What does Nix use for isolation?

[fricklerhandwerk]

It would be great if we got people to stop thinking “package manager” or “build system” when they think “Nix”.

Nix is a tool to force Unix processes to behave (mostly) like pure functions that operate on file system trees. The Nix language allows composing these functions, and also conveniently offers first class support for file system paths and string interpolation.

Market nix not as a package manager but as a build tool and dependency management tool

It takes a bit more time than an elevator pitch, but my introduction so far seemed convincing. Nix does exactly two things: Nail down the contents of files and references between them, such that when you need to move around the entire collection, you always get exactly that, regardless where you place it Run executables in isolation, such that they can only access these nailed-down files, and itself will produce only nailed-down files. The Nix language is just there to orchestrate that, and …

Today’s process isolation when running the builder executable of a derivation is a homegrown sandbox, because Nix pre-dates contemporary commonplace technologies by many years.

If I made Nix today from scratch, I’d build a pluggable interface for isolating the cached execve() and have containers or VMs by default, and would use a string templating language extension for Haskell instead of inventing a new language.