anchor.diff:  RUN mkdir /licenses && \\
       cp LICENSE.txt /licenses/LICENSE
   <% } %>
  +
   USER elasticsearch:root
   
   # Our actual entrypoint is `tini`, a minimal but functional init program. It
  
positive.code: FROM ${base_image} AS builder
  
  # Install required packages to extract the Elasticsearch distribution
  RUN <%= retry_loop(package_manager, "${package_manager} install -y tar gzip") %>
  
  # `tini` is a tiny but valid init for containers. This is used to cleanly
  # control how ES and any child processes are shut down.
  
negative.code: 
  COPY --from=curl /work/curl /rootfs/usr/bin/curl
  
  # Ensure that there are no files with setuid or setgid, in order to mitigate "stackclash" attacks.
  RUN find /rootfs -xdev -perm -4000 -exec chmod ug-s {} +
  
  ################################################################################
  # Step 3. Fetch the Elasticsearch distribution and configure it for Docker
  ################################################################################
  