anchor.diff:  
     system = config.nixpkgs.system;
   
  +  mkBindFlag = d: if d.isReadOnly then " --bind-ro=${d.host}:${d.container}" else " --bind=${d.host}:${d.container}";
  +  mkBindFlags = bs: concatMapStrings mkBindFlag bs;
  +
   in
   
   {
  
positive.code:               '';
              };
  
              extraBindsRO = mkOption {
                type = types.listOf types.str;
  	      default = [];
  	      example = [ "/home/alice" ];
                description =
  	        ''
                    An extra list of directories that is bound to the container with read-only permission. 
                  '';
              };
  
              extraBindsRW = mkOption {
                type = types.listOf types.str;
  	      default = [];
  	      example = [ "/home/alice" ];
                description =
  	        ''
                    An extra list of directories that is bound to the container with read-only permission. 
                  '';
              };
  
            };
  
  
negative.code:              AUTO_START=1
             ''}
  
             EXTRABINDS="${mkBindFlags cfg.extraBinds}"
  
            '';
        }) config.containers;
  
      #"${concatMapStrings (d: " --bind-ro=${d}") cfg.extraBindsRO + concatMapStrings (d: " --bind=${d}") cfg.extraBindsRW}"
  
  
      # Generate /etc/hosts entries for the containers.
      networking.extraHosts = concatStrings (mapAttrsToList (name: cfg: optionalString (cfg.localAddress != null)
  