NixOS 26.05
by cloudimg
Declarative Linux rebuilt atomically from one config file, with instant rollback and no drift.
NixOS is a Linux distribution built on the Nix package manager, with a uniquely declarative model: the entire system, from the kernel and packages to services, users and /etc, is generated from a single configuration and rebuilt atomically. You describe the system you want and NixOS realises it, with the ability to roll back to any previous generation from the boot menu. This cloudimg image runs NixOS 26.05 (Yarara), the current stable release.
Reproducible by construction. There is no official NixOS Azure image, so cloudimg builds one deterministically: the Gen2 (UEFI) disk is produced by a pinned nixpkgs revision on the stable nixos-26.05 channel, so the platform you certify against today is the exact platform you keep. Automatic channel upgrades are off by default, so the machine does not drift underneath you; the deployment guide shows how to opt into rolling or unattended updates when you want them.
Secure by default and asserted, not assumed. Because the image is assembled offline and never booted, it ships with no machine identity and no SSH host keys; NixOS regenerates both uniquely on every machine's first boot, so two machines built from this image never share an identity. At first boot cloud-init creates the admin user you name at deployment, places it in the wheel group with passwordless sudo, and injects the public key you supply. Root SSH login is disabled, password authentication is off, and the host firewall exposes exactly one port, SSH on 22. There is no swap on the disk and no build or vendor account is left behind. Both the Azure Linux agent (waagent) and cloud-init are enabled for full Azure integration.
NixOS and the Nix package manager are licensed MIT; the shipped system closure is a collection of independently packaged open source components (MIT, BSD, Apache-2.0, GPL, LGPL, MPL and more) and is built with the nixpkgs default that excludes unfree packages, so nothing proprietary is baked in. No paid subscription, licence key or support contract is required. cloudimg is not affiliated with or endorsed by the NixOS Foundation; NixOS is used nominatively to identify the distribution the image contains. cloudimg provides packaging, secure by default hardening and 24/7 support with a guaranteed 24 hour response SLA.