anchor.diff:          PrivateNetwork = false;
           # Cannot be true due to Node
           MemoryDenyWriteExecute = false;
  +
  +        # The more restrictive "pid" option makes `nix` commands in CI emit
  +        # "GC Warning: Couldn't read /proc/stat"
  +        # You may want to set this to "pid" if not using `nix` commands
  +        ProcSubset = "all";
  +        # Coverage programs for compiled code such as `cargo-tarpaulin` disable
  +        # ASLR (address space layout randomization) which requires the
  +        # `personality` syscall
  +        # You may want to set this to `true` if not using coverage tooling on
  +        # compiled code
  +        LockPersonality = false;
         };
       };
     };
  
positive.code:         CapabilityBoundingSet = "";
          # ProtectClock= adds DeviceAllow=char-rtc r
          DeviceAllow = "";
          LockPersonality = true;
          NoNewPrivileges = true;
          PrivateDevices = true;
          PrivateMounts = true;
  
negative.code:         RestrictSUIDSGID = true;
          UMask = "0066";
          ProtectProc = "invisible";
          SystemCallFilter = [
            "~@capset"
            "~@clock"
            "~@cpu-emulation"
            "~@module"
            "~@mount"
            "~@obsolete"
            "~@raw-io"
            "~@reboot"
            "~setdomainname"
            "~sethostname"
          ];
          RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" "AF_NETLINK" ];
  
  