anchor.diff:  , storeDir ? builtins.storeDir
   , substituteAll
   , symlinkJoin
  +, tarsum
   , util-linux
   , vmTools
   , writeReferencesToFile
  
positive.code:         outputHashAlgo = "sha256";
          outputHash = sha256;
  
          nativeBuildInputs = lib.singleton skopeo;
          SSL_CERT_FILE = "${cacert.out}/etc/ssl/certs/ca-bundle.crt";
  
          sourceURL = "docker://${imageName}@${imageDigest}";
  
negative.code: rec {
    examples = callPackage ./examples.nix {
      inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
    };
  
    tests = {
      inherit (nixosTests)
        docker-tools
        docker-tools-overlay
        # requires remote builder
        # docker-tools-cross
        ;
    };
  
    pullImage =
  