anchor.diff:  
       <% if p("garden.experimental_rootless_mode") %>
        # if rootless mode, we need to run `gdn setup` as the root user here
  -     exec_command="exec chpst -u :100000:100000"
  +     exec_command="exec chpst -u :$(getMaxUidAndGid)"
       <% else %>
        exec_command="exec"
       <% end %>
   
  -    /var/vcap/packages/guardian/bin/gdn setup
  +    /var/vcap/packages/guardian/bin/gdn setup \
  +      --iptables-bin=/var/vcap/packages/iptables/sbin/iptables \
  +    <% if p("garden.allow_host_access") %> \
  +      --allow-host-access \
  +    <% end %> \
  +    <% p("garden.deny_networks").each do |network| %> \
  +      --deny-network=<%= network %> \
  +    <% end %> \
  +    <% if p("garden.destroy_containers_on_start") %> \
  +      --reset-iptables-rules \
  +    <% end %>
  +
       echo $$ > $PIDFILE
       $exec_command /var/vcap/packages/guardian/bin/gdn \
       server --skip-setup \
  
positive.code:     export TMPDIR=/var/vcap/data/tmp
      mkdir -p $TMPDIR
  
      <% if p("garden.experimental_rootless_mode") %>
        chown -R 100000:100000 $GARDEN_DIR $LOG_DIR $TMPDIR
      <% end %>
  
      export PATH=/var/vcap/packages/iptables/sbin:$PATH
      export PATH=/var/vcap/packages/shadow/sbin:$PATH
  
negative.code:   local graph_path
    graph_path=$1
  
    # the uid/gid here is just an arbitrarily high number
    # chosen as it is not the uid/gid of root (0) or vcap (1000)
  
    chown "$(getMaxUidAndGid)" "$graph_path"
    chmod 700 "$graph_path"
  }
  
  