:
      dockerTools.buildImage {
        name = name;
  