Integrate with nix gc so that our containers, once created, can not have their contents ripped out from under them.