My problem with NixOS is the second you try to go "outside the guardrails", the difficulty increases 100x
Is it? Why? If a NixOS module doesn’t support what you need, you can just write your own module, and the module system lets you disable existing modules if you need to. Doing anything custom this way still feels easier than doing it in an imperative world.
Kind of the same for docker? Plopping a docker compose file and setting up few environment vars vs writing dockerfiles from scratch.