What Is Nix? • Hacker News Board

Re: What Is Nix?

#151

Post by mehrdadn » Thu, May 21, 2020, 1:10 AM UTC

geofft wrote: post #127

mehrdadn wrote: post #114

Earlier quoted context omitted.

Oh dear... so you have to write a Nix package (and learn how the language and package management work) just to modify global config files, instead of just editing them? That sounds like an absolute nightmare for a local machine, though possibly a great tool for automated systems. Also, if there's no /nix/etc... then what is Nix modifying? sshd (or any other more common program; I'm just using sshd as an example to un…

I haven't used NixOS, so take me with a grain of salt - it looks like the actual way of doing this in NixOS is that you have a systemwide configuration file that you can edit, and running "nixos-rebuild" will pick up your changes and automatically make the packages you need. See "Changing the Configuration" in the manual: https://nixos.org/nixos/manual/index.html So, at the end of the day, there is a Nix package, but…

Wow interesting, okay. I think I'll probably have to give it a shot at some point to try it out. Hopefully it'll live up to the expectations :-) thanks a ton for all the explanations!

Re: What Is Nix?

#152

Post by somatic » Thu, May 21, 2020, 1:10 AM UTC

joepie91_ wrote: post #146

geofft wrote: post #133

Earlier quoted context omitted.

If you're applying idiomatic Nix to modern JS, I wouldn't be surprised - modern JS tends to involve installing thousands of packages by just combining them into a directory, but Nix doesn't want you to edit existing directories. So your dependency graph turns into a build-dependency graph, with each JS package requiring a full build of everything it depends on, and the Nix build system is presumably not optimized for…

Hi, JS developer here who uses Nix and who liberally makes use of single-responsibility modules. No, Nix does not need "hours" to build a modern JS project. Something else is going on here. Nix is slow, but not that slow. (With the limited information provided here, my first guess would be "someone turned off the binary cache because they don't trust prebuilt binaries, and now it recompiles the world from scratch bec…

“who liberally makes use of single-responsibility modules”

If your aim is precision of language, you should call this “400MB of unaudited and unauditable mystery code from the [total clowns]( https://github.com/babel/babel/pull/3646 )* who run the npm ecosystem.”

Imagine [this]( https://medium.com/s/silicon-satire/i-peeked-into-my-node-mo... )* but instead riddled with advertisers and intelligence agencies.

Burn it down and start over.

* Insert Markdown, etc.

Re: What Is Nix?

#153

Post by joepie91_ » Thu, May 21, 2020, 1:12 AM UTC

enriquto wrote: post #13

exdsq wrote: post #8

Earlier quoted context omitted.

One really cool thing about NixOS is you declare the OS just like you might a DockerFile, and you can choose which configuration file you use at booting time. This lets you install applications just during up-time (to try out a new tool), add it to the configuration file if you like it, and roll back to the version before if it breaks something. Versions are declarative too (PSql == X.X.X) and upgrades/downgrades are…

> One really cool thing about NixOS is you declare the OS just like you might a DockerFile, But DockerFiles have a really terse, self-evident, trivial to read language. It is obvious what a given DockerFile means even if it's the first one you see. For nix; well, I have seen a few nix files and each one leaves me more confused than the last. Can anybody point me to good examples of beautiful, single-file, complete, s…

> But DockerFiles have a really terse, self-evident, trivial to read language. It is obvious what a given DockerFile means even if it's the first one you see.

Is it, though? It's obvious what commands it runs, yes, but that doesn't translate to actually understanding what the end state is, and that's precisely the bit that matters.

Yet that's something you have to infer from a pile of operations that mutate global state, which is precisely the sort of thing that's very difficult to do reliably.

Sure, the result is that a Dockerfile is less code - because you're outsourcing a lot of the "understanding what this does" work to the reader's brain rather than to the code. That's not a good thing.

> Can anybody point me to good examples of beautiful, single-file, complete, self-contained terse nix examples that describe a few simple systems?

It's not completely self-contained (eg. the hardware configuration is in separate files for infrastructure migration reasons and some custom abstractions are used), but here's an example of the actual configuration of two of my servers, warts and all: https://git.cryto.net/joepie91/morph-rc/src/master/configura...

In practice, "self-contained" is something you're not likely to see in real-world usages of Nix.

