For me, isolating the breakage of one service from another is a strong motivation to run containers and virtual machines. Upgrade some, let all others remain unaffected.
MicroVM.nix ships its own tooling for updating your independent NixOS systems: the microvm command. All that it is doing consists of maintaining the source flakeref in /var/lib/microvms/*/flake so that updates can be built from somewhere, and then creating the /var/lib/microvms/*/current symlink to the config.microvm.declaredRunner. Are these internals already, or should I start documenting them?
At c3d2.de we just switched from Proxmox to a setup that consists of MicroVMs on NixOS. It is very pleasing to see my cheap but NixOS-native “virtualization solution” arriving at more deployments. I really wished for this setup to become much more convenient than what we had before.
Both Initial deployment and updates from your local working state of this infrastructure’s flake are conducted with a nix run .#microvm-update-$hostname that will run something that looks like this:
nix copy --to ssh://root@${server} ${self}
ssh root@${server} -- bash -e<<EOF
mkdir -p /var/lib/microvms/${name}
cd /var/lib/microvms/${name}
nix build -L -o current \
${self}#nixosConfigurations.${name}.config.microvm.declaredRunner
echo 'git+https://gitea.c3d2.de/c3d2/nix-config?ref=flake-update' > flake
systemctl restart microvm@${name}.service
EOF
First, we copy the current flake to the server so that it can build from it, which is then done via ssh. Afterwards, the flake file is written so that microvm -u later works, and finally the new or updated MicroVM is restarted. I simplified a bit. The MicroVM can also be built locally or with a remote builder. The service shouldn’t be restarted if there was no change to the current symlink. There is not only plenty of room but really an open space to design these workflows to your own preferences and work style.
To prepare all updates from stable NixOS for our infrastructure, we’ve got a systemd.timer that runs nix flake update --commit-lock-file and pushes to that flake-update branch which is then prebuilt by our local Hydra, saving us a lot of time once we run microvm -u. We can even fetch JSON from the Hydra API to obtain the resulting store path which we can then just nix copy onto target server so that /var/lib/microvms/*/current can get updated, relieving you of that extra Nix evaluation. If you made ssh a requirement for your MicroVMs and also ran with a /nix/store mounted from the host, you could even switch to the new system without rebooting the MicroVM.
The included microvm tool still works:
(stderr omitted for two lines of embarassing warnings.)
Composing infrastructure with NixOS is fun!
Comments
August 30, 2025 14:49
asdaf
소액결제현금화 현금화란 휴대폰 소액결제(통신사 결제)로 구매한 상품권이나 유료 콘텐츠(정보이용료)를 다른 사람이나 업체에 판매하여 현금으로 교환하는 과정을 의미합니다
September 29, 2025 11:32
<a href="https://riversafe.biz/">breathable workwear for hot climates</a>
I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful. Good day!
September 29, 2025 11:34
<a href="https://riversafe.biz/">breathable workwear for hot climates</a>
I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful. Good day!
September 29, 2025 11:36
<a href="https://riversafe.biz/">breathable workwear for hot climates</a>
I really appreciate the kind of topics you post here. Thanks for sharing us a great information that is actually helpful. Good day!
October 8, 2025 08:08
nnnnn
When it comes to non-emergency medical transportation (NEMT services) in Canyon Country and the surrounding Los Angeles Metro Area, MEDIX Transportation stands out as a top-tier provider. Our highly trained team is committed to offering safe, reliable, and comfortable transportation options for seniors, disabled individuals, and patients recovering from surgeries or undergoing treatments like dialysis or chemotherapy. Ambulatory transportation service
October 8, 2025 15:03
hmh
At R&H Global Protection, every Israeli bodyguard is trained to anticipate threats before they occur, ensuring maximum protection without disrupting the client’s daily routine. From risk assessment to close personal protection, the company delivers services that go beyond standard security. Global Protection
October 12, 2025 15:17
recycled auto parts in Caldwell, ID
At Trusty Pick-A-Part, we take pride in promoting environmental responsibility through our selection of recycled auto parts in Caldwell, ID. By reusing and recycling components, we help reduce waste and minimize the environmental footprint of the automotive industry.
October 14, 2025 08:42
HMMM
At THC Vape Pen España, we specialize in delivering high-quality cannabis products designed for those who value purity, potency, and consistency. Whether you’re new to vaping or an experienced enthusiast, our carefully curated selection of THC vape, premium flowers, vaper thc, edibles, and THCP vaper devices ensures that you’ll always have access to the best cannabis Spain has to offer.
October 22, 2025 10:27
hhhh
There are many options for pest control in Reno, NV, but few match Statewide’s combination of experience, integrity, and results. Here’s what makes them the trusted choice for thousands of Northern Nevada residents.
October 22, 2025 11:06
GHHHH
When it comes to enhancing the look of your Mid-Century Modern or Atomic Ranch home, attention to detail is key. One of the most overlooked yet impactful elements in the exterior design is the mailbox. This often-neglected piece of the home’s curb appeal can actually make a bold statement when chosen thoughtfully. At Modern Mailbox, midcentury modern mailboxes, post mounted modern mailbox, we specialize in crafting unique, stylish modern mailboxes that bring together form and function with clean lines and timeless design.
October 22, 2025 12:47
Been There Financial Planning is led by William Rychliwsky, an accredited financial planner Ottawa residents trust for honest, goal-oriented advice. From early retirement strategies to RESP and RRSP optimization, we help you build a stronger future. Explore more about our retirement planning Ottawa services today.