diff --git a/doc/languages-frameworks/go.section.md b/doc/languages-frameworks/go.section.md
index b4228d9d313d..f52570ac8cca 100644
--- a/doc/languages-frameworks/go.section.md
+++ b/doc/languages-frameworks/go.section.md
@@ -114,21 +114,24 @@ Both `buildGoModule` and `buildGoPackage` can be tweaked to behave slightly diff
 
 ### `buildFlagsArray` and `buildFlags`: {#ex-goBuildFlags-noarray}
 
-These attributes set build flags supported by `go build`. We recommend using `buildFlagsArray`. The most common use case of these attributes is to make the resulting executable aware of its own version. For example:
+These attributes set build flags supported by `go build`. We recommend using `buildFlagsArray`.
 
 ```nix
   buildFlagsArray = [
-    # Note: single quotes are not needed.
-    "-ldflags=-X main.Version=${version} -X main.Commit=${version}"
+    "-tags=release"
   ];
 ```
 
+### `ldflags` {#var-go-ldflags}
+
+Arguments to pass to the Go linker tool via the `-ldflags` argument of `go build`. The most common use case for this argument is to make the resulting executable aware of its own version. For example:
+
 ```nix
-  buildFlagsArray = ''
-    -ldflags=
-    -X main.Version=${version}
-    -X main.Commit=${version}
-  '';
+  ldflags = [
+    "-s" "-w"
+    "-X main.Version=${version}"
+    "-X main.Commit=${version}"
+  ];
 ```
 
 ### `deleteVendor` {#var-go-deleteVendor}
diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index 45d4f877ae5b..84824e2f90f0 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -65,6 +65,18 @@ in
       '';
     };
 
+    storage.settings = mkOption {
+      type = toml.type;
+      default = {
+        storage = {
+          driver = "overlay";
+          graphroot = "/var/lib/containers/storage";
+          runroot = "/run/containers/storage";
+        };
+      };
+      description = "storage.conf configuration";
+    };
+
     registries = {
       search = mkOption {
         type = types.listOf types.str;
@@ -129,6 +141,9 @@ in
     environment.etc."containers/containers.conf".source =
       toml.generate "containers.conf" cfg.containersConf.settings;
 
+    environment.etc."containers/storage.conf".source =
+      toml.generate "storage.conf" cfg.storage.settings;
+
     environment.etc."containers/registries.conf".source = toml.generate "registries.conf" {
       registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
     };
diff --git a/nixos/modules/virtualisation/lxd.nix b/nixos/modules/virtualisation/lxd.nix
index 6b6f4b6e6524..cde29f7bf59c 100644
--- a/nixos/modules/virtualisation/lxd.nix
+++ b/nixos/modules/virtualisation/lxd.nix
@@ -175,5 +175,8 @@ in {
       "net.ipv6.neigh.default.gc_thresh3" = 8192;
       "kernel.keys.maxkeys" = 2000;
     };
+
+    boot.kernelModules = [ "veth" "xt_comment" "xt_CHECKSUM" "xt_MASQUERADE" ]
+      ++ optionals (!config.networking.nftables.enable) [ "iptable_mangle" ];
   };
 }
diff --git a/nixos/tests/lxd.nix b/nixos/tests/lxd.nix
index ab56b75c02e4..889ca9598e3f 100644
--- a/nixos/tests/lxd.nix
+++ b/nixos/tests/lxd.nix
@@ -96,6 +96,7 @@ in {
         ## limits.cpu ##
 
         machine.succeed("lxc config set test limits.cpu 1")
+        machine.succeed("lxc restart test")
 
         # Since Alpine doesn't have `nproc` pre-installed, we've gotta resort
         # to the primal methods
@@ -105,6 +106,7 @@ in {
         )
 
         machine.succeed("lxc config set test limits.cpu 2")
+        machine.succeed("lxc restart test")
 
         assert (
             "2"
@@ -115,6 +117,7 @@ in {
         ## limits.memory ##
 
         machine.succeed("lxc config set test limits.memory 64MB")
+        machine.succeed("lxc restart test")
 
         assert (
             "MemTotal:          62500 kB"
@@ -122,6 +125,7 @@ in {
         )
 
         machine.succeed("lxc config set test limits.memory 128MB")
+        machine.succeed("lxc restart test")
 
