anchor.diff:  
           ${concatStringsSep "\n" (mapAttrsToList renderExtraVeth cfg.extraVeths)}
   
  -        # Start the regular stage 1 script.
  -        exec "$1"
  +        # Start the regular stage 2 script.
  +        # We source instead of exec to not lose an early stop signal, which is
  +        # also the only _reliable_ shutdown signal we have since early stop
  +        # does not execute ExecStop* commands.
  +        set +e
  +        . "$1"
         ''
       );
   
  
positive.code:       script = startScript dummyConfig;
  
        postStart = postStartScript dummyConfig;
  
        preStop = "machinectl poweroff $INSTANCE";
  
        restartIfChanged = false;
  
  
negative.code:     Slice = "machine.slice";
      Delegate = true;
  
      # We rely on systemd-nspawn turning a SIGTERM to itself into a shutdown
      # signal (SIGRTMIN+3) for the inner container.
      KillMode = "mixed";
      KillSignal = "TERM";
  
      DevicePolicy = "closed";
      DeviceAllow = map (d: "${d.node} ${d.modifier}") cfg.allowedDevices;
  