anchor.diff:          { preVM =
               ''
                 mkdir $out
  -              diskImage=$out/disk.raw
  +              diskImage=$out/$diskImageBase
                 truncate $diskImage --size 10G
                 mv closure xchg/
               '';
  
positive.code:     169.254.169.254 metadata.google.internal metadata
    '';
  
    # fetch authorized keys for root user
    systemd.services.fetch-root-authorized-keys =
      { description = "Fetch authorized_keys for root user.";
  
        wantedBy = [ "multi-user.target" ];
        before = [ "sshd.service" ];
  
negative.code:             ''
                PATH=$PATH:${pkgs.gnutar}/bin:${pkgs.gzip}/bin
                pushd $out
                tar -Szcf $diskImageBase.tar.gz $diskImageBase
                rm $out/$diskImageBase
                popd
              '';
            diskImageBase = "nixos-${config.system.nixosVersion}-${pkgs.stdenv.system}.raw";
            buildInputs = [ pkgs.utillinux pkgs.perl ];
            exportReferencesGraph =
              [ "closure" config.system.build.toplevel ];
  