In the September 26 feed digest, a link from Hacker News went by, racking up nearly a thousand points and over five hundred comments: "Dutch governments builds alternative for Microsoft based on NixOS". The Dutch are building their own digital work environment for civil servants, called DAWO, and they're doing it on top of a Linux system that almost no one outside a narrow circle has seen in corporate production — but which has been known for twenty years in academia and the functional programming world.
Readers accustomed to the "Europe is tired of Microsoft" genre usually close the tab at this point. The real story here is the technology choice. A platform for hundreds of thousands of government workstations is being built not on Ubuntu, not on RHEL, not on Windows with an overlay, but on NixOS — an operating system where a machine's configuration is not the result of an administrator's manual actions, but text. A government that must be able to prove to an auditor that it knows what its own desktop is made of has chosen a tool designed precisely for such proof. That's what's worth discussing.
First, what DAWO actually is, because in retellings it dissolves into a "sovereign OS". The acronym stands for Digitaal Autonome Werkomgeving Overheid, digital autonomous work environment for the public sector. It's an open blueprint and a community around it — there's no ready-made distro or product here. A set of completed and replaceable blocks — operating system, cloud, collaboration tools, AI — from which an organization assembles its workspace.
The code lives on code.overheid.nl, the national government code platform, with a mirror on Codeberg. The repository core is one hundred percent written in Nix. The stable version they themselves show is 0.1.2 from August 15, 2026. They promise the next one in 2027.
The institutional part came together this summer. In July 2026, the inter-ministerial commission on organizing civil service work instructed the three main IT suppliers to the central government — SSC-ICT, DICTU, and DUO-ICT — to build a standardized, "more sovereign" work environment. It's specifically emphasized that they're taking existing work as a foundation: MijnBureau and DAWO. Municipalities are running a parallel track — since April 2026, four cities, 's-Hertogenbosch, Zaanstad, Ede, and Amsterdam, together with the association of Dutch municipalities, have been testing Linux laptops paired with MijnBureau; the trial period ends at the end of 2026, and by fall publications mention eight cities.
What's being replaced is also worth stating plainly. Workspace, documents, email, video calls — the entire daily scaffolding around Windows, Office, and Teams. Not the search engine, not billing, not specialized industry-specific programs: those remain and will remain, because dependence on a specific program in a specific department lives independently of political will.
Someone had to put a price tag on this venture, and here's where it gets most interesting. The Dutch state does not know how much it pays Microsoft.
In October 2025, parliament adopted a proposal from MP Jessi Six Dijkstra with a simple request: show by department how spending on Microsoft, Oracle, and SAP licenses has grown. By December 18, the state secretary for internal affairs reported that a quick audit had been prepared, and that it "does not support further specification into license costs". Translated into plain language: the state tried to add up what it pays to its largest software suppliers and officially concluded that it's impossible.
The reason is prosaic and humiliating because of it. Procurement goes through the EAP framework agreement, signed in December 2023 with five resellers for approximately €300 million per year. The government buys software from Dustin, Dustin buys from Microsoft, and in the reporting under Dustin's name the word "Microsoft" disappears. Hence the figure of 230 million euros for 2024 — that's the sum across eight suppliers at once, from AWS and Google to Oracle and SAP, and it can't be broken down. And the "software" category as a whole — 570 million, smeared across more than three thousand sub-suppliers.
Then the arithmetic voiced out loud at the iBestuur conference becomes clear: about 400 thousand government workstations and licenses on the order of €500 per user per year — meaning "hundreds of millions" annually, before cloud and hardware. I'm deliberately leaving this pair of figures without an official reference: it was said in a panel discussion, not in a document, and no one in the Netherlands today can confirm it with primary data. There's a funny loop here: the project is launched because the cost of dependence is unknown, and the very unknowability is proof of the dependence.
How painted the background is can be seen from Germany's national debt: in 2025 the federation paid Microsoft €481 million, a 38% year-over-year increase. Britain pays £1.9 billion annually under its framework agreement. Dutch inability to reconcile the bill looks like the result of a procurement setup in which reconciling the bill is unprofitable.
Now the technical part, for which this whole venture happened. In Nix, packages are installed in isolated directories in a store, whose contents are immutable and addressed by hash. A machine is described declaratively: the configuration says what it should be, not what steps someone took to bring it to its current state. From this flows for free what the public sector pays separate contractors for.
Reproducibility — any host is rebuilt from the description and comes out the same. Rollback — the previous state remains in the store, returning to it means switching, not restoring a backup. Verifiability — an external auditor gets text and change history instead of a system administrator's story. And third, what people remember more often in 2026: composition specification.
In the repository you can see how this works live. The build publishes SBOM for each host — software bill of materials specification — along with a report on what's knowingly wrong in that specification.