         assert (
             "MemTotal:         125000 kB"
diff --git a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
index 44bbbeece30c..364e6e294ec0 100644
--- a/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
+++ b/pkgs/applications/networking/instant-messengers/zoom-us/default.nix
@@ -29,11 +29,11 @@
 assert pulseaudioSupport -> libpulseaudio != null;
 
 let
-  version = "5.6.16888.0424";
+  version = "5.6.20278.0524";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${version}/zoom_x86_64.pkg.tar.xz";
-      sha256 = "H/G9cSVmxYM0AVfrdpXzm7ohssDbKq2xdvIBc4d+elc=";
+      sha256 = "1nkpmrpb0bz4zkg8nszxmcfy3ymigd2bmxhnxbjrcnv64ykdrgp7";
     };
   };
 
diff --git a/pkgs/development/compilers/compcert/default.nix b/pkgs/development/compilers/compcert/default.nix
index 4679e01e9002..4e550bac9a6a 100644
--- a/pkgs/development/compilers/compcert/default.nix
+++ b/pkgs/development/compilers/compcert/default.nix
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, fetchpatch, makeWrapper
 , coqPackages, ocamlPackages, coq2html
 , tools ? stdenv.cc
-, version ? "3.8"
+, version ? "3.9"
 }:
 
 let
@@ -56,6 +56,10 @@ let param = {
     ];
     useExternalFlocq = true;
   };
+  "3.9" = {
+    sha256 = "1srcz2dqrvmbvv5cl66r34zqkm0hsbryk7gd3i9xx4slahc9zvdb";
+    useExternalFlocq = true;
+  };
 }."${version}"; in
 
 stdenv.mkDerivation rec {
@@ -78,6 +82,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace ./configure \
+      --replace \$\{toolprefix\}ar 'ar' \
       --replace '{toolprefix}gcc' '{toolprefix}cc'
   '';
 
diff --git a/pkgs/development/compilers/go/1.15.nix b/pkgs/development/compilers/go/1.15.nix
index 1aa0ec030174..58cd616728c3 100644
--- a/pkgs/development/compilers/go/1.15.nix
+++ b/pkgs/development/compilers/go/1.15.nix
@@ -11,7 +11,7 @@ let
 
   inherit (lib) optionals optionalString;
 
-  version = "1.15.12";
+  version = "1.15.13";
 
   go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
 
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-HGkRk330onf6dOe378PQhZRJjExK3AtsSuNWYTdSgJE=";
+    sha256 = "sha256-mQaeciNHnM5FU/hPh0uTRfb0BF8nz1CJSJtUbaYZokQ=";
   };
 
   # perl is used for testing go vet
@@ -268,5 +268,6 @@ stdenv.mkDerivation rec {
     license = licenses.bsd3;
     maintainers = teams.golang.members;
     platforms = platforms.linux ++ platforms.darwin;
+    badPlatforms = [ "aarch64-darwin" ];
   };
 }
diff --git a/pkgs/development/compilers/go/1.16.nix b/pkgs/development/compilers/go/1.16.nix
index 219f19ad27c7..93c9fa5c7788 100644
--- a/pkgs/development/compilers/go/1.16.nix
+++ b/pkgs/development/compilers/go/1.16.nix
@@ -11,7 +11,7 @@ let
 
   inherit (lib) optionals optionalString;
 
-  version = "1.16.4";
+  version = "1.16.5";
 
   go_bootstrap = buildPackages.callPackage ./bootstrap.nix { };
 
@@ -45,7 +45,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://dl.google.com/go/go${version}.src.tar.gz";
-    sha256 = "sha256-rk9rbioWd9MYF5hGVadiB0tTVtpQ+1hyK5kQSHDUNQM=";
+    sha256 = "sha256-e/p+WQjHzJ512l3fMGbXy88/2fpRlFhRMl7rwX9QuoA=";
   };
 
