You can install a single package from a specific nixpkgs commit and it will pull in whatever dependencies it needs to make that work, with everything as of the time of that commit. You may have duplicated libraries but they can coexist fine, and you'd have that with docker as well (probably even worse unless you are very intentional about building layers).

I imagine people do this somewhat regularly at least to e.g. occasionally pull in a package or two from unstable when they normally run a stable system.