Nix Flakes

Rationale

We use Nix Flakes  to build, develop and distribute software in a fast, secure and reproducible way.

• It allows us to create modular and reproducible packages or environments for any programming language and system architecture.
• It does not do anything else besides providing building blocks for fulfilling the above purpose.
• It provides standard interfaces for declaring inputs and outputs for a given piece of software.
• It embraces pure Nix, meaning that modularity and overall flexibility are greater, but the learning curve is also higher.
• It has first-class-level support implementations for all our current programming languages.
• It supports declarative configurations for language-specific package managers like uv  and npm .
• It does not provide out-of-the-box declarative support for external services.
• It supports fully cryptographically-signed environments  for security and reproducibility.
• It can be easily integrated into Cachix  for performance.
• It provides garbage collection  support for easily cleaning up disk space.
• It supports automatic shell activation via nix-direnv  for development experience.
• It has a big community and excellent support.

Alternatives

Below are alternatives to Nix Flakes considered or used in the past:

Makes

• Makes , developed by Fluid Attacks in 2021, was an entry-level framework designed to help developers new to Nix. It was deprecated in 2025 in favor of Nix Flakes. It is a Nix wrapper for creating reproducible tasks.
• It only provides a way to run tasks on any Linux-based machine, meaning that development environments and modularity are considerably affected.
• It provides standard interfaces for declaring inputs and outputs for a given piece of software.
• Its interfaces are designed to abstract those of Nix, aiming to make the system more accessible and easier to use for developers.
• It requires us to support the programming languages we need, increasing the maintenance burden.
• It supports declarative configurations for language-specific package managers like uv  and npm .
• It requires us to support the external services we need, increasing the maintenance burden.
• It supports fully cryptographically-signed environments  for security and reproducibility.
• It has its own Cachix  integration for performance.
• Although it does not provide garbage collection, Nix’s native one can be used.
• Its shell activation support is pretty limited, considerably affecting the development experience.
• It is maintained solely by us and receives virtually no support beyond what we provide ourselves.

devenv

• devenv  provides a Nix wrapper for creating reproducible environments for any programming language and system architecture.
• It only provides development environments, meaning that reproducibility and modularity are highly affected.
• It does not provide standard interfaces for declaring inputs and outputs for a given piece of software.
• Its interfaces are similar to Makes’s, considerably decreasing its learning curve for us.
• It has out-of-the-box declarative support for all our current programming languages .
• It supports declarative configurations for language-specific package managers like Poetry  and npm .
• It provides out-of-the-box declarative support for a considerable list of services , like DynamoDB, OpenSearch, Nginx, among others.
• It supports fully cryptographically-signed environments  for security and reproducibility.
• It has Cachix support  for performance.
• It provides garbage collection  support for easily cleaning up disk space.
• It supports automatic shell activation  for the development experience.
• Being a Nix wrapper, its community is smaller and support is not as good.

Devbox

• Devbox  provides a Nix wrapper for creating reproducible tasks for any programming language and system architecture.
• It does not do anything else besides providing building blocks for fulfilling the above purpose. It is less flexible compared to Nix Flakes, Makes, and devenv.
• It does not provide standard interfaces for declaring inputs and outputs for a given piece of software.
• Its interfaces try to fully abstract Nix with JSON, making it less flexible but also making it way simpler.
• It has out-of-the-box declarative support for all our current programming languages .
• It supports declarative configurations for language-specific package managers like Poetry  and npm .
• It provides out-of-the-box declarative support for a small list of services , although most of them are currently not relevant to our needs.
• It supports fully cryptographically-signed environments  for security and reproducibility.
• It provides its own cache  for performance. This would increase the learning curve for us, as we already know Cachix.
• It does not provide any information regarding garbage collection.
• It supports automatic shell activation  for the development experience.
• Being a Nix wrapper, its community is smaller and support is not as good.

Flox

• Flox  provides a Nix wrapper for creating reproducible tasks for any programming language and system architecture.
• It does not do anything else besides providing building blocks for fulfilling the above purpose. It is less flexible compared to Nix Flakes, Makes, and devenv.
• It does not provide standard interfaces for declaring inputs and outputs for a given piece of software.
• Its interfaces try to fully abstract Nix with a self-made approach, making it less flexible and increasing its learning curve for us.
• It does not have support for any programming language, forcing users to approach configurations in a procedural way.
• It does not support any language-specific package managers, forcing users to approach configurations in a procedural way.
• It does not provide support for any services, forcing users to approach configurations in a procedural way.
• It does not seem to provide a way for pinning environments, making them unstable.
• It does not support Cachix but instead uses FloxHub , increasing the learning curve for us.
• It does not provide any information regarding garbage collection.
• It does not provide any information regarding automatic shell activation.
• Being a Nix wrapper, its community is smaller and support is not as good.

Usage

We use Nix Flakes to manage and serve all of Fluid Attacks’ software. However, the migration to Nix Flakes is still in progress, so some components may still rely on Makes.

Guidelines

Installation

You only need to install Determinate Nix .

How to use it

You can run components of your choice, for example:

nix run "gitlab:fluidattacks/universe?dir=forces" -- --help
nix run "gitlab:fluidattacks/universe?dir=melts" -- --help
nix run "gitlab:fluidattacks/universe?dir=skims" -- --help

Troubleshooting

• A stable internet connection is required.
• A stable DNS resolver is required. Please consider using the following:
  • IPv4: 1.1.1.1, 8.8.8.8, 8.8.4.4
  • IPv6: 2001:4860:4860::8888, 2001:4860:4860::884
• If the problem persists, please let us know at help@fluidattacks.com