Ah yes, I got it working, the issue was unshare-pgid which had already been sort of raised in nixpak.
In my case, I used bubblewrap.newSession (which is equivalent of --new-session). Idk why that worked out finally with --unshare-pgid, but I'd rather not spend more time on this.
I like the idea of let binding the package declaration to use it in the config as well. I'll probably use that. Thanks!
Ok, so reading the replies I see that it was meant for me.
All the relevant volumes are mapped to the actual filesystem on disk (like you do in docker compose, ig it's called a volume bind-mount?), so when I have to take backups I stop the docker container and manually cp/rsync/whatever from the directory.
The github and codeberg services are nothing but HTTPS checks for both of them