nix: Include runtime deps in enclosure

We weren't actually including these, so a bit of mystery how it was
working for me.

What's not included is new{uid,gid}map in the shadow package because
it requires the suid bit to be set. So we have to rely on that being
on the system already.

distros/nix/cli-cross.nix

@@ -15,7 +15,6 @@ in
   version = version;
   src = srcWithProtobuf;
   modRoot = "./go";
-  # Use lib.fakeHash when updating deps
   inherit vendorHash;
   # Avoids workspace mode error
   proxyVendor = true;

distros/nix/server.nix

@@ -1,8 +1,19 @@
 {
-    lib, stdenv, makeWrapper, version, buildkit, cli
+    lib, stdenv, makeWrapper, version, cli,
+    buildkit, slirp4netns, rootlesskit, runc, cni, buildkit-cni-plugins,
+    util-linux, iproute2
 }:
 let
-    runtimeDeps = [ buildkit ];
+    runtimeDeps = [
+        slirp4netns
+        rootlesskit
+        runc
+        cni
+        buildkit-cni-plugins
+        buildkit
+        util-linux # unshare,nsenter for rootlesskit
+        iproute2 # ip for slirp4netns
+    ];
 in
     stdenv.mkDerivation {
         pname = "ayup-server";

flake.nix

@@ -61,7 +61,7 @@
         GOARCH = "amd64";
       };
       server = pkgs.callPackage ./distros/nix/server.nix {
-        inherit version cli;
+        inherit version cli buildkit-cni-plugins;
       };
   in
     {