anchor.diff:  , makeWrapper
   , lib
   , extraPackages ? []
  -, cri-o
   , runc # Default container runtime
   , crun # Container runtime (default with cgroups v2 for podman/buildah)
   , conmon # Container runtime monitor
  
positive.code:     iptables
    ] ++ extraPackages);
  
  in runCommand cri-o.name {
    name = "${cri-o.pname}-wrapper-${cri-o.version}";
    inherit (cri-o) pname version passthru;
  
    preferLocalBuild = true;
  
    meta = builtins.removeAttrs cri-o.meta [ "outputsToInstall" ];
  
    outputs = [
      "out"
  
negative.code: }:
  
  let
    binPath = lib.makeBinPath ([
      runc
      crun
  