anchor.diff:    && cp src/newuidmap src/newgidmap /usr/bin
   
   # Rootless mode.
  -FROM alpine AS rootless
  +FROM alpine:3.12 AS rootless
   RUN apk add --no-cache fuse3 git xz pigz
   COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
   COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  
positive.code: ARG SHADOW_VERSION=4.8.1
  ARG FUSEOVERLAYFS_VERSION=v1.2.0
  ARG STARGZ_SNAPSHOTTER_VERSION=3a04e4c2c116c85b4b66d01945cf7ebcb7a2eb5a
  
  ARG ALPINE_VERSION=3.12
  
  FROM alpine:${ALPINE_VERSION} AS alpine
  
  # git stage is used for checking out remote repository sources
  FROM --platform=$BUILDPLATFORM alpine AS git
  
negative.code: # newuidmap & newgidmap binaries (shadow-uidmap 4.7-r1) shipped with alpine cannot be executed without CAP_SYS_ADMIN,
  # because the binaries are built without libcap-dev.
  # So we need to build the binaries with libcap enabled.
  FROM alpine:3.12 AS idmap
  RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
  RUN git clone https://github.com/shadow-maint/shadow.git /shadow
  WORKDIR /shadow
  