anchor.diff:      );
   
     nspawnExtraVethArgs = (name: cfg: "--network-veth-extra=${name}");
  -  startScript = (cfg:
  +
  +  startScript = cfg:
       ''
         mkdir -p -m 0755 "$root/etc" "$root/var/lib"
         mkdir -p -m 0700 "$root/var/lib/private" "$root/root" /run/containers
  
positive.code:       ${concatStringsSep "\n" (
          mapAttrsToList (name: cfg:
            ''ip link del dev ${name} 2> /dev/null || true ''
          ) cfg . "extraVeths" or {}
        )}
     ''
      );
    postStartScript = (cfg:
      let
        ipcall = (cfg: ipcmd: variable: attribute:
          if cfg . attribute or null == null then
            ''
              if [ -n "${variable}" ]; then
                ${ipcmd} add ${variable} dev $ifaceHost
              fi
            ''
          else
            ''${ipcmd} add ${cfg . attribute} dev $ifaceHost''
          );
        renderExtraVeth = (name: cfg:
          if cfg . "hostBridge" or null != null then
            ''
              # Add ${name} to bridge ${cfg.hostBridge}
              ip link set dev ${name} master ${cfg.hostBridge} up
            ''
          else
            ''
            # Set IPs and routes for ${name}
            ${optionalString (cfg . "hostAddress" or null != null) ''
              ip addr add ${cfg . "hostAddress"} dev ${name}
            ''}
            ${optionalString (cfg . "hostAddress6" or null != null) ''
              ip -6 addr add ${cfg . "hostAddress6"} dev ${name}
            ''}
            ${optionalString (cfg . "localAddress" or null != null) ''
              ip route add ${cfg . "localAddress"} dev ${name}
            ''}
            ${optionalString (cfg . "localAddress6" or null != null) ''
              ip -6 route add ${cfg . "localAddress6"} dev ${name}
            ''}
            ''
          );
      in
        ''
          if [ "$PRIVATE_NETWORK" = 1 ]; then
  
negative.code:         --setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
          --setenv PATH="$PATH" \
          ${containerInit cfg} "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init"
      '';
  
    preStartScript = cfg:
      ''
        # Clean up existing machined registration and interfaces.
        machinectl terminate "$INSTANCE" 2> /dev/null || true
  