Yes. Thats how I do it actually (not with apt). You can even point the runner at the nix community cache to prevent overly long build times. I have never trusted the Docker style of “I crammed everything I needed into this amorphous, way-too-capable, badly sandboxed, portable Alpine Linux box. Trust me bro, it’s secure” and prefer “here’s code showing exactly how I build this software with pinned, hashed versions that pass checks and you can use them too” with a simple flake file.

Here’s some pseudo code demonstrating it:

flake.nix

{
  description = "hello-cli: pinned end to end by a lockfile, built in a sandbox";

  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
    flake-utils.url = "github:numtide/flake-utils";
  };

  outputs = { self, nixpkgs, flake-utils }:
    flake-utils.lib.eachDefaultSystem (system:
      let
        pkgs = import nixpkgs { inherit system; };
      in {
        packages.default = pkgs.rustPlatform.buildRustPackage {
          pname = "hello-cli";
          version = "0.1.0";
          src = ./.;

          # No magic hash to paste. The committed Cargo.lock IS the pin:
          # Nix reads it and fetches every crate as a fixed-output
          # derivation. Change a dep, the lock changes, the build changes.
          cargoLock.lockFile = ./Cargo.lock;

          meta.mainProgram = "hello-cli";
        };

        devShells.default = pkgs.mkShell {
          packages = with pkgs; [ cargo rustc rust-analyzer clippy ];
        };
      });
}

And a pertinent example runner.yml file:

when:
  - event: [push, pull_request, tag]

steps:
  - name: build
    image: nixos/nix:2.28.3
    environment:
      NIX_CONFIG: |
        experimental-features = nix-command flakes
        accept-flake-config = false
        sandbox = true
        substituters = https://cache.nixos.org/ https://nix-community.cachix.org/
        trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
    commands:
      # stale lock is a hard failure, so CI can never silently float
      - nix build .#default --no-update-lock-file --print-build-logs
      - ./result/bin/hello-cli nix
      # the money shot
      - nix path-info -r --closure-size --human-readable ./result
      # prove it again from scratch with zero cache and zero network
      - nix build .#default --rebuild --option substituters "" --print-build-logs