The reason is clear from the calendar: the EU Cyber Resilience Act came into force December 10, 2024, from September 11, 2026 obligations to report on vulnerabilities apply, and main requirements apply from December 11, 2027. At NixCon 2025 there was a separate talk on this: Nix tools with their focus on reproducibility are well positioned for compliance, while the update mechanism, matching composition with the vulnerability database, and support timelines remain unsolved. In other words, declarativeness stopped being a matter of taste and became a matter of getting a pass to the European market. This isn't "we chose the beautiful", it's "we chose what can be presented to an inspector".
The way DAWO handles security deserves a separate discussion, because that's where you see the difference between normal engineering work and a political project.
Inside there's a hardening module with a rule registry. Each rule is an object: title, severity level, tags, list of norms requesting it, explanation of "why", and most importantly, a check command. A device chooses a level — baseline, hardened, strict, or none — and on top of the level, compliance profiles operate: say, a set for a specific national standard. The level is ordered, the profile cuts across it, and any specific rule can be disabled separately. The documentation explains this two-axis scheme in one sentence: a norm requests a set of rules, not a degree of strictness.
Then the details begin, for which I honestly tip my hat. Three requirements for a rule: the check only reads and never writes, restarts, or goes on the network. The check proves state, not configuration — meaning it asks the daemon what it will do, instead of reading the value in the config; when they diverge, the daemon answers. And the "why" field is written for someone who wants to disable the rule, not for someone who wants to understand it: what it does is already said by the code.
Mandatory settings are enforced at the language level, so the one accepting the configuration can't quietly weaken them, and a value that will break the device — an empty list of time servers, a non-positive limit on login attempts — crashes the build with an error, not passes silently. There's a check utility: one line per rule, PASS or FAIL, SKIP with the reason for disabling, NONE when there's no check yet; runs daily and after each activation, so the machine fleet can be read from the log.
However, the most honest document in this repository is not about what works, but about what doesn't. In the architecture description it's stated plainly: auditd, the audit subsystem, is postponed, because the module on the current nixpkgs branch does nothing due to a bug in auditctl, and declaring it on the list would mean imitating coverage; logging remains baseline until this is fixed. Next to it — a caveat about usbguard: it's disabled by default intentionally, since a machine that refuses to see a flash drive out of the box reads to the owner as broken.
The pitfalls documentation is arranged the same way. There's a case where the main branch stopped building on any fresh machine, while continuous integration stayed green — because it was checked on a runner where the needed archive was still in cache. One commit, two different answers, and not code decides, but cache. Second case: the device and the update mechanism authenticate separately, so deployment logged in for rebuild and didn't log in for polling — the error is visible only as a line in the log, and the symptom is one: the machine quietly stops moving. Literal postscript to this case: "so the machine fleet sat for six weeks on the old version". I don't know a more convincing argument that the document was written by people who hurt from this.
No one's going to build all this in a vacuum, and here begins the conversation about how digital sovereignty runs into other people's work.
German openDesk was launched in October 2024 by the digital sovereignty center ZenDiS. In September 2026, ZenDiS opened a partner program: certified cloud providers, distributors, integrators, with requirements like BSI C5 certification and level three of the European cloud sovereignty framework. Its own staff looked ascetic: in March 2024, responding to an MP's inquiry, the Ministry of Internal Affairs reported that nine people work at ZenDiS, three each for the two main products, and the organization has no separate dedicated budget; that year, open source spending in the budget was cut from roughly 50 to 24.7 million euros.
I didn't find a fresh headcount — and won't claim it's the same, but the very proportion between the stated mission and the starting staff explains why the partner program appeared only two years later.
French La Suite is made at DINUM, with the gendarmerie and general directorate of finance switching to free software before the agency itself. The product was assembled in collaboration with the Netherlands and Germany, and there was a detail rarely found in engineering reports: along with developers, many designers worked on the tools, because, the head of open source explains, "if tools are inconvenient and ugly, people don't use them". Plus a separate thought worth framing: in any migration the human factor matters more than the technical, and users need to be accompanied.
Munich stands nearby as a memory of the previous defeat and how to get out of it. The LiMux project started in 2003, by 2013 more than 12 thousand city administration machines ran Linux and LibreOffice, and a proprietary set of template-working tools was born there. In 2017 the city returned to Windows 10, citing compatibility, support, and specialized programs as reasons. So today's Munich didn't go for a second round: after 2021 the city committed to publishing its own developments as open source, in 2024 established an open source programs office and "open-source sabbatical" practice for external developers, and the coalition that came to power in 2026 declared open source the preferred procurement model.
A full return to a free desktop isn't planned.
