Fix permissions on /var/lib/startup-done
Bring back ‘nixos-container update’
nixos-container: Add ‘run’ and ‘root-login’ commands

And remove ‘root-shell’.
Add option networking.nat.internalInterfaces

This allows applying NAT to an interface, rather than an IP range.
Document NixOS containers