> manually handling such containers Well not by hand of course. virtualisation.oci-containers is pretty darn good. Podman+systemd provides some local sandboxin

> manually handling such containers Well not by hand of course. virtualisation.oci-containers is pretty darn good. Podman+systemd provides some local sandboxing. Network-wide firewall prevents odd traffic from happening. > No reproducibility etc Images can be pinned to specific versions providing some reproducibility guarantees. Same goes for configs mounted as volumes. There is also some software (libedgetpu using bazel as a prime example IME) with a complicated build process. Packaging it is a major PITA and the nixpkgs issue[1] is a graveyard of attempts to do so. I just build it using a container and push the binary version to the node with coral tpu. [1]: https://github.com/NixOS/nixpkgs/issues/188719 https://github.com/NixOS/nixpkgs/issues/188719