anchor.diff:  RUN chmod +x kubewatch
   
   # Clean up no-longer-needed dev stuff.
  -RUN apk del build-base libffi-dev openssl-dev python3-dev go
  +# RUN apk del build-base libffi-dev openssl-dev python3-dev go
   
  -# MKDIR an empty /ambassador/ambassador-config. You can dump a
  -# configmap over this with no trouble, or you can let
  -# annotations do the right thing
  +################################################################
  +## SECOND STAGE: this is where we pull over the stuff we need to actually run Ambassador,
  +## _without_ all the compilers and crap.
  +
  +FROM BASE as foundation
  +ENV AMBASSADOR_ROOT=/ambassador
  +WORKDIR ${AMBASSADOR_ROOT}
  +
  +RUN apk --no-cache add curl python3
  +
  +# One could argue that this is perhaps a bit of a hack. However, it's also the way to
  +# get all the stuff that pip installed without needing the whole of the Python dev
  +# chain.
  +COPY --from=builder /usr/lib/python3.6 /usr/lib/python3.6
  +
  +# Copy Ambassador binaries...
  +COPY --from=builder /usr/bin/ambassador /usr/bin/diagd /usr/bin/
  +
  +# ...and go-kubewatch.
  +COPY --from=builder ${AMBASSADOR_ROOT}/kubewatch ${AMBASSADOR_ROOT}/
  +
  +# MKDIR an empty /ambassador/ambassador-config, so that you can drop a configmap over it
  +# if you really really need to (not recommended).
   RUN mkdir ambassador-config
   RUN mkdir envoy
   
  
positive.code:       VENDOR                   = "Datawire" \
        VENDOR_URL               = "https://datawire.io/"
  
  # This Dockerfile is set up to install all the application-specific stuff into
  # /ambassador.
  #
  # NOTE: If you don't know what you're doing, it's probably a mistake to
  # blindly hack up this file.
  
  RUN apk --no-cache add curl go python3 build-base libffi-dev openssl-dev python3-dev
  RUN pip3 install -U pip
  
  # Set WORKDIR to /ambassador which is the root of all our apps then COPY
  # only requirements.txt to avoid screwing up Docker caching and causing a
  # full reinstall of all dependencies when dependencies are not changed.
  ENV AMBASSADOR_ROOT=/ambassador
  WORKDIR ${AMBASSADOR_ROOT}
  COPY releng releng
  COPY multi/requirements.txt multi/
  COPY ambassador/requirements.txt ambassador/
  
negative.code:     chmod -R u+x ${AMBASSADOR_ROOT} && \
      chmod -R g=u ${AMBASSADOR_ROOT} /etc/passwd
  
  # COPY the entrypoint and Python-kubewatch and make them runnable.
  COPY ambassador/kubewatch.py .
  COPY ambassador/entrypoint.sh .
  RUN chmod 755 kubewatch.py entrypoint.sh
  
  # Grab ambex, too.
  RUN wget -q https://s3.amazonaws.com/datawire-static-files/ambex/0.1.1/ambex
  RUN chmod 755 ambex
  
  