Live data from Hacker News

NixOS 21.05

nixos.org

181–190 of 234 posts

Re: NixOS 21.05

#181
post #149

Earlier quoted context omitted.

> and a few servers The problem I see with NixOS on a typical personal server is that you have to setup all these things using nix expressions, from which the actual configuration files are generated. That means if you e.g. want to install postfix, instead of learning about main.cf you have to learn the syntax of the nix configuration wrapper for postfix, and postfix having hundreds if not thousands of options, many…

> I am curious if anyone have experience to share? With one exception (nginx, because it's very well supported) I always just use raw config files and ignore the options. For TVL[0] we've written a bunch of NixOS modules[1] ourselves where the upstream one was either not flexible enough, or deviated strongly from how we wanted things to work. Nix is the kind of tool that lends itself well to solutions that are more c…

Maybe you could propose the improvements in nixpkgs so we can all benefit from them?

Re: NixOS 21.05

#182

I must admit, I'm curious about the idea but I don't yet "get" it. Reproducible builds sound like a great idea at first, but this has the same problem as Docker containers: you inadvertently become a package/distro maintainer. How does one update the system regularly with security updates? Are we locking by semver somehow (like node, etc.)? And who decides which version ranges to lock to, etc. etc.? Honestly, I'd pro…

It's like an OS that has builtin salt/ansible/chef/puppet.

Because Nix language describe the OS instead of what to change/configure it's superior to these tools, and solves the problem that supposedly same machines are drifting apart.

For example if in the CM you tell it to install a package, then change your mind and remove the entry that does it. The package will remain installed.

With NixOS if you remove the package from configuration, it's gone.

I personally really like Nix's building capability. For example I can use it to generate a minimal docker container. It requires some knowledge, but I can also modify compilation options in dependencies (like remove unneeded functionality).

It looks like there's also an option to similarly build lightweight OS images[1]. I haven't tried it yet but looks cool.

[1] https://github.com/cleverca22/not-os

Re: NixOS 21.05

#183

I must admit, I'm curious about the idea but I don't yet "get" it. Reproducible builds sound like a great idea at first, but this has the same problem as Docker containers: you inadvertently become a package/distro maintainer. How does one update the system regularly with security updates? Are we locking by semver somehow (like node, etc.)? And who decides which version ranges to lock to, etc. etc.? Honestly, I'd pro…

> but this has the same problem as Docker containers: you inadvertently become a package/distro maintainer. How does one update the system regularly with security updates? Are we locking by semver somehow (like node, etc.)? And who decides which version ranges to lock to, etc. etc.?

That is not true in the case of NixOS.

NixOS is an ordinary distribution: it has a release (which seems to be maintained for a year, receiving security patches) and an unstable branch.

So if you want to maintain your whole system in Nix, my recommendation is something like:

(1) use nix flakes. Flakes basically means you expressly specify the versions of your inputs, following the well known pattern of a human-edited but loosely specify source specification and a lockfile.

(2) One of your inputs will be github:NixOS/nixpkgs/release-21.05, which means the release-21.05 branch of github.com/NixOS/nixpkgs. The lockfile will ensure this follows the latest version

(3) In your flake, include your system configuration: it should build the whole system (systemd jobs, your reverse proxy, whatever it is you want each machine/class of machines in your network to do), not merely your application.

(4) In your flake, include your system tests. They can run on a virtual machine (or a network of virtual machines) whose configurations are derived from the configurations you created in (3).

If you've done that, you can now be reasonable confident that you can automatically receive security updates, run your tests against them, and deploy them.

Re: NixOS 21.05

#184
post #53

Earlier quoted context omitted.

You're looking at a solid 10-20 hours of hacking stuff together to get a decent working system, and you still won't understand a good 80% of what you copied from various repos. I've been using NixOS for a year now, and I have a definite love/hate relationship. Many times I miss the simplicity of Arch, where I understood _everything_ about my system and how it was configured. NixOS is like learning everything all over…

This is where I'm sitting right now. I'm trying out Void Linux on my laptop and it's just so simple. I love that I understand my system. I look at Nix as a language and I just have no idea what is going on. What I'd really like, as a learning resource, is a "Nix for apt/yum users" or a "Nix for Ansible" users guide. There is the cheat sheet ( https://nixos.wiki/wiki/Cheatsheet ) but it's just not enough. For example,…

My advice would be (per the other person here) to ignore home-manager when you're getting started, and then, when you're ready, treat it as a dotfiles manager on steroids.

