anchor.diff:          inherit name;
           tag = version;
           fromImage = self_docker;
  -        runAsRoot = ''
  +        config = self_docker_config // {
  +            User = dockerUser;
  +        };
  +        runAsRoot = (if dockerUser == null then "" else ''
  +          #!${stdenv.shell}
  +          ${dockerTools.shadowSetup}
  +          groupadd --gid ${toString dockerGroupId} ${dockerGroup}
  +          useradd --gid ${dockerGroup} --uid ${toString dockerUserId} --home-dir /app ${dockerUser}
  +          # gunicorn requires /tmp, /var/tmp, or /usr/tmp
  +          mkdir -p --mode=1777 /tmp
  +          mkdir -p /app
  +          cp -a ${self.src}/. /app/
  +        '') + ''
             cp -a ${self.src}/* /app
             cat > /app/version.json  <<EOF
             ${builtins.toJSON version_json}
  
positive.code:               "SSL_CERT_FILE=${releng_pkgs.pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"
              ] ++ dockerEnv;
              Cmd = dockerCmd;
              User = dockerUser;
              WorkingDir = "/";
            };
          runAsRoot = if dockerUser == null then null else ''
            #!${stdenv.shell}
            ${dockerTools.shadowSetup}
            groupadd --gid ${toString dockerGroupId} ${dockerGroup}
            useradd --gid ${dockerGroup} --uid ${toString dockerUserId} --home-dir /app ${dockerUser}
            # gunicorn requires /tmp, /var/tmp, or /usr/tmp
            mkdir -p --mode=1777 /tmp
            mkdir -p /app
            cp -a ${self.src}/. /app/
          '';
        };
  
        githubCommit = builtins.getEnv "GITHUB_COMMIT";
  
negative.code:     , version
      , config ? {}
      , contents ? []
      , runAsRoot ? null
      }:
      dockerTools.buildImage {
        name = name;
  