anchor.diff:  # See the License for the specific language governing permissions and
   # limitations under the License
   
  -FROM quay.io/datawire/ambassador-envoy-alpine-stripped:v1.8.0-15c5befd43fb9ee9b145cc87e507beb801726316
  +################################################################
  +# This is a multistage Dockerfile, because while we need the compilers et al for the build, we don't need them
  +# to run things. If you don't know what you're doing, it's probably a mistake to blindly hack up this file.
  +#
  +# By default, Ambassador's config and other application-specific stuff gets written to /ambassador. You can
  +# configure a different location for the runtime configuration elements via environment variables.
  +#
  +# Ambassador itself is installed with pip, so it ends up in /usr/bin and /usr/lib. At present, other
  +# executables are written into /ambassador, but we'll likely change that shortly.
  +#
  +# The base image (for everything) is defined here.
  +
  +FROM quay.io/datawire/ambassador-envoy-alpine-stripped:v1.8.0-15c5befd43fb9ee9b145cc87e507beb801726316 as BASE
   
   MAINTAINER Datawire <flynn@datawire.io>
   LABEL PROJECT_REPO_URL         = "git@github.com:datawire/ambassador.git" \
  
positive.code: RUN chmod +x kubewatch
  
  # Clean up no-longer-needed dev stuff.
  RUN apk del build-base libffi-dev openssl-dev python3-dev go
  
  # MKDIR an empty /ambassador/ambassador-config. You can dump a
  # configmap over this with no trouble, or you can let
  # annotations do the right thing
  RUN mkdir ambassador-config
  RUN mkdir envoy
  
  
negative.code:     chmod -R u+x ${AMBASSADOR_ROOT} && \
      chmod -R g=u ${AMBASSADOR_ROOT} /etc/passwd
  
  # COPY the entrypoint and Python-kubewatch and make them runnable.
  COPY ambassador/kubewatch.py .
  COPY ambassador/entrypoint.sh .
  RUN chmod 755 kubewatch.py entrypoint.sh
  
  # Grab ambex, too.
  RUN wget -q https://s3.amazonaws.com/datawire-static-files/ambex/0.1.1/ambex
  RUN chmod 755 ambex
  
  