I've never used it to manage visible directories in my ~/, but for ~/.gitconfig? Absolutely :).

Re: NixOS 21.05

#185
post #129

Ahhhh, Nix/NixOS. The package manager/OS that I so desperately wanted to love. I stuck with Nix for about six months. I even became a package maintainer. In the end, I gave up for three reasons: 1. Documentation is really bad. It's often confusing, incomplete or just plain wrong. What drove me crazy is the extreme imprecision with which certain fundamental concepts are referred to. For example, "derivations" are amon…

> never appreciated how much package management is intertwined with individual ecosystems' cultures until I tried using a "universal" package manager like Nix. Unfortunately it is not a problem for nix to solve, they can’t really mandate upstream projects to not include hardcoded executables. Also, the problem with npm/pip etc is that they are themselves package managers more or less trying to solve the same thing. S…

> Unfortunately it is not a problem for nix to solve, they can’t really mandate upstream projects to not include hardcoded executables.

Yet it's normal for Linux distros to patch upstream so that it works well inside of the distro. You may say "but that's crazy! Downstream patching Node packages opens up a whole can of worms!" Maybe you would be right--or maybe not. My point is that when I would raise these kinds of issues, I was met with a collective shrug or various justifications for why brokenness is actually a good thing.

That's what I call a kind of academic/purist mentality that's really great for a research project and not practical for a product. If you ship a Linux distro (and note, I'm talking here about NixOS, not just Nix) that comes with software in the repo, the universal expectation is that the software works as intended, and if it doesn't that it's a bug. There can be an argument over whether the bug is upstream or downstream, but the fault is recognized. That recognition doesn't seem to happen in Nix world in cases where the package comes from an ecosystem that has assumptions that contradict Nix's (or NixOS') assumptions.

> So I would even wager that without some language-specific help nix can’t really work seamlessly across other dependency managers.

The thing is, Nix provides various helper functions to aid in writing derivations for packages from the different ecosystems. They actually try to adapt to the various idioms, which is admirable.

My gripe is that each set of adaptations for each different ecosystem has its own entirely unique API. There's no meta-framework or set of common practices for writing makeNodePackage vs. makePythonPackage vs. makeHaskellPackage even though in many cases they share similar challenges (e.g., X and Y ecosystem's packages import dependencies from hardwired relative paths). It's a question of abstraction; makeXYZPackage exists, but there's no supra-ecosystem abstraction for writing it.

That sounds like an obscure concern until you try using Nix as your daily driver for dev work. As long as you stick to one ecosystem, it's passable. Still a bad UX because nothing is properly documented and really bad anti-patterns (such as forcing package maintainers to update hundreds of thousands of packages to update a single package) are championed, but at least you only need to learn one ecosystem's quirks and idiosyncrasies. The situation changes very quickly as soon as you try to mesh NPM packages with Python with Ruby, etc.

I actually raised this concern a while ago with the Nix devs, and their response was basically that it would take too much effort to harmonize all the different approaches. I thought that was a valid response, but it's unfortunate since I think it's the project's Achilles' heel.

Re: NixOS 21.05

#186
post #68
post #62

Earlier quoted context omitted.

> how painful was it to learn and get working? nixpkgs (which you can use on macOS or any Linux distro), quite little, you can get up to speed in 15min as a Homebrew replacement: nix-env -qas ruby # 'q'uery 'a'vailable 'search' nix-env -I ruby. # install by package name (not recommended) nix-env -iA nixpkgs.ruby_3_0 # install by "attribute", recommended nix-env -q # 'q'uery (i.e list installed) nix-env -e ruby # unin…

I use nix-shell for dev environments. Once I've got it working it's wonderful - full replicable, across multiple development machines and CI. It's painful though. Some problems I've encountered recently on different projects: Old version of fwup packaged. Can override to get newer version, but needed to add another dependency to make tests pass (and it gets built locally rather than being cached) Pain getting my envi…

Just a hint - extra attributes in the `mkShell` appear as environment variables in the built shell. So instead of a `shellHook` for this you can just have an attribute `ERL_LIBS="";`

I'm not completely sure but I think this approach is preferred because shellHook only runs in `nix-shell` but if you ever wanted to `nix-build` a release it might not run.

