NixOS store (app folder) is read only. You literally can’t mess with it. It doesn’t really need a container, most things are locked down already. Of course you could mess up your home folder, but that’s on you then