nix-installer

t in /nix/store. (The only exception is a symlink /bin/sh to Bash in the Nix store.) Not using ‘global’ directories such as /bin is what allows multiple versions of a package to coexist. Nix does have a /etc to keep system-wide configuration files, but most files in that directory are symlinks to generated files in /nix/store. But which files should be assigned which extended filesystem attribute labels; signed packages only, local builds of [GPU drivers, out-of-tree modules,], not-yet-packaged things like ProtonGE; I remembered hearing that Bazzite ships with Nix. This [1] describes installing with the nix-determinate-installer [2] and then [3] installing home-manager : nix run nixpkgs#home-manager -- switch --flake nix/#$USER [1] https://universal-blue.discourse.group/t/issue-installing-ce... [2] https://github.com/DeterminateSystems/nix-installer [3] https://nixos.wiki/wiki/Home_Manager Working with rpm-ostree; upgrading the layered firefox RPM without a reboot requires -A/--apply-live (which runs twice) and upgrading the firefox flatpak doesn't require a reboot, but SELinux policies don't apply to flatpaks which run unconfined FWIU. "SEC: Flatpak Chrome, Chromium, and Firefox run without SELinux confinement?" https://discussion.fedoraproject.org/t/sec-flatpak-chrome-ch... From https://news.ycombinator.com/item?id=43564972 : > Flatpaks bypass selinux and apparmor policies and run unconfined (on DAC but not MAC systems) because the path to the executable in the flatpaks differs from the system policy for /s?bin/* and so wouldn't be relabeled with the necessary extended filesystem attributes even on `restorecon /` (which runs on reboot if /.autorelabel exists).* Having written a venv_relabel.sh script to copy selinux labels from /etc onto $VIRTUAL_ENV/etc , IDK; consistently-built packages are signed and maintained. The relevant commands from that script: https://github.com/westurner/dotfiles/blob/develop/scripts/v... : sudo semanage fcontext --modify -e "${_equalpth}" "${_path}"; sudo restorecon -Rv "${_path}"; Is something like this necessary for every /nix/store/<key> directory? sudo semanage fcontext --modify -e "/etc" "${VIRTUAL_ENV}/etc"; sudo restorecon -Rv "${VIRTUAL_ENV}/etc"; Or is there a better way to support chroots with selinux with or without extending the existing SELinux functionality?

nate.systems, the upstream is similarly facepalm: https://nixos.org/manual/nix/stable/installation/installing-... )

nd in Nixpkgs, command for installing 0.9 from that PR branch after using the above Nix installer is nix profile install github:GaetanLePage/nixpkgs/neovim#neovim which will build from source against that PR branch. Nix can be a great complement to a stable, conventional base system like Debian for use cases like this. I hope you give it a try!

doesn't build or cache non-free derivations as a legal precaution. For grabbing things like iTerm or whatever, you might prefer using Homebrew in a limited way ('casks' only) with a non-standard prefix. This is what I have done and recommend doing. (That said, macOS GUI apps do exist in Nixpkgs and they build just fine, so if you want you can still use Nix for your iTerm and your custom Emacs build and whatever.) Now the good parts: Package availability on macOS is still great. Nix feels really fast compared to Homebrew! There's a new, alternative Nix installer available from a credible company in the Nix community that seems to cope a bit better with macOS' integration quirks, making uninstalling and reinstalling a bit easier: https://github.com/DeterminateSystems/nix-installer If you like NixOS' declarative style and service/configuration management capabilities, there's an awesome module system that lets you get a very similar experience on macOS: https://daiderd.com/nix-darwin/ The ugly(?): The default build environment for packages on macOS uses a completely different toolchain than Nix uses on Linux. LLVM instead of GCC, libsystem instead of glibc. This is appropriate and generally invisible, but you may notice it and think about it when writing your own packages or something like that. Nix builds and the environment in general are a bit less 'pure' on macOS. Some of that is part of what I just mentioned above. Another aspect is that Nix builds are not sandboxed on macOS. I hope that helps! Overall, if you like NixOS, I think you will find lots to like about Nix on Mac. :)