title: Build versus Runtime Dependencies in Nix
body: <p>I am just starting to get to grips with Nix, so apologies if I missed the answer to my question in the docs.</p>
  
  <p>I want to use Nix to setup a secure production machine with the minimal set of libraries and executables. I don't want any compilers or other build tools present because these can be security risks. </p>
  
  <p>When I install some packages, it seems that they depend on only the minimum set of runtime dependencies. For example if I install <code>apache-tomcat-8.0.23</code> then I get a Java runtime (JRE) and the pre-built JAR files comprising Tomcat.</p>
  
  <p>On the other hand, some packages seem to include a full build toolchain as dependencies. Taking another Java-based example, when I install <code>spark-1.4.0</code> Nix pulls down the Java development kit (JDK) which includes a compiler, and it also pulls the Maven build tool etc.</p>
  
  <p>So, my questions are as follows:</p>
  
  <ol>
  <li>Do Nix packages make any distinction between build and runtime dependencies?</li>
  <li>Why do some packages appear to depend on build tools whereas others only need runtime? Is this all down to how the package author wrapped up the application?</li>
  <li>If a package contains build dependencies that I don't want, is there anything that I, as the operator, can do about it except design my own alternative packaging for the same application?</li>
  </ol>
  
  <p>Many thanks.</p>