I keep thinking of rolling a simpler solution with chroot + something something, but if someone is able to hide the complexity of Nix well enough, sign me up. Those abstractions tend to be leaky though.