Turns out the image does have bash and openssh now, hooray.  However, the
checkout step is failing:

> /usr/bin/docker exec a5e8... sh -c "cat /etc/*release | grep ^ID"
> OCI runtime exec failed: exec failed: container_linux.go:380: starting container process caused: no such file or directory: unknown

I suppose because there is no `/etc/os-release`?

I have no idea if this is the way to do it

> invalid argument "kernel.unprivileged_userns_clone=1" for "--sysctl" flag: sysctl 'kernel.unprivileged_userns_clone=1' is not whitelisted

If we use a different container for each step then each step has to download
and build the whole stack for itself, adding about 8 minutes to the job. :/

The previous nixpkgs revision was an arbitrary revision of master that just
happened to work during development.  Instead of enshrining it, switch to
something that's compatible with a version of pypi-deps-db we can get (and get
that, too).

… steps

Prior to this change the steps still don't actually run the tox command.

It's not clear the CI problems have anything to do with this, but might as
well try.