Nix Flakes

Last updated: Oct 28, 2026

Rationale

Fluid Attacks uses Nix Flakes to build, develop, and distribute software in a fast, secure, and reproducible way.

• It lets Fluid Attacks make modular and reproducible packages or environments for any programming language and system architecture.
• It gives only the building blocks for this purpose.
• It gives standard interfaces to declare the inputs and outputs of a piece of software.
• It uses pure Nix. Thus, modularity and flexibility are better, but it is also harder to learn.
• It has first-class support implementations for all the programming languages that Fluid Attacks uses at this time.
• It supports declarative configurations for language-specific package managers, for example, uv and npm.
• It does not give declarative support for external services by default.
• It supports fully cryptographically-signed environments for security and reproducibility.
• You can easily integrate it with Cachix for performance.
• It supports garbage collection, which makes it easy to release disk space.
• It supports automatic shell activation with nix-direnv for the development experience.
• It has a large community and very good support.

Alternatives

These are alternatives to Nix Flakes that Fluid Attacks examined or used before:

Makes

• Fluid Attacks developed Makes in 2021. It was an entry-level framework to help developers who were new to Nix. Fluid Attacks deprecated it in 2025 and replaced it with Nix Flakes. It is a Nix wrapper to make reproducible tasks.
• It only gives a method to run tasks on Linux-based machines. Thus, it has a bad effect on development environments and modularity.
• It gives standard interfaces to declare the inputs and outputs of a piece of software.
• Its interfaces hide the interfaces of Nix, to make the system easier to use for developers.
• Fluid Attacks must add support for each programming language that it uses. This increases the maintenance work.
• It supports declarative configurations for language-specific package managers, for example, uv and npm.
• Fluid Attacks must add support for each external service that it uses. This increases the maintenance work.
• It supports fully cryptographically-signed environments for security and reproducibility.
• It has its own Cachix integration for performance.
• It does not have garbage collection, but you can use the garbage collection of Nix.
• Its shell activation support is very small. This has a bad effect on the development experience.
• Only Fluid Attacks maintains it, and it gets almost no support from other sources.

devenv

• devenv gives a Nix wrapper to make reproducible environments for any programming language and system architecture.
• It only gives development environments. Thus, it has a very bad effect on reproducibility and modularity.
• It does not give standard interfaces to declare the inputs and outputs of a piece of software.
• Its interfaces are similar to the interfaces of Makes. Thus, it is much easier for Fluid Attacks to learn.
• It has declarative support by default for all the programming languages that Fluid Attacks uses at this time.
• It supports declarative configurations for language-specific package managers, for example, Poetry and npm.
• It has declarative support by default for a large list of services, for example, DynamoDB, OpenSearch, and Nginx.
• It supports fully cryptographically-signed environments for security and reproducibility.
• It has Cachix support for performance.
• It supports garbage collection, which makes it easy to release disk space.
• It supports automatic shell activation for the development experience.
• Because it is a Nix wrapper, its community is smaller and its support is not as good.

Devbox

• Devbox gives a Nix wrapper to make reproducible tasks for any programming language and system architecture.
• It gives only the building blocks for this purpose. It is less flexible than Nix Flakes, Makes, and devenv.
• It does not give standard interfaces to declare the inputs and outputs of a piece of software.
• Its interfaces try to hide Nix fully with JSON. Thus, it is less flexible, but it is much simpler.
• It has declarative support by default for all the programming languages that Fluid Attacks uses at this time.
• It supports declarative configurations for language-specific package managers, for example, Poetry and npm.
• It has declarative support by default for a small list of services, but most of them are not necessary for Fluid Attacks at this time.
• It supports fully cryptographically-signed environments for security and reproducibility.
• It has its own cache for performance. Fluid Attacks already knows Cachix. Thus, this cache would make Devbox harder to learn.
• It does not give information about garbage collection.
• It supports automatic shell activation for the development experience.
• Because it is a Nix wrapper, its community is smaller and its support is not as good.

Flox

• Flox gives a Nix wrapper to make reproducible tasks for any programming language and system architecture.
• It gives only the building blocks for this purpose. It is less flexible than Nix Flakes, Makes, and devenv.
• It does not give standard interfaces to declare the inputs and outputs of a piece of software.
• Its interfaces try to hide Nix fully with a custom approach. Thus, it is less flexible and harder for Fluid Attacks to learn.
• It does not support programming languages. Thus, users must write configurations in a procedural way.
• It does not support language-specific package managers. Thus, users must write configurations in a procedural way.
• It does not support services. Thus, users must write configurations in a procedural way.
• It does not seem to give a method to pin environments. Thus, the environments are not stable.
• It does not support Cachix. It uses FloxHub, which makes it harder for Fluid Attacks to learn.
• It does not give information about garbage collection.
• It does not give information about automatic shell activation.
• Because it is a Nix wrapper, its community is smaller and its support is not as good.

Usage

Fluid Attacks uses Nix Flakes to manage and serve all its software.

Guidelines

Installation

You only have to install Determinate Nix.

How to use it

You can run the components that you select. For example:

nix run "gitlab:fluidattacks/universe?dir=forces" -- --help
nix run "gitlab:fluidattacks/universe?dir=melts" -- --help
nix run "gitlab:fluidattacks/universe?dir=skims" -- --help

Troubleshooting

• You must have a stable internet connection.
• You must have a stable DNS resolver. Fluid Attacks recommends one of these resolvers:
  • IPv4: 1.1.1.1, 8.8.8.8, 8.8.4.4
  • IPv6: 2001:4860:4860::8888, 2001:4860:4860::884
• If the problem continues, send a message to [email protected]