anchor.diff:  
   FROM --platform=$BUILDPLATFORM alpine AS cni-plugins
   RUN apk add --no-cache curl
  -ENV CNI_VERSION=v0.8.1
  +ARG CNI_VERSION
   ARG TARGETOS
   ARG TARGETARCH
   WORKDIR /opt/cni/bin
  
positive.code:   && make bin/containerd-shim \
    && mv bin /out
  
  FROM tonistiigi/registry:$REGISTRY_VERSION AS registry
  
  FROM gobuild-base AS rootlesskit
  ARG ROOTLESSKIT_VERSION
  
negative.code: FROM integration-tests AS dev-env
  VOLUME /var/lib/buildkit
  
  # newuidmap & newgidmap binaries (shadow-uidmap 4.7-r1) shipped with alpine:3.11 cannot be executed without CAP_SYS_ADMIN,
  # because the binaries are built without libcap-dev.
  # So we need to build the binaries with libcap enabled.
  FROM alpine:3.11 AS idmap
  RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
  RUN git clone https://github.com/shadow-maint/shadow.git /shadow
  WORKDIR /shadow
  ARG SHADOW_VERSION
  RUN git checkout $SHADOW_VERSION
  RUN ./autogen.sh --disable-nls --disable-man --without-audit --without-selinux --without-acl --without-attr --without-tcb --without-nscd \
    && make \
    && cp src/newuidmap src/newgidmap /usr/bin
  
  FROM alpine:3.11 AS rootless-base-internal
  RUN apk add --no-cache git
  COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
  COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  # we could just set CAP_SETUID filecap rather than `chmod u+s`, but requires kernel >= 4.14
  RUN chmod u+s /usr/bin/newuidmap /usr/bin/newgidmap \
    && adduser -D -u 1000 user \
    && mkdir -p /run/user/1000 /home/user/.local/tmp /home/user/.local/share/buildkit \
    && chown -R user /run/user/1000 /home/user \
    && echo user:100000:65536 | tee /etc/subuid | tee /etc/subgid
  
  # tonistiigi/buildkit:rootless-base is a pre-built multi-arch version of rootless-base-internal https://github.com/moby/buildkit/pull/666#pullrequestreview-161872350
  FROM tonistiigi/buildkit:rootless-base@sha256:7e87da0f64e4987b4b6620f7b27b62d7178fc27964fcc3afeb8412f4231aa425 AS rootless-base-external
  