anchor.diff:  
       wrapProgram $out/bin/lxd --prefix PATH : ${lib.makeBinPath (
         networkPkgs
  -      ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute2 bash criu ]
  +      ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute2 bash criu attr ]
         ++ [ (writeShellScriptBin "apparmor_parser" ''
                exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@"
              '') ]
  
positive.code: { lib, hwdata, pkg-config, lxc, buildGoPackage, fetchurl
  , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq
  , squashfsTools, iproute2, iptables, ebtables, iptables-nftables-compat, libcap
  , dqlite, raft-canonical, sqlite-replication, udev
  , writeShellScriptBin, apparmor-profiles, apparmor-parser
  
negative.code:   '';
  
    preBuild = ''
      # required for go-dqlite. See: https://github.com/lxc/lxd/pull/8939
      export CGO_LDFLAGS_ALLOW="(-Wl,-wrap,pthread_create)|(-Wl,-z,now)"
  
  