Great thanks! So Fedora+Nix (maybe some hacky way to symlink it to /var/nix on every boot and it can run on Atomic too)+bubblejail (there is a COPR now for use in secureblue) could be a great setup!
Any info about namespaces? Hardened kernels block these for valid reasons. Flatpaks can use bubblewrap-suid, Podman is supposedly not compatible (not sure about that)