in the same way that flakes address build-time (and hence, nix project) boundaries, i want to easily control runtime boundaries does a service need to see all

in the same way that flakes address build-time (and hence, nix project) boundaries, i want to easily control runtime boundaries does a service need to see all of the store? no; just its closure. all of /proc? probably not. i would love to stop caring about secrets in the store something as heavyweight as a container just to achieve those restrictions almost feels insulting, and something like pledge(2) approaches the problem from the wrong end. then you take those well-defined boundaries, and you know exactly where you can deploy that service. take advantage of that well-known nix reproducibility, stub out the endpoints, plop it down on your local system, debug it at zero latency, revise it, deploy the fixed version.