I am trying to understand.

Docker, which uses OCI containers that are supported by Docker, Podman, Containerd, systemd-nspawn, etc, is lock-in.

But Nix Shells, which require Nix, are not lock-in.

Also, how are you going to run Nix shells in VLANs? They run on the host’s network namespace.