anchor.diff:        "ssl/certs"
         "pki"
       ];
  -  in concatStringsSep " \\\n  "
  +  in concatStringsSep "\n  "
     (map (file: "--ro-bind-try /etc/${file} /etc/${file}") files);
   
     init = run: writeShellScriptBin "${name}-init" ''
  
positive.code:   '';
  
    bwrapCmd = { initArgs ? "" }: ''
      blacklist="/nix /dev /proc /etc"
      ro_mounts=""
      for i in ${env}/*; do
        path="/''${i##*/}"
        if [[ $path == '/etc' ]]; then
          continue
        fi
        ro_mounts="$ro_mounts --ro-bind $i $path"
        blacklist="$blacklist $path"
      done
  
      if [[ -d ${env}/etc ]]; then
        for i in ${env}/etc/*; do
          path="/''${i##*/}"
          ro_mounts="$ro_mounts --ro-bind $i /etc$path"
        done
      fi
  
  
negative.code:     # loop through all directories in the root
      for dir in /*; do
        # if it is a directory and it is not in the blacklist
        if [[ -d "$dir" ]] && [[ ! "''${blacklist[@]}" =~ "$dir" ]]; then
          # add it to the mount list
          auto_mounts+=(--bind "$dir" "$dir")
        fi
      done
  
      cmd=(
        ${bubblewrap}/bin/bwrap
        --dev-bind /dev /dev
        --proc /proc
        --chdir "$(pwd)"
        --unshare-all
        --share-net
        --die-with-parent
        --ro-bind /nix /nix
        ${etcBindFlags}
        "''${ro_mounts[@]}"
        "''${auto_mounts[@]}"
        ${init runScript}/bin/${name}-init ${initArgs}
      )
      exec "''${cmd[@]}"
    '';
  
    bin = writeShellScriptBin name (bwrapCmd { initArgs = ''"$@"''; });
  