anchor.diff:      # randomizes addresses of mmap base, heap, stack and VDSO page
       "kernel.randomize_va_space" = mkDefault "2";
   
  +    # Reboot the machine soon after a kernel panic.
  +    "kernel.panic" = mkDefault "10";
  +
  +    ## Not part of the original config
  +
       # provides protection from ToCToU races
       "fs.protected_hardlinks" = mkDefault "1";
   
  
positive.code:   services.openssh.permitRootLogin = "prohibit-password";
    services.openssh.passwordAuthentication = mkDefault false;
  
    # Force getting the hostname from Google Compute.
    networking.hostName = mkDefault "";
  
    # Always include cryptsetup so that NixOps can use it.
    environment.systemPackages = [ pkgs.cryptsetup ];
  
    # Configure default metadata hostnames
    networking.extraHosts = ''
  
negative.code: with lib;
  let
    diskSize = 1024; # MB
    gce = pkgs.google-compute-engine;
  in
  {
    imports = [ ../profiles/headless.nix ../profiles/qemu-guest.nix ./grow-partition.nix ];
  
    system.build.googleComputeImage = import ../../lib/make-disk-image.nix {
      name = "google-compute-image";
  