Motivation for this change

Fix bug in dockerTools.buildLayeredImage that causes non-root containers to be not runnable.

Pardon my python, but I was unsure how - in the prettiest way - to hook into the existing logic around /nix/store dir-creation.

example docker error message:

docker: Error response from daemon: OCI runtime create failed: container_linux.go:349: starting container process caused "exec: \"/nix/store/3avafdzgh694z5m3rgw2vvlgsfz2gmkl-coredns-1.6.6/bin/coredns\": stat /nix/store/3avafdzgh694z5m3rgw2vvlgsfz2gmkl-coredns-1.6.6/bin/coredns: permission denied": unknown.

The cause of the error is that /nix and /nix/store has wrong permissions inside the final image, i.e.:

bash-4.4# ls -dl /nix/store/
drw-r--r-- 32 root root 34 Jan  1  1970 /nix/store/

The top-level directories lack world execute permissions, which, is ok as long we run the image as root, but fails when the image is run as an unprivileged user.

Steps to reproduce

1. cherry-pick 4fc255e from my branch onto master
2. docker load <$(nix-build . -A dockerTools.examples.bashLayeredWithUser)
3. docker run --rm -it -u somebody bash-layered-with-user /bin/echo "it works"

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

cc @LnL7 @utdemir