--- title: "Deterministic systems with Nix" url: "https://www.bekk.christmas/post/2021/13/deterministic-systems-with-nix" authors: ["Andreas Mosti"] published: "2021-12-13" updated: "2024-11-07T13:05:28Z" language: "en-US" type: "article" tags: ["Sky"] keywords: ["nix", "configuration", "cloud", "server", "configuration management", "infrastructure as code", "package management"] --- # Deterministic systems with Nix Setting up reliable environments for our software is tricky. The task has kept developers and sysadmins up at night for decades. Making environments and packages _truly_ reproducible and reliable for more than a few weeks before regression sets in, is surely no easy task. In this post, we'll see how we can set up truly deterministic, reproducible and even ephemeral environments with the help of a clever set of tools called Nix, so we can sleep better, knowing our systems can be installed from literary scratch and be guaranteed the same binary packages down to the lowest dependencies. ## In short Nix makes software environments deterministic by building packages from their full dependency graph and storing each result in its own hashed path, so different versions can coexist and rollbacks are easy. It also provides isolated, ephemeral development shells with nix-shell, letting teams share reproducible setups without installing tools system-wide. - **For:** Developers and sysadmins who need reproducible environments - **Good to know beforehand:** Basic familiarity with package managers and shell environments _AI-generated_ ## What's in a name? Let's face it, "Nix" has a quite ambiguous name that can reference a lot of things, so first, let's get the naming out of the way. When people hear "Nix", they might think about "*nix", or the commonly spoken variant (without the asterix) "nix", the short name the industry has adopted for systems based on good old UNIX. Linux is "nix", macOS is "nix", BSD is "nix" - and in a way, "Nix" is also... well, "nix." Confused? Yeah. Nix, in our context, refers to three things: the [Nix Expression Language](https://nixos.wiki/wiki/Nix_Expression_Language), a pure, lazy, functional language. This language makes up the foundational building blocks of the [Nix package manager,](https://nixos.org/guides/how-nix-works.html) which can be installed on any "*nix" system ([like Linux or macOS](https://nixos.org/manual/nix/stable/quick-start.html)) or as it's own unique Linux distro, [NixOS](https://nixos.org/). So a language, a package manager and even a distro. What's this all about? ## What makes Nix so special? With the naming out of the way, what makes Nix so special? What does it have to offer that `apt`, `yum`, or `brew` don't have? First off, it's cross platform. The Nix Package Manager can run on the most common [Linux systems, as well as macOS](https://nixos.org/manual/nix/unstable/installation/supported-platforms.html), but that is true for many package managers these days, and is not it's main advantage. What makes Nix special