Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hard User Separation with NixOS

tweag.io

Post reply on HN
Print view View original

11–20 of 27 posts

Re: Hard User Separation with NixOS

#11

Post by nineteen999 »

ninefathom wrote: post #9

This makes me nostalgic for Trusted Solaris. Nearly identical motivations, but also allowed for runtime context switching (even within running X11 sessions) without a reboot. It combined Zones, ZFS filesystems, Crossbow network virtualization, a modified X11 server, and an auth framework to glue it all together. I don't know how widely Trusted Solaris was ever adopted, but I know that I haven't seen it in use in many…

> Maybe this particular NixOS strategy will gain more traction.

Is anybody even vaguely relevant (ie. "non startup") using it in production? Right now it seems to be a plaything for developers.

Re: Hard User Separation with NixOS

#12

Post by spindle »

freedinosaur wrote: post #2

TIL specialisations: https://nixos.wiki/wiki/Specialisation I plan to use this for testing changes to my boot units. In theory, plain old generations allow you to safely test changes to boot units, by allowing you to jump to the previous generation. In practice, this involves remembering which generations have known-good boots. Specialisations will allow me to run a stable and candy track, on per generation. What oth…

> In practice, this involves remembering which generations have known-good boots.

Another option is to use named profiles for this:

nixos-rebuild switