apt: "apt-get update" fails trying to modify /var/lib/apt/lists/partial in /nix/store

[milahu]

i want to use apt to fetch a debian package source:

apt-get source 7zip

to make apt-get work on nixos
i must create some files in /etc and run apt-get update

# fix: E: Unable to determine a suitable packaging system type
echo unstable | sudo tee /etc/debian_version

# fix: E: You must put some 'deb-src' URIs in your sources.list
sudo mkdir /etc/apt
echo -e "deb http://deb.debian.org/debian unstable main\ndeb-src http://deb.debian.org/debian unstable main" | sudo tee /etc/apt/sources.list
sudo apt-get update

apt-get update fails with

$ sudo apt-get update
Reading package lists... Done
W: chmod 0700 of directory /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (30: Read-only file system)
W: Not using locking for read only lock file /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/lib/apt/lists/lock
W: No sandbox user '_apt' on the system, can not drop privileges

expected:
apt-get update should modify /var/lib/apt/lists/partial
in the filesystem root, not in the nix store

similar apt-get commands fail too

$ sudo apt-get clean 
W: chmod 0700 of directory /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/cache/apt/archives/partial failed - SetupAPTPartialDirectory (30: Read-only file system)
W: Not using locking for read only lock file /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/cache/apt/archives/lock
W: chmod 0700 of directory /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/lib/apt/lists/partial failed - SetupAPTPartialDirectory (30: Read-only file system)
W: Not using locking for read only lock file /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/lib/apt/lists/lock

$ sudo apt-get upgrade
E: Could not open lock file /nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/lib/dpkg/lock-frontend - open (2: No such file or directory)
E: Unable to acquire the dpkg frontend lock (/nix/store/ryviwc5dpc46yzprjnqxqdyj4jjqmwaz-apt-2.7.1/var/lib/dpkg/lock-frontend), are you root?

similar issue: what is the purpose of the files in this directory: /var/lib/apt/lists?

From man apt-get

/var/lib/apt/lists/
Storage area for state information for each package resource
specified in sources.list(5) Configuration Item: Dir::State::Lists.

/var/lib/apt/lists/partial/
Storage area for state information in transit. Configuration Item:
Dir::State::Lists (partial will be implicitly appended)

so this should be fixed by

echo 'Dir::State "/var/lib/apt";' | sudo tee /etc/apt/apt.conf

or

echo 'Dir::State::Lists "/var/lib/apt/lists";' | sudo tee /etc/apt/apt.conf

but apt-get ignores /etc/apt/apt.conf
which is fixed by apt-get -c /etc/apt/apt.conf update

$ apt-get -c /etc/apt/apt.conf source 7zip
Reading package lists... Done
E: You must put some 'deb-src' URIs in your sources.list

now apt-get ignores /etc/apt/sources.list
this should be fixed by

echo -e 'Dir::State "/var/lib/apt";\nDir::Etc "/etc/apt";\nDir::Cache "/var/cache/apt";' | sudo tee /etc/apt/apt.conf

or

echo 'Dir { State "/var/lib/apt"; Etc "/etc/apt"; Cache "/var/cache/apt"; };' | sudo tee /etc/apt/apt.conf

but no, apt-get still ignores /etc/apt/sources.list

$ apt-get -c /etc/apt/apt.conf source 7zip
Reading package lists... Done
E: You must put some 'deb-src' URIs in your sources.list