is how it manages packages and dependencies. Nix guarantees _reproducible_ packages, which means that all steps involved in building a package can be run again and again with the same outcome, and if any of the variables in the dependency chain change (all the way down to low-level packages like `libc`), it will result in a new version of this package, that can be installed side-by-side with the old version. This is possible thanks to the nature of the functional Nix language. From the docs: > Nix is a purely functional package manager. This means that it treats packages like values in purely functional programming languages such as Haskell — they are built by functions that don’t have side-effects, and they never change after they have been built. Nix stores packages in the Nix store, usually the directory `/nix/store`, where each package has its own unique subdirectory such as ```bash /nix/store/b6gvzjyb2pg0kjfwrjmg1vfhh54ad73z-firefox-33.1 ``` where `b6gvzjyb2pg0…` is a unique identifier for the package that captures all its dependencies (it’s a cryptographic hash of the package’s build dependency graph). This enables many powerful features. In more practical terms, this is accomplished by generating hash values of all dependencies going _in_ to the package build, as well as the _outcome_ of the build itself. ## Kicking the tires Let's look at an example package called `hello`. The Nix-script responsible for building the package [can be found in the nixpkgs-github repo](https://github.com/NixOS/nixpkgs) (all packages are essentially built and installed from these scripts) and it looks like this: ```nix { lib, stdenv, fetchurl, testVersion, hello }: stdenv.mkDerivation rec { pname = "hello"; version = "2.10"; src = fetchurl { url = "mirror://gnu/hello/${pname}-${version}.tar.gz"; sha256 = "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl7c9lng89ndq1i"; }; doCheck = true; passthru.tests.version = testVersion { package = hello; }; meta = with lib; { description = "A program that produces a familiar, friendly greeting"; longDescription = '' GNU Hello is a program that prints "Hello, world!" when you run it. It is fully customizable. ''; homepage = "https://www.gnu.org/software/hello/manual/"; changelog = "https://git.savannah.gnu.org/cgit/hello.git/plain/NEWS?h=v${version}"; license = licenses.gpl3Plus; maintainers = [ maintainers.eelco ]; platforms = platforms.all; }; } ``` We begin by installing it to the user's environment: ```bash $ nix-env -iA nixpkgs.hello installing 'hello-2.10' these 16 paths will be fetched (15.41 MiB download, 74.63 MiB unpacked): /nix/store/0rx79a6b2lg3phlr6khkzmc4vinxhvlr-libxml2-2.9.12 /nix/store/3nahqyla1q5qxh7xl93vih9nxpiqq8f4-Libsystem-1238.60.2 /nix/store/5wkw1d6whdcr0dz0b0n212cbbh98xxxz-curl-7.79.1 /nix/store/7372zikynxbpgbqjsgz8w5q3hhvfr25b-brotli-1.0.9-lib /nix/store/7g0bkk8hcljw8z3ka8clnjgq5laga1i0-libkrb5-1.18 /nix/store/c4lldbbc8b7vb6nv2gp8sjvd876ja5qz-hello-2.10 /nix/store/d9n33knjgihd2aafcsw57d3g53072vc7-swift-corefoundation /nix/store/dp6w2v2lk4pkrvyvb50f0d3ci91hr6ls-libcxx-7.1.0 /nix/store/jiwn81413520hd9bsly0pxy66rl14z1i-openssl-1.1.1l /nix/store/kcy5whblh9z38qvmmjxdzmxc5p5xjw35-libssh2-1.10.0 /nix/store/kzcbx33jamrhwn4ipjkvdwzh4hnfkjpw-nghttp2-1.43.0-lib /nix/store/lxx8lma1jiw6i9c8w46nx953cl1p5n5v-bash-5.1-p8 /nix/store/nn4dvvr7m1nvxa0fcadxbw22k14hr9ii-libcxxabi-7.1.0 /nix/store/rbvk36dni1jzygzk0s15sqxm5lmaxbsy-libiconv-50 /nix/store/wcy62ywnzwqiafvx0z7idwhv8mck0xjw-zlib-1.2.11 /nix/store/z3zn8az9akcp3rmndx1wsj8i6v70jahc-ICU-66108 copying path '/nix/store/rbvk36dni1jzygzk0s15sqxm5lmaxbsy-libiconv-50' from 'https://cache.nixos.org'... copying path '/nix/store/3nahqyla1q5qxh7xl93vih9nxpiqq8f4-Libsystem-1238.60.2' from 'https://cache.nixos.org'... ... ... building '/nix/store/p7h7xvb10fhm4pkgsjmcpn38wqg7f1si-user-environment.drv'... $ hello Hello, world! $ which hello /Users/andreasmosti/.nix-profile/bin/hello ``` As we can see, a lot of things was required for a simple program that prints out `Hello, World!`. One might look at this list and think "Hey, i see curl on there - curl is already installed on my machine, why do I need it again, and won't multiple versions of the same package wreck-havoc on my machine?" To address the first comment, this neat little trick is what makes Nix-packages self-contained and immune to what else might be installed on the system. Other package managers, like `apt` or `brew` are often heavily dependent on there existing _one_ version of a package or it's transitive dependency. This is why installing packages on different systems can lead to quite different results, and why a package update can break a system. With Nix, all package dependencies comes bundled and are stored in their own hashed directories. The model Nix follows is that every transitive dependency must be defined in a Nix-expression that can be built itself, thus supplying a dependency chain of "build instructions" all the way to the lowest parts. If one lower-level dependency change, the main package can not be seen as the same exact version as we had before, and will be installed side-by-side with the old version, completely isolated. This nifty feature is why Nix and NixOS has become a favorite among developers and system administrators alike, it makes for highly robust and deterministic systems, easy to update or rollback. To address the concern of multiple versions of `curl`, let's take a look at what we have on our `PATH` after the install of `hello`: ```bash $ which curl /usr/bin/curl ``` `curl` being a transitive dependency for `hello` does not place it on our `PATH`, the version of `curl` provided by macOS is still in place. If we install `curl` as a top level package, the story would be different: ```bash $ nix-env -iA nixpkgs.curl installing 'curl-7.79.1' these 32 paths will be fetched (14.34 MiB download, 73.41 MiB unpacked): /nix/store/19lmg65k8fsdxs41rpgdlzhvlhrk6k1b-compiler-rt-libc-7.1.0 /nix/store/3rgwzinh07qa4l6yf6bjb4f1fv023rim-openssl-1.1.1l /nix/store/78a4mwr6n6jfnjs6k26jbm56xyaarihj-libcxx-7.1.0-dev /nix/store/8a9l7n2772j4aa8b11s9mwgpzr55g04d-brotli-1.0.9-lib /nix/store/8rcy9nq8ykdrhwfhl5jpk0dfjf1q4jlw-nghttp2-1.43.0-dev /nix/store/9dp5jzp1c2vnxqy0wqh4y9xby8n4vp24-openssl-1.1.1l-bin /nix/store/aq5ql1h3r4hh5xwdmdcqiaalhc2nk71h-libidn-1.38-bin /nix/store/az9iq0rjlb9kba41c1gzmj1gj4bsqgi6-perl-5.34.0 /nix/store/b6c5f3gdxyx2ndvifbh2h67z26b5ll0q-libssh2-1.10.0-dev /nix/store/ba0yqafhmv1fhnzzgjxdaswk2y15z0pc-curl-7.79.1-man /nix/store/bgm2pkxvc36hllbbaffvliw0xv0yzbid-curl-7.79.1-dev /nix/store/ckxqa7rk7arxmq1z3h9n41b28ff7rzw9-curl-7.79.1-devdoc /nix/store/cqbxrm62h5an2024vmjdkasd4lnxg9bl-zlib-1.2.11-dev /nix/store/czsaypzy5n5w3c7d4svmn76b2nmfvpyw-libcxxabi-7.1.0-dev /nix/store/ick031g8hhb4d25i1hpm3wi8vxyq95i3-libkrb5-1.18 /nix/store/jdv4wnz9xr74lgx6lh8s61ljmcd83n1y-compiler-rt-libc-7.1.0-dev /nix/store/kbsrwds08ykpc5m2r45z4kf7k5a1dqj7-curl-7.79.1-bin /nix/store/mx38fsqlg9hb2mibc11k4hq48q5l7kzl-libidn-1.38-dev /nix/store/n8g6zmy5499hnxrpp1ihh9qdwb9g4x2f-nghttp2-1.43.0-bin /nix/store/p264vrdmjnlgdlv06bbzsbbnkrmrllcc-brotli-1.0.9-dev /nix/store/pdbs26i4d02r0bcswvgqdc0gscjpz8cx-libev-4.33 /nix/store/pryhfwrz78p7i5dhpsk2cj5kkmdi3rsn-nghttp2-1.43.0-lib /nix/store/pvj3zfwpz9nd7hwykqg59shq29lis0gk-gmp-6.2.1 /nix/store/qxsvvrnkpqvmvqyl13amz6aqk3d0r1rd-libidn-1.38 /nix/store/r0rz0lv1zpmnrrax2c7lhlg5257hln03-nghttp2-1.43.0 /nix/store/rzfpjd14dmpplh8dmxjy8dgm2mb848l9-libssh2-1.10.0 /nix/store/v86hs9nmbi1xi3sybrq222bjs2w07i4n-brotli-1.0.9 /nix/store/vj93j53y8a7f3gcf70zwjbw6k9fzpz6d-openssl-1.1.1l-dev /nix/store/x1sr1lm2y7v07ig6awkpafly9wlg8y9a-libkrb5-1.18-dev /nix/store/x20lc6gld5c6ghlli4lbkixs2nj6scmm-curl-7.79.1 /nix/store/y3xjlzax47f97bcxn4ya7mfdg5fzrac6-coreutils-9.0 /nix/store/yi0kv2nizkz71syk3lggz9xapywbdn49-c-ares-1.17.2 copying path '/nix/store/ckxqa7rk7arxmq1z3h9n41b28ff7rzw9-curl-7.79.1-devdoc' from 'https://cache.nixos.org'... copying path '/nix/store/ba0yqafhmv1fhnzzgjxdaswk2y15z0pc-curl-7.79.1-man' from 'https://cache.nixos.org'... copying path '/nix/store/8a9l7n2772j4aa8b11s9mwgpzr55g04d-brotli-1.0.9-lib' from 'https://cache.nixos.org'... copying path '/nix/store/r0rz0lv1zpmnrrax2c7lhlg5257hln03-nghttp2-1.43.0' from 'https://cache.nixos.org'... building '/nix/store/1ssx63kil8pc8y7hyk804r69ad2jmjdd-user-environment.drv'... $ which curl /Users/andreasmosti/.nix-profile/bin/curl ``` To keep score of what version of a Nix-package is currently being used, Nix takes leverage of symlinks: ```bash $ ls -lha /Users/andreasmosti/.nix-profile/bin/curl lrwxr-xr-x 1 root wheel 68B Jan 1 1970 /Users/andreasmosti/.nix-profile/bin/curl -> /nix/store/kbsrwds08ykpc5m2r45z4kf7k5a1dqj7-curl-7.79.1-bin/bin/curl ``` If we regret installing `curl` via Nix or something broke, Nix keeps track of the users environment in [Generations](https://nixos.wiki/wiki/NixOS#Generations), making it easy to rollback the system: ```bash $ nix-env --list-generations 1 2021-07-01 17:58:51 2 2021-07-01 17:58:51 3 2021-07-16 21:04:08 4 2021-07-17 12:36:25 5 2021-08-03 17:39:55 