[pid 137791] openat(AT_FDCWD, "/nix/store/9bh3986bpragfjmr32gay8p95k91q4gy-glibc-2.33-47/lib/libnss_dns.so.2", O_RDONLY|O_CLOEXEC) = 10

[pid 137783] socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 12
[pid 137783] connect(12, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = 0
[pid 137783] sendto(12, "\2\0\0\0\16\0\0\0000\0\0\0this.pre-initializes.the.dns.resolvers.invalid.\0", 60, MSG_NOSIGNAL, NULL, 0) = 60
[pid 137783] poll([{fd=12, events=POLLIN|POLLERR|POLLHUP}], 1, 5000) = 1 ([{fd=12, revents=POLLIN}])
[pid 137783] read(12, "\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 24) = 24
[pid 137783] close(12)                  = 0

here (where it works), and similar on your log

In reply to @zhaofeng:zhaofeng.li
I think it's actually a bug that it worked with / and /nix/store in the same filesystem. It shouldn't have worked with the sandbox.

#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <stddef.h>

void preloadNSS() {
        struct addrinfo *res = NULL;

        char * previous_env = getenv("LOCALDOMAIN");
        setenv("LOCALDOMAIN", "invalid", 1);
        if (getaddrinfo("this.pre-initializes.the.dns.resolvers.invalid.", "http", NULL, &res) != 0) {
            if (res) freeaddrinfo(res);
        }
        if (previous_env)
             setenv("LOCALDOMAIN", previous_env, 1);
        else
             unsetenv("LOCALDOMAIN");
}

int main() {
    preloadNSS();
}

This forces nss to make a dns lookup, and to load the nss_dns.so