anchor.diff:    mkdir /out && CGO_ENABLED=0 PREFIX=/out/ make && \
     xx-verify --static /out/containerd-stargz-grpc && \
     xx-verify --static /out/ctr-remote
  -
  -FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS fuse-overlayfs
  -RUN apk add --no-cache curl
  -COPY --from=xx / /
  -ARG FUSEOVERLAYFS_VERSION
  -ARG TARGETPLATFORM
  -RUN mkdir /out && \
  -  curl -sSL -o /out/fuse-overlayfs https://github.com/containers/fuse-overlayfs/releases/download/${FUSEOVERLAYFS_VERSION}/fuse-overlayfs-$(xx-info march) && \
  -  chmod +x /out/fuse-overlayfs && \
  -  xx-verify --static /out/fuse-overlayfs
   
   # Copy together all binaries needed for oci worker mode
   FROM buildkit-export AS buildkit-buildkitd.oci_only
  
positive.code: 
  # Rootless mode.
  FROM alpine:${ALPINE_VERSION} AS rootless
  RUN apk add --no-cache fuse3 git openssh pigz xz
  COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
  COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  COPY --from=fuse-overlayfs /out/fuse-overlayfs /usr/bin/
  # we could just set CAP_SETUID filecap rather than `chmod u+s`, but requires kernel >= 4.14
  # nsswitch.conf needs to be present to work around
  #   https://github.com/golang/go/issues/35305
  
negative.code: FROM integration-tests AS dev-env
  VOLUME /var/lib/buildkit
  
  # newuidmap & newgidmap binaries (shadow-uidmap 4.8.1-r0) shipped with alpine cannot be executed without CAP_SYS_ADMIN,
  # because the binaries are built without libcap-dev.
  # So we need to build the binaries with libcap enabled.
  # TODO: ask the Alpine upstream to enable libcap: https://github.com/moby/buildkit/issues/2038
  FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS idmap
  RUN apk add --no-cache git autoconf automake clang lld gettext-dev libtool make byacc binutils
  COPY --from=xx / /
  