6 2021-08-04 17:57:09 7 2021-08-12 19:15:17 8 2021-09-21 15:49:39 9 2021-11-02 17:26:36 10 2021-11-11 18:58:31 11 2021-11-21 11:25:39 12 2021-11-21 11:55:53 (current) $ nix-env --rollback switching profile from version 12 to 11 $ which curl /usr/bin/curl ``` ## Creating reproducible development environments with nix-shell Another powerful tool provided with Nix, is `nix-shell`. Software teams have always been struggling with the famous "works on my machine" syndrome, where a build or piece of code works as expected on one machine, but not on another. Creating reproducible development environments has been the holy grail for many, and tools like [Packer](https://www.packer.io/) and [Vagrant](https://www.vagrantup.com/) takes the virtual machine way to solve this, by building VM images that can have tool pre-installed or installed via provisioning systems like [Ansible](https://www.vagrantup.com/docs/provisioning/ansible). Another way to solve this is with containers, typically with [Docker](https://www.docker.com/) and [Docker-Compose](https://docs.docker.com/compose/). Both virtual machines and container technology has pros and cons, but the mayor drawback is that it is quite hard to make truly reproducible environments. Both are great for freezing a setup in time (like a VM image or a container image), but are hardly deterministic. A badly written `Dockerfile` can produce different results when built on two different systems (as a side note, it is possible to build reproducible and small Docker images [with Nix](https://nix.dev/tutorials/building-and-running-docker-images)). `nix-shell` on the other hand leverages the power of Nix to build local, reproducible, isolated and ephemeral shell-environments. Let's say we want `python3` but don't want to install it user/system-wide. It is possible to use `nix-shell` to provide an on-demand shell with just `python3`: ```bash $ python3 -bash: python3: command not found $ nix-shell -p python3 these 51 paths will be fetched (146.56 MiB download, 738.86 MiB unpacked): /nix/store/06ajcknjnwq1ya7ccdczk6yn4h88k0i5-expat-2.4.1 /nix/store/0dy3gpydknrgarpkjjpr3qc32vas6vcp-ed-1.17 /nix/store/19lmg65k8fsdxs41rpgdlzhvlhrk6k1b-compiler-rt-libc-7.1.0 /nix/store/2f3swbj89zzp0bxdahly604wvsqyhada-diffutils-3.8 /nix/store/32d8i33s4k3akmy5ggp8i0s66rw4fd0k-bash-interactive-5.1-p8-man /nix/store/3689xjcapxzzgl6a6z2yncpzdpsp8m1s-readline-8.1p0 /nix/store/3bjy8iv8k6si1bsxxa5f7jy2s97q8da9-clang-7.1.0 /nix/store/3sp84cykwfbyxyyzy5y8dxifgfhs1bx0-cctools-binutils-darwin-949.0.1 /nix/store/3v9c7lnj5zdw5ikdhy67r44f27hiilbp-clang-7.1.0-lib /nix/store/3zigqlizrcpbywcy0pa6sdkbmflqyd5n-findutils-4.8.0 /nix/store/5gd2kl7lglv49njmsa2pgid8j0mqwzzb-gettext-0.21 /nix/store/665s1slgnqyc6rxkyrqq9ancm7vmx05f-sqlite-3.36.0 /nix/store/6ldi4c31d4j1y458hbv357alh57xv2fx-cctools-binutils-darwin-wrapper-949.0.1 /nix/store/78a4mwr6n6jfnjs6k26jbm56xyaarihj-libcxx-7.1.0-dev /nix/store/7c27ywyq9yz8bz928bbfnnprcx479qsi-gzip-1.11 /nix/store/7fpn1fl9q6zxhkcm7475k1r6h8xvihj5-Security-55471.14.18 /nix/store/83zp31wg8wmyhszlhpyrys0cc7hnv4iq-expand-response-params /nix/store/a6r1bhsr4hx4cr3ix6kcfmxf8wvghgpn-ncurses-6.2 /nix/store/a9vm6wmi8c2m0gh6db5dzrs02shwpd0s-bzip2-1.0.6.0.2-bin /nix/store/ar3a52skwci8pjh5hy71ngg1chxq84na-clang-wrapper-7.1.0 /nix/store/b612cgdsbhffrwjvf4l1pbnyhx0y9pa5-bash-interactive-5.1-p8-doc /nix/store/cc6fd463w33g4lj4d86ybcl3pg2c0mr2-adv_cmds-119-locale /nix/store/cq6d0yvkxrpf6in1n4cxrz4dr3gkyw0f-gawk-5.1.0 /nix/store/czll3bc4l4flsd16avv0vdxkkwdmf1cq-bash-interactive-5.1-p8-dev /nix/store/czsaypzy5n5w3c7d4svmn76b2nmfvpyw-libcxxabi-7.1.0-dev /nix/store/d3i7g3k7gm3xid3s86h1cz164jbii7xk-gnused-4.8 /nix/store/djz6rlxc0k4cplcadr6ysk4vy8qxj1nc-pcre-8.44 /nix/store/fljyk8m7l3sccdm7krjclr9xzkw69n0h-bzip2-1.0.6.0.2 /nix/store/g3h44wk74xdnpbmj87636wxyd3yai8ds-bash-interactive-5.1-p8 /nix/store/h568sbrllk8a7ncd3x29yyfydzalbrjs-xz-5.2.5 /nix/store/hzkyp1z5amrp9b01hiim19p1wwyf1hjz-cctools-port-949.0.1 /nix/store/irqmwy7jlgvzxymv1959rcyk5y8wnf43-bash-interactive-5.1-p8-info /nix/store/iz9k0q8gm5qv1d55avfjf1p4w5a9kjp5-xz-5.2.5-bin /nix/store/j9a4xfr6b3wimpc8kinavq4xwn7yazph-llvm-7.1.0 /nix/store/jdv4wnz9xr74lgx6lh8s61ljmcd83n1y-compiler-rt-libc-7.1.0-dev /nix/store/jkwzj2phya5xik7rdgkmn874d3bj95mq-patch-2.7.6 /nix/store/jnqsbvzlapp51xf4wzb7zngrixg77sn5-llvm-7.1.0-lib /nix/store/k56d6jw3f50wiqlgy8aqdpibxxhl7a1m-gnugrep-3.7 /nix/store/ln98nq2nycfhgdx58bgh8vgq9y0n51gb-gnumake-4.3 /nix/store/mpcy3krk88948fgk81nn9x8x629yyvpm-gnutar-1.34 /nix/store/mr5jfv8vxg7nzwsw02pwzm88mkhwnz34-libffi-3.4.2 /nix/store/n5n8xi8f67yqh1mzcyiw95x3iwa8dla0-readline-6.3p08 /nix/store/p69g40lkhfjzjfa0l32d59dafbqxgzcr-gdbm-1.20 /nix/store/pvj3zfwpz9nd7hwykqg59shq29lis0gk-gmp-6.2.1 /nix/store/vq0vhl9bvajq6zjhsg26x4fvw4yxbri2-binutils-2.35.2 /nix/store/vxnbc6hyrafl7ndky87zfnlq5l06z3ra-python3-3.9.6 /nix/store/xpgk15c33cz4dlayh9dmb7waipv0yaz3-tzdata-2021c /nix/store/y3pkfmvjb1xpwrh7ixx4m4l4qnnpz193-stdenv-darwin /nix/store/y3xjlzax47f97bcxn4ya7mfdg5fzrac6-coreutils-9.0 /nix/store/y9c9qs23vm3n7vmv9d278y511d1arhxv-libtapi-1100.0.11 /nix/store/zw8s0isdmyyplgvlis4zb8yngj06al87-configd-453.19 copying path '/nix/store/irqmwy7jlgvzxymv1959rcyk5y8wnf43-bash-interactive-5.1-p8-info' from 'https://cache.nixos.org'... copying path '/nix/store/b612cgdsbhffrwjvf4l1pbnyhx0y9pa5-bash-interactive-5.1-p8-doc' from 'https://cache.nixos.org'... [nix-shell:~/Dev]# which python3 /nix/store/vxnbc6hyrafl7ndky87zfnlq5l06z3ra-python3-3.9.6/bin/python3 $ exit $ which python3 $ ``` When exiting the shell, no version of `python3` is available on path. With the Nix language, it is possible to write declarations for these shells that can be shared among the development team. Let's say the team is maintaining a Java application, deployed on Kubernetes, and want a setup that just works™ on all systems: ```nix # default.nix { pkgs ? import {}, jdk ? "jdk11" }: let # get a normalized set of packages from https://github.com/NixOS/nixpkgs, from which # we will install all the needed dependencies pkgs = import { inherit jdk; }; in pkgs.mkShell { buildInputs = [ pkgs.