The dev shell (guix shell -D) has the full toolchain and network, so the build happens there.
The isolated 'guix shell -C -N' container only runs the already-compiled binary, which needs just the GTK/WebKit C libraries via LD_LIBRARY_PATH.
Also export WEBKIT_DISABLE_COMPOSITING_MODE and WEBKIT_DISABLE_DMABUF_RENDERER, without which WebKit renders a blank surface inside the sandbox.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>