Create a an ACI image with tar, then run it with rkt.

manifest

{
    "acKind": "ImageManifest",
    "acVersion": "0.7.0",
    "name": "my-app",
    "labels": [
        {"name": "os", "value": "linux"},
        {"name": "arch", "value": "amd64"}
    ],
    "app": {
        "exec": [
            "/nix/store/v9pq6f0s1r5fdybqc7pbv7mkb33lx9yy-python-2.7.10/bin/python2-config"
        ],
        "user": "0",
        "group": "0"
    }
}

rkt+nix.sh

tar --xform "s_nix/_rootfs/nix/_" \
    -czf image.aci \
    $(nix-store -qR /nix/store/v9pq6f0s1r5fdybqc7pbv7mkb33lx9yy-python-2.7.10) \
    manifest
sudo /home/tom/.nix-profile/bin/rkt run \
    --insecure-skip-verify \
    --no-overlay \
    --mds-register=false image.aci

Thanks, this is really cool. I tried converting it into something you could use in a derivation - I am certain this could be written better/more idiomatically, but here is what I came up with (which seems to work)

+  rkt = stdenv.mkDerivation rec {
+    name = "rkt-image";
+    buildInputs = [ rsync ] ;
+    allDerivations = writeReferencesToFile jar;
+    manifest = builtins.toJSON {
+      acKind = "ImageManifest";
+      acVersion = "0.7.0";
+      inherit name;
+      labels = [
+        { name = "os"; value = "linux"; }
+        { name = "arch"; value = "amd64"; } 
+      ];
+      app = {
+        exec = [ "${jar}/bin/start-the-app" ] ;
+        user = "0";
+        group = "0";
+      };
+    };
+    src = ./empty;
+    manifestFile = writeTextFile {
+      name= "manifest";
+      text= manifest;
+    };
+    buildPhase = ''
+      mkdir -p rootfs/nix/store
+      rsync -a $(cat $allDerivations) rootfs/nix/store
+      cp $manifestFile  manifest
+    '';
+    installPhase = ''
+      mkdir -p $out
+      tar cf $out/$name.aci .
+    '';
+  };

(for context, the derivation jar builds a java app and a shell script to start it)