anchor.diff:          --setenv HOST_ADDRESS6="$HOST_ADDRESS6" \
           --setenv LOCAL_ADDRESS6="$LOCAL_ADDRESS6" \
           --setenv PATH="$PATH" \
  +        ${if cfg.additionalCapabilities != null then
  +          ''--capability="${concatStringsSep " " cfg.additionalCapabilities}"'' else ""
  +        } \
           ${containerInit cfg} "''${SYSTEM_PATH:-/nix/var/nix/profiles/system}/init"
       '';
   
  
positive.code: 
    };
  
    mkBindFlag = d:
                 let flagPrefix = if d.isReadOnly then " --bind-ro=" else " --bind=";
                     mountstr = if d.hostPath != null then "${d.hostPath}:${d.mountPoint}" else "${d.mountPoint}";
  
negative.code: 
        restartIfChanged = false;
  
        serviceConfig = serviceDirectives dummyConfig;
      };
    in {
      systemd.services = listToAttrs (filter (x: x.value != null) (
        # The generic container template used by imperative containers
        [{ name = "container@"; value = unit; }]
        # declarative containers
        ++ (mapAttrsToList (name: cfg: nameValuePair "container@${name}" (let
            config = cfg // (
            if cfg.enableTun then
              {
                allowedDevices = cfg.allowedDevices
                  ++ [ { node = "/dev/net/tun"; modifier = "rw"; } ];
                additionalCapabilities = cfg.additionalCapabilities
                  ++ [ "CAP_NET_ADMIN" ];
              }
            else {});
          in
            unit // {
              preStart = preStartScript config;
              script = startScript config;
              postStart = postStartScript config;
              serviceConfig = serviceDirectives config;
            } // (
            if config.autoStart then
              {
                wantedBy = [ "multi-user.target" ];
                wants = [ "network.target" ];
                after = [ "network.target" ];
                restartTriggers = [ config.path ];
                reloadIfChanged = true;
              }
            else {})
        )) config.containers)
      ));
  
  