The cases that you're raising are all ones that the nix ecosystem has had to find solutions for, but they have generally done so. The first thing to note is th

The cases that you're raising are all ones that the nix ecosystem has had to find solutions for, but they have generally done so. The first thing to note is that it's generally discouraged to use full paths like the one you gave for python in shebangs in loose scripts. Instead, it is encouraged to write e.g. /usr/bin/env python. In this case, the python from the current environment will be picked up "impurely" when the script is run. That said, it's pretty heavily encouraged to package anything that will be used seriously, since this is very easy with nix and gives access to better tools. For example, there is built in automation for recognizing shell shebangs and rewriting them, based on the dependencies expressed in the build description. As far as your case of programs shelling out to other programs: that can either happen "impurely" (which would work like that you describe, including the potential drawbacks) or "purely" (where a specific version is captured). In order to attain "purity", nix has automation for generating wrapper scripts which manipulate the PATH before delegating to some underlying executable.