${jdk} pkgs.gradle pkgs.jq pkgs.kubectl pkgs.kustomize pkgs.terraform_1_0 ]; shellHook = '' export NIX_ENV=dev ''; } ``` This script can be stored in the root of the Java-project and added to version control. When a developer wants the environment, a simple command will provide it: ```bash $ nix-shell these 56 paths will be fetched (524.13 MiB download, 1445.00 MiB unpacked): /nix/store/0dy3gpydknrgarpkjjpr3qc32vas6vcp-ed-1.17 /nix/store/0yg6kywwxzz38hkf1lka7ngm9acvzxz5-jq-1.6-bin /nix/store/19lmg65k8fsdxs41rpgdlzhvlhrk6k1b-compiler-rt-libc-7.1.0 /nix/store/2194b70bqlhndb78d881j4z00zp0y0lc-onig-6.9.7.1 /nix/store/2f3swbj89zzp0bxdahly604wvsqyhada-diffutils-3.8 /nix/store/2pr0yy8zrrnrxynli3fxv64jx69i4n0h-jq-1.6-lib /nix/store/32d8i33s4k3akmy5ggp8i0s66rw4fd0k-bash-interactive-5.1-p8-man /nix/store/3689xjcapxzzgl6a6z2yncpzdpsp8m1s-readline-8.1p0 /nix/store/3bjy8iv8k6si1bsxxa5f7jy2s97q8da9-clang-7.1.0 /nix/store/3sp84cykwfbyxyyzy5y8dxifgfhs1bx0-cctools-binutils-darwin-949.0.1 /nix/store/3v9c7lnj5zdw5ikdhy67r44f27hiilbp-clang-7.1.0-lib /nix/store/3zigqlizrcpbywcy0pa6sdkbmflqyd5n-findutils-4.8.0 /nix/store/6ldi4c31d4j1y458hbv357alh57xv2fx-cctools-binutils-darwin-wrapper-949.0.1 /nix/store/78a4mwr6n6jfnjs6k26jbm56xyaarihj-libcxx-7.1.0-dev /nix/store/7c27ywyq9yz8bz928bbfnnprcx479qsi-gzip-1.11 /nix/store/7x4yr2knrrlar6my79g04ljwlpbabjn6-terraform-1.0.11 /nix/store/83zp31wg8wmyhszlhpyrys0cc7hnv4iq-expand-response-params /nix/store/8pn15rby4h66a3dn9n0zlf5kk5pl638h-gradle-7.3 /nix/store/a6r1bhsr4hx4cr3ix6kcfmxf8wvghgpn-ncurses-6.2 /nix/store/a9vm6wmi8c2m0gh6db5dzrs02shwpd0s-bzip2-1.0.6.0.2-bin /nix/store/ar3a52skwci8pjh5hy71ngg1chxq84na-clang-wrapper-7.1.0 /nix/store/b612cgdsbhffrwjvf4l1pbnyhx0y9pa5-bash-interactive-5.1-p8-doc /nix/store/cc6fd463w33g4lj4d86ybcl3pg2c0mr2-adv_cmds-119-locale /nix/store/cq6d0yvkxrpf6in1n4cxrz4dr3gkyw0f-gawk-5.1.0 /nix/store/czll3bc4l4flsd16avv0vdxkkwdmf1cq-bash-interactive-5.1-p8-dev /nix/store/czsaypzy5n5w3c7d4svmn76b2nmfvpyw-libcxxabi-7.1.0-dev /nix/store/d3i7g3k7gm3xid3s86h1cz164jbii7xk-gnused-4.8 /nix/store/d7ic52z2m72qkkna11yj5x1x6ax3skd8-hook /nix/store/djz6rlxc0k4cplcadr6ysk4vy8qxj1nc-pcre-8.44 /nix/store/dwm8sxbgq4w2v0m42h95wy2y77wnlvcz-iana-etc-20210225 /nix/store/fljyk8m7l3sccdm7krjclr9xzkw69n0h-bzip2-1.0.6.0.2 /nix/store/g3h44wk74xdnpbmj87636wxyd3yai8ds-bash-interactive-5.1-p8 /nix/store/h568sbrllk8a7ncd3x29yyfydzalbrjs-xz-5.2.5 /nix/store/hzkyp1z5amrp9b01hiim19p1wwyf1hjz-cctools-port-949.0.1 /nix/store/irqmwy7jlgvzxymv1959rcyk5y8wnf43-bash-interactive-5.1-p8-info /nix/store/iz9k0q8gm5qv1d55avfjf1p4w5a9kjp5-xz-5.2.5-bin /nix/store/j9a4xfr6b3wimpc8kinavq4xwn7yazph-llvm-7.1.0 /nix/store/jdv4wnz9xr74lgx6lh8s61ljmcd83n1y-compiler-rt-libc-7.1.0-dev /nix/store/jkwzj2phya5xik7rdgkmn874d3bj95mq-patch-2.7.6 /nix/store/jnqsbvzlapp51xf4wzb7zngrixg77sn5-llvm-7.1.0-lib /nix/store/jsk696vh2bl6lb3c564wwcl90g00alyz-kustomize-4.4.0 /nix/store/k56d6jw3f50wiqlgy8aqdpibxxhl7a1m-gnugrep-3.7 /nix/store/kpsh0ij2k1ihn18hd344ld7gk4il8gnw-kubectl-1.22.3 /nix/store/ln98nq2nycfhgdx58bgh8vgq9y0n51gb-gnumake-4.3 /nix/store/mpcy3krk88948fgk81nn9x8x629yyvpm-gnutar-1.34 /nix/store/mr5jfv8vxg7nzwsw02pwzm88mkhwnz34-libffi-3.4.2 /nix/store/pvj3zfwpz9nd7hwykqg59shq29lis0gk-gmp-6.2.1 /nix/store/qd3g8rk5hx5zkb70idjh6fa12sh6bipg-mailcap-2.1.53 /nix/store/vq0vhl9bvajq6zjhsg26x4fvw4yxbri2-binutils-2.35.2 /nix/store/xpgk15c33cz4dlayh9dmb7waipv0yaz3-tzdata-2021c /nix/store/xqjxfi23mwbr77a8va9y06lvfizlbk2r-jq-1.6-dev /nix/store/y3pkfmvjb1xpwrh7ixx4m4l4qnnpz193-stdenv-darwin /nix/store/y3xjlzax47f97bcxn4ya7mfdg5fzrac6-coreutils-9.0 /nix/store/y4vp5qzqz3pd4amjzjmqcql05ad3pvlr-zulu11.48.21-ca-jdk-11.0.11 /nix/store/y9c9qs23vm3n7vmv9d278y511d1arhxv-libtapi-1100.0.11 /nix/store/zjdjssyd1sw8n6xqnm1g9cbh167kvm2l-zulu8.54.0.21-ca-jdk-8.0.292 copying path '/nix/store/b612cgdsbhffrwjvf4l1pbnyhx0y9pa5-bash-interactive-5.1-p8-doc' from 'https://cache.nixos.org'... copying path '/nix/store/irqmwy7jlgvzxymv1959rcyk5y8wnf43-bash-interactive-5.1-p8-info' from 'https://cache.nixos.org'... copying path '/nix/store/32d8i33s4k3akmy5ggp8i0s66rw4fd0k-bash-interactive-5.1-p8-man' from 'https://cache.nixos.org'... copying path '/nix/store/cc6fd463w33g4lj4d86ybcl3pg2c0mr2-adv_cmds-119-locale' from 'https://cache.nixos.org'... copying path '/nix/store/vq0vhl9bvajq6zjhsg26x4fvw4yxbri2-binutils-2.35.2' from 'https://cache.nixos.org'... copying path '/nix/store/fljyk8m7l3sccdm7krjclr9xzkw69n0h-bzip2-1.0.6.0.2' from 'https://cache.nixos.org'... copying path '/nix/store/19lmg65k8fsdxs41rpgdlzhvlhrk6k1b-compiler-rt-libc-7.1.0' from 'https://cache.nixos.org'... [nix-shell:~/Dev]# java --version openjdk 11.0.11 2021-04-20 LTS OpenJDK Runtime Environment Zulu11.48+21-CA (build 11.0.11+9-LTS) OpenJDK 64-Bit Server VM Zulu11.48+21-CA (build 11.0.11+9-LTS, mixed mode) ``` As we can se, the selected packages and dependencies are all installed. To clean up old `nix-shell` sessions, we can simply run ```bash $ nix-collect-garbage ``` It's also possible to build the entire [Java application with Nix](https://fzakaria.com/2020/07/20/packaging-a-maven-application-with-nix.html), leveraging it's deterministic nature to ensure a reproducible build. ## Conclusion This post has been a brief intro to Nix and what at can provide in terms of reproducible, isolated systems. It is possible to do so much more than just install pre-built packages. I would recommend [How Shopify Uses Nix](https://shopify.engineering/shipit-presents-how-shopify-uses-nix) for further inspiration on how to build and deliver software using Nix, as well as checking out the [home-manager](https://github.com/nix-community/home-manager) project for managing user environments. I would also like to recommend Ian Henry's [Learning Nix Guide](https://ianthehenry.com/posts/how-to-learn-nix/). Interested in building your first Nix package? See the excellent [nix-tutorials website](https://nix-tutorial.gitlabpages.inria.fr/nix-tutorial/first-package.html) and start hacking!