Yes. With docker you may as well forget about updating anything ever, you really don't know whats in there. Some insecure openssl/nginx versions? Who knows! Can

Yes. With docker you may as well forget about updating anything ever, you really don't know whats in there. Some insecure openssl/nginx versions? Who knows! Can't just update them. The real issue with nix is amount of building that needs to take place. If you go to update openssl, everything dependent on it also needs to be rebuilt to get the latest. The difference in comparison to say static linking or docker though is that its easy to automate. Hydra is proof. It's also easy to continue to use shared libraries, sharing the storage and memory burden. This is unlike docker or everything using static linking. Having a few threadrippers laying around to do all that building might be useful.