Sure, people start out with a self-contained configuration, but they tend to discover pretty quickly that configuration is code, and that means that you can abstract out the repetitive and messy bits to separate modules, and now it is no longer self-contained.

Basically, asking for a self-contained Nix configuration is going to yield similar results to asking for a self-contained source file for a piece of software. You'll either get a) non-real-world code, b) a big mess of stuff dumped into a single file, or c) multiple files.

Re: What Is Nix?

#154

Post by tomberek » Thu, May 21, 2020, 1:13 AM UTC

addicted wrote: post #128

yawaramin wrote: post #77

Earlier quoted context omitted.

Sounds like their main concern wasn't Nix but the complexity of the code itself.

The hours long build system appears to be attributed to Nix. Is Nix really that slow?

I've built a combined python2/3,c,c++,javascript (VueJS) deployment along with hardware-in-the-loop integration testing and compiling for ARM on an Raspberry Pi with Nix. Should not take hours.

Something else is wrong. Perhaps binary cache is not being used? Something is invalidating the builds like a "src = ./.;" which telling the build system to include every single file in the directory in the build rather than using a .gitignore or git-hash for reproducibility. Or someone was using npm2nix (deprecated)?

Re: What Is Nix?

#155

Post by takeda » Thu, May 21, 2020, 1:13 AM UTC

dataflow wrote: post #67

thequux wrote: post #60

Earlier quoted context omitted.

If you install the "linux" package using nix on Debian, you get a directory in your nix store (the collection of "installed" packages) containing a bzImage, a System.map, and a `lib` directory containing all of the kernel modules. It would then be up to you to build an initrd and wire it into your bootloader, if that's what you wanted to do. In other words, Nix packages are just files in their own special place on th…

"Just files" doesn't quite capture the complexity of the situation to me though. Say I happen to install package X via apt and Y via nix, and both of them depend on Z (in apt and nix respectively), and Z needs to bind to a port, then I imagine both will install but one of them will break, possibly including their dependents. Or if I install a package on Nix that expects a certain syscall that's not in the Ubuntu kern…

> Say I happen to install package X via apt and Y via nix, and both of them depend on Z (in apt and nix respectively)

That actually is impossible, Nix will only depend on packages in nix, and nothing else. So whatever you have installed won't affect it.

The important part of Nix on Linux is patchelf[1] basically binaries generated are processed by it, this rewrites elfs to link to libraries in the /nix/store

Regarding syscalls, if you use NixOS then you're tied to specific state of nixpkgs, which also dictates the kernel installed. So you shouldn't run into it. You probably might run if you install Nix on Ubuntu. I don't remember running into it, and I think it should be rare since linux ABI supposed to not break compatibility.

[1] https://github.com/NixOS/patchelf

Re: What Is Nix?

#156

Post by yawaramin » Thu, May 21, 2020, 1:17 AM UTC

joepie91_ wrote: post #146

geofft wrote: post #133

Earlier quoted context omitted.

If you're applying idiomatic Nix to modern JS, I wouldn't be surprised - modern JS tends to involve installing thousands of packages by just combining them into a directory, but Nix doesn't want you to edit existing directories. So your dependency graph turns into a build-dependency graph, with each JS package requiring a full build of everything it depends on, and the Nix build system is presumably not optimized for…

Hi, JS developer here who uses Nix and who liberally makes use of single-responsibility modules. No, Nix does not need "hours" to build a modern JS project. Something else is going on here. Nix is slow, but not that slow. (With the limited information provided here, my first guess would be "someone turned off the binary cache because they don't trust prebuilt binaries, and now it recompiles the world from scratch bec…

I suspect that someone being the auditors who are suspicious of opaque binary caches and insist on building everything from scratch.

Re: What Is Nix?

#157

Post by joepie91_ » Thu, May 21, 2020, 1:18 AM UTC

mehrdadn wrote: post #76

throwaway894345 wrote: post #50

Earlier quoted context omitted.

