anchor.diff:  
         [Install]
         WantedBy=sockets.target
  +  - name: vault.service
  +    command: start
  +    enable: true
  +    content: |
  +      [Unit]
  +      Description=Vault
  +      After=docker.service
  +      Requires=docker.service
  +
  +      [Service]
  +      TimeoutStartSec=0
  +      User=core
  +      ExecStartPre=-/usr/bin/docker kill vault
  +      ExecStartPre=-/usr/bin/docker rm vault
  +      ExecStartPre=/usr/bin/docker pull quay.io/dtan4/vault:latest
  +      ExecStart=/usr/bin/docker run --cap-add IPC_LOCK --name vault -p 8200:8200 -v /home/core/config:/config quay.io/dtan4/vault:latest vault server -config=/config/server.hcl
  +      ExecStop=/usr/bin/docker stop vault
  +
  +      [Install]
  +      WantedBy=multi-user.target
   write_files:
     - path: /etc/ssh/sshd_config
       permissions: "0600"
  
positive.code:       PermitRootLogin no
        PasswordAuthentication no
        ChallengeResponseAuthentication no
  
negative.code:     # legacy ports can be omitted if your application doesn't depend on them
      listen-client-urls: http://0.0.0.0:2379,http://0.0.0.0:4001
      listen-peer-urls: http://$private_ipv4:2380,http://$private_ipv4:7001
    units:
    - name: etcd2.service
      command: start
  