Make Nix configure itself better when it runs in the sandbox

[roberth]

Is your feature request related to a problem? Please describe.

When running nix inside the nix sandbox, users have to perform a lot of nontrivial setup just to get instantiation to work.

• It is complicated:
  • in nixpkgs tests
  • in Test nested sandboxing, and make nicer error #8696
• And error prone
  • flake: update nixpkgs: 22.11 -> 23.05 #8569
    • https://github.com/NixOS/nix/actions/runs/5446254680/jobs/9906719733?pr=8569#step:6:3655

Describe the solution you'd like

Nix should detect that it is run in the sandbox, and then adapt (some of) its default configuration to comply with the restrictions.

It should not automatically relocate its store, as that would be a problem for

• RFC 92 and A very restricted recursive nix socket in the sandbox #8602

It should configure --offline when it is in the sandbox and it is not a fixed-output derivation sandbox.

This might necessitate extra environment variables that are set in the sandbox.

Describe alternatives you've considered

• Add generic test setup logic to Nixpkgs, as tests could use a relocated store anyway, but this wouldn't help RFC 92

• Try to set --offline in Nixpkgs.

Additional context

• Closely related to A very restricted recursive nix socket in the sandbox #8602

Priorities

Add 👍 to issues you find important.