anchor.diff:        , runcRev, runcSha256
         , containerdRev, containerdSha256
         , tiniRev, tiniSha256
  -  } : stdenv.mkDerivation rec {
  -    inherit version rev;
  -
  -    name = "docker-${version}";
  -
  -    src = fetchFromGitHub {
  -      owner = "docker";
  -      repo = "docker-ce";
  -      rev = "v${version}";
  -      sha256 = sha256;
  -    };
  -
  +    } :
  +  let
       docker-runc = runc.overrideAttrs (oldAttrs: rec {
         name = "docker-runc";
         src = fetchFromGitHub {
  
positive.code: 
        # systemd
        install -Dm644 ./components/engine/contrib/init/systemd/docker.service $out/etc/systemd/system/docker.service
  
        # completion (cli)
        install -Dm644 ./components/cli/contrib/completion/bash/docker $out/share/bash-completion/completions/docker
  
negative.code:       ++ optional (devicemapper == null) "exclude_graphdriver_devicemapper"
        ++ optional (libseccomp != null) "seccomp";
  
     }) // rec {
      inherit version rev;
  
      name = "docker-${version}";
  
      src = fetchFromGitHub {
        owner = "docker";
        repo = "docker-ce";
        rev = "v${version}";
        sha256 = sha256;
      };
  
      # Optimizations break compilation of libseccomp c bindings
      hardeningDisable = [ "fortify" ];
  
      nativeBuildInputs = [ pkgconfig ];
      buildInputs = [
        makeWrapper removeReferencesTo go-md2man go libtool
      ] ++ optionals (stdenv.isLinux) [
        sqlite devicemapper btrfs-progs systemd libtool libseccomp
      ];
  
      dontStrip = true;
  
      buildPhase = (optionalString (stdenv.isLinux) ''
        # build engine
        cd ./components/engine
        export AUTO_GOPATH=1
        export DOCKER_GITCOMMIT="${rev}"
        ./hack/make.sh dynbinary
        cd -
      '') + ''
        # build cli
        cd ./components/cli
        # Mimic AUTO_GOPATH
  