anchor.diff:  
           ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)}
   
  -        # Start the regular stage 1 script.
  -        exec "$1"
  +        # Start the regular stage 2 script.
  +        # We source instead of exec to not lose an early stop signal, which is
  +        # also the only _reliable_ shutdown signal we have since early stop
  +        # does not execute ExecStop* commands.
  +        set +e
  +        . "$1"
         ''
       );
   
  
positive.code:       script = startScript dummyConfig;
  
        postStart = postStartScript dummyConfig;
  
        preStop = "machinectl poweroff $INSTANCE";
  
        restartIfChanged = false;
  
  
negative.code:       ''}
  
        # Run systemd-nspawn without startup notification (we'll
        # wait for the container systemd to signal readiness)
        # Kill signal handling means systemd-nspawn will pass a system-halt signal
        # to the container systemd when it receives SIGTERM for container shutdown;
        # containerInit and stage2 have to handle this as well.
        exec ${config.systemd.package}/bin/systemd-nspawn \
          --keep-unit \
          -M "$INSTANCE" -D "$root" $extraFlags \
          $EXTRA_NSPAWN_FLAGS \
          --notify-ready=yes \
          --kill-signal=SIGRTMIN+3 \
          --bind-ro=/nix/store \
          --bind-ro=/nix/var/nix/db \
          --bind-ro=/nix/var/nix/daemon-socket \
  