anchor.diff:  RUN mkdir /licenses && \\
       cp LICENSE.txt /licenses/LICENSE
   <% } %>
  +
   USER elasticsearch:root
   
   # Our actual entrypoint is `tini`, a minimal but functional init program. It
  
positive.code: FROM ${base_image} AS builder
  
  # Install required packages to extract the Elasticsearch distribution
  RUN <%= retry_loop(package_manager, "${package_manager} install -y tar gzip") %>
  
  # `tini` is a tiny but valid init for containers. This is used to cleanly
  # control how ES and any child processes are shut down.
  
negative.code: COPY --from=builder --chown=0:0 /bin/tini /bin/tini
  <% } %>
  
  ENV PATH /usr/share/elasticsearch/bin:\$PATH
  
  COPY ${bin_dir}/docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
  
  # 1. Sync the user and group permissions of /etc/passwd
  # 2. Set correct permissions of the entrypoint
  # 3. Ensure that there are no files with setuid or setgid, in order to mitigate "stackclash" attacks.
  #    We've already run this in previous layers so it ought to be a no-op.
  # 4. Replace OpenJDK's built-in CA certificate keystore with the one from the OS
  #    vendor. The latter is superior in several ways.
  #    REF: https://github.com/elastic/elasticsearch-docker/issues/171
  RUN chmod g=u /etc/passwd && \\
      chmod 0775 /usr/local/bin/docker-entrypoint.sh && \\
      find / -xdev -perm -4000 -exec chmod ug-s {} + && \\
      ln -sf /etc/pki/ca-trust/extracted/java/cacerts /usr/share/elasticsearch/jdk/lib/security/cacerts
  
  EXPOSE 9200 9300
  
  