This led to the container test failing, which made no sense whatsoever, until I realized nix-daemon.socket creates the socket directory as a side effect, which systemd-nspawn then bind-mounts. http://hydra.nixos.org/build/10397575