--- title: Flox for Kubernetes | Ship to Kubernetes without rebuilding images description: Run the same declarative environment from laptop to CI to production Kubernetes, without container image rebuilds. Book 30 minutes with the Flox team. --- [![Flox](https://flox.dev/favicon.svg)](https://flox.dev/) - Features [Flexible Environments](https://flox.dev/features/) [Seamless Builds](https://flox.dev/builds/) [Shareable, Traceable CUDA Stacks](https://flox.dev/cuda/) [Kubernetes, Uncontained NEW](https://flox.dev/kubernetes/) [Agent Stacks NEW](https://flox.dev/ai/) - Use Cases [For Platform Engineers](https://flox.dev/platform-engineers/) [For Developers](https://flox.dev/developers/) [For AI Agents](https://flox.dev/agents) - Resources [**Documentation**Key concepts, tutorials, cookbooks, and references](https://flox.dev/docs/) [**Changelog**See what the Flox team has shipped](https://flox.dev/docs/changelog) [**Example environments**Prebuilt Flox environments and powerful one-liners you can use right away](https://flox.dev/environments/) [**Community**Learn from Flox power users and get updates first](https://go.flox.dev/slack?hsLang=en) [**Case Studies NEW**How engineering teams use Flox to ship faster](https://flox.dev/case-studies/) [**Most popular packages**Step-by-step guides for using the most popular Flox software packages](https://flox.dev/popular-packages/) [**Nix**Guides, stories, and resources about Nix.](https://flox.dev/nix/) [**Blog**Guides and news from the Flox and Nix world](https://flox.dev/blog/) [**Nix in the Wild**Case studies from real-world Nix users](https://flox.dev/nixinthewild/) [**Get Flox**Install Flox and connect it to your editor and CI](https://flox.dev/docs/install-flox/install/) Search the Flox catalog: Download Flox v1.19.4 **Linux (deb)** · [x86](https://flox.dev/download/) [ARM](https://flox.dev/download/) **Linux (rpm)** · [x86](https://flox.dev/download/) [ARM](https://flox.dev/download/) **macOS** · [Apple Silicon](https://flox.dev/download/) [Intel](https://flox.dev/download/) - [Pricing](https://flox.dev/pricing/) - Company [About](https://flox.dev/about/) [Careers](https://flox.dev/careers/) [News](https://flox.dev/news/) [Contact](https://flox.dev/contact/) [Security & Compliance](https://flox.dev/compliance/) [4.2k](https://github.com/flox/flox) [Sign in](https://hub.flox.dev/) Met us at **Booth #233** in Salt Lake City, or missed us at KubeCon NA 2026? This page covers what we showed. # Ship to Kubernetes without rebuilding images. Flox runs the same declarative environment on a laptop, in CI, and in production pods. The build, push, and pull loop goes away. Kubernetes stays Kubernetes. [Book 30 minutes with Ale](https://go.flox.dev/post-kubecon-conference-kubernetes#book) [See how it works](https://go.flox.dev/post-kubecon-conference-kubernetes#how) The full change to a Deployment**deployment.yaml** ``` template: metadata: annotations: flox.dev/environment: "acme/training" spec: runtimeClassName: flox containers: - name: trainer image: registry.acme.io/training:cuda12-v41 image: flox/empty:1.0.0 # 49 bytes command: ["python", "train.py"] ``` Packages mount from a node-local, hash-addressed cache. Each node pulls only what the environment needs. 800 MB to 0 Base image overhead 50% Faster provisioning 5 to 2 Pipeline stages Available today on Amazon EKS, self-managed clusters, and distributions like K3s, on x86 and ARM. ## Where the time goes today Container images were built to ship applications. For AI/ML stacks and multi-language services, they’ve turned into the slowest part of the release. - **Images keep growing**PyTorch, TensorFlow, and CUDA workloads routinely ship as 5–10 GB images, and every node pulls the whole thing. - **One dependency bump means a full rebuild**Build, push, pull, unpack. Each change waits on the registry round trip before a pod can start. - **Dev, CI, and prod drift apart**The laptop, the runner, and the cluster resolve dependencies differently, and the gap shows up as incidents. - **SBOMs are a guess after the fact**Scanners infer what’s inside a layer. Security teams triage CVEs that may not be in the running code at all. ## How imageless Kubernetes works Flox maintains a containerd shim that registers as an extra runtime next to the default one. You opt in pod by pod. Step 1 ### Define the environment Declare packages, variables, and services once. Run `flox push` to publish it to FloxHub, or build into your own private catalog. Step 2 ### Reference it in the manifest Set `runtimeClassName: flox` and add the `flox.dev/environment` annotation. A node selector keeps pods on Flox-enabled nodes. Step 3 ### Deploy At startup the shim activates the environment and mounts hash-pinned packages from the node’s read-only store. No image to build or pull. **What stays the same:** Argo, Helm, Tekton, and GitHub