anchor.diff:  RUN mkdir /licenses && \\
       cp LICENSE.txt /licenses/LICENSE
   <% } %>
  +
   USER elasticsearch:root
   
   # Our actual entrypoint is `tini`, a minimal but functional init program. It
  
positive.code: COPY --from=builder --chown=0:0 /bin/tini /bin/tini
  <% } %>
  
  # Replace OpenJDK's built-in CA certificate keystore with the one from the OS
  # vendor. The latter is superior in several ways.
  # REF: https://github.com/elastic/elasticsearch-docker/issues/171
  RUN ln -sf /etc/pki/ca-trust/extracted/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
  
  ENV PATH /usr/share/elasticsearch/bin:\$PATH
  
  COPY ${bin_dir}/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
  
  # 1. The JDK's directories' permissions don't allow `java` to be executed under a different
  #    group to the default. Fix this.
  # 2. Sync the user and group permissions of /etc/passwd
  # 3. Set correct permissions of the entrypoint
  # 4. Ensure that there are no files with setuid or setgid, in order to mitigate "stackclash" attacks.
  # 5. Ensure all files are world-readable by default. It should be possible to
  #    examine the contents of the image under any UID:GID
  RUN find /usr/share/elasticsearch/jdk -type d -exec chmod 0755 {} + && \\
      chmod g=u /etc/passwd && \\
      chmod 0775 /usr/local/bin/docker-entrypoint.sh && \\
      find / -xdev -perm -4000 -exec chmod ug-s {} + && \\
      find /usr/share/elasticsearch -type f -exec chmod o+r {} +
  
  EXPOSE 9200 9300
  
  
negative.code: 
  COPY --from=curl /work/curl /rootfs/usr/bin/curl
  
  # Ensure that there are no files with setuid or setgid, in order to mitigate "stackclash" attacks.
  RUN find /rootfs -xdev -perm -4000 -exec chmod ug-s {} +
  
  ################################################################################
  # Step 3. Fetch the Elasticsearch distribution and configure it for Docker
  ################################################################################
  