nixos/singularity: disable setuid for apptainer

    };

    enableSuid = mkOption {

      type = types.bool;

      default = true;

      # SingularityCE requires SETUID for most things. Apptainer prefers user

      # namespaces, e.g. `apptainer exec --nv` would fail if built

      # `--with-suid`:

      # > `FATAL: nvidia-container-cli not allowed in setuid mode`

      default = cfg.package.projectName != "apptainer";

      defaultText = literalExpression ''config.services.singularity.package.projectName != "apptainer"'';

      example = false;

      description = mdDoc ''

        Whether to enable the SUID support of Singularity/Apptainer.