[pid 137783] socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 12
[pid 137783] connect(12, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = 0
[pid 137783] sendto(12, "\2\0\0\0\16\0\0\0000\0\0\0this.pre-initializes.the.dns.resolvers.invalid.\0", 60, MSG_NOSIGNAL, NULL, 0) = 60
[pid 137783] poll([{fd=12, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=12, revents=POLLIN}])
[pid 137783] read(12, "\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24) = 24
[pid 137783] close(12)                  = 0

here (where it works), and similar on your log

In reply to @zhaofeng:zhaofeng.li
I think it's actually a bug that it worked with / and /nix/store in the same filesystem. It shouldn't have worked with the sandbox.

#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stddef.h>

void preloadNSS() {
        struct addrinfo *res = NULL;

        char * previous_env = getenv("LOCALDOMAIN");
        setenv("LOCALDOMAIN", "invalid", 1);
        if (getaddrinfo("this.pre-initializes.the.dns.resolvers.invalid.", "http", NULL, &res) != 0) {
            if (res) freeaddrinfo(res);
        }
        if (previous_env)
             setenv("LOCALDOMAIN", previous_env, 1);
        else
             unsetenv("LOCALDOMAIN");
}

int main() {
    preloadNSS();
}

This forces nss to make a dns lookup, and to load the nss_dns.so

client # /dev/vda on / type ext4 (rw,relatime)
client # store on /nix/.ro-store type 9p (rw,relatime,dirsync,loose,access=client,trans=virtio)
client # tmpfs on /nix/.rw-store type tmpfs (rw,relatime,mode=755)
client # shared on /tmp/shared type 9p (rw,relatime,sync,dirsync,access=client,trans=virtio)
client # xchg on /tmp/xchg type 9p (rw,relatime,sync,dirsync,access=client,trans=virtio)
client # overlay on /nix/store type overlay (rw,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/store,workdir=/mnt-root/nix/.rw-store/work)
client # overlay on /nix/store type overlay (ro,relatime,lowerdir=/mnt-root/nix/.ro-store,upperdir=/mnt-root/nix/.rw-store/store,workdir=/mnt-root/nix/.rw-store/work)

interestingly, my nix-daemon does mount

[pid 42542] mount("/nix/store/9bh3986bpragfjmr32gay8p95k91q4gy-glibc-2.33-47", "/nix/store/r4rn52pvm83frvq2q4a2zb3vdq73l5x2-example.com.drv.c
hroot/nix/store/9bh3986bpragfjmr32gay8p95k91q4gy-glibc-2.33-47", 0x7f833016bef1, MS_BIND|MS_REC, NULL) = 0

-  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
+  #boot.binfmt.emulatedSystems = [ "aarch64-linux" ];