[sigmonsays]

you can run nix in a container

It's tricky because said program probably needs to access the original $HOME