anchor.diff:          containerd
           runc
           iptables
  -      ];
  +      ] ++ lib.optional config.boot.zfs.enabled config.boot.zfs.package;
         serviceConfig = {
           ExecStart = ''${pkgs.containerd}/bin/containerd ${lib.concatStringsSep " " (lib.cli.toGNUCommandLine {} cfg.args)}'';
           Delegate = "yes";
  
positive.code: { pkgs, lib, config, ... }:
  let
    cfg = config.virtualisation.containerd;
    containerdConfigChecked = pkgs.runCommand "containerd-config-checked.toml" { nativeBuildInputs = [pkgs.containerd]; } ''
      containerd -c ${cfg.configFile} config dump >/dev/null
      ln -s ${cfg.configFile} $out
    '';
  in
  {
  
  
negative.code:   };
  
    config = lib.mkIf cfg.enable {
      warnings = lib.optional (cfg.configFile != null) ''
        `virtualisation.containerd.configFile` is deprecated. use `virtualisation.containerd.settings` instead.
      '';
  
      virtualisation.containerd = {
        args.config = toString containerdConfigChecked;
        settings = {
          plugins.cri.containerd.snapshotter = lib.mkIf config.boot.zfs.enabled "zfs";
          plugins.cri.cni.bin_dir = lib.mkDefault "${pkgs.cni-plugins}/bin";
        };
      };
  
      environment.systemPackages = [ pkgs.containerd ];
  
      systemd.services.containerd = {
        description = "containerd - container runtime";
  