> A builder implementation using OCI instead of custom sandboxing code.

Hermetic builds require some sandboxing; Using OCI containers seems like an obvious choice, but didn't exist when Nix was first created.

Presumably this would make this implementation Linux-only, since OCI isn't natively supported outside of Linux?