This addresses the concerns with network isolation that have been raised previously [1] by only running the tests by default in a network namespace. This way all networks tests are independent of each other and do not bind to ports in the host namespace. This is much neater than doing these sorts of tests in functional suite. [1]: https://github.com/NixOS/nix/pull/14266#issuecomment-3411261285