Immutable deploys
Every deploy builds a new, self-contained NixOS revision instead of mutating a running one — and a push never swings live traffic onto unproven code.
The isolation model
Workloads run as Incus system containers or VMs, not shared-kernel containers — and the control plane connects over a scoped credential it cannot widen.
Rollback and the state boundary
You can revert an application to its previous revision and its data is untouched — because the data was never inside the revision you reverted.