GitLab Runner nix-shell macOS sandbox