anchor.diff:  
     # We need to sum layer.tar, not a directory, hence tarsum instead of nix-hash.
     # And we cannot untar it, because then we cannot preserve permissions etc.
  -  tarsum = pkgs.tarsum;
  +  inherit tarsum; # pkgs.dockerTools.tarsum
   
     # buildEnv creates symlinks to dirs, which is hard to edit inside the overlay VM
     mergeDrvs =
  
positive.code: rec {
    examples = callPackage ./examples.nix {
      inherit buildImage buildLayeredImage fakeNss pullImage shadowSetup buildImageWithNixDb;
    };
  
    pullImage =
  
negative.code:   # "#!/usr/bin/env executable" shebang.
    usrBinEnv = runCommand "usr-bin-env" { } ''
      mkdir -p $out/usr/bin
      ln -s ${coreutils}/bin/env $out/usr/bin
    '';
  
    # This provides /bin/sh, pointing to bashInteractive.
  