The nix by default makes builds in a sandbox. It is purposefully making certain operations unavailable (local home directory, local configuration, network acces

The nix by default makes builds in a sandbox. It is purposefully making certain operations unavailable (local home directory, local configuration, network access etc). I don't think it prevents Rand(), but that's not as common.