anchor.diff:  # syntax = docker/dockerfile:1.1-experimental
   
   ARG RUNC_VERSION=v1.0.0-rc10
  -ARG CONTAINERD_VERSION=v1.3.2
  +ARG CONTAINERD_VERSION=v1.3.6
   # containerd v1.2 for integration tests
  -ARG CONTAINERD_OLD_VERSION=v1.2.11
  +ARG CONTAINERD_OLD_VERSION=v1.2.13
   # available targets: buildkitd, buildkitd.oci_only, buildkitd.containerd_only
   ARG BUILDKIT_TARGET=buildkitd
   ARG REGISTRY_VERSION=2.7.1
  -ARG ROOTLESSKIT_VERSION=v0.9.1
  -ARG CNI_VERSION=v0.8.5
  +ARG ROOTLESSKIT_VERSION=v0.9.5
  +ARG CNI_VERSION=v0.8.6
   ARG SHADOW_VERSION=4.8.1
  -ARG FUSEOVERLAYFS_VERSION=v0.7.6
  +ARG FUSEOVERLAYFS_VERSION=v1.1.2
   
   # git stage is used for checking out remote repository sources
   FROM --platform=$BUILDPLATFORM alpine AS git
  
positive.code:   && cp src/newuidmap src/newgidmap /usr/bin
  
  # Rootless mode.
  FROM alpine:3.11 AS rootless
  RUN apk add --no-cache fuse3 git xz
  COPY --from=idmap /usr/bin/newuidmap /usr/bin/newuidmap
  COPY --from=idmap /usr/bin/newgidmap /usr/bin/newgidmap
  
negative.code: FROM integration-tests AS dev-env
  VOLUME /var/lib/buildkit
  
  # newuidmap & newgidmap binaries (shadow-uidmap 4.7-r1) shipped with alpine cannot be executed without CAP_SYS_ADMIN,
  # because the binaries are built without libcap-dev.
  # So we need to build the binaries with libcap enabled.
  FROM alpine:3.12 AS idmap
  RUN apk add --no-cache autoconf automake build-base byacc gettext gettext-dev gcc git libcap-dev libtool libxslt
  RUN git clone https://github.com/shadow-maint/shadow.git /shadow
  WORKDIR /shadow
  