anchor.diff:  
   # password set in sshd/run script at ssh start. allows for override via env var.
   RUN \
  -  set -e; groupadd --system airstack --gid 432 && \
  -  useradd --uid 431 --system --base-dir /home --create-home --gid airstack --shell /bin/nologin --comment "airstack user" airstack && \
  +  set -e; groupadd --system airstack --gid 432; \
  +  useradd --uid 431 --system --base-dir /home --create-home --gid airstack --shell /bin/nologin --comment "airstack user" airstack; \
     chown -R airstack:airstack /home/airstack
   
   # passwordless sudo enabled for airstack user. should only do for development environment.
   # RUN [ $AIRSTACK_TAGS_ENV = "development" ] && echo "airstack  ALL = NOPASSWD: ALL" > /etc/sudoers.d/airstack && usermod --shell /bin/bash airstack
   RUN \
  -  echo "airstack  ALL = NOPASSWD: ALL" > /etc/sudoers.d/airstack && \
  +  set -e; echo "airstack  ALL = NOPASSWD: ALL" > /etc/sudoers.d/airstack; \
     usermod --shell /bin/bash airstack
   
   #runit install
  
positive.code: 
  # Packages::Lua
  RUN \
    /command/core-package-install libssl-dev && \
    /command/core-package-install luajit luarocks && \
    luarocks install --server=http://rocks.moonscript.org luasec OPENSSL_LIBDIR=/usr/lib/x86_64-linux-gnu/ && \
    luarocks install --server=https://rocks.moonscript.org moonrocks
  
  # Packages::test
  
negative.code: 
  #env vars
  RUN \
    set -e; mkdir -vp /etc/airstack; \
    echo $AIRSTACK_RUNTIME_VARS | jq '' | tee /etc/airstack/runtime.json
  
  
  ################################################################################
  