Try specifying the 2nd generation execution environment. Your service is probably defaulting to the first generation which has faster cold start times but doesn't implement some Linux features like cgroups that nsjail relies on.