Requirements & Caveats

Requirements

• Nix: nix on PATH, plus common utilities (uname, id, echo, cat, readlink, curl, tar) that run on the target machines during Inspect, Bootstrap, and Rollback
• rsync: on the control host and targets for file transfers (included in kexec images); version 3.2.3 or newer, since Panix passes --mkpath
• kexec memory: 1GB RAM minimum without swap for kexec bootstrap
• SSH key auth: password authentication is not supported
• Flakes: only Nix flakes are supported

Caution

macOS’s bundled rsync (2.6.9 before Sequoia, openrsync from Sequoia onward) does not support the --mkpath flag Panix passes by default, so deploys fail until you install GNU rsync 3.2.3 or newer on the control host (for example nix shell nixpkgs#rsync, or brew install rsync). Targets need the same, since Panix pushes and --mkpath is forwarded to the receiving side. The flags are configurable via rsync_default_flags.

Lix Support

Lix is a Nix fork that Panix detects and supports automatically. Detection runs on the local machine only; the local nix flavor decides behavior for all targets. Panix adjusts:

• Store URL format: Lix uses ?port=N query params instead of :port in the host.
• nix profile command: Nix 2.30 renamed nix profile install to nix profile add (keeping install as an alias), but Lix only supports install. With Lix detected locally, Panix uses nix profile install for package activation on all targets.

Caution

In mixed environments (local Lix with remote Nix, or the reverse), remote build mode (build_mode: remote, see Build Modes) can hit store URL format mismatches. Local build mode works without issues.

Caveats

• Nix store location: Panix expects the store at /nix/store; build outputs are validated against that prefix, so non-standard store roots are not supported.
• Nix store locking: concurrent builds of identical packages serialize on the store lock, so some builds briefly show a waiting for store lock warning.