   # perl is used for testing go vet
diff --git a/pkgs/development/compilers/go/binary.nix b/pkgs/development/compilers/go/binary.nix
index 7eb8f8f7b984..a2fff4f6d074 100644
--- a/pkgs/development/compilers/go/binary.nix
+++ b/pkgs/development/compilers/go/binary.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
   dontStrip = stdenv.hostPlatform.isDarwin;
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/share/go $out/bin
     mv bin/* $out/bin
     cp -r . $out/share/go
@@ -37,5 +38,6 @@ stdenv.mkDerivation rec {
       --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
       $out/bin/go
     '')}
-  '' ;
+    runHook postInstall
+  '';
 }
diff --git a/pkgs/development/compilers/zig/default.nix b/pkgs/development/compilers/zig/default.nix
index 399cb62ba3d7..a31a9e6ca43f 100644
--- a/pkgs/development/compilers/zig/default.nix
+++ b/pkgs/development/compilers/zig/default.nix
@@ -1,5 +1,4 @@
 { lib
-, stdenv
 , fetchFromGitHub
 , cmake
 , llvmPackages
@@ -7,19 +6,23 @@
 , zlib
 }:
 
-llvmPackages.stdenv.mkDerivation rec {
+let
+  inherit (llvmPackages) stdenv;
+in
+stdenv.mkDerivation rec {
   pname = "zig";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "ziglang";
     repo = pname;
     rev = version;
-    hash = "sha256-rZYv8LFH3M70SyPwPVyul+Um9j82K8GZIepVmaonzPw=";
+    hash = "sha256-bILjcKX8jPl2n1HRYvYRb7jJkobwqmSJ+hHXSn9n2ag=";
   };
 
   nativeBuildInputs = [
-    cmake llvmPackages.llvm.dev
+    cmake
+    llvmPackages.llvm.dev
   ];
   buildInputs = [
     libxml2
@@ -34,14 +37,6 @@ llvmPackages.stdenv.mkDerivation rec {
     export HOME=$TMPDIR;
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    ./zig test --cache-dir "$TMPDIR" -I $src/test $src/test/stage1/behavior.zig
-    runHook postCheck
-  '';
-
-  doCheck = true;
-
   meta = with lib; {
     homepage = "https://ziglang.org/";
     description =
@@ -53,3 +48,4 @@ llvmPackages.stdenv.mkDerivation rec {
     broken = stdenv.isDarwin;
   };
 }
+# TODO: checkPhase
diff --git a/pkgs/development/go-modules/generic/default.nix b/pkgs/development/go-modules/generic/default.nix
index 8246eaefed4c..10beb80f2e6a 100644
--- a/pkgs/development/go-modules/generic/default.nix
+++ b/pkgs/development/go-modules/generic/default.nix
@@ -7,6 +7,9 @@
 , passthru ? {}
 , patches ? []
 
+# Go linker flags, passed to go via -ldflags
+, ldflags ? []
+
 # A function to override the go-modules derivation
 , overrideModAttrs ? (_oldAttrs : {})
 
@@ -153,7 +156,7 @@ let
         echo "$d" | grep -q "\(/_\|examples\|Godeps\|testdata\)" && return 0
         [ -n "$excludedPackages" ] && echo "$d" | grep -q "$excludedPackages" && return 0
         local OUT
-        if ! OUT="$(go $cmd $buildFlags "''${buildFlagsArray[@]}" -v -p $NIX_BUILD_CORES $d 2>&1)"; then
+        if ! OUT="$(go $cmd $buildFlags "''${buildFlagsArray[@]}" ''${ldflags:+-ldflags="$ldflags"} -v -p $NIX_BUILD_CORES $d 2>&1)"; then
           if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
             echo "$OUT" >&2
             return 1
diff --git a/pkgs/development/go-packages/generic/default.nix b/pkgs/development/go-packages/generic/default.nix
index 8a093a03d1c1..88d7acb42fc9 100644
--- a/pkgs/development/go-packages/generic/default.nix
+++ b/pkgs/development/go-packages/generic/default.nix
@@ -7,6 +7,9 @@
 , preFixup ? ""
 , shellHook ? ""
 
+# Go linker flags, passed to go via -ldflags
+, ldflags ? []
+
 # We want parallel builds by default
 , enableParallelBuilding ? true
 
