anchor.diff:  WORKDIR /
   ENTRYPOINT ["cri-containerd", "-v", "2", "--alsologtostderr", "--network-bin-dir", "/var/lib/cni/opt/bin", "--network-conf-dir", "/var/lib/cni/etc/net.d"]
   COPY --from=build /out /
  -LABEL org.mobyproject.config='{"binds": ["/etc/resolv.conf:/etc/resolv.conf", "/run:/run:rshared,rbind", "/tmp:/tmp", "/var:/var:rshared,rbind", "/var/lib/kubeadm:/etc/kubernetes", "/var/lib/cni/etc:/etc/cni:rshared,rbind", "/var/lib/cni/opt:/opt/cni:rshared,rbind", "/run/containerd/containerd.sock:/run/containerd/containerd.sock"], "mounts": [{"type": "cgroup", "options": ["rw","nosuid","noexec","nodev","relatime"]}], "capabilities": ["all"], "rootfsPropagation": "shared", "pid": "host", "runtime": {"mkdir": ["/var/lib/kubeadm", "/var/lib/cni/etc/net.d", "/var/lib/cni/opt"]}}'
  +LABEL org.mobyproject.config='{"binds": ["/etc/resolv.conf:/etc/resolv.conf", "/run:/run:rshared,rbind", "/dev:/dev", "/tmp:/tmp", "/var:/var:rshared,rbind", "/var/lib/kubeadm:/etc/kubernetes", "/var/lib/cni/etc:/etc/cni:rshared,rbind", "/var/lib/cni/opt:/opt/cni:rshared,rbind", "/run/containerd/containerd.sock:/run/containerd/containerd.sock"], "mounts": [{"type": "cgroup", "options": ["rw","nosuid","noexec","nodev","relatime"]}], "capabilities": ["all"], "rootfsPropagation": "shared", "pid": "host", "runtime": {"mkdir": ["/var/lib/kubeadm", "/var/lib/cni/etc/net.d", "/var/lib/cni/opt"]}}'
  
positive.code:         git fetch origin "$CRI_CONTAINERD_BRANCH"; \
      fi; \
      git checkout $CRI_CONTAINERD_COMMIT
  RUN make static-binaries
  
  RUN mkdir -p /out/etc/apk && cp -r /etc/apk/* /out/etc/apk/
  # util-linux because a full ns-enter is required.
  
negative.code:   git \
    go \
    libc-dev \
    libseccomp-dev \
    linux-headers \
    make \
    && true
  ENV GOPATH=/go PATH=$PATH:/go/bin
  
  ENV CRI_CONTAINERD_URL https://github.com/kubernetes-incubator/cri-containerd.git
  #ENV CRI_CONTAINERD_BRANCH pull/NNN/head
  ENV CRI_CONTAINERD_COMMIT 0e6e59348122e86842bcd93c75c1d4a264ca1288
  RUN mkdir -p $GOPATH/src/github.com/kubernetes-incubator && \
      cd $GOPATH/src/github.com/kubernetes-incubator && \
      git clone $CRI_CONTAINERD_URL cri-containerd
  