Hold up, nix added containerization? How did I miss that? I will have another look now!

Nix is containerization. Here is firing up a temporary little container with a new python version and then throwing it away once I'm done with it (although you can also do this with more complicated setups, this is just showing doing it with one thing only):

[hap@glimmer:/proc/69235/fd]$ python --version
Python 3.12.8

[hap@glimmer:/proc/69235/fd]$ nix-shell -p python39
this path will be fetched (27.46 MiB download, 80.28 MiB unpacked):
  /nix/store/jrq27pp6plnpx0iyvr04f4apghwc57sz-python3-3.9.21
copying path '/nix/store/jrq27pp6plnpx0iyvr04f4apghwc57sz-python3-3.9.21' from 'https://cache.nixos.org/'...

[nix-shell:~]$ python --version
Python 3.9.21

[nix-shell:~]$ exit
exit

[hap@glimmer:/proc/69235/fd]$ python --version
Python 3.12.8

The whole "system" you get when moving from Nix to NixOS is basically just a composition of a whole bunch of individual packages like python39 was, in one big container that is "the system." But you can also fire up temporary containers trivially for particular things. I have a couple of tools with source in ~/src which, whenever I change the source, nix-os rebuild will automatically fire up a little container to rebuild them in (with their build dependencies which don't have to be around cluttering up my main system). If it works, it'll deploy the completed product into my main system image for me, but if it doesn't then nothing will have changed (and either way it throws away the container it used to attempt the build in).

Each config change spawns a new container for the main system OS image ("generation"), but you can roll back to one of the earlier generations (which are, from a functional perspective, still around) if you want or if you broke something.

And so on. It's very nice.