Yes but NixOS does all of these things already, without the process overhead

Even the minimal SBOM part? It's hard to be more minimal than a busybox binary.

	▲	amusingimpala75 4 hours ago \| parent [-]
		That’s fair, NixOS avoids the direct stuff from Docker itself but if you’re basing on an Alpine image or something that would probably be more minimal / smaller