> the DockerFiles themselves can also describe a reproducible process This is true, but Docker does almost nothing to support reproducibility. As soon as you do an apt-get, reproducibility goes out the window. > they are certainly "incremental" due to caching Caching is layer-based. Docker has no awareness of whether or not a particular dependency has changed or what is necessary to rebuild it. Docker only understand…

Great description, thanks. Question: do you know how Nix deals with language package managers (like pip)? If I do sudo pip install (leaving aside the usual debate as to its merits), does that then wreck my Nix install, especially if it happens to contain another version of the same package? And does it instantly make things non-reproducible again (just like the apt-get issue you mentioned)? Or does Nix somehow get ar…

It's totally possible to introduce mutable, non-reproducible state on a system that uses Nix, even if that system is NixOS. However, you can't do so in your Nix store, which is where all the Nix-installed things live (at least, not without a lot of hackery - Nix tries very hard to make the entire store immutable).

Basically this works out to: anything you install or configure with Nix, is immutable and reproducible. Anything you don't is at your own risk. Unfortunately there are still some "pockets of state" that haven't been solved yet, most notably applications storing state in ~.

For most every language dependency management system, there's a Nix equivalent of some sort that allows you to manage those dependencies without invoking the non-reproducible mutable tooling.

Re: What Is Nix?

#158

Post by yawaramin » Thu, May 21, 2020, 1:18 AM UTC

somatic wrote: post #152

joepie91_ wrote: post #146

Earlier quoted context omitted.

Hi, JS developer here who uses Nix and who liberally makes use of single-responsibility modules. No, Nix does not need "hours" to build a modern JS project. Something else is going on here. Nix is slow, but not that slow. (With the limited information provided here, my first guess would be "someone turned off the binary cache because they don't trust prebuilt binaries, and now it recompiles the world from scratch bec…

“who liberally makes use of single-responsibility modules” If your aim is precision of language, you should call this “400MB of unaudited and unauditable mystery code from the [total clowns]( https://github.com/babel/babel/pull/3646 )* who run the npm ecosystem.” Imagine [this]( https://medium.com/s/silicon-satire/i-peeked-into-my-node-mo... )* but instead riddled with advertisers and intelligence agencies. Burn it d…

Part of the removed code:

    test("guy", function() {
      assert.equal(typeof babel.guy, "string");
    });

Facepalming so hard right now

Re: What Is Nix?

#159

Post by endgame » Thu, May 21, 2020, 1:18 AM UTC

jdlshore wrote: post #147

takeda wrote: post #111

Earlier quoted context omitted.

You can use Nix on MacOS X and with nix you don't need brew. I used it for few years that way. If you use nix-darwin + home-manager you can also configure your mac the way you would NixOS. Amazing tools that discovered not long ago (they aren't specific to os x) is: niv - makes pinning to specific repos/versions in repos much easier which helps with reproducibility, especially pinning of nixpkgs version which is now…

Unfortunately, the security updates introduced in MacOS Catalina have made installing Nix on the latest version of MacOS a fairly involved process.[1] I looked at using it when I rebuilt my computer recently and decided to wait until it was more baked. [1] Catalina restricts which directories can be added to the root dir. Nix uses /nix.

There is a way to deal with the latest round of developer-hostile changes from Apple:

https://github.com/NixOS/nix/issues/2925#issuecomment-604501... documents the workaround but if you don't have a direct link it's almost impossible to find because GitHub's UI is terrible.

Re: What Is Nix?

#160

Post by rgoulter » Thu, May 21, 2020, 1:19 AM UTC

ironmagma wrote: post #150

nilkn wrote: post #129

This article is a good explanation of how nix works at a high level, and I'm excited to see nix getting some really prominent support, but for some reason it never tells you what the point of all of this is, so I think many folks might feel turned off by it. In other words, I don't believe it ever compellingly answers the question that constitutes its title. The word "package" doesn't even appear until near the end o…

Isn’t that the same goal as Docker? I’m surprised there’s still no Docker base image for NixOS...

"Same execution environment everywhere" is one way which developers use Docker. Docker gets this by copying the layers of a built image. Unlike nix, the image building itself doesn't need to be reproducible. So you can have a Dockerfile which works now but will fail to build in however many months.

"Reproducible builds" do get you "same execution environment everywhere". But they have the stronger guarantee that for the same inputs, outputs will be the same.

IMO/IME, I don't think that aspect of nix is a strong selling point for use of nix on developer workstations. Probably thanks to less-elegant solutions like " Version Manager" etc..

But I think the nix language makes for a nicer way of describing a package of software you're developing in terms of dependencies and outputs than Dockerfile.