Containers allow running software that does not have a nix package available and one could not be bothered to write. My lab is fully on NixOS, but a couple of services are happily chugging along as containers in podman.
So you prefer manually handling such containers, that you probably do not really know enough, perhaps even for serious usage, instead of writing a derivation? No reproducibility etc
For quick testing something, nothing to say, but for real, albeit personal homelab, usage...
Well not by hand of course. virtualisation.oci-containers is pretty darn good. Podman+systemd provides some local sandboxing. Network-wide firewall prevents odd traffic from happening.
> No reproducibility etc
Images can be pinned to specific versions providing some reproducibility guarantees. Same goes for configs mounted as volumes.
There is also some software (libedgetpu using bazel as a prime example IME) with a complicated build process. Packaging it is a major PITA and the nixpkgs issue[1] is a graveyard of attempts to do so. I just build it using a container and push the binary version to the node with coral tpu.
An escape hatch like that can be really nice for trying software out on a temporary basis, before you know if you care about it enough to write a package and a service module.
Given time limitations, I can imagine living with some applications like that for quite some time, their packaging sitting at the bottom of a long todo list. :)
Now dream, it's a dream, but perfectly feasible technically, where most devs have found and understood the NixOS/Guix System way to develop and manage whole deploy. We would have various distro with different configuration languages like Nix and Guix, and some less diverse, since all devs simply "package", meaning describing, their code in their own distro how hard could be port the derivation/description?
Try also compute how hw requirement for whole infra plunge thanks to an immense overhead avoided on scale. The sole unhappy? Those who sell services, because for that they do need containers. This would push another evolution: built-in easy to tune isolation from a config, so they can sell instead of a VPS a system where you upload just your config, they import it, producing an isolated FHS for you, something we already have (i.e. FHSUserEnv) but with tunable system isolation. You would get your VPS, configured with just few SLoC instead of manually/in wrapped ways via SSH, and they can sell much more on the same iron, with much better performances as well.
All of the above is perfectly possible TODAY, it's only a matter of mass knowledge or lack thereof.
