anchor.diff:  
   FROM --platform=$BUILDPLATFORM alpine AS cni-plugins
   RUN apk add --no-cache curl
  -ENV CNI_VERSION=v0.8.1
  +ARG CNI_VERSION
   ARG TARGETOS
   ARG TARGETARCH
   WORKDIR /opt/cni/bin
  
positive.code: FROM integration-tests AS dev-env
  VOLUME /var/lib/buildkit
  
  # To allow running buildkit in a container without CAP_SYS_ADMIN, we need to do either
  #  a) install newuidmap/newgidmap with file capabilities rather than SETUID (requires kernel >= 4.14)
  #  b) install newuidmap/newgidmap >= 20181125 (59c2dabb264ef7b3137f5edb52c0b31d5af0cf76)
  # We choose b) until kernel >= 4.14 gets widely adopted.
  # See https://github.com/shadow-maint/shadow/pull/132 https://github.com/shadow-maint/shadow/pull/138 https://github.com/shadow-maint/shadow/pull/141
  # (Note: we don't use the patched idmap for the testsuite image)
  FROM alpine:3.8 AS idmap
  RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
  RUN git clone https://github.com/shadow-maint/shadow.git /shadow
  WORKDIR /shadow
  RUN git checkout 59c2dabb264ef7b3137f5edb52c0b31d5af0cf76
  RUN ./autogen.sh --disable-nls --disable-man --without-audit --without-selinux --without-acl --without-attr --without-tcb --without-nscd \
    && make \
    && cp src/newuidmap src/newgidmap /usr/bin
  
  FROM alpine AS rootless-base-internal
  RUN apk add --no-cache git
  COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
  COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  RUN chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap \
    && adduser -D -u 1000 user \
    && mkdir -p /run/user/1000 /home/user/.local/tmp /home/user/.local/share/buildkit \
    && chown -R user /run/user/1000 /home/user \
    && echo user:100000:65536 | tee /etc/subuid | tee /etc/subgid \
    && passwd -l root
  # As of v3.8.1, Alpine does not set SUID bit on the busybox version of /bin/su.
  # However, future version may set SUID bit on /bin/su.
  # We lock the root account by `passwd -l root`, so as to disable su completely.
  
  # tonistiigi/buildkit:rootless-base is a pre-built multi-arch version of rootless-base-internal https://github.com/moby/buildkit/pull/666#pullrequestreview-161872350
  FROM tonistiigi/buildkit:rootless-base@sha256:7e87da0f64e4987b4b6620f7b27b62d7178fc27964fcc3afeb8412f4231aa425 AS rootless-base-external
  
negative.code:   && make bin/containerd-shim \
    && mv bin /out
  
  ARG REGISTRY_VERSION
  FROM registry:$REGISTRY_VERSION AS registry
  
  FROM gobuild-base AS rootlesskit
  ARG ROOTLESSKIT_VERSION
  