The easiest thing is to turn the list of neighbors into a victory table. More correct is to see a gradient in it. Schleswig-Holstein closed email migration — 44 thousand mailboxes, 110 million emails and calendar entries — to Open-Xchange and Thunderbird, moved about 80% of workstations to LibreOffice and announced savings of €15 million in license payments, reinvesting €9 million back into the open source ecosystem. It's also the most honest example of what success costs: 20% of workstations remain that still hang on Word and Excel because of industry-specific programs, and the opposition continues to criticize the quality of the transition. No one got a clean result. Munich got two transitions in different directions over twenty years, Schleswig-Holstein — eighty percent and an open tail.
The good part of this story is that the Dutch project has a chance LiMux didn't have. Munich couldn't boast that the international court in its own city became a victim of a decision made on another continent. But The Hague can.
In early 2025, the Trump administration imposed sanctions against the International Criminal Court; eleven officials fell under them, including chief prosecutor Karim Khan and eight judges. Then what happened needs to be retold literally. Microsoft gave the court a choice: either the court closes the prosecutor's account, or the company terminates service to the entire organization. The court closed it. In February 2026, Microsoft confirmed this — moreover in the British Parliament its representative first said that the decision was made by the court, "not Microsoft", after which the company apologized to the committee and asked to correct the session transcripts. Postscript in the official statement: "Microsoft at no time discontinued or suspended its services to the ICC".
An analysis of this discrepancy, by the way, was done by former Dutch intelligence service regulator Bert Hubert.
Judge Kimberley Prost in conversation with The Guardian describes the consequences in everyday words: her credit cards were canceled, Amazon and Google accounts closed. The court itself after this switched to German openDesk. Gartner estimates that investments in sovereign cloud services will triple between 2025 and 2027.
That's why the Dutch project gets more attention than neighboring ones: it was born from having a neighbor's email cut off for someone else's political decisions. And right here the last mile becomes visible. The DAWO-NixOS repository honestly admits in a comment in its own main configuration file: all input dependencies are free, but pulled from GitHub, and the goal is stated literally — zero dependencies on foreign hosting by the time they're mirrored and relinked; of twenty-five inputs ten dead ones were cleaned by audit, the remaining fifteen are named load-bearing and put in queue. One of them, a configuration tool, already moved to Codeberg, and its GitHub mirror stops working October 31, 2026.
Another move — libraries that this tool pulled in bypassing the lock file — broke the build of all devices at once, although not a line changed in the repository itself.
Meaning sovereignty at the operating system level is already assembled, and at the platform level is yet to come. And platform choice doesn't reduce to "own server instead of someone else's": in July 2026 Codeberg, a nonprofit association from Berlin hosting the Dutch project among others, held a general meeting and prohibited using its content to train language models, and also restricted projects created automatically by agents and consuming many resources. The motive given was engineering, not ideological: AI provider crawlers pull not only normal cloning, but also multiple web representations, filter variants in the task system, and history states — and bring down databases, forcing access restrictions on everyone else. Its own platform turned out to be not just a political decision.
What remains is to say what the state signed itself up for by taking Nix.
First — personnel. The entry barrier to a declarative system is higher than to a familiar one: an administrator who knows where to click becomes useless here without understanding the description language. The Dutch panel at the conference called coordination the main difficulty: departments work in parallel, do the same analyses separately, and develop similar solutions without noticing each other. Second — money. One-time migration investments are large, and savings don't come immediately: Schleswig-Holstein paid €9 million to start saving €15 million per year, and that's the best payback speed example available. Third, what they warned separately about at the same panel: the danger of replacing one dependency with another without gaining autonomy.
I'll leave the fourth as is, because there's nothing to glue together here. Nix has no single owner: it's a community that went through a difficult split in 2024. In April an open letter appeared calling for the resignation of project founder Eelco Dolstra, gathering over a hundred signatures; complaints concerned unilateral pressure on the board, conflict of interest through his company, and a dispute about sponsoring a conference by defense contractor Anduril. Twenty-four maintainers left the package set by the end of April.
The founder's response appeared on his own firm's blog, and the board publicly distanced itself from his position; followers forked the language implementation into the Lix project, which directly states it doesn't fall under the NixOS foundation and isn't managed by its leadership. By 2026 the community has a constitution, annual steering committee elections, and rotation; in the current foundation board composition I didn't find Dolstra, but there was no direct announcement of his departure in the sources I found — so I leave it, without speculation.
The Dutch state is sitting on a technology whose own internal disputes haven't ended yet. And this, if you drop the pathos, is a normal sign: a closed vendor doesn't argue out loud, it just changes the license. The only thing that should be said honestly — sovereignty here won't be achieved as a state. It will be maintained as a process: as long as dependency mirroring goes on, as long as the rule registry is filled, as long as the local engineer has work.