anchor.diff:      chmod -R u+x ${AMBASSADOR_ROOT} && \
       chmod -R g=u ${AMBASSADOR_ROOT} /etc/passwd
   
  -# COPY the entrypoint script and make it runnable.
  +# COPY the entrypoint and Python-kubewatch and make them runnable.
   COPY ambassador/kubewatch.py .
   COPY ambassador/entrypoint.sh .
  -RUN chmod 755 entrypoint.sh
  +RUN chmod 755 kubewatch.py entrypoint.sh
   
  +# Grab ambex, too.
   RUN wget -q https://s3.amazonaws.com/datawire-static-files/ambex/0.1.1/ambex
   RUN chmod 755 ambex
   
  
positive.code:       VENDOR                   = "Datawire" \
        VENDOR_URL               = "https://datawire.io/"
  
  # This Dockerfile is set up to install all the application-specific stuff into
  # /ambassador.
  #
  # NOTE: If you don't know what you're doing, it's probably a mistake to
  # blindly hack up this file.
  
  RUN apk --no-cache add curl go python3 build-base libffi-dev openssl-dev python3-dev
  RUN pip3 install -U pip
  
  # Set WORKDIR to /ambassador which is the root of all our apps then COPY
  # only requirements.txt to avoid screwing up Docker caching and causing a
  # full reinstall of all dependencies when dependencies are not changed.
  ENV AMBASSADOR_ROOT=/ambassador
  WORKDIR ${AMBASSADOR_ROOT}
  COPY releng releng
  COPY multi/requirements.txt multi/
  COPY ambassador/requirements.txt ambassador/
  
negative.code: # See the License for the specific language governing permissions and
  # limitations under the License
  
  ################################################################
  # This is a multistage Dockerfile, because while we need the compilers et al for the build, we don't need them
  # to run things. If you don't know what you're doing, it's probably a mistake to blindly hack up this file.
  #
  # By default, Ambassador's config and other application-specific stuff gets written to /ambassador. You can
  # configure a different location for the runtime configuration elements via environment variables.
  #
  # Ambassador itself is installed with pip, so it ends up in /usr/bin and /usr/lib. At present, other
  # executables are written into /ambassador, but we'll likely change that shortly.
  #
  # The base image (for everything) is defined here.
  
  FROM quay.io/datawire/ambassador-envoy-alpine-stripped:v1.8.0-15c5befd43fb9ee9b145cc87e507beb801726316 as BASE
  
  MAINTAINER Datawire <flynn@datawire.io>
  LABEL PROJECT_REPO_URL         = "git@github.com:datawire/ambassador.git" \
  