The documentation for nss-mdns says the following:
`nss-mdns` tries to contact a running
[avahi-daemon](http://avahi.org/) for resolving host names and
addresses and making use of its superior record cacheing. If
Avahi is not available at lookup time, the lookups will fail.
So it isn’t clear that adding nss-mdns to nsswitch.conf in the sandbox would be sufficient without also plugging avahi-observe (or adjusting the network plug to grant access to /var/run/avahi-daemon/socket).