NixOS 17.03 prior to 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands.
nixos nixos 17.03