GeezerVison

In NixOS, the entire operating system—including the kernel, applications, system packages, and configuration files—is built by the Nix Package manager from a definition in the Nix language. Building a new version will not overwrite previous versions.^[20]

A NixOS system is configured by specifying the desired state in a Nix expression file, typically /etc/nixos/configuration.nix. The following example configures the bootloader and enables the OpenSSH daemon:^[21]

{
  boot.loader.grub.device = "/dev/sda";
  fileSystems."/".device = "/dev/sda1";
  services.openssh.enable = true;
}

Changes may be built and activated with the nixos-rebuild command, which evaluates the configuration, builds the necessary derivations, and produces a new system generation.^[6]

Configurations in Nix are evaluated as pure, declarative expressions. Given the same inputs (such as the Nixpkgs revision and configuration files), evaluation is deterministic and produces the same build plan each time, independent of the machine's prior state.^[22]

Upgrades and configuration changes to NixOS systems are applied transactionally. New system generations are activated atomically, so that previous generations are retained and may be rolled back. If an upgrade is interrupted (for example, by power failure), the system remains consistent and will boot either the old or the new configuration.^[22][23] After an upgrade, the switch to the new generation can be postponed to the next boot or executed immediately, in which case any affected system services are restarted.^[24]

If, after a system update, the new configuration is undesirable, it may be rolled back by switching to a previous generation (nixos-rebuild switch --rollback). New generations are automatically added to the system bootloader and may be selected prior to boot. Rollbacks are lightweight operations that switch system references to different store paths.^[25]

NixOS uses a declarative configuration model that allows system configurations to be reproduced on different machines. By sharing a configuration file with a target machine, users can generate an equivalent system, including the kernel, applications, and system services. Components not managed by the package manager, such as user data, are not affected by this process.

In addition to the system-wide profile, every normal user in a NixOS system has a profile in which they can install packages without special privileges. In the Nix store, multiple versions of a package may coexist, allowing different users to have alternate versions of the same package installed in their respective profiles, or share an identical version.

Nix’s security model restricts what unprivileged users can influence. Prebuilt binaries may be fetched from binary caches that are explicitly trusted by the system configuration, otherwise packages are built locally in a sandbox. Without special privileges, users cannot pass options that would introduce impurities into builds or use untrusted caches.

The nix-shell command starts an interactive shell based on a Nix expression. It allows developers to work with isolated sets of dependencies without affecting the system globally.^[26]

Installed packages are stored in a read-only directory known as the Nix store, commonly located at /nix/store. Packages in the store are identified by a cryptographic hash of all input used for their build. This system is also used to manage configuration files, ensuring that newer configurations do not overwrite older ones.

An implication of these principles is that NixOS does not follow the Filesystem Hierarchy Standard. The only exceptions are that a /bin/sh symlink is created to the version of bash in the Nix store (e.g. /nix/store/s/5rnfzla9kcx4mj5zdc7nlnv8na1najvg-bash-4.3.43/), and while NixOS does have an /etc directory to keep system-wide configuration files, most files in that directory are symlinks to generated files in the Nix store, such as /nix/store/s2sjbl85xnrc18rl4fhn56irkxqxyk4p-sshd_config. By not using global directories such as /bin, Nix allows multiple versions of a package to coexist, avoiding package conflicts sometimes known as "dependency hell".

This also means that AppImage executables cannot be run directly as they expect certain libraries to exist on certain paths.^[28] This can be worked around by running them through an interpreter.^[28]

Nix maintains consistency between the running system and its logical specification by rebuilding packages as needed. When the kernel is modified, external kernel modules are automatically rebuilt. Similarly, updates to libraries trigger rebuilds of all system packages that depend on them, including those with static linking.

The Nix build language used by NixOS specifies how to build all packages from source. This makes it easy to adapt the system to user needs and create new packages. To avoid long and intensive builds from source, the package manager automatically downloads pre-built binaries from a cache server known as a "substituter" when they are available. It is possible to disable substitutions and force building from source by passing --option substitute false to a build. Changing any of the build options from the defaults will also cause packages to be built from source. This gives the flexibility of a source-based package management model, with the efficiency of a binary model.^[29]

An official NixOS wiki was launched in 2011, but was shut down in 2016 due to spam. An unofficial wiki at nixos.wiki was later started by the community to fill in the documentation gap.^[34] On 1 April 2024, the official wiki was revived at wiki.nixos.org, using contents migrated from the unofficial nixos.wiki.^[34][35]

The French government's Interministerial Products Operator (OPI) department of DINUM (Interministerial Directorate for Digital Affairs) is developing Sécurix, a secure, reproducible operating system base built on NixOS.^[36] This is part of a plan to require all French ministries to create a strategy by autumn 2026 to adopt non-American tech for PC operating systems, collaboration tools, antivirus software, artificial intelligence, databases, virtualization, and network equipment.^[37][38][39]

In 2026 the Dutch government also announced plans to make a hardened NixOS distro.^[40]

The American company Anduril Industries is a major user of NixOS; they created the NixOS Security Technical Implementation Guide, developed the now open-sourced jetpack-nixos module, and employ NixOS engineers.^[41][42][43] In September 2023, it was announced that Anduril was joining as a sponsor of NixCon, an annual convention on NixOS. This sparked community controversy and Anduril was removed as a sponsor the following day.^[44] In 2025, Tom Bereknyei – a member of the NixOS Steering Committee – began employment at Anduril, sparking new controversy around transparency, ethics, and conflicts of interest within NixOS governance.^[45]

In April 2024, an open letter to the NixOS community was published, focusing on Eelco Dolstra's leadership.^[46] The letter critiques Dolstra's continued partnership with Anduril, and argues the sponsorship is a symptom of a larger authority problem from Dolstra. The letter contains arguments and allegations on Dolstra's leadership: control over the community, discrimination against marginalized communities, and quality impacts on Nix's development.^[46] The controversy resulted in Dolstra stepping down and an initiative towards community-based governance.^[47][48]