Do builds use sandboxing? It appears not[0], is this in the roadmap? Based on my experiences with node2nix, composer2nix, carnix, etc, I don't blame you for not going that route. Not to knock on the developers of those tools - it's a difficult problem. I apologize if my interpretation is incorrect.

[0]: https://github.com/railwayapp/nixpacks/blob/60ab563fdc9bf4fb...