anchor.diff:    '';
   
     bwrapCmd = { initArgs ? "" }: ''
  -    blacklist="/nix /dev /proc /etc"
  -    ro_mounts=""
  +    blacklist=(/nix /dev /proc /etc)
  +    ro_mounts=()
       for i in ${env}/*; do
         path="/''${i##*/}"
         if [[ $path == '/etc' ]]; then
           continue
         fi
  -      ro_mounts="$ro_mounts --ro-bind $i $path"
  -      blacklist="$blacklist $path"
  +      ro_mounts+=(--ro-bind "$i" "$path")
  +      blacklist+=("$path")
       done
   
       if [[ -d ${env}/etc ]]; then
         for i in ${env}/etc/*; do
           path="/''${i##*/}"
  -        ro_mounts="$ro_mounts --ro-bind $i /etc$path"
  +        ro_mounts+=(--ro-bind "$i" "/etc$path")
         done
       fi
   
  
positive.code:     # loop through all directories in the root
      for dir in /*; do
        # if it is a directory and it is not in the blacklist
        if [[ -d "$dir" ]] && grep -v "$dir" <<< "$blacklist" >/dev/null; then
          # add it to the mount list
          auto_mounts+=(--bind "$dir" "$dir")
        fi
      done
  
      exec ${bubblewrap}/bin/bwrap \
        --dev-bind /dev /dev \
        --proc /proc \
        --chdir "$(pwd)" \
        --unshare-all \
        --share-net \
        --die-with-parent \
        --ro-bind /nix /nix \
        ${etcBindFlags} \
        $ro_mounts \
        "''${auto_mounts[@]}" \
        ${init runScript}/bin/${name}-init ${initArgs}
    '';
  
    bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });
  
negative.code:       "ssl/certs"
        "pki"
      ];
    in concatStringsSep "\n  "
    (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
  
    init = run: writeShellScriptBin "${name}-init" ''
  