Yes, immutable linux can be made much safer. With overlays none of the projects compete for config so agents are much less likely to introduce bugs and access important context by accident basically just by reading explicit immutable configs. We’re rolling everything on nixos now and it’s really good. Immutable linux has basically won imo.