Thank you for the draft: I tried to run it in a nixos-shell like this vm.nix:

{ pkgs, ... }:
{
  boot.kernelPackages = pkgs.linuxPackages_latest;

  virtualisation = {
    podman.enable = true;
    containers.containersConf.extraConfig = ''
      [engine]
      hooks_dir = [
        "${pkgs.linuxPackages.oci-seccomp-bpf-hook}",
      ]
    '';
  };
}

> export NIX_PATH=nixpkgs=$PWD && nixos-shell

When applying the patch from #96761 (comment), then it sill complains to lookup the old kernel sources on runtime:

> podman run --annotation io.containers.trace-syscall="of:/tmp/out.json" -it alpine echo hi
…
Error: chdir(/nix/store/37fqbzwkv23r3c340jw7bcy2zl3yn98i-linux-5.4.61-dev/lib/modules/5.8.4/build):

If we do not change the kernel packages and remove the

boot.kernelPackages = pkgs.linuxPackages_latest;

from vm.nix, then it works as expected.

I think this should work:

{ config, pkgs, ... }:
{
  boot.kernelPackages = pkgs.linuxPackages_latest;

  virtualisation = {
    podman.enable = true;
    containers.containersConf.extraConfig = ''
      [engine]
      hooks_dir = [
        "${config.boot.kernelPackages.oci-seccomp-bpf-hook}",
      ]
    '';
  };
}

I think this should work:
…

Yep, this works! Thank you again I'll update my PR to use the new config.

@saschagrunert Does this have a minimum kernel version that we need to set?

@saschagrunert Does this have a minimum kernel version that we need to set?

I think so, but I'm not sure which one exactly. For sake of security we could go with the current NixOS 20.03 default. This one should at least work.