anchor.diff: -{ config, lib, pkgs, ... }:
  +{ config, lib, pkgs, ... }@host:
   
   with lib;
   
  
positive.code:                 merge = loc: defs: (import "${toString config.nixpkgs}/nixos/lib/eval-config.nix" {
                    modules =
                      let
                        extraConfig = {
                          _file = "module at ${__curPos.file}:${toString __curPos.line}";
                          config = {
                            nixpkgs = { inherit localSystem; };
                            boot.isContainer = true;
                            networking.hostName = mkDefault name;
                            networking.useDHCP = false;
  
negative.code:     DeviceAllow = map (d: "${d.node} ${d.modifier}") cfg.allowedDevices;
    };
  
    kernelVersion = config.boot.kernelPackages.kernel.version;
  
    bindMountOpts = { name, ... }: {
  