anchor.diff:  	&& (test -d ngx_brotli/deps/brotli && rmdir ngx_brotli/deps/brotli) \
   	&& mv brotli-${brotli_version} ngx_brotli/deps/brotli \
   	&& cd .. \
  -	&& patch -p1 < ../fast_cgiparams_CVE-2016-5387.patch 
  -
  -ENV LUAJIT_LIB /usr/lib
  -ENV LUAJIT_INC /usr/include/luajit-$LUA_VERSION
  -
  -	RUN cd /tmp/build/nginx-${KUSANAGI_NGINX_VERSION} \  
  -	&& ./configure \
  +	&& patch -p1 < ../fast_cgiparams_CVE-2016-5387.patch \
  +\
  +# configure
  +	&& cd /tmp/build/nginx-${KUSANAGI_NGINX_VERSION} \  
  +	&& CONF="\
  +		--prefix=/etc/nginx \
   		--conf-path=/etc/nginx/nginx.conf \
  -		--add-module=./extensions/${naxsi_tarball_name}/naxsi_src \
   		--sbin-path=/usr/sbin/nginx \
  +		--modules-path=/usr/lib/nginx/modules \
   		--error-log-path=/var/log/nginx/error.log \
   		--http-log-path=/var/log/nginx/access.log \
   		--pid-path=/var/run/nginx.pid \
  
positive.code: 		tiff-dev \
  		libxcb-dev \
  		lua-dev \
  		libaio-dev \
  		pcre-dev \
  		geoip-dev \
  		gd-dev \
  		ruby-dev \
  		bz2-dev \
  	" \
  	&& apk add --force --no-cache $DEP 
  	RUN cd /tmp/build/nginx-${KUSANAGI_NGINX_VERSION}/extensions \
  	&& curl -Lo nginx-ct-${nginx_ct_version}.tar.gz https://github.com/grahamedgecombe/nginx-ct/archive/v${nginx_ct_version}.tar.gz \
  	&& curl -Lo ngx_cache_purge-${ngx_cache_purge_version}.tar.gz https://github.com/FRiCKLE/ngx_cache_purge/archive/${ngx_cache_purge_version}.tar.gz \
  	&& curl -Lo ngx_brotli-${ngx_brotli_version}.tar.gz https://github.com/google/ngx_brotli/archive/${ngx_brotli_version}.tar.gz \
  
negative.code: 		--add-module=./extensions/ngx_cache_purge \
  		--add-module=./extensions/nginx-ct \
  		--add-module=./extensions/ngx_brotli \
  		--add-module=./extensions/${naxsi_tarball_name}/naxsi_src \
  		--add-module=./extensions/${passenger_tarball_name}/src/nginx_module \
  	" \
  	&& CFLAGS='-O2 -g -pipe -Wp,-D_FORTIFY_SOURCE=2 \
  		-fexceptions -fstack-protector \
  		--param=ssp-buffer-size=4 -m64 -mtune=generic \
  		-Wno-deprecated-declarations \
  		-Wno-cast-function-type \
  		-Wno-unused-parameter \
  		-Wno-stringop-truncation \
  		-Wno-stringop-overflow' \
  	&& ./configure $CONF --with-cc-opt="$CFLAGS" \
  \
  # build
  	&& make -j$(getconf _NPROCESSORS_ONLN) \
  	&& find . -type f -a -name 'nginx' -o -name '*.so*' | xargs strip \
  	&& make install \
  	&& mkdir -p /usr/lib/nginx/modules \
  	&& (for so in `find extensions -type f -name '*.so'`; do mv $so /usr/lib/nginx/modules ; done; true) \
  	&& apk add --no-cache --virtual .gettext gettext \
  \
  	#&& mv /usr/bin/envsubst /tmp/ \
  	&& runDeps="$( \
  		scanelf --needed --nobanner --format '%n#p' /usr/sbin/nginx /usr/lib/nginx/modules/*.so /tmp/envsubst \
  			| tr ',' '\n' \
  			| sort -u \
  			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
  	)" \
  \
  	#&& apk del --virtual .gettext \
  	#&& mv /usr/bin/envsubst /tmp/ \
  	&& apk add --no-cache --virtual .nginx-rundeps $runDeps \
  	&& (strip /usr/sbin/nginx /usr/lib/nginx/modules/*.so; true) \
  	&& (chmod 755 /usr/lib/nginx/modules/*.so; true) \
  	&& apk del --purge --virtual .builddep \
  	&& mkdir -p -m755 /usr/lib/systemd/system  \
  		/etc/nginx/conf.d \
  		/var/cache/nginx  \
  		/var/log/nginx  \
  		/usr/share/nginx/html \
  	&& install -m644 /tmp/build/nginx.conf /etc/nginx/nginx.conf \
  	&& install -m644 /tmp/build/nginx_httpd.conf /etc/nginx/conf.d/_http.conf \
  	&& install -m644 /tmp/build/nginx_ssl.conf /etc/nginx/conf.d/_ssl.conf \
  	&& install -m644 /etc/nginx/html/50x.html /usr/share/nginx/html \
  	&& install -m644 /etc/nginx/html/index.html /usr/share/nginx/html \
  	&& mkdir -p -m755 /etc/nginx/naxsi.d \
  	&& cd /tmp/build/nginx-${KUSANAGI_NGINX_VERSION}/ \
  	&& install -m644 extensions/${naxsi_tarball_name}/naxsi_config/naxsi_core.rules /etc/nginx/naxsi.d/naxsi_core.rules.conf \
  	&& cd /etc/nginx/ \
  	&& tar xf /tmp/build/naxsi.d.tar.gz \
  	&& install -m644 /tmp/build/kusanagi_naxsi_core.conf /etc/nginx/conf.d/kusanagi_naxsi_core.conf \
  	&& install -m644 /tmp/build/security.conf /etc/nginx/conf.d/security.conf \
  	\
  	# forward request and error logs to docker log collector
  	&& ln -s ../../usr/lib/nginx/modules /etc/nginx/modules \
  	&& ln -sf /dev/stdout /var/log/nginx/access.log \
  	&& ln -sf /dev/stderr /var/log/nginx/error.log \
  	&& apk add --no-cache tzdata \
  	&& cd / \
  	&& rm -rf /tmp/build \
  	&& : # END of RUN
  
  USER httpd
  CMD [ "/usr/sbin/nginx", "-g", "daemon off;" ]
  