anchor.diff:          iproute2 \
       && apt-get autoremove -yqq --purge \
       && apt-get clean \
  -    && rm -rf /var/lib/apt/lists/*
  -
  -RUN addgroup --gid "${APP_GID}" "pola-backend" && \
  -    adduser --quiet "pola-backend" --uid "${APP_UID}" \
  +    && rm -rf /var/lib/apt/lists/* \
  +    && addgroup --gid "${APP_GID}" "pola-backend" \
  +    && adduser --quiet "pola-backend" --uid "${APP_UID}" \
           --gid "${APP_GID}" \
  -        --home "${APP_USER_HOME_DIR}"
  -
  +        --home "${APP_USER_HOME_DIR}" \
   # Make app files belong to the root group and are accessible. This is to accomodate the guidelines from
   # OpenShift https://docs.openshift.com/enterprise/3.0/creating_images/guidelines.html
  -RUN mkdir -pv "${APP_HOME}"; \
  -    chown -R "pola-backend:root" "${APP_USER_HOME_DIR}" "${APP_HOME}"; \
  -    find "${APP_HOME}" -executable -print0 | xargs --null chmod g+x && \
  -    find "${APP_HOME}" -print0 | xargs --null chmod g+rw
  +    && mkdir -pv "${APP_HOME}" \
  +    && chown -R "pola-backend:root" "${APP_USER_HOME_DIR}" "${APP_HOME}" \
  +    && find "${APP_HOME}" -executable -print0 | xargs --null chmod g+x  \
  +    && find "${APP_HOME}" -print0 | xargs --null chmod g+rw
   
   COPY --chown=pola-backend:root --from=build /root/.local "${APP_USER_HOME_DIR}/.local"
   
   # Make /etc/passwd root-group-writeable so that user can be dynamically added by OpenShift
  -RUN chmod g=u /etc/passwd
  -
  +# hadolint ignore=DL4005
  +RUN chmod g=u /etc/passwd \
   # Enable heroku-exec
   # See: https://devcenter.heroku.com/articles/exec#using-with-docker
  -# hadolint ignore=DL4005
  -RUN rm /bin/sh && ln -s /bin/bash /bin/sh
  +    && rm /bin/sh \
  +    && ln -s /bin/bash /bin/sh
  +
   COPY ./scripts/prod-docker-image/heroku-exec.sh /app/.profile.d/heroku-exec.sh
   
  -ENV PATH="${APP_USER_HOME_DIR}/.local/bin:${PATH}"
  -ENV GUNICORN_CMD_ARGS="--worker-tmp-dir /dev/shm"
  +ENV PATH="${APP_USER_HOME_DIR}/.local/bin:${PATH}" \
  +    GUNICORN_CMD_ARGS="--worker-tmp-dir /dev/shm"
   
  -COPY ./scripts/prod-docker-image/entrypoint.sh /entrypoint
  +COPY --chown=pola-backend:root ./scripts/prod-docker-image/entrypoint.sh /entrypoint
   COPY ./ ${APP_HOME}
   
   WORKDIR ${APP_HOME}
   
   EXPOSE 8080
  +
  +RUN usermod -g 0 pola-backend -G "${APP_GID}"
   
   USER ${APP_UID}
   
  
positive.code: 
  ARG APP_UID
  ARG APP_GID
  ENV APP_UID=${APP_UID}
  ENV APP_GID=${APP_GID}
  ARG APP_USER_HOME_DIR=/home/pola-backend
  ENV APP_USER_HOME_DIR=${APP_USER_HOME_DIR}
  ARG APP_HOME
  ENV APP_HOME=${APP_HOME}
  
  SHELL ["/bin/bash", "-o", "pipefail", "-e", "-u", "-x", "-c"]
  
  
negative.code:     && apt-get clean \
      && rm -rf /var/lib/apt/lists/*
  
  # hadolint ignore=DL3044
  ENV PYTHONUNBUFFERED=1 \
      PATH=${PATH}:/root/.local/bin
  RUN mkdir -p /root/.local/bin && pip install --no-cache-dir --upgrade "pip" && pip --version
  
  COPY ./requirements/production.txt ${APP_HOME}/requirements/
  
  RUN pip install --no-cache-dir --user -r "${APP_HOME}/requirements/production.txt" \
      && pip check \
      && find /root/.local/ -name '*.pyc' -print0 | xargs -0 rm -r \
      && find /root/.local/ -type d -name '__pycache__' -print0 | xargs -0 rm -r \
      # make sure that all directories and files in .local are also group accessible
      && find /root/.local -executable -print0 | xargs --null chmod g+x  \
      && find /root/.local -print0 | xargs --null chmod g+rw
  
  LABEL io.github.klubjagiellonski.distro="debian" \
      io.github.klubjagiellonski.distro.version="buster" \
  