NixOS simplifies system management through declarative files

NixOS manages the entire system state through a single configuration.nix file where you specify everything, configure everything for your installation or upgrade, and ensure that the entire batch of packages being upgraded will fail if the stream is tampered with. This file defines users and kernel options. This approach ensures batch integrity. This prevents the insertion of malicious packages. Nixpkgs contains definitions for over 80,000 packages. Guix provides a different model using the Scheme programming language. Both systems allow users to define a centralized configuration. Nix is a purely functional package manager. It is also lazy, meaning it calculates only the information about produced values that is actually required. This allows Nix programs to skip performing computations for optional dependencies that are not used. Guix is a younger project than Nix, receiving its first commit in 2012 compared to Nix’s start in 2003. NixOS provides built-in virtualization capabilities similar to Windows HyperV to help developers build and test software. It also supports apparmor for mandatory access control at the program level. After you finish specifying changes, you perform a build with the command nixos-rebuild switch. The system reconfigures itself, downloads new packages, and then reboots. The learning curve for the Nix language remains a significant hurdle for new users.

Security constraints in the Nix ecosystem

NixOS uses a non-standard directory layout where configuration files in /etc link to the read-only /nix/store. This layout prevents many standard Linux scripted attacks. However, the nix-env command remains executable by everyone because of its file permissions. You cannot restrict this command via sudo. To fix this, you must manually re-mount the /nix/store as read-write, change the permission with sudo chmod o-x, and then re-mount it as read-only after every rebuild. The difficulty of automating permission changes in the /nix/store exists because the directory uses changeable guid folder names. An attacker who has made it onto an account can also use the command curl to install software. This command is built in and is world executable. You have to find the current build’s guid directory and change its permission after every build. Guix only packages free software, whereas Nix allows non-free software through a configuration option. Guix provides a feature called "grafting" to substitute up-to-date runtime dependencies without recompiling packages. Guix is capable of building itself almost entirely from source on x86_64. Guix uses GNU Shepherd as an init system instead of systemd. This can make adjusting to the new service manager difficult for those used to systemd.

Developing with flakes and isolated shells

Teams use flakes to solve the problem of inconsistent environments. A flake.nix file defines the inputs and outputs. Developers use nix develop to enter a shell with specific tool versions. This ensures every teammate uses the same version of Node or PostgreSQL. You can pair this with nix-direnv to load environments automatically when you enter a directory. This eliminates the "it runs on my machine" problem. Flakes provide a stable foundation, but they do not fix broken derivations or misconfigured modules. Developers use nix run to test a specific version of Node without cluttering their profile. This allows you to run tools like jq or a specific Node version temporarily. A flake reference defines a complete Nix dependency graph in a single string. This makes it easy to move between local development and CI pipelines. Flakes are the go-to for containers. While flakes are self-contained, the runtime is not isolated like containers or cgroups. You know the basics, so you understand the friction of a new language. If you need to change a simple shell alias, you must still edit your configuration and rebuild. Will developers eventually abandon the experimental status of flakes to simplify onboarding?