diff --git a/tests/nixos/git-submodules.nix b/tests/nixos/git-submodules.nix
index b18300a91..a82ddf418 100644
--- a/tests/nixos/git-submodules.nix
+++ b/tests/nixos/git-submodules.nix
@@ -46,6 +46,7 @@
       remote.wait_for_unit("sshd")
       remote.wait_for_unit("multi-user.target")
       remote.wait_for_unit("network-online.target")
+      client.wait_for_unit("network-online.target")
       client.succeed(f"ssh -o StrictHostKeyChecking=no {remote.name} 'echo hello world'")
 
       remote.succeed("""
diff --git a/tests/nixos/github-flakes.nix b/tests/nixos/github-flakes.nix
index 8e646f6dd..69d1df410 100644
--- a/tests/nixos/github-flakes.nix
+++ b/tests/nixos/github-flakes.nix
@@ -161,7 +161,9 @@ in
          github.succeed("cat /var/log/httpd/*.log >&2")
 
     github.wait_for_unit("httpd.service")
+    github.wait_for_unit("network-online.target")
 
+    client.wait_for_unit("network-online.target")
     client.succeed("curl -v https://github.com/ >&2")
     out = client.succeed("nix registry list")
     print(out)
diff --git a/tests/nixos/nix-docker.nix b/tests/nixos/nix-docker.nix
new file mode 100644
index 000000000..00b04482c
--- /dev/null
+++ b/tests/nixos/nix-docker.nix
@@ -0,0 +1,54 @@
+# Test the container built by ../../docker.nix.
+
+{ lib, config, nixpkgs, hostPkgs, ... }:
+
+let
+  pkgs = config.nodes.machine.nixpkgs.pkgs;
+
+  nixImage = import ../../docker.nix {
+    inherit (config.nodes.machine.nixpkgs) pkgs;
+  };
+  nixUserImage = import ../../docker.nix {
+    inherit (config.nodes.machine.nixpkgs) pkgs;
+    name = "nix-user";
+    uid = 1000;
+    gid = 1000;
+    uname = "user";
+    gname = "user";
+  };
+
+  containerTestScript = ./nix-docker-test.sh;
+
+in {
+  name = "nix-docker";
+
+  nodes =
+    { machine =
+        { config, lib, pkgs, ... }:
+        { virtualisation.diskSize = 4096;
+        };
+      cache =
+        { config, lib, pkgs, ... }:
+        { virtualisation.additionalPaths = [ pkgs.stdenv pkgs.hello ];
+          services.harmonia.enable = true;
+          networking.firewall.allowedTCPPorts = [ 5000 ];
+        };
+    };
+
+  testScript = { nodes }: ''
+    cache.wait_for_unit("harmonia.service")
+    cache.wait_for_unit("network-online.target")
+
+    machine.succeed("mkdir -p /etc/containers")
+    machine.succeed("""echo '{"default":[{"type":"insecureAcceptAnything"}]}' > /etc/containers/policy.json""")
+
+    machine.succeed("${pkgs.podman}/bin/podman load -i ${nixImage}")
+    machine.succeed("${pkgs.podman}/bin/podman run --rm nix nix --version")
+    machine.succeed("${pkgs.podman}/bin/podman run --rm -i nix < ${containerTestScript}")
+
+    machine.succeed("${pkgs.podman}/bin/podman load -i ${nixUserImage}")
+    machine.succeed("${pkgs.podman}/bin/podman run --rm nix-user nix --version")
+    machine.succeed("${pkgs.podman}/bin/podman run --rm -i nix-user < ${containerTestScript}")
+    machine.succeed("[[ $(${pkgs.podman}/bin/podman run --rm nix-user stat -c %u /nix/store) = 1000 ]]")
+  '';
+}
diff --git a/tests/nixos/nss-preload.nix b/tests/nixos/nss-preload.nix
index 610769c8d..b7e704f39 100644
--- a/tests/nixos/nss-preload.nix
+++ b/tests/nixos/nss-preload.nix
@@ -102,6 +102,7 @@ in
   };
 
   testScript = { nodes, ... }: ''
+    http_dns.wait_for_unit("network-online.target")
     http_dns.wait_for_unit("nginx")
     http_dns.wait_for_open_port(80)
     http_dns.wait_for_unit("unbound")
@@ -109,6 +110,7 @@ in
 
     client.start()
     client.wait_for_unit('multi-user.target')
+    client.wait_for_unit('network-online.target')
 
     with subtest("can fetch data from a remote server outside sandbox"):
         client.succeed("nix --version >&2")
diff --git a/tests/nixos/s3-binary-cache-store.nix b/tests/nixos/s3-binary-cache-store.nix
index 83b85c032..f8659b830 100644
--- a/tests/nixos/s3-binary-cache-store.nix
+++ b/tests/nixos/s3-binary-cache-store.nix
@@ -52,12 +52,15 @@ in {
 
     # Create a binary cache.
     server.wait_for_unit("minio")
+    server.wait_for_unit("network-online.target")
 
     server.succeed("mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4")
     server.succeed("mc mb minio/my-cache")
 
     server.succeed("${env} nix copy --to '${storeUrl}' ${pkgA}")
 
+    client.wait_for_unit("network-online.target")
+
     # Test fetchurl on s3:// URLs while we're at it.
     client.succeed("${env} nix eval --impure --expr 'builtins.fetchurl { name = \"foo\"; url = \"s3://my-cache/nix-cache-info?endpoint=http://server:9000&region=eu-west-1\"; }'")
 
diff --git a/tests/nixos/sourcehut-flakes.nix b/tests/nixos/sourcehut-flakes.nix
index 04f3590e1..2f469457a 100644
--- a/tests/nixos/sourcehut-flakes.nix
+++ b/tests/nixos/sourcehut-flakes.nix
@@ -122,6 +122,8 @@ in
       start_all()
 
       sourcehut.wait_for_unit("httpd.service")
+      sourcehut.wait_for_unit("network-online.target")
+      client.wait_for_unit("network-online.target")
 
       client.succeed("curl -v https://git.sr.ht/ >&2")
       client.succeed("nix registry list | grep nixpkgs")