Containix – Run Nix flakes as Kubernetes pods without images

Name: Containix – Run Nix flakes as Kubernetes pods without images
Availability: InStock
Author: atmask

by atmask·Jul 12, 2026·2 points·0 comments

Visit Project View on HN

AI Analysis

●●●BangerBig BrainZero to OneSolve My Problem

Replaces Dockerfiles and registries with a single pod annotation.

Strengths

•Bypasses the entire OCI image lifecycle—no build, push, or pull steps.
•Uses existing Nix binary caches (Cachix, S3) instead of container registries.
•Eliminates 'works in CI, fails in prod' by running the exact tested closure.

Weaknesses

•Requires Nix installed on every cluster node, adding operational complexity.
•Early stage with API instability; currently requires pinning commits.

Post Description

Containix is a containerd shim that runs Nix flakes directly as Kubernetes pods. When using containix you can reference a flake in a pod annotation (`containix.dev/flake: <flake ref>`) instead of building, pushing, and pulling an OCI image.

CRI still depends on the presence of a valid image so a small <1KB image is provided (`ghcr.io/atmask/containix-empty`) for compatibility but is ignored.

Containix bypasses the usual image process of building, pushing, and pulling entirely — the shim resolves the flake, fetches the closure from your binary cache, mounts the Nix store paths as the container's rootfs, and hands off to runc.

There is still some work I would like to do on the project to improve quality of life around running it and ensuring nodes have nix installed (e.g. daemonset installation, operator) but in the meantime I'd love feedback.

Repo: https://github.com/atmask/containix Kubernetes guide: https://github.com/atmask/containix/blob/main/docs/kubernete...