anchor.diff:              exec ${config.systemd.package}/bin/systemd-nspawn \
                 --keep-unit \
                 -M "$INSTANCE" -D "$root" $extraFlags \
  -	      $EXTRABINDS \
  +              $EXTRABINDS \
                 --bind-ro=/nix/store \
                 --bind-ro=/nix/var/nix/db \
                 --bind-ro=/nix/var/nix/daemon-socket \
  
positive.code:               '';
              };
  
              extraBinds = mkOption {
                type = types.listOf types.attrs;
  	      default = [];
  	      example = [ { host = "/home/alice";
                              container = "/home";
  			    isReadOnly = false; }
                          ];
                description =
  	        ''
                    An extra list of directories that is bound to the container.
                  '';
              };
  
              #extraBindsRW = mkOption {
              #  type = types.listOf types.str;
  	    # default = [];
  	    #  example = [ "/home/alice" ];
              #  description =
  	    #    ''
              #      An extra list of directories that is bound to the container with read-only permission. 
              #    '';
              #};
  
            };
  
  
negative.code: 
    system = config.nixpkgs.system;
  
    bindMountOpts = { name, config, ... }: {
    
      options = {
        mountPoint = mkOption {
          example = "/mnt/usb";
          type = types.str;
          description = "Location of the mounted in the container file systems";
        };
        hostPath = mkOption {
          default = null;
          example = "/home/alice";
          type = types.uniq (types.nullOr types.string);
          description = "Location of the host path to be mounted";
        };
        isReadOnly = mkOption {
          default = false;
          example = true;
          type = types.bool;
          description = "Determine whether the mounted path will be accessed in read-only mode";
        };
      };
      
      config = {
        mountPoint = mkDefault name;
      };
      
    };
    
    mkBindFlag = d:
                 let flagPrefix = if d.isReadOnly then " --bind-ro=" else " --bind=";
                     mountstr = if d.hostPath != null then "${d.hostPath}:${d.mountPoint}" else "${d.mountPoint}";
                 in flagPrefix + mountstr ;
  
    mkBindFlags = bs: concatMapStrings mkBindFlag (lib.attrValues bs);
  
  in
  
  