anchor.diff:  # newuidmap & newgidmap binaries (shadow-uidmap 4.7-r1) shipped with alpine cannot be executed without CAP_SYS_ADMIN,
   # because the binaries are built without libcap-dev.
   # So we need to build the binaries with libcap enabled.
  -FROM alpine:3.12 AS idmap
  +FROM alpine:${ALPINE_VERSION} AS idmap
   RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
   RUN git clone https://github.com/shadow-maint/shadow.git /shadow
   WORKDIR /shadow
  
positive.code: VOLUME /run/containerd
  ENTRYPOINT ["containerd"]
  
  FROM --platform=$BUILDPLATFORM alpine AS cni-plugins
  RUN apk add --no-cache curl
  ARG CNI_VERSION
  ARG TARGETOS
  
negative.code: 
  FROM buildkit-buildkitd-$TARGETOS AS buildkit-buildkitd
  
  FROM alpine:${ALPINE_VERSION} AS containerd-runtime
  COPY --from=runc /usr/bin/runc /usr/bin/
  COPY --from=containerd /out/containerd* /usr/bin/
  COPY --from=containerd /out/ctr /usr/bin/
  