Nix and small containers with Docker multi-stage builds