anchor.diff:  ARG ROOTLESSKIT_VERSION=v0.14.2
   ARG CNI_VERSION=v0.9.1
   ARG SHADOW_VERSION=4.8.1
  -ARG FUSEOVERLAYFS_VERSION=v1.5.0
   ARG STARGZ_SNAPSHOTTER_VERSION=v0.5.0
   
  -ARG ALPINE_VERSION=3.12
  +ARG ALPINE_VERSION=3.14
   
   # git stage is used for checking out remote repository sources
   FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS git
  
positive.code: 
  # Rootless mode.
  FROM alpine:${ALPINE_VERSION} AS rootless
  RUN apk add --no-cache fuse3 git openssh pigz xz
  COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
  COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  COPY --from=fuse-overlayfs /out/fuse-overlayfs /usr/bin/
  # we could just set CAP_SETUID filecap rather than `chmod u+s`, but requires kernel >= 4.14
  # nsswitch.conf needs to be present to work around
  #   https://github.com/golang/go/issues/35305
  
negative.code:   mkdir /out && CGO_ENABLED=0 PREFIX=/out/ make && \
    xx-verify --static /out/containerd-stargz-grpc && \
    xx-verify --static /out/ctr-remote
  
  # Copy together all binaries needed for oci worker mode
  FROM buildkit-export AS buildkit-buildkitd.oci_only
  