anchor.diff:  FROM integration-tests AS dev-env
   VOLUME /var/lib/buildkit
   
  -# newuidmap & newgidmap binaries (shadow-uidmap 4.7-r1) shipped with alpine cannot be executed without CAP_SYS_ADMIN,
  +# newuidmap & newgidmap binaries (shadow-uidmap 4.8.1-r0) shipped with alpine cannot be executed without CAP_SYS_ADMIN,
   # because the binaries are built without libcap-dev.
   # So we need to build the binaries with libcap enabled.
  +# TODO: ask the Alpine upstream to enable libcap: https://github.com/moby/buildkit/issues/2038
   FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS idmap
   RUN apk add --no-cache git autoconf automake clang lld gettext-dev libtool make byacc binutils
   COPY --from=xx / /
  
positive.code:   mkdir /out && CGO_ENABLED=0 PREFIX=/out/ make && \
    xx-verify --static /out/containerd-stargz-grpc && \
    xx-verify --static /out/ctr-remote
  
  FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS fuse-overlayfs
  RUN apk add --no-cache curl
  COPY --from=xx / /
  ARG FUSEOVERLAYFS_VERSION
  ARG TARGETPLATFORM
  RUN mkdir /out && \
    curl -sSL -o /out/fuse-overlayfs https://github.com/containers/fuse-overlayfs/releases/download/${FUSEOVERLAYFS_VERSION}/fuse-overlayfs-$(xx-info march) && \
    chmod +x /out/fuse-overlayfs && \
    xx-verify --static /out/fuse-overlayfs
  
  # Copy together all binaries needed for oci worker mode
  FROM buildkit-export AS buildkit-buildkitd.oci_only
  
negative.code: ARG ROOTLESSKIT_VERSION=v0.14.2
  ARG CNI_VERSION=v0.9.1
  ARG SHADOW_VERSION=4.8.1
  ARG STARGZ_SNAPSHOTTER_VERSION=v0.5.0
  
  ARG ALPINE_VERSION=3.14
  
  # git stage is used for checking out remote repository sources
  FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS git
  