anchor.diff:  		--add-module=./extensions/ngx_cache_purge \
   		--add-module=./extensions/nginx-ct \
   		--add-module=./extensions/ngx_brotli \
  +		--add-module=./extensions/${naxsi_tarball_name}/naxsi_src \
   		--add-module=./extensions/${passenger_tarball_name}/src/nginx_module \
  -		--with-cc-opt='-O2 -g -pipe -Wp,-D_FORTIFY_SOURCE=2 -fexceptions -fstack-protector --param=ssp-buffer-size=4 -m64 -mtune=generic  -Wno-deprecated-declarations -Wno-cast-function-type -Wno-unused-parameter -Wno-stringop-truncation -Wno-stringop-overflow ' \
  -		--with-ld-opt='-Wl,-rpath,$LUAJITLIB' \
  -	    --prefix=/etc/nginx \
  -	&& make \
  +	" \
  +	&& CFLAGS='-O2 -g -pipe -Wp,-D_FORTIFY_SOURCE=2 \
  +		-fexceptions -fstack-protector \
  +		--param=ssp-buffer-size=4 -m64 -mtune=generic \
  +		-Wno-deprecated-declarations \
  +		-Wno-cast-function-type \
  +		-Wno-unused-parameter \
  +		-Wno-stringop-truncation \
  +		-Wno-stringop-overflow' \
  +	&& ./configure $CONF --with-cc-opt="$CFLAGS" \
  +\
  +# build
  +	&& make -j$(getconf _NPROCESSORS_ONLN) \
   	&& find . -type f -a -name 'nginx' -o -name '*.so*' | xargs strip \
   	&& make install \
  -	&& mkdir -p /usr/lib/systemd/system  \
  +	&& mkdir -p /usr/lib/nginx/modules \
  +	&& (for so in `find extensions -type f -name '*.so'`; do mv $so /usr/lib/nginx/modules ; done; true) \
  +	&& apk add --no-cache --virtual .gettext gettext \
  +\
  +	#&& mv /usr/bin/envsubst /tmp/ \
  +	&& runDeps="$( \
  +		scanelf --needed --nobanner --format '%n#p' /usr/sbin/nginx /usr/lib/nginx/modules/*.so /tmp/envsubst \
  +			| tr ',' '\n' \
  +			| sort -u \
  +			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
  +	)" \
  +\
  +	#&& apk del --virtual .gettext \
  +	#&& mv /usr/bin/envsubst /tmp/ \
  +	&& apk add --no-cache --virtual .nginx-rundeps $runDeps \
  +	&& (strip /usr/sbin/nginx /usr/lib/nginx/modules/*.so; true) \
  +	&& (chmod 755 /usr/lib/nginx/modules/*.so; true) \
  +	&& apk del --purge --virtual .builddep \
  +	&& mkdir -p -m755 /usr/lib/systemd/system  \
   		/etc/nginx/conf.d \
   		/var/cache/nginx  \
   		/var/log/nginx  \
   		/usr/share/nginx/html \
  +	&& install -m644 /tmp/build/nginx.conf /etc/nginx/nginx.conf \
  +	&& install -m644 /tmp/build/nginx_httpd.conf /etc/nginx/conf.d/_http.conf \
  +	&& install -m644 /tmp/build/nginx_ssl.conf /etc/nginx/conf.d/_ssl.conf \
  +	&& install -m644 /etc/nginx/html/50x.html /usr/share/nginx/html \
  +	&& install -m644 /etc/nginx/html/index.html /usr/share/nginx/html \
  +	&& mkdir -p -m755 /etc/nginx/naxsi.d \
   	&& cd /tmp/build/nginx-${KUSANAGI_NGINX_VERSION}/ \
  -	&& cp /tmp/build/nginx.conf /etc/nginx/nginx.conf \
  -	&& cp /tmp/build/nginx_httpd.conf /etc/nginx/conf.d/_http.conf \
  -	&& cp /tmp/build/nginx_ssl.conf /etc/nginx/conf.d/_ssl.conf \
  -	&& cp /etc/nginx/html/50x.html /usr/share/nginx/html \
  -	&& cp /etc/nginx/html/index.html /usr/share/nginx/html \
  -	&& mkdir -p /etc/nginx/naxsi.d \
  -	&& cp extensions/${naxsi_tarball_name}/naxsi_config/naxsi_core.rules /etc/nginx/naxsi.d/naxsi_core.rules.conf \
  -	&& (cd /etc/nginx/; tar xf /tmp/build/naxsi.d.tar.gz) \
  -	&& cp /tmp/build/kusanagi_naxsi_core.conf /etc/nginx/conf.d/kusanagi_naxsi_core.conf \
  -	&& cp /tmp/build/security.conf /etc/nginx/conf.d/security.conf \
  +	&& install -m644 extensions/${naxsi_tarball_name}/naxsi_config/naxsi_core.rules /etc/nginx/naxsi.d/naxsi_core.rules.conf \
  +	&& cd /etc/nginx/ \
  +	&& tar xf /tmp/build/naxsi.d.tar.gz \
  +	&& install -m644 /tmp/build/kusanagi_naxsi_core.conf /etc/nginx/conf.d/kusanagi_naxsi_core.conf \
  +	&& install -m644 /tmp/build/security.conf /etc/nginx/conf.d/security.conf \
  +	\
  +	# forward request and error logs to docker log collector
  +	&& ln -s ../../usr/lib/nginx/modules /etc/nginx/modules \
  +	&& ln -sf /dev/stdout /var/log/nginx/access.log \
  +	&& ln -sf /dev/stderr /var/log/nginx/error.log \
  +	&& apk add --no-cache tzdata \
   	&& cd / \
  -	&& : # END OF RUN
  -	#&& rm -rf /tmp/build \
  -	#&& apk del --purge $DEP \
  -
  +	&& rm -rf /tmp/build \
  +	&& : # END of RUN
  +
  +USER httpd
   CMD [ "/usr/sbin/nginx", "-g", "daemon off;" ]
  
positive.code: 		--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
  		--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
  		--http-scgi-temp-path=/var/cache/nginx/scgi_temp \
  		--user=nginx \
  		--group=nginx \
  		--with-http_ssl_module \
  		--with-http_realip_module \
  		--with-http_addition_module \
  
negative.code: 		--with-http_secure_link_module \
  		--with-http_stub_status_module \
  		--with-http_auth_request_module \
  		--with-http_xslt_module \
  		--with-http_image_filter_module \
  		--with-http_geoip_module \
  		--with-threads \
  		--with-stream \
  		--with-stream_ssl_module \
  		--with-stream_ssl_preread_module \
  		--with-stream_realip_module \
  		--with-stream_geoip_module \
  		--with-http_slice_module \
  		--with-mail \
  		--with-mail_ssl_module \
  