anchor.diff:                ++ map (v: "--docker-allowed-images ${escapeShellArg v}") service.dockerAllowedImages
                 ++ map (v: "--docker-allowed-services ${escapeShellArg v}") service.dockerAllowedServices
               )
  -          ))} && sleep 1
  +          ))} && sleep 1 || exit 1
           fi
         '') hashedServices)}
   
  
positive.code: 
        # update global options
        remarshal --if toml --of json ${configPath} \
          | jq -cM '.check_interval = ${toString cfg.checkInterval} |
                    .concurrent = ${toString cfg.concurrent}' \
          | remarshal --if json --of toml \
          | sponge ${configPath}
  
  
negative.code: { config, lib, pkgs, ... }:
  with builtins;
  with lib;
  let
    cfg = config.services.gitlab-runner;
    hasDocker = config.virtualisation.docker.enable;
    hashedServices = mapAttrs'
      (name: service: nameValuePair
        "${name}_${config.networking.hostName}_${
          substring 0 12
          (hashString "md5" (unsafeDiscardStringContext (toJSON service)))}"
        service)
      cfg.services;
    configPath = "$HOME/.gitlab-runner/config.toml";
    configureScript = pkgs.writeShellScriptBin "gitlab-runner-configure" (
      if (cfg.configFile != null) then ''
  