Honestly I think you need to divide "Nix" up into two:[1] a language interpreter and the build system/sandbox. First nix interprets the expressions. It does tha

Honestly I think you need to divide "Nix" up into two:[1] a language interpreter and the build system/sandbox. First nix interprets the expressions. It does that in your local context - so that, if it's configured to, it might read your .aws/credentials file to get access to resources stored in your S3 bucket. Once it's established what it needs to build, then the build system takes over and sets up a sandbox and runs bash scripts and other commands to produce output. I had conflated the two for some time and it caused my a variety of confusions that are resolved by observing the distinction. (Also, I tend to think it's better to view NixOS as a tool for producing a linux distribution, which in many cases just happens to have an installbase of 1 - but that's not necessarily the case, and you could build your images with NixOS and deploy a dozen of them to aws.) [1]: this was meant to be a joke, but it occurs to me that a person might think I missed that they had divided "Nix" up into two, the buildsystem and the language. But a language is not a command and doesn't do anything, so it can't possibly be an interpreter as well - and there could be and to some degree is multiple nix interpreters. So it is the first of the divisions of Nix that I sliced in two, and you end up with three Nixes: the buildsystem/sandbox; the main language interpreter; and the language.