anchor.diff:  export no_proxy=<%= no_proxy %>
   <% end %>
   
  +function getMaxUidAndGid() {
  +  uid="$(getMaxId /proc/self/uid_map)"
  +  gid="$(getMaxId /proc/self/gid_map)"
  +
  +  echo "$uid:$gid"
  +}
  +
  +function getMaxId() {
  +  id_file=$1
  +  shift
  +
  +  max_id=0
  +  while IFS='' read -r map_entry; do
  +    container_id=$(echo "$map_entry" | awk '{print $1}')
  +    mapping_size=$(echo "$map_entry" | awk '{print $3}')
  +    id=$(( container_id + mapping_size - 1 ))
  +    if [ "$id" -gt "$max_id" ]; then
  +      max_id="$id"
  +    fi
  +  done < "$id_file"
  +
  +  echo "$max_id"
  +}
  +
   # copied from https://github.com/concourse/concourse/blob/master/jobs/baggageclaim/templates/baggageclaim_ctl.erb#L54
   # break out of bosh-lite device limitations
   function permit_device_control() {
  
positive.code:   local graph_path
    graph_path=$1
  
    # the uid/gid 100000 here is just an arbitrarily high number
    # chosen as it is not the uid/gid of root (0) or vcap (1000)
  
    chown 100000:100000 "$graph_path"
    chmod 700 "$graph_path"
  }
  
  
negative.code:     export TMPDIR=/var/vcap/data/tmp
      mkdir -p $TMPDIR
  
      guardian_user=root:root
      <% if p("garden.experimental_rootless_mode") %>
        guardian_user="$(getMaxUidAndGid)"
      <% end %>
      chown -R "$guardian_user" $GARDEN_DIR $LOG_DIR $TMPDIR
  
      export PATH=/var/vcap/packages/iptables/sbin:$PATH
      export PATH=/var/vcap/packages/shadow/sbin:$PATH
  