As a relatively heavy solution, you can use a container orchestrator that understands a failure to pull an image as a temporary or transient situation. The lightest orchestrator that I've used on NixOS in a homelab is k3s
:
services.k3s.enable = true;
It is more-or-less a cut-down Kubernetes, and as such it will not fail to start merely because one Pod
had an error pulling one Image
. It will also offer a path forward if you want to continue building up software-defined networking.
That all said, I'd re-examine what you want from service isolation during OS upgrades; it's possible for routine NixOS updates to only restart affected services and not reboot. In production, nixos-rebuild switch
can do things like upgrade shared libraries, switch webroots, or flip feature flags. Containerization might be unnecessary overhead, and I say that as a Kubernetes proponent.
For what it's worth, most of your comments aren't eligible for copyright; they aren't sufficiently original or information-packed. Just like @onlinepersona@programming.dev and their licensing efforts, it's mostly a vanity to attach a license to unoriginal one-line throwaway jokes. I wouldn't say that it's arrogant so much as lacking in self-awareness; a one-liner must be deeply insightful, contain a pun or paraprosdokian, address the current zeitgeist, or otherwise be memorable above and beyond the time and place that contextualized it.