anchor.diff:    mkdir /out && CGO_ENABLED=0 PREFIX=/out/ make && \
     xx-verify --static /out/containerd-stargz-grpc && \
     xx-verify --static /out/ctr-remote
  -
  -FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS fuse-overlayfs
  -RUN apk add --no-cache curl
  -COPY --from=xx / /
  -ARG FUSEOVERLAYFS_VERSION
  -ARG TARGETPLATFORM
  -RUN mkdir /out && \
  -  curl -sSL -o /out/fuse-overlayfs https://github.com/containers/fuse-overlayfs/releases/download/${FUSEOVERLAYFS_VERSION}/fuse-overlayfs-$(xx-info march) && \
  -  chmod +x /out/fuse-overlayfs && \
  -  xx-verify --static /out/fuse-overlayfs
   
   # Copy together all binaries needed for oci worker mode
   FROM buildkit-export AS buildkit-buildkitd.oci_only
  
positive.code: ARG ROOTLESSKIT_VERSION=v0.14.2
  ARG CNI_VERSION=v0.9.1
  ARG SHADOW_VERSION=4.8.1
  ARG FUSEOVERLAYFS_VERSION=v1.5.0
  ARG STARGZ_SNAPSHOTTER_VERSION=v0.5.0
  
  ARG ALPINE_VERSION=3.12
  
  # git stage is used for checking out remote repository sources
  FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS git
  
negative.code: 
  # Rootless mode.
  FROM alpine:${ALPINE_VERSION} AS rootless
  RUN apk add --no-cache fuse3 fuse-overlayfs git openssh pigz xz
  COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
  COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  # we could just set CAP_SETUID filecap rather than `chmod u+s`, but requires kernel >= 4.14
  # nsswitch.conf needs to be present to work around
  #   https://github.com/golang/go/issues/35305
  