Actions. Admission control, network policy, logs, metrics, and traces. The Kubernetes API. Remove `runtimeClassName` and the pod goes back to the default containerd shim. Rollback is switching to a previous environment generation. ## What changes for your team Pick the view closest to your role. Platform & SRE Security AI/ML & research computing Engineering leadership ### Faster, predictable starts with fewer moving parts For platform engineering, SRE, DevOps, and infrastructure teams. - No image rebuilds or registry pulls. Pods start from pre-warmed, node-local caches instead of multi-gigabyte downloads. - Atomic rollback: switch the environment to a previous generation, or pin one in the Pod spec. - One environment definition runs on x86 and ARM nodes. - Debug the exact environment running in the cluster, locally or in a debug pod. No guessing what’s inside a layer. ### SBOMs from the build graph, not a scan For CISOs, application security, and DevSecOps teams. - Build-time and runtime SBOMs by default, derived from Nix’s input-addressed build graph. Fewer false positives in CVE matching. - Admission policy can verify that the SBOM, the environment, and the deployment all match before rollout. - Run private, signed binary caches inside your network and point your scanners at them. - A smaller attack surface: pods carry only the exact, versioned dependencies they declare. ### GPU stacks without the 10 GB image For AI/ML engineers, ML Ops, scientific, research, and quant computing teams. - Define PyTorch, CUDA, and model dependencies as hash-pinned environments. Nodes fetch only what changed. - Zero-copy model serving: load once and reuse across pods. Swap a model with one edit. - Move from Jupyter to batch training jobs to serving APIs in the same locked environment. - Results you can reproduce months later, because the environment is cryptographically pinned. ### Shorter pipelines, no platform migration For CIOs, CTOs, and developer experience and productivity leads. - Teams have cut pipelines from five stages to two by dropping build, push, and pull. - Lower registry storage and transfer, since environments ship as a definition rather than a payload. - Developers test locally against exactly what runs in production. Code and runtime change in the same PR. - Adoption is pod by pod on the clusters you already run. Nothing to rip out. ![Kelsey Hightower](https://flox.dev/images/kubernetes/testimonial/kelsey-hightower.jpeg) > “Like Kata or gVisor extend CRI for isolation, Flox uses CRI to deliver Nix-style reproducibility, so you run only the software you actually need.” Kelsey Hightower, Distinguished Engineer and Flox advisor Fortune 5 enterprises and fast-growing tech companies run Flox. Flox is backed by a $25M Series B led by Addition, and its open source CLI is on [GitHub](https://github.com/flox/flox). ## Walk through your pipeline with Ale 30 minutes, focused on your clusters and your workloads. 1. **1**How you build and ship images today, and where releases slow down. 2. **2**Which workloads would gain the most from going imageless, starting with the largest images. 3. **3**A live pod running on Flox, including the agent-sandbox demo from KubeAuto Day if that’s useful. 4. **4**Fit for your setup: EKS or self-managed, private caches, and your security review. AV You’ll meet with Ale Vogel from the Flox team. Bring whoever owns your build pipeline or cluster. ## Read before the call The technical background, from the Flox engineering team and the press. [**Kubernetes, Uncontained explained** How the runtime shim, RuntimeClass, and node labels fit together. *Flox blog*](https://flox.dev/blog/kubernetes-uncontained-explained-unlocking-faster-more-reproducible-deployments-on-k8s) [**Reproducible workloads without changing the Kubernetes API** Why package management is the last mile of reproducibility on K8s. *Flox blog*](https://flox.dev/blog/with-kubernetes-uncontained-flox-unlocks-faster-more-reproducible-workloads-on-k8s) [**Imageless Kubernetes documentation** Pod spec examples, EKS install, and how updates roll out. *Flox docs*](https://flox.dev/docs/imageless-kubernetes/intro) [**Try it locally with kind** A demo repo that runs imageless pods on a local cluster. *GitHub*](https://github.com/flox/flox-kind-demo) [**Video walkthrough with Morgan Helton** Deploying real workloads on Kubernetes without building or pushing images. *YouTube*](https://www.youtube.com/watch?v=-tIoO0z0zFQ) [**AI leads a platform engineering revival** SiliconANGLE’s recap of KubeCon NA 2025 in Atlanta, where Flox launched its imageless approach. *SiliconANGLE, November 2025*](https://siliconangle.com/2025/11/15/ai-leads-platform-engineering-revival-kubecon-na-2025/) © 2026 Flox. All rights reserved. [Privacy policy](https://flox.dev/privacy-policy/)   [Flox for Kubernetes](https://flox.dev/kubernetes/)