Good point. I’ll have to stop using immutable and stay with atomic (and declarative).

Interestingly /bin and /usr/bin are not in PATH by default, so /bin/chewy can only be executed by its path directly and won’t affect the systems reliability.

Fully agreed. On almost any atomic distro, /home/user is writeable like usual, so any attacker is able to persist itself by editing ~/.bashrc and putting a binary somewhere.

NixOS is immutable and atomic, but it isn’t image-based.

Immutable simply refers to how the running system configuration can’t be changed by simply putting a file somewhere (e.g. copy a binary to /bin, which is a bad idea).

For example, Fedora Atomic and derivatives are image based, although they are more flexible than the A/B types like SteamOS.

OpenSUSE MicroOS uses btrfs snapshots to apply updates atomically, and is more flexible than most image based immutable distros.

Edit: But I don’t think those terms have a single definition, so how would you differentiate these terms?

MPV also supports pipewire.