anchor.diff:    cat <<EOF >$out/bin/${name}
     #! ${stdenv.shell}
     export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:\$CHROOTENV_EXTRA_BINDS"
  -  exec ${chroot-user}/bin/chroot-user ${env} bash -l ${init runScript} "\$(pwd)" "\$@"
  +  exec ${chroot-user}/bin/chroot-user ${env} ${bash'} -l ${init runScript} "\$(pwd)" "\$@"
     EOF
     chmod +x $out/bin/${name}
     ${extraInstallCommands}
  
positive.code: { runCommand, lib, writeText, writeScriptBin, stdenv, ruby } :
  { env, runScript ? "bash", extraBindMounts ? [], extraInstallCommands ? "" } :
  
  let
    name = env.pname;
  
    # Sandboxing script
    chroot-user = writeScriptBin "chroot-user" ''
  
negative.code:     runCommand "${name}-shell-env" {
        shellHook = ''
          export CHROOTENV_EXTRA_BINDS="${lib.concatStringsSep ":" extraBindMounts}:$CHROOTENV_EXTRA_BINDS"
          exec ${chroot-user}/bin/chroot-user ${env} ${bash'} -l ${init bash'} "$(pwd)"
        '';
      } ''
        echo >&2 ""
  