One reproducible, governed stack from laptop to CI to production, so teams ship faster, eliminate drift, and know exactly what ran and where it came from.
Trusted by Fortune 20 firms, Tier 1 banks, and leading AI companies
Remove drift and brittle steps with certainty.
If your machines are inconsistent, it results in an ongoing troubleshooting tax. Your Platform Teams can offer a confident baseline to standardize on.
The drift
One setup, three machines
The same SETUP.md resolves to different versions on a laptop, in CI, and on an agent.
LaptopCIAgentpython3.13.13.12.73.13.1nodejs22.3.022.3.020.11.1openssl3.3.13.3.23.3.2rust1.79.01.79.01.77.2go1.22.51.21.111.22.5
Nothing matches.
The weight
Pinning it by hand
Reproducing that stack in Docker means a multi-stage build, gigabytes of images, and a daemon.
Without Flox~5 GB · a daemon
Dockerfilemulti-stage · 74 lines
nvidia/cuda:12.23.1 GB
+ python, postgres, redis1.9 GB
dockerda daemon
With Flox1 file · 0 images
manifest.toml16 linessha256:9f3c2a
Flox gives us a reproducible foundation we can trust, which matters more and more as our team grows. It also gives us a much more controlled path for shipping software fast and reliably.
Amin KarbasTechnical Staff, Resolve AI
One manifest, every target
Resolve once. Run identically everywhere.
One manifest resolves to one lock, and every target below runs that exact software. Go from mostly the same to exactly the same.
How the manifest workssource of truth
manifest.toml
[install]
python.pkg-path = "python313"
nodejs.pkg-path = "nodejs_22"
sha256:9f3c2a
Laptopyour machinesha256:9f3c2a
CIevery pipeline runsha256:9f3c2a
Cloudremote sandboxsha256:9f3c2a
Agentany AI agentsha256:9f3c2a
Change the manifest, and every target moves with it.
One declaration, every stage.
Declare it once, and the same locked environment carries all the way through, from development to production. No re-describing your stack at every stage.
Build and publish guideDeclare & activate
$flox activate
resolved → sha256:9f3c2a
Start services
$flox services start
postgres, redis up
Build
$flox build api
sandboxed · reproducible
Publish
$flox publish -o acme api
→ flox install acme/api
Ship
sha256:9f3c2a
Standard OCI image
$flox containerize -t api:1.0
standard OCI, same lock
Imageless Kubernetes
Or skip the image: a pod references the environment directly, so there are no multi-GB images to build or pull.
Reproducible builds and imageless Kubernetes, powered by Nix under the hood. You never write a line of it.
A supply chain you can defend.
Every environment carries a signed, hash-pinned software bill of materials. The security work most teams postpone is built into the workflow.
See CVE remediation in depthA deterministic SBOM
A hash-pinned bill of materials, read straight from the dependency graph. Not inferred after the fact.
CVE remediation in one bump
Know which environments a CVE hits. Bump one pin, rebuild, and roll back in one step.
Audit-ready provenance
Prove what shipped and how it was built. Evidence is a byproduct of the build, not a separate scan.
SBOM · app412 packages · signed
hover a node to inspect ittap a node to inspect it
Enterprise platform
Standardize every environment your Platform Team supports.
Give every developer and agent the same ground truth, and give platform and security the controls to govern it across the org.
Identity and access
Bring your identity provider. SSO plus role-based control over who can publish, pull, and promote environments across the org.
Private distribution
Ship environments and packages from your own registry, on your network, air-gapped, with no dependency on the public internet.
Audit and provenance
Every environment carries a signed bill of materials and a full lineage, so compliance falls out of the lock instead of being bolted on.
Support with an SLA
A named team, response-time commitments, and a roadmap you can influence. The people who build Flox, on call for yours.
Bringing Nix to work, at enterprise scale.
Standardize every environment your platform, security, and ML teams run, on your own infrastructure.