anchor.diff:    && cp src/newuidmap src/newgidmap /usr/bin
   
   # Rootless mode.
  -FROM alpine:3.11 AS rootless
  +FROM alpine:3.12 AS rootless
   RUN apk add --no-cache fuse3 git xz
   COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
   COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  
positive.code: FROM integration-tests AS dev-env
  VOLUME /var/lib/buildkit
  
  # newuidmap & newgidmap binaries (shadow-uidmap 4.7-r1) shipped with alpine:3.11 cannot be executed without CAP_SYS_ADMIN,
  # because the binaries are built without libcap-dev.
  # So we need to build the binaries with libcap enabled.
  FROM alpine:3.11 AS idmap
  RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
  RUN git clone https://github.com/shadow-maint/shadow.git /shadow
  WORKDIR /shadow
  
negative.code:   CGO_ENABLED=0 go build -o /rootlesskit ./cmd/rootlesskit && \
    file /rootlesskit | grep "statically linked"
  
  FROM --platform=$BUILDPLATFORM alpine AS fuse-overlayfs
  RUN apk add --no-cache curl
  ARG FUSEOVERLAYFS_VERSION
  ARG TARGETARCH
  RUN echo $TARGETARCH | sed -e s/^amd64$/x86_64/ -e s/^arm64$/aarch64/ -e s/^arm$/armv7l/ > /uname_m && \
    mkdir /out && \
    curl -sSL -o /out/fuse-overlayfs https://github.com/containers/fuse-overlayfs/releases/download/${FUSEOVERLAYFS_VERSION}/fuse-overlayfs-$(cat /uname_m) && \
    chmod +x /out/fuse-overlayfs
  
  # Copy together all binaries needed for oci worker mode
  FROM buildkit-export AS buildkit-buildkitd.oci_only
  