Seems like a Nix could take a good advantage of Landlock, as it already (kind of) knows all the paths processes need access to.