anchor.diff:  
     };
   
  +  allowedDeviceOpts = { name, config, ... }: {
  +    options = {
  +      node = mkOption {
  +        example = "/dev/net/tun";
  +        type = types.str;
  +        description = "Path to device node";
  +      };
  +      modifier = mkOption {
  +        example = "rw";
  +        type = types.str;
  +        description = ''
  +          Device node access modifier. Takes a combination
  +          <literal>r</literal> (read), <literal>w</literal> (write), and
  +          <literal>m</literal> (mknod). See the
  +          <literal>systemd.resource-control(5)</literal> man page for more
  +          information.'';
  +      };
  +    };
  +  };
  +
  +
     mkBindFlag = d:
                  let flagPrefix = if d.isReadOnly then " --bind-ro=" else " --bind=";
                      mountstr = if d.hostPath != null then "${d.hostPath}:${d.mountPoint}" else "${d.mountPoint}";
  
positive.code: 
        restartIfChanged = false;
  
        serviceConfig = {
          ExecReload = pkgs.writeScript "reload-container"
            ''
              #! ${pkgs.stdenv.shell} -e
              ${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
                bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
            '';
  
          SyslogIdentifier = "container %i";
  
          EnvironmentFile = "-/etc/containers/%i.conf";
  
          Type = "notify";
  
          # Note that on reboot, systemd-nspawn returns 133, so this
          # unit will be restarted. On poweroff, it returns 0, so the
          # unit won't be restarted.
          RestartForceExitStatus = "133";
          SuccessExitStatus = "133";
  
          Restart = "on-failure";
  
          # Hack: we don't want to kill systemd-nspawn, since we call
          # "machinectl poweroff" in preStop to shut down the
          # container cleanly. But systemd requires sending a signal
          # (at least if we want remaining processes to be killed
          # after the timeout). So send an ignored signal.
          KillMode = "mixed";
          KillSignal = "WINCH";
  
          DevicePolicy = "closed";
        };
      };
    in {
      systemd.services = listToAttrs (filter (x: x.value != null) (
        # The generic container template used by imperative containers
        [{ name = "container@"; value = unit; }]
        # declarative containers
        ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (
          unit // {
            preStart = preStartScript cfg;
            script = startScript cfg;
            postStart = postStartScript cfg;
          } // (
          if cfg.autoStart then
            {
              wantedBy = [ "multi-user.target" ];
              wants = [ "network.target" ];
              after = [ "network.target" ];
              restartTriggers = [ cfg.path ];
              reloadIfChanged = true;
            }
          else {})
        )) config.containers)
      ));
  
  
negative.code:       ''
    );
  
    serviceDirectives = cfg: {
      ExecReload = pkgs.writeScript "reload-container"
        ''
          #! ${pkgs.stdenv.shell} -e
          ${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
            bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
        '';
  
      SyslogIdentifier = "container %i";
  
      EnvironmentFile = "-/etc/containers/%i.conf";
  
      Type = "notify";
  
      # Note that on reboot, systemd-nspawn returns 133, so this
      # unit will be restarted. On poweroff, it returns 0, so the
      # unit won't be restarted.
      RestartForceExitStatus = "133";
      SuccessExitStatus = "133";
  
      Restart = "on-failure";
  
      # Hack: we don't want to kill systemd-nspawn, since we call
      # "machinectl poweroff" in preStop to shut down the
      # container cleanly. But systemd requires sending a signal
      # (at least if we want remaining processes to be killed
      # after the timeout). So send an ignored signal.
      KillMode = "mixed";
      KillSignal = "WINCH";
  
      DevicePolicy = "closed";
      DeviceAllow = map (d: "${d.node} ${d.modifier}") cfg.allowedDevices;
    };
  
  
    system = config.nixpkgs.system;
  
    bindMountOpts = { name, config, ... }: {
  