{
  config,
  lib,
  ...
}:

{
  config = {
    boot.enableContainers = true;
    virtualisation.containers.enable = true;

    # containers.damocles = {
    #   autoStart = false;
    #   privateNetwork = false;
    #   path = self.nixosConfigurations.damocles.config.system.build.toplevel;
    #   bindMounts."/etc/nix/distributed-build-key" = {
    #     hostPath = "/etc/nix/distributed-build-key";
    #     isReadOnly = true;
    #   };
    #   bindMounts."/persist/damocles-ssh" = {
    #     hostPath = "/persist/damocles-ssh";
    #     isReadOnly = true;
    #   };
    #   bindMounts."/persist/damocles-lab" = {
    #     hostPath = "/persist/damocles-lab";
    #     isReadOnly = false;
    #   };
    # };

    # Global DefaultTimeoutStopSec is 10s (modern-desktop.nix), which kills systemd-nspawn
    # before it finishes halting, leaving cgroups busy and breaking restarts.
    systemd.services =
      let
        # The imperative template plus every declarative container: nixos-containers
        # generates each one as its own unit, so an override on "container@" alone
        # would not reach them.
        containerUnits = [
          "container@"
        ]
        ++ map (name: "container@${name}") (lib.attrNames config.containers);
      in
      lib.genAttrs containerUnits (_: {
        serviceConfig = {
          TimeoutStopSec = "2min";
          # After a SIGKILL of nspawn, the kernel needs a moment to reap its cgroups.
          # Without this, the immediate restart attempt fails with "Device or resource busy".
          RestartSec = "5s";
        };
      });
  };
}