anchor.diff:            target = pkgs.writeText "symlink-target" "got me\n";
           } "ln -s \"$target\" \"$out\"";
         in {
  -        description = "check if symlinks are properly bind-mounted";
           config.confinement.packages = lib.singleton symlink;
           testScript = ''
  -          $machine->fail('chroot-exec test -e /etc');
  -          $machine->succeed('chroot-exec cat ${symlink} >&2');
  -          $machine->succeed('test "$(chroot-exec cat ${symlink})" = "got me"');
  +          with subtest("check if symlinks are properly bind-mounted"):
  +              machine.fail("chroot-exec test -e /etc")
  +              machine.succeed(
  +                  "chroot-exec cat ${symlink} >&2",
  +                  'test "$(chroot-exec cat ${symlink})" = "got me"',
  +              )
           '';
         })
  -      { description = "check if StateDirectory works";
  -        config.serviceConfig.User = "chroot-testuser";
  +      { config.serviceConfig.User = "chroot-testuser";
           config.serviceConfig.Group = "chroot-testgroup";
           config.serviceConfig.StateDirectory = "testme";
           testScript = ''
  -          $machine->succeed('chroot-exec touch /tmp/canary');
  -          $machine->succeed('chroot-exec "echo works > /var/lib/testme/foo"');
  -          $machine->succeed('test "$(< /var/lib/testme/foo)" = works');
  -          $machine->succeed('test ! -e /tmp/canary');
  +          with subtest("check if StateDirectory works"):
  +              machine.succeed("chroot-exec touch /tmp/canary")
  +              machine.succeed('chroot-exec "echo works > /var/lib/testme/foo"')
  +              machine.succeed('test "$(< /var/lib/testme/foo)" = works')
  +              machine.succeed("test ! -e /tmp/canary")
           '';
         }
  -      { description = "check if /bin/sh works";
  -        testScript = ''
  -          $machine->succeed(
  -            'chroot-exec test -e /bin/sh',
  -            'test "$(chroot-exec \'/bin/sh -c "echo bar"\')" = bar',
  -          );
  +      { testScript = ''
  +          with subtest("check if /bin/sh works"):
  +              machine.succeed(
  +                  "chroot-exec test -e /bin/sh",
  +                  'test "$(chroot-exec \'/bin/sh -c "echo bar"\')" = bar',
  +              )
           '';
         }
  -      { description = "check if suppressing /bin/sh works";
  -        config.confinement.binSh = null;
  +      { config.confinement.binSh = null;
           testScript = ''
  -          $machine->succeed(
  -            'chroot-exec test ! -e /bin/sh',
  -            'test "$(chroot-exec \'/bin/sh -c "echo foo"\')" != foo',
  -          );
  +          with subtest("check if suppressing /bin/sh works"):
  +              machine.succeed("chroot-exec test ! -e /bin/sh")
  +              machine.succeed('test "$(chroot-exec \'/bin/sh -c "echo foo"\')" != foo')
           '';
         }
  -      { description = "check if we can set /bin/sh to something different";
  -        config.confinement.binSh = "${pkgs.hello}/bin/hello";
  +      { config.confinement.binSh = "${pkgs.hello}/bin/hello";
           testScript = ''
  -          $machine->succeed(
  -            'chroot-exec test -e /bin/sh',
  -            'test "$(chroot-exec /bin/sh -g foo)" = foo',
  -          );
  +          with subtest("check if we can set /bin/sh to something different"):
  +              machine.succeed("chroot-exec test -e /bin/sh")
  +              machine.succeed('test "$(chroot-exec /bin/sh -g foo)" = foo')
           '';
         }
  -      { description = "check if only Exec* dependencies are included";
  -        config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
  +      { config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
           testScript = ''
  -          $machine->succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" != eek');
  +          with subtest("check if only Exec* dependencies are included"):
  +              machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" != eek')
           '';
         }
  -      { description = "check if all unit dependencies are included";
  -        config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
  +      { config.environment.FOOBAR = pkgs.writeText "foobar" "eek\n";
           config.confinement.fullUnit = true;
           testScript = ''
  -          $machine->succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek');
  +          with subtest("check if all unit dependencies are included"):
  +              machine.succeed('test "$(chroot-exec \'cat "$FOOBAR"\')" = eek')
           '';
         }
       ];
  
positive.code: import ./make-test.nix {
    name = "systemd-confinement";
  
    machine = { pkgs, lib, ... }: let
  
negative.code:       exit "''${ret:-1}"
      '';
  
      mkTestStep = num: { config ? {}, testScript }: {
        systemd.sockets."test${toString num}" = {
          description = "Socket for Test Service ${toString num}";
          wantedBy = [ "sockets.target" ];
  