code: func runPkgCreate() {
  	// To test the equivalent from the shell:
  	// docker run --rm -i -t --privileged -v $PWD/out:/toolkit/result_spk -v $HOME/keys/perkeep-synology:/toolkit/build_env/ds.6281-6.2/root/.gnupg perkeep/synology ./pkgscripts/PkgCreate.py -v 6.2 -p x64 -x0 -c --print-log --build-opt="-J" perkeep
  	build_env := "ds." + *flagArch + "-" + *flagDsm
  	// TODO(mpl): test discrete --cap-add flags when I have a docker that supports them.
  	cmd := exec.Command("docker", "run", "--rm", "--privileged",
  		"-v", filepath.Join(pwd+"/out")+":/toolkit/result_spk",
  		"-v", filepath.Join(os.Getenv("HOME"), "keys", "perkeep-synology")+":/toolkit/build_env/"+build_env+"/root/.gnupg",
  		"perkeep/synology-"+*flagArch,
  		"./pkgscripts/PkgCreate.py", "-p", *flagArch, "-v", *flagDsm, "-x0", "-c", "--print-log", `--build-opt="-J"`, "perkeep")
  	out, err := cmd.CombinedOutput()
  	if err != nil {
  		log.Fatalf("Error building synology package: %v, %s", err, out)
  	}
  	fmt.Println(string(out))
  }
docs: // runPkgCreate runs the actual build/install step provided in the DSM toolkit: ./pkgscripts/PkgCreate.py
  // It can't be run during the build stage (in the Dockerfile), because it does
  // privileged operations (at least chroot) so it is run as a privileged container.
  // It requires the GPG keys at
  // https://drive.google.com/drive/folders/1P95Lk1U6nA6kaVaxKRPi4Dv2Het-CWlY?usp=sharing