Currently, sudo doesn't work in a NixOS container running inside a Nix build, because Nix's seccomp filter doesn't allow setuid programs. In any case, runuser is a bit lower-overhead than sudo.