anchor.diff:        ${lib.optionalString unshareNet "--unshare-net"}
         ${lib.optionalString unshareUts "--unshare-uts"}
         ${lib.optionalString unshareCgroup "--unshare-cgroup"}
  -      --die-with-parent
  +      ${lib.optionalString dieWithParent "--die-with-parent"}
         --ro-bind /nix /nix
         # Our glibc will look for the cache in its own path in `/nix/store`.
         # As such, we need a cache to exist there, because pressure-vessel
  
positive.code: , unshareNet ? false
  , unshareUts ? true
  , unshareCgroup ? true
  , ...
  }:
  
  
negative.code:   buildFHSEnv = callPackage ./env.nix { };
  
    env = buildFHSEnv (removeAttrs args [
      "runScript" "extraInstallCommands" "meta" "passthru" "dieWithParent"
      "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc"
    ]);
  
  