<p>nixbitcoindev explains <a href="https://btctranscripts.com/stephan-livera-podcast/2020-07-26-nix-bitcoin/" rel="nofollow noreferrer">here</a> that the additional security provided by nix-bitcoin is due to minimalism, code reproducibility, compartmentalization and defense in depth.</p>
<p>nix-bitcoin uses NixOS which is a purely functional operating system which means that it builds the entire operating system from the source code of every application of the Linux kernel resulting in the same system every single time it is deployed.</p>
<p>With a general Linux distribution it is not possible to de-install all the packages you don't need as it would eventually result in a broken system. NixOS has a kind of formula where it goes through and calculates what you need and only builds that. This <strong>minimalism</strong> significantly reduces the attack surface.</p>
<p>Everything is <strong>reproducible</strong> with NixOS, not only Bitcoin related software such as Bitcoin Core, c-lightning, lnd etc but the entire stack including the Linux kernel. As a result you know you have exactly the same system that everybody else has. That’s a really strong defense against  the developers inserting malicious code or code upstream getting compromised. Once the developers have verified the software, within the hash it’s going to be the same software that everybody is using.</p>
<p>Every service runs in its own little box under its own user. It can only see its own directory and with network namespaces it can't even scope out your entire network. It can only scope out its own network and its Linux namespace and the ones it is allowed to see. Outside processes outside of that network namespace also can't look inside. That offers a great deal of security because now programs like Spark wallet that connect to your c-lightning, they’ll never see JoinMarket, they’ll never see Electrum, they’ll never see bitcoind. They are maximally <strong>compartmentalized</strong>.</p>
<p><strong>Defense in depth</strong> means putting up multiple walls or multiple lines of defense. nix-bitcoin isolates by users and isolates on the network level with systemd.</p>

CC BY-SA 4.0
2020-08-09T21:44:57.120Z
2023-05-25T11:25:54.350Z
2023-05-25T11:25:54.350Z
Michael Folkson
<p>nix-bitcoin claims on its GitHub <a href="https://github.com/fort-nix/nix-bitcoin" rel="nofollow noreferrer">repo</a> to facilitate the installing of Bitcoin nodes and higher layer protocols (e.g. Lightning) with increased security? How does it do this?</p>
<p>[edit: as RedGrittyBrick points out below this project is a work in progress as of time of writing (August 2020)]</p>

CC BY-SA 4.0
2020-08-10T08:27:31.667Z
As of 2020-08-10 the GitHub page for this project includes the warning *"This is a work in progress - don't expect it to be bug-free, secure or stable."*
RedGrittyBrick
<bitcoin-core><security><full-node>
How does nix-bitcoin provide greater security for installing Bitcoin nodes?
Michael Folkson
# How does nix-bitcoin provide greater security for installing Bitcoin nodes?

(Asked by: username_0 on 2020-08-09)

nix-bitcoin claims on its GitHub [repo](https://github.com/fort-nix/nix-bitcoin) to facilitate the installing of Bitcoin nodes and higher layer protocols (e.g. Lightning) with increased security? How does it do this?

[edit: as username_1 points out below this project is a work in progress as of time of writing (August 2020)]

**Tags:** bitcoin-core, security, full-node

> **Comments:**
> **username_1**: As of 2020-08-10 the GitHub page for this project includes the warning *"This is a work in progress - don't expect it to be bug-free, secure or stable."*  

---

## 1 answers

### Answer by username_0 on 2020-08-09. Score: 4 | Accepted answer

nixbitcoindev explains [here](https://btctranscripts.com/stephan-livera-podcast/2020-07-26-nix-bitcoin/) that the additional security provided by nix-bitcoin is due to minimalism, code reproducibility, compartmentalization and defense in depth.

nix-bitcoin uses NixOS which is a purely functional operating system which means that it builds the entire operating system from the source code of every application of the Linux kernel resulting in the same system every single time it is deployed.

With a general Linux distribution it is not possible to de-install all the packages you don't need as it would eventually result in a broken system. NixOS has a kind of formula where it goes through and calculates what you need and only builds that. This **minimalism** significantly reduces the attack surface.

Everything is **reproducible** with NixOS, not only Bitcoin related software such as Bitcoin Core, c-lightning, lnd etc but the entire stack including the Linux kernel. As a result you know you have exactly the same system that everybody else has. That’s a really strong defense against the developers inserting malicious code or code upstream getting compromised. Once the developers have verified the software, within the hash it’s going to be the same software that everybody is using.

Every service runs in its own little box under its own user. It can only see its own directory and with network namespaces it can't even scope out your entire network. It can only scope out its own network and its Linux namespace and the ones it is allowed to see. Outside processes outside of that network namespace also can't look inside. That offers a great deal of security because now programs like Spark wallet that connect to your c-lightning, they’ll never see JoinMarket, they’ll never see Electrum, they’ll never see bitcoind. They are maximally **compartmentalized**.

**Defense in depth** means putting up multiple walls or multiple lines of defense. nix-bitcoin isolates by users and isolates on the network level with systemd.


---

