anchor.diff:      export TMPDIR=/var/vcap/data/tmp
       mkdir -p $TMPDIR
   
  +    guardian_user=root:root
       <% if p("garden.experimental_rootless_mode") %>
  -      chown -R 100000:100000 $GARDEN_DIR $LOG_DIR $TMPDIR
  +      guardian_user="$(getMaxUidAndGid)"
       <% end %>
  +    chown -R "$guardian_user" $GARDEN_DIR $LOG_DIR $TMPDIR
   
       export PATH=/var/vcap/packages/iptables/sbin:$PATH
       export PATH=/var/vcap/packages/shadow/sbin:$PATH
  
positive.code: 
      <% if p("garden.experimental_rootless_mode") %>
       # if rootless mode, we need to run `gdn setup` as the root user here
       exec_command="exec chpst -u :100000:100000"
      <% else %>
       exec_command="exec"
      <% end %>
  
      /var/vcap/packages/guardian/bin/gdn setup
      echo $$ > $PIDFILE
      $exec_command /var/vcap/packages/guardian/bin/gdn \
      server --skip-setup \
  
negative.code: export no_proxy=<%= no_proxy %>
  <% end %>
  
  function getMaxUidAndGid() {
    uid="$(getMaxId /proc/self/uid_map)"
    gid="$(getMaxId /proc/self/gid_map)"
  
    echo "$uid:$gid"
  }
  
  function getMaxId() {
    id_file=$1
    shift
  
    max_id=0
    while IFS='' read -r map_entry; do
      container_id=$(echo "$map_entry" | awk '{print $1}')
      mapping_size=$(echo "$map_entry" | awk '{print $3}')
      id=$(( container_id + mapping_size - 1 ))
      if [ "$id" -gt "$max_id" ]; then
        max_id="$id"
      fi
    done < "$id_file"
  
    echo "$max_id"
  }
  
  # copied from https://github.com/concourse/concourse/blob/master/jobs/baggageclaim/templates/baggageclaim_ctl.erb#L54
  # break out of bosh-lite device limitations
  function permit_device_control() {
  