anchor.diff:  FROM debian:stretch-slim
   
   # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
  -RUN groupadd -r mysql && useradd -m -g mysql mysql
  +RUN groupadd -r mysql && useradd -u 1000 -m -g mysql mysql
   
  -RUN apt-get update && apt-get install -y --no-install-recommends gnupg dirmngr && rm -rf /var/lib/apt/lists/*
  +RUN apt-get update && apt-get install -y --no-install-recommends curl gnupg dirmngr && rm -rf /var/lib/apt/lists/*
   
   # add gosu for easy step-down from root
   ENV GOSU_VERSION 1.7
  
positive.code: RUN chown -R mysql:mysql /var/lib/mysql
  
  # Config files
  USER mysql
  WORKDIR /etc/mysql
  COPY docker-entrypoint.sh /usr/local/bin/
  ENTRYPOINT ["docker-entrypoint.sh"]
  
negative.code: 	&& wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture)" \
  	&& wget -O /usr/local/bin/gosu.asc "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$(dpkg --print-architecture).asc" \
  	&& export GNUPGHOME="$(mktemp -d)" \
  	&& gpg --keyserver hkp://pool.sks-keyservers.net:80 --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 || \
          gpg --keyserver pgp.mit.edu --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 || \
          gpg --keyserver keyserver.pgp.com --recv-keys B42F6819007F00F88E364FD4036A9C25BF357DD4 || \
          curl https://keybase.io/tianon/pgp_keys.asc?fingerprint=b42f6819007f00f88e364fd4036a9c25bf357dd4 | gpg --import ; \
  	gpg --batch --verify /usr/local/bin/gosu.asc /usr/local/bin/gosu \
  	&& rm -rf "$GNUPGHOME" /usr/local/bin/gosu.asc \
  	&& chmod +x /usr/local/bin/gosu \
  	&& gosu nobody true \
  