I have a question about the Nix sandbox. In this simple derivation, there are no dependencies yet the sandbox does contain a /bin/sh. Where does it come from?
builtins.derivation {
name = "simple";
builder = "/bin/sh";
args = [ "-c" "echo 1 > $out" ];
system = "x86_64-linux";
}