Re: NixOS 21.05

#188
post #125

Earlier quoted context omitted.

I like to use nix-env (or more often, now, `nix profile`) for a persistence level in between nix-shell and really adding something to my home-manager or NixOS config. I let my profile build up 10-20 things installed, then every few weeks I decide what belongs in my declared config and uninstall everything in the profile. Imo entirely removing imperative package management would be a mistake, although imperatively man…

> I let my profile build up 10-20 things installed, then every few weeks I decide what belongs in my declared config and uninstall everything in the profile. I'm curious what you get out of this that you don't get from just adding/removing packages in your home-manager config? Is it just a matter of it being quicker to do nix-env -iA instead of updating your config and running home-manager switch? Or is there some ot…

> Is [the benefit of this approach] just a matter of it being quicker to do nix-env -iA instead of updating your config and running home-manager switch?

That's definitely a factor. I think since I keep my Nix configurations in source control, somehow modifying the configuration feels more ‘official’, and it also usually comes with extra steps like committing and pushing.

The other thing I like is that it makes it very easy to tell if I actually want/need something: if I find myself installing something over and over (because I periodically purge my profile), I know for sure that it's time to add it to my config. This way I end up pulling less crap I don't actually use into my setup in an enduring way.

Maybe I'd also feel the same way about invoking things via `nix run` or `nix-shell` over time, and that would motivate me to incorporate them into my config ‘for realsies’ by declaring them.

> instead of updating your config and running home-manager switch?

I'm not currently a home-manager user on NixOS. Before home-manager was a thing, I used to define groups of packages using buildEnv and store them in an overlay for very simple de-facto declarative package management, so something like:

  nix-env -iA pxc-tui-apps
would install my whole CLI environment at once, and then on NixOS, I'd include `pxc-tui-apps` in my `environment.systemPackages`.

I'm switching to home-manager in my new setup, but one thing I still like about `nix profile install ...` (the flakes-based/next-gen replacement for nix-env, currently) is that it's user-mode/unprivileged, and it doesn't involve rebuilding my whole system (or anything other than the dependencies of just the package I want), even if my nixpkgs checkout/channel/flake registry or whatever has changed. `home-manager rebuild switch` is also unprivileged and also doesn't involve updating my whole system, but unfortunately home-manager doesn't support flakes just yet. You can use it on flakes-based setups on NixOS and macOS via the home-manager NixOS and nix-darwin modules, respectively... but then you're giving up the other benefits I like, because you have to invoke nixos-rebuild after all!

If `nix profile` were some day removed along with `nix-env`, but I had a user-level declarative environment management tool (like home-manager or something more tightly integrated), I could probably get by with just a little discipline about how I choose to edit my configurations and manage sources of Nix expressions and be pretty happy.

But I think the problems with `nix-env`/`nix profile` are pretty solvable, and I think lacking any imperative solution at all will likely put some ‘winnable’ new users off.

I do agree that `nix-env` itself sucks and needs to go, though. `nix-env --upgrade` doesn't really do what people expect, and there's no real reason to use/prefer it over just removing/reinstalling a package. The way that `nix-env` thinks about versions is basically insane, since Nixpkgs doesn't have any real version metadata and `nix-env` just parses attribute names to get the versions back out. `nix-env --query` is clunky and slow (but the new `nix search` is awesome and crazy fast!). `nix-env` was a cool thing for its time, and it's actually how `home-manager` manages its profiles on the backend (which is why flake support is still lacking; enabling flakes disables `nix-env` for your user). But it's like an imitation of `rpm`, and it was made before Nix had a real userbase and opportunities to think about what operations/abstractions/metadata were desirable at that level.

