anchor.diff:  WORKDIR /root
   
   #----
  -# Base Environment
  +# Packages
   #----
   
   # install commands
   # TODO: move PKG_INSTALL to core/service-install to get rid of evil eval below
   ENV PKG_INSTALL apt-get update; apt-get install -o Dpkg::Options::=--force-confdef -o Dpkg::Options::=--force-confold --no-install-recommends --no-install-suggests -y
   ENV DEBIAN_FRONTEND noninteractive
  +
  +# TODO: refactor without eval. or remove and handle elsewhere so not distro-specific
  +
  +# Try and have binaries that are modified less often up at top of this package section.
  +
  +# Packages::Common
  +RUN set -x; eval $PKG_INSTALL apt-utils net-tools less curl wget unzip sudo ca-certificates procps jq
  +
  +# Packages::Development-Utils
  +RUN set -x; eval $PKG_INSTALL vim-tiny ethtool bwm-ng man-db psmisc
  +
  +# Packages::runit
  +RUN set -x; eval $PKG_INSTALL runit
  +
  +# Packages::socklog
  +RUN set -x; eval $PKG_INSTALL socklog ipsvd
  +
  +# Packages::dropbear
  +RUN set -x; eval $PKG_INSTALL dropbear
  +
  +# Packages::haproxy
  +RUN set -x; eval $PKG_INSTALL haproxy
  +
  +# Packages::serf
  +RUN set -x; wget -vO serf.zip https://dl.bintray.com/mitchellh/serf/0.6.3_linux_amd64.zip && \
  +  unzip serf.zip && mv serf /usr/local/bin && rm -vf ./serf.zip
  +
  +#----
  +# Base Environment
  +#----
   
   # TODO: load all tags from json then remove these ENVs
   ENV AIRSTACK_TAGS_CLUSTERNAME airstack_cluster
  
positive.code: # Runlevel 2
  #----
  
  #socklog-ucspi-tcp install
  ADD services/socklog-ucspi-tcp /package/airstack/conf/socklog-ucspi-tcp
  
  #dropbear install
  ADD services/dropbear /package/airstack/conf/dropbear
  RUN set -x; eval $PKG_INSTALL dropbear
  EXPOSE 22
  
  #haproxy install
  ADD services/haproxy /package/airstack/conf/haproxy
  RUN \
    set -x; eval $PKG_INSTALL haproxy && \
    rm -vf /etc/haproxy/haproxy.cfg && \
    rm -vf /etc/rsyslog.d/haproxy.conf;
  EXPOSE 443 80
  
  #serf install
  ADD services/serf /package/airstack/conf/serf
  RUN \
    wget -vO serf.zip https://dl.bintray.com/mitchellh/serf/0.6.3_linux_amd64.zip && \
    unzip serf.zip && mv serf /usr/local/bin && rm -vf ./serf.zip
  EXPOSE 7946
  
  ADD core /package/airstack/conf/core
  
negative.code: 
  #password set in sshd/run script at ssh start. allows for override via env var.
  RUN \
    set -e; groupadd --system airstack --gid 432 && \
    useradd --uid 431 --system --base-dir /home --create-home --gid airstack --shell /bin/nologin --comment "airstack user" airstack && \
    chown -R airstack:airstack /home/airstack
  
  # passwordless sudo enabled for airstack user. should only do for development environment.
  # RUN [ $AIRSTACK_TAGS_ENV = "development" ] && echo "airstack  ALL = NOPASSWD: ALL" > /etc/sudoers.d/airstack && usermod --shell /bin/bash airstack
  RUN \
    echo "airstack  ALL = NOPASSWD: ALL" > /etc/sudoers.d/airstack && \
    usermod --shell /bin/bash airstack
  
  #runit install
  RUN set -x; eval $PKG_INSTALL runit
  