anchor.diff:    # Provide a /etc/passwd and /etc/group that contain root and nobody.
     # Useful when packaging binaries that insist on using nss to look up
     # username/groups (like nginx).
  +  # /bin/sh is fine to not exist, and provided by another shim.
     fakeNss = symlinkJoin {
       name = "fake-nss";
       paths = [
  
positive.code:       '')
      ];
    };
  
    # Build an image and populate its nix database with the provided
    # contents. The main purpose is to be able to use nix commands in
  
negative.code: {
    bashInteractive,
    buildPackages,
    cacert,
    callPackage,
  