That's the dream of containers. Arguably this is the "reality" of Nix. But the reality of containers is that if a layer gets invalidated, you need to refetch packages that are lower down. If the Python 2 versions (or Python 2 itself) is removed, then you can't "just" surgically make the change you want in the container without affecting the rest of the system (this is a major failing of Docker, but the world we live in). Now, you can start digging around in the container image and trying to do "layer surgery" yourself by editing the tars, but I would also consider that a less than ideal outcome of these changes.