anchor.diff:  
         restartIfChanged = false;
   
  -      serviceConfig = {
  -        ExecReload = pkgs.writeScript "reload-container"
  -          ''
  -            #! ${pkgs.stdenv.shell} -e
  -            ${pkgs.nixos-container}/bin/nixos-container run "$INSTANCE" -- \
  -              bash --login -c "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/bin/switch-to-configuration test"
  -          '';
  -
  -        SyslogIdentifier = "container %i";
  -
  -        EnvironmentFile = "-/etc/containers/%i.conf";
  -
  -        Type = "notify";
  -
  -        # Note that on reboot, systemd-nspawn returns 133, so this
  -        # unit will be restarted. On poweroff, it returns 0, so the
  -        # unit won't be restarted.
  -        RestartForceExitStatus = "133";
  -        SuccessExitStatus = "133";
  -
  -        Restart = "on-failure";
  -
  -        # Hack: we don't want to kill systemd-nspawn, since we call
  -        # "machinectl poweroff" in preStop to shut down the
  -        # container cleanly. But systemd requires sending a signal
  -        # (at least if we want remaining processes to be killed
  -        # after the timeout). So send an ignored signal.
  -        KillMode = "mixed";
  -        KillSignal = "WINCH";
  -
  -        DevicePolicy = "closed";
  -      };
  +      serviceConfig = serviceDirectives dummyConfig;
       };
     in {
       systemd.services = listToAttrs (filter (x: x.value != null) (
         # The generic container template used by imperative containers
         [{ name = "container@"; value = unit; }]
         # declarative containers
  -      ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (
  -        unit // {
  -          preStart = preStartScript cfg;
  -          script = startScript cfg;
  -          postStart = postStartScript cfg;
  -        } // (
  -        if cfg.autoStart then
  -          {
  -            wantedBy = [ "multi-user.target" ];
  -            wants = [ "network.target" ];
  -            after = [ "network.target" ];
  -            restartTriggers = [ cfg.path ];
  -            reloadIfChanged = true;
  -          }
  -        else {})
  +      ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (let
  +          config = cfg // (
  +          if cfg.enableTun then
  +            {
  +              allowedDevices = cfg.allowedDevices
  +                ++ [ { node = "/dev/net/tun"; modifier = "rw"; } ];
  +              additionalCapabilities = cfg.additionalCapabilities
  +                ++ [ "CAP_NET_ADMIN" ];
  +            }
  +          else {});
  +        in
  +          unit // {
  +            preStart = preStartScript config;
  +            script = startScript config;
  +            postStart = postStartScript config;
  +            serviceConfig = serviceDirectives config;
  +          } // (
  +          if config.autoStart then
  +            {
  +              wantedBy = [ "multi-user.target" ];
  +              wants = [ "network.target" ];
  +              after = [ "network.target" ];
  +              restartTriggers = [ config.path ];
  +              reloadIfChanged = true;
  +            }
  +          else {})
         )) config.containers)
       ));
   
  
positive.code:               '';
              };
  
              privateNetwork = mkOption {
                type = types.bool;
                default = false;
  
negative.code:                 ''
                    An extra list of directories that is bound to the container.
                  '';
              };
  
              allowedDevices = mkOption {
                type = types.listOf types.optionSet;
                options = [ allowedDeviceOpts ];
                default = [];
                example = [ { node = "/dev/net/tun"; modifier = "rw"; } ];
                description = ''
                  A list of device nodes to which the containers has access to.
                '';
              };
  
            } // networkOptions;
  