Even more reproducibility

[kamadorueda]

1. Make the container run as user by default, and instead make a feature flag run it as root
2. Make sure sandbox is enabled in the container
3. Update Nix, and make sure only one version is in the final container
4. Document the extra steps needed so that a Nix with Daemon installation works, so that we can suggest people to use this kind of install