@@ -148,7 +151,7 @@ let
         echo "$d" | grep -q "\(/_\|examples\|Godeps\)" && return 0
         [ -n "$excludedPackages" ] && echo "$d" | grep -q "$excludedPackages" && return 0
         local OUT
-        if ! OUT="$(go $cmd $buildFlags "''${buildFlagsArray[@]}" -v -p $NIX_BUILD_CORES $d 2>&1)"; then
+        if ! OUT="$(go $cmd $buildFlags "''${buildFlagsArray[@]}" ''${ldflags:+-ldflags="$ldflags"} -v -p $NIX_BUILD_CORES $d 2>&1)"; then
           if ! echo "$OUT" | grep -qE '(no( buildable| non-test)?|build constraints exclude all) Go (source )?files'; then
             echo "$OUT" >&2
             return 1
diff --git a/pkgs/development/ocaml-modules/ansiterminal/default.nix b/pkgs/development/ocaml-modules/ansiterminal/default.nix
index 53b02a453a0e..edd40fb4df29 100644
--- a/pkgs/development/ocaml-modules/ansiterminal/default.nix
+++ b/pkgs/development/ocaml-modules/ansiterminal/default.nix
@@ -1,36 +1,29 @@
-{ lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild }:
+{ lib, buildDunePackage, fetchFromGitHub }:
 
-stdenv.mkDerivation rec {
+buildDunePackage rec {
+  pname = "ANSITerminal";
+  version = "0.8.2";
 
-  version = "0.7";
+  useDune2 = true;
 
-  name = "ocaml${ocaml.version}-ansiterminal-${version}";
-
-  src = fetchurl {
-    url = "https://github.com/Chris00/ANSITerminal/releases/download/${version}/ANSITerminal-${version}.tar.gz";
-    sha256 = "03pqfxvw9pa9720l8i5fgxky1qx70kw6wxbczd5i50xi668lh0i9";
+  src = fetchFromGitHub {
+    owner = "Chris00";
+    repo = pname;
+    rev = version;
+    sha256 = "0dyjischrgwlxqz1p5zbqq76jvk6pl1qj75i7ydhijssr9pj278d";
   };
 
-  buildInputs = [ ocaml findlib ocamlbuild ];
-
-  configurePhase = "ocaml setup.ml -configure --prefix $out";
-
-  buildPhase = "ocaml setup.ml -build";
-
-  installPhase = "ocaml setup.ml -install";
-
-  createFindlibDestdir = true;
+  doCheck = true;
 
   meta = with lib; {
-    homepage = "https://github.com/Chris00/ANSITerminal";
     description = "A module allowing to use the colors and cursor movements on ANSI terminals";
     longDescription = ''
       ANSITerminal is a module allowing to use the colors and cursor
       movements on ANSI terminals. It also works on the windows shell (but
       this part is currently work in progress).
     '';
+    inherit (src.meta) homepage;
     license = licenses.lgpl3;
-    platforms = ocaml.meta.platforms or [];
     maintainers = [ maintainers.jirkamarsik ];
   };
 }
diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix
index 7397825f714a..11c2da247d71 100644
--- a/pkgs/tools/admin/lxd/default.nix
+++ b/pkgs/tools/admin/lxd/default.nix
@@ -7,6 +7,7 @@
 , bash
 , installShellFiles
 , nftablesSupport ? false
+, nixosTests
 }:
 
 let
@@ -58,6 +59,8 @@ buildGoPackage rec {
     installShellCompletion --bash --name lxd go/src/github.com/lxc/lxd/scripts/bash/lxd-client
   '';
 
+  passthru.tests.lxd = nixosTests.lxd;
+
   nativeBuildInputs = [ installShellFiles pkg-config makeWrapper ];
   buildInputs = [ lxc acl libcap dqlite.dev raft-canonical.dev
                   sqlite-replication udev.dev ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0a967539b856..1af225fb78b9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -18653,7 +18653,7 @@ in
   libzra = callPackage ../development/libraries/libzra { };
 
   zig = callPackage ../development/compilers/zig {
-    llvmPackages = llvmPackages_11;
+    llvmPackages = llvmPackages_12;
   };
 
   zimlib = callPackage ../development/libraries/zimlib { };
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index c35f0b48b0f3..bd957bdb49d5 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -80,7 +80,7 @@ let
       VST = callPackage ../development/coq-modules/VST (with lib.versions;
         lib.switch coq.coq-version [
           { case = "8.11"; out = { compcert = compcert.override { coqPackages = self; version = "3.7"; }; }; }
-          { case = range "8.12" "8.13"; out = { compcert = compcert.override { coqPackages = self; }; }; }
+          { case = range "8.12" "8.13"; out = { compcert = compcert.override { coqPackages = self; version = "3.8"; }; }; }
         ] {});
       zorns-lemma = callPackage ../development/coq-modules/zorns-lemma {};
       filterPackages = doesFilter: if doesFilter then filterCoqPackages self else self;