One of the things that's cool about Nix's design is that its design allows you to just bypass the hardest and most annoying problem that faces traditional package managers: dependency resolution. If you want a package manager that's guaranteed to give you solutions that are correct and complete, you need a SAT solver for dependency resolution, and that's NP-complete. By leveraging its quasi-content-addressable derivation approach, Nix gets to avoid resolving dependencies like traditional package managers do— the thing you need is the thing you were built against, and that's that! Similarly, by leaning hard into the Nixpkgs monorepo so that almost all packages live on it and all third-party package sources are built as de facto overlays on top of it, Nix has been able to totally avoid having to think about versions.

Compared to formats like DEB or RPM, Nix packages have very, very little metadata. Nix packagers don't have to declare things like acceptable version ranges for dependencies, what packages provide, what package names ought to be considered equivalent, what other packages it's incompatible with, or even what version number a package has. But `nix-env`'s `-q`, -i`, and `-u` options all imitate the `rpm` CLI, where all of that kind of metadata is necessary and present. And `nix-env` makes all that stuff work by assuming the structure of Nixpkgs and operating on Nix attributes representing packages directly. And it doesn't really make sense in the Nix world as it exists.

Flakes is the first attempt to revisit all these questions the community has basically punted on like ‘how do we want to relate packages to each other in a way that's not monorepo-centric?’, ‘what kind of metadata do we actually want to have for publishable Nix source package artifacts?’, ‘how should Nix code repositories advertise what features/tooling (packages, shell environments, modules, overlays, whatever) they support?’, ‘do we want Nix to actually be able to reason about versions?’, etc. (This also possibly reintroduces the question of dependency resolution. Hopefully not?) I think once we have real, considered answers for questions of that kind, grounded in the experience of the community so far, we can build an imperative frontend to Nix that makes sense and is nice to use.

Re: NixOS 21.05

#189
post #152

Earlier quoted context omitted.

I really can't believe they didn't finalize Flakes in this release. The difference between it and the "standard" way of doing things is night-and-day. these sort of "secret better ways of doing things" that are not the default really frustrate and drive away new users

The problem with this is that flakes are currently an experiment, and one which many people in the community think has flaws that need another iteration. Making it stable now locks Nix into the current flakes model forever - it's too early for that.

Agree. I think the core of the problem was that we didn't get a discussion before implementation.

We got an implementation and then were given chance to discuss upon. So when the discussion pointed out flaws, since so much work was already put in, it was decided to push as experimental instead of starting from square 1. But now that implementation was available for everyone with simple flag change (a strength of Nix, if I might say), adventurers started using them. And since these adventurers have outsized impact in terms of mind share projection, the community looks divided and confuses the hell out of newcomers. I know I struggled with this because when I started learning 'The Nix Way™', flakes were the hotness and everywhere, but the documentation sucked, but still looked like they were the future so I had to wade my through anyway.

Re: NixOS 21.05

#190
post #155

Earlier quoted context omitted.

Each NixOS machine has a current configuration, symlinked from /run/current-system. For example, my NixOS laptop currently has this: /run/current-system -> /nix/store/95n5xr5n8bw6xbab8fiz6cqc6mydryg8-nixos-system-Sweetpea-21.11pre291991.ea7d4aa9b82 My $PATH contains /run/current-system/sw/bin, so all of my machine's (globally-installed) software comes from whatever the current configuration is. There's also some othe…

Thanks for taking the time to describe that, it makes sense now. I'm impressed that it manages restarting everything on the fly without a reboot on a running system.

On rare occasions, there can be problems restarting a service, like if the service in the new configuration in fact relies on a newer kernel module than what you've got in your running configuration. In addition, sometimes Nix's garbage collector won't dispose of something because it can tell you've still got some processes running that use it or something like that, and so there's a bit of space you can't free up until after reboot. And of course, kernel changes still require reboots on NixOS.

All in all, the service management stuff is handled very gracefully imo. I've never run into real trouble with it (and one time I had a power outage in the middle of a `nixos-rebuild switch`).

Post reply on HN