Nix paper cut of the day: I'm trying to build a Linux OCI image (on a macOS host) and apparently you can't add a `runAsRoot` attribute under `buildImage` on a non-Linux host. Even if it's just an empty string. Feels like a bug. Any thoughts from hardened veterans?