[shatsky]

Another opinion: immutability is required to guarantee software integrity, but there is no need to make whole system or "apps" immutable units. NixOS also consists of "immutable units", but its "granularity" is similar to packages of traditional Linux distros, each unit (Nix store item) representing single program, library or config file. This provides a better tradeoff, allowing to change system relatively easily (much easier than in immutable distros described here, and in many cases as easy as in traditional Linux distros) while having advantages of immutability.

[UltraSane]

Immutable distros are a good fit for very mature Infrastructure as Code setups. They make drift from the original config impossible.

[shatsky]

>make drift from the original config impossible

NixOS makes that too, its whole "system output path closure" is as immutable as every single store unit within it. But NixOS "reuses" units which are unaffected by NixOS config changes when applying new config, making its "system rebuild" super fast and light on resources when something like a single config file is changed in NixOS config. And possible to be done "in place", unlike with "conventional immutable distro"

[packetlost]

IME you don't need a mature IaC setup to have it work well, especially if you've bought into containerization

[toprerules]

You don’t understand what immutable distros are for. Imagine you need to upgrade 500k machines and your options are either run an agent that has to make the same changes 500k times and hopefully converges onto the same working state no matter the previous state of the machines its running on, or you pull a well tested image that can be immediately rolled back to the previous image if something goes wrong.

Saying it’s just about integrity is like saying docker images are just about integrity… they absolutely are not. They give you atomic units of deployment, the ability to run the same thing in prod as you do in dev. Many other benifits.

[shatsky]

>hopefully converges onto the same working state >Saying it’s just about integrity is like saying docker images are just about integrity >atomic units of deployment, the ability to run the same thing in prod as you do in dev

In my understanding, integrity is exactly about software being in certain known correct state, including absence of anything which is not part of that state. Of course integrity of parts of software system like individual packages contents does not make it really reliable when the whole system does not have it. NixOS has it and also allows to "run the same thing"

[IshKebab]

> and hopefully converges onto the same working state no matter the previous state of the machines its running on

Isn't that exactly the point of NixOS?

[bezier-curve]

Is immutability's benefits not the "integrity" of a system? This seems pedantic.