dockerTools: pullImage of nixos/nix 2.28.5 or later fails with "not allowed to refer to other store paths"

Nixpkgs version

• Stable (25.05)

Describe the bug

pkgs.dockerTools.pullImage breaks on the official Nix dockerhub image (nixos/nix) version 2.28.5 or later. Nixpkgs 25.05 (b2a3852bd078e68dd2b3dfa8c00c67af1f0a7d20) fails with the error below.

error: fixed output derivation 'docker-image-nix-2.28.5.tar' is not allowed to refer to other store paths.
       You may need to use the 'unsafeDiscardReferences' derivation attribute, see the manual for more details.

Nixpkgs unstable successfully builds the same image digest, so it looks like something needed to support recent images may not have been backported.

Steps to reproduce

Attempt to build this in 25.05 (hashes are for x86_64-linux):

pullImage {
  imageName = "nixos/nix";
  imageDigest = "sha256:e2bff159b88c242722022a273d3832a4392f01dba35b796204d852b89042526e";
  sha256 = "sha256-RCmQLIm3ZeJQQWt5eUvsjohW/wrsFPTvibzx8e2OyE0=";
  finalImageTag = "2.28.5";
  finalImageName = "nix";
}

Compare with the below which builds successfully:

pullImage {
  imageName = "nixos/nix";
  imageDigest = "sha256:85169a7ff4ac6928b70b15ced20c74770e07e8fbc7f97e92f64c1fca47ea9486";
  sha256 = "sha256-858VnvtLisD2DTDdoJXfVGl/SP3xOlwOJtVF7x9Pdbc=";
  finalImageTag = "2.28.4";
  finalImageName = "nix";
}

Expected behaviour

pullImage should build successfully when used on official Nix images.

System metadata

• system: "x86_64-linux"
• host os: Linux 6.12.47-xanmod1, NixOS, 25.05 (Warbler), 25.05.20250920.b2a3852
• multi-user?: yes
• sandbox: yes
• version: nix-env (Nix) 2.28.5
• nixpkgs: /nix/store/gg9fmyvsizavv6x9srffip7kky023x07-source

Notify maintainers

@terlar @pineapplehunter

I don't see a maintainer list immediately so pinging some recent committers. If you know better names, please suggest. Thanks and sorry for the noise.

---

Note for maintainers: Please tag this issue in your pull request description. (i.e. Resolves #ISSUE.)

I assert that this issue is relevant for Nixpkgs

• I assert that this is a bug and not a support request.
• I assert that this is not a duplicate of an existing issue.
• I assert that I have read the NixOS Code of Conduct and agree to abide by it.

Is this issue important to you?

Add a 👍 reaction to issues you find important.

Start at pkgs.dockerTools.pullImage and reproduce the provided nixos/nix 2.28.5 image failure on Nixpkgs 25.05, then compare with the successful unstable build and the 2.28.4 example. Done means the official 2.28.5 image builds successfully without the fixed-output derivation error.