anchor.diff:  # grab gosu for easy step-down from root
   RUN set -x \
       && export GOSU_VERSION=1.10 \
  -    && apt-get update && apt-get install -y --no-install-recommends gnupg gnupg2 wget && rm -rf /var/lib/apt/lists/* \
  +    && apt-get update && apt-get install -y --no-install-recommends dirmngr gnupg gnupg2 wget && rm -rf /var/lib/apt/lists/* \
       && wget --no-verbose -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
       && wget --no-verbose -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
       && export GNUPGHOME="$(mktemp -d)" \
  
positive.code:     ; do \
        gpg --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
      done \
      && apt-get update && apt-get install -y --no-install-recommends gnupg gnupg2 wget && rm -rf /var/lib/apt/lists/* \
      && wget --no-verbose "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.gz" \
      && wget --no-verbose "https://nodejs.org/dist/v$NODE_VERSION/SHASUMS256.txt.asc" \
      && gpg --verify SHASUMS256.txt.asc \
      && grep " node-v$NODE_VERSION-linux-x64.tar.gz\$" SHASUMS256.txt.asc | sha256sum -c - \
      && tar -xzf "node-v$NODE_VERSION-linux-x64.tar.gz" -C /usr/local --strip-components=1 \
      && rm -r "$GNUPGHOME" "node-v$NODE_VERSION-linux-x64.tar.gz" SHASUMS256.txt.asc \
      && apt-get purge -y --auto-remove gnupg gnupg2 wget \
      && npm install -g yarn@$YARN_VERSION \
      && npm cache clear --force
  
  
negative.code:     && rm -r "$GNUPGHOME" /usr/local/bin/gosu.asc \
      && chmod +x /usr/local/bin/gosu \
      && gosu nobody true \
      && apt-get purge -y --auto-remove dirmngr gnupg gnupg2 wget
  
  # grab tini for signal processing and zombie killing
  RUN set -x \
      && export TINI_VERSION=0.15.0 \
      && apt-get update && apt-get install -y --no-install-recommends dirmngr gnupg gnupg2 wget && rm -rf /var/lib/apt/lists/* \
      && wget --no-verbose -O /usr/local/bin/tini "https://github.com/krallin/tini/releases/download/v$TINI_VERSION/tini" \
      && wget --no-verbose -O /usr/local/bin/tini.asc "https://github.com/krallin/tini/releases/download/v$TINI_VERSION/tini.asc" \
      && export GNUPGHOME="$(mktemp -d)" \
  