NixOS treats your server as a rebuildable text file — no drift, no surprises

On November 30, 2025, NixOS shipped release 25.11 — codenamed « Xantusia ». The project counted 2,857 contributors on the previous cycle and crossed the 100,000-package mark inside nixpkgs, the largest package repository in the Linux ecosystem. Repology ranks it first not only in total packages but also in package freshness. By April 2026, the distribution is six months into its stable release cycle, and the message it has been hammering on for years is finally landing in production teams: a Linux server can be a 200-line text file, rebuildable identically on any machine, and it never drifts.

NixOS isn’t just another Linux distribution

There’s a temptation to treat NixOS as yet another Debian or Arch derivative. It’s not. It’s a Linux distribution built from the ground up around the Nix package manager, a purely functional package manager designed by Eelco Dolstra during his PhD at Utrecht University in 2006. The core idea is simple: every package lives under /nix/store/ with a cryptographic hash that encodes its entire build dependency graph — compiler version, build flags, linked libraries. Two packages can never conflict because they never share the same path.

The operating system itself is described in a single /etc/nixos/configuration.nix file (or a flake.nix, now that flakes were stabilized in Nix 2.24, November 2024). That file declares the complete desired state: installed packages, running services, user accounts, firewall rules, containers, VMs, systemd unit configurations. A single command applies the state:

nixos-rebuild switch

This command doesn’t « update » the system in the traditional sense. It builds a new generation, appends it to the bootloader menu, and switches to it atomically. The previous generation stays intact. If anything breaks, rebooting into the previous generation restores the server to its prior state in under 30 seconds — no recovery disk, no SSH rescue, no cold sweat.

The store: why your server never drifts

To understand NixOS, you have to understand /nix/store/. Every package lands there under a path like:

/nix/store/v5pzi9x8wj6h1lzr3p0k7d4nq2by9amc-nginx-1.28.0/

The prefix hash encodes every input that produced the binary: source code, patches, compilation flags, dependencies, and even the compiler version. Change a single input, the hash changes, and the package is rebuilt in a fresh path. The old one remains untouched.

This has three direct operational consequences:

• No dependency hell. Two applications can require two different OpenSSL versions without the operator juggling /usr/local hacks or throwaway containers. The store keeps them side by side and the loader resolves the right one at runtime.
• Atomic upgrades. nixos-rebuild switch never overwrites a running binary. It builds the new generation alongside, then swaps. If the service crashes after the swap, the rollback is immediate — no lost SSH sessions from a botched apt upgrade.
• Full reproducibility. The same configuration.nix (or flake.lock) produces bit-for-bit identical binaries on two different machines. No « works on my machine », no configuration drift between staging and production.

The catalog: 100,000 packages and the freshest on the planet

Nixpkgs is the shared package repository for NixOS and the standalone Nix package manager (usable on macOS, WSL, and any Linux distribution). As of November 30, 2025, nixpkgs stats for the 25.11 cycle:

• 7,002 new packages added
• 25,252 existing packages updated
• 6,338 outdated packages removed
• 107 new NixOS modules and 1,778 new configuration options

These numbers aren’t vanity metrics. They reflect a maintenance cadence that only Arch Linux approaches in the Linux world — but nixpkgs covers roughly four times as many packages as the AUR. Repology consistently places it at the top for both total package count and percentage of up-to-date packages.

The default kernel is Linux 6.17 (6.12 LTS remains available as an option). GNOME 49 ships without an X11 session — a deliberate choice that signals the project’s willingness to break backwards compatibility when the migration path is documented. LLVM 21 and GCC 14 are available side by side, making NixOS a strong platform for developers compiling modern Rust, Go, or C++.

Flakes and Home Manager: the modern NixOS stack

Since 2025, the Nix ecosystem has coalesced around two components that change the game for teams.

Flakes (stabilized in Nix 2.24, November 2024) replace the traditional configuration.nix with a format that locks input versions — think Cargo.lock or package-lock.json, but for an entire operating system. A flake.nix declares inputs (a pinned nixpkgs revision, a home-manager repository, an internal tool) and outputs (NixOS configurations, packages, project templates). The flake.lock pins every input to an exact commit. Result: two engineers sharing the same Git repository build the exact same OS, down to the last byte.

Home Manager applies the same declarative principle at the user level: shell, editor, GTK theme, GNOME extensions, dotfiles — all in ~/.config/home-manager/home.nix. Combined with a flake.nix, it provisions a complete development machine in one command:

nixos-rebuild switch --flake .#my-server

For teams, the value isn’t just reproducibility — it’s rebuild speed. A server that catches fire is rebuilt in 20 minutes (compile time included) on a fresh VPS, with no manual inventory, no Ansible playbook failing at step 7 because the Ubuntu mirror dropped the exact libssl version you needed.

NixOS vs. Ansible vs. Docker: a comparison that reshuffles responsibilities

The table below compares the three approaches on criteria that matter in production — not on first-day developer ergonomics.

Ansible applies convergence: it compares the current state to the desired state and runs tasks to bridge the gap. If a task fails silently — a corrupted file, a partially installed package — the gap remains without the operator knowing. NixOS doesn’t compare anything: it rebuilds the state from scratch and swaps the old one out. The difference is philosophical, but it’s measured in 3 a.m. pages.

Docker solves reproducibility at the application layer, not the host layer. You can deploy an immutable image on a host that has been drifting for six months — the two layers coexist without anyone knowing exactly what’s running underneath. NixOS pushes the immutability guarantee up to the OS level: no forgotten apt upgrade, no rogue pip install lurking in /usr/local, no difference between the staging box and production.

The operational truth: NixOS isn’t a direct replacement for Ansible or Docker. It combines with both — NixOS as the base OS, Docker for containerized workloads, and Ansible reduced to a thin ansible-playbook -i inventory deploy.yml that does nothing but trigger nixos-rebuild on targets. In this architecture, Ansible no longer manages configuration — it just fires the declarative rebuild remotely.

What NixOS actually costs you

The entry price isn’t in dollars. It’s paid in learning time.

The Nix language is a pure, lazy functional language with a syntax that looks like JSON but isn’t. Writing a simple derivation requires understanding fixed points, overlays, and the difference between callPackage and import. The official documentation is comprehensive but not pedagogical — the community fills the gap with resources like nix.dev, Zero to Nix (Determinate Systems), and the NixOS Wiki. In June 2026, Determinate Systems added a seven-day cooldown on new nixpkgs submissions after an AUR malware incident highlighted supply-chain risks across package ecosystems — a move that signals the project’s maturing security posture.

For an engineer who already knows Ansible and Docker, the productivity threshold sits around two weeks of full-time work. After that, configuring a new service follows a repeatable pattern:

services.nginx = {
  enable = true;
  recommendedProxySettings = true;
  virtualHosts."myapp.example.com" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://127.0.0.1:3000";
    };
  };
};

This 10-line block replaces a 60-line nginx configuration file, a 30-line Ansible playbook for Let’s Encrypt certificate installation, and a cron job for automatic renewal. NixOS bundles all of that natively in the services.nginx module.

The hidden price is abstraction debt: when a service lacks an official NixOS module, the operator must write a custom derivation or enable the service through systemd.services.<name> in imperative mode — forfeiting part of the declarative benefit. Fortunately, the 1,778 options added in 25.11 cover the bulk of production services (PostgreSQL, Redis, Caddy, Nginx, Prometheus, Grafana, Tailscale, WireGuard…), and the community maintains a steady module expansion cadence.

Verdict: at three servers, NixOS pays for itself

NixOS is not cost-effective for a single VPS. For a lone server, Debian + Docker Compose + a monthly apt upgrade are sufficient, and the Nix learning curve will never amortize.

At three servers, the equation flips. Bit-for-bit reproducibility eliminates configuration drift across environments. Atomic rollback turns risky upgrades into operations reversible in 30 seconds. And declarative configuration centralized in a Git repository turns git push into the new ssh server && vim /etc/nginx/nginx.conf.

If your fleet exceeds ten machines, the question isn’t whether NixOS is worth the investment — it’s how much longer you want to spend manually patching configuration drift. Ansible and Docker don’t disappear, but their roles shift: Ansible becomes a thin nixos-rebuild launcher, and Docker remains the runtime for applications without a native module. NixOS takes the layer neither has ever properly occupied: the zero layer, the one that guarantees every server in your fleet runs exactly the same thing.

References

• NixOS 25.11 Release Announcement — NixOS Foundation, November 30, 2025
• NixOS 25.05 Release Announcement — NixOS Foundation, May 23, 2025
• Repology — Repository Statistics — accessed April 2026
• NixOS Wiki — Flakes — accessed April 2026
• Home Manager Manual — Nix Community, accessed April 2026
• Phoronix, « NixOS 25.11 Released With 7,002 New Packages Added » — November 30, 2025
• Linuxiac, « NixOS 25.11 Ships with GNOME 49, Linux Kernel 6.17 » — November 30, 2025
• Linuxiac, « Determinate Nix Adds Seven-Day Nixpkgs Cooldown After AUR Malware Scare » — June 16, 2026