Nix Impermanence NoExec Root

Fri, 26 Jun 2026 15:15:56 +0200

An impermanent NixOS Setup is something, I personally I really enjoy, as I don’t like preserving everything on my system forever … Persistence Opt-In is the best approach.

And recently I came across a nice Blog about hardening NixOS from Xe Iaso’s blog. And well one thing especially seemed cool, so I wanted to share it.

NoExec for the Root FS

At the bottom of the blog is a part about having noexec for the root fs (which is a tmpfs anyway). Since all programs in NixOS life anyway in /nix/store and /nix is its own partition in the typical Impermancence Setup (I won’t talk about how to this now, as there are already many good blogs discussing this, and showing how it’s done; if you want to see my own setup, check my Codeberg out). So only the /nix parititon needs to be mounted without noexec, the rest can be noexec.

Security on Cat in a Shell

Nix Impermanence NoExec Root

NoExec for the Root FS