NixOS

Compliance audits are painful. Anyone who’s been through ISO 27001 certification knows the drill: weeks of documentation gathering, screenshots of configurations, evidence of change management processes, proof that what you say you do is what you actually do. But here’s something I’ve realized after running declarative infrastructure for years: systems like Talos and NixOS don’t just make infrastructure better — they make compliance dramatically easier. The same properties that make these systems reliable (immutability, reproducibility, auditability) are exactly what auditors want to see. ...

People often think you need VMware, Hyper-V, or at minimum Proxmox to run a “real” hypervisor. Something with a web UI, enterprise features, the whole package. But here’s the thing: KVM with libvirt can do virtually everything those commercial hypervisors do. Live migration, memory ballooning, CPU pinning, GPU passthrough, SR-IOV, nested virtualization — it’s all there. The Linux kernel has been a production-grade hypervisor for over a decade. I run NixOS as my hypervisor. No Proxmox, no web UI, just declarative Nix configs and virsh. Let me show you what’s possible. ...

I’ve written about Talos Linux as the immutable Kubernetes OS, and I’ve compared Arch vs NixOS for workstations. But there’s a question I get asked often: what about NixOS for Kubernetes nodes? Both NixOS and Talos are declarative. Both can be immutable. Both version their configuration. So why would you choose one over the other for running Kubernetes? I’ve run both in production. Here’s what I’ve learned. The Philosophical Difference Before diving into specifics, understand the core difference: ...

I’ve run both Arch and NixOS as my daily driver workstation. Not in VMs, not as a weekend experiment — as my actual work machine where I do professional DevOps/platform engineering work, and as my personal machine where I do everything else. Both are excellent. Both have serious trade-offs. And the “best” choice depends heavily on your life situation and how much time you have for system maintenance. Here’s the thing: I have kids now. The days of spending a Saturday afternoon debugging a broken Xorg config are gone. My system needs to work, reliably, every time I open the laptop. But I’ve also learned that Arch’s “instability” is largely a skill issue — with the right practices, Arch can be just as reliable as NixOS. ...