it makes so much sense. a small team of experts maintaining a rock-solid base configuration providing the essentials, which can then be built on top of for agency/department or even personal specifics - all declarative, immutable, cachable, testable. I can't think of a better tool for the job.

As a downside, any change to software, version updates, keeping things secure now depends on the team is experts. Most are easy, some are hard (e.g. new software now requires a new Swift version - one person motivated enough to do that project has been pushing it for months), some are annoying (patch to libc means you're re-downloading your whole system).

As a positive thing, maybe at least nixos will get a serious security pipeline rather than the current best-effort community approach.

buildroot