glycin/sandbox: Support /nix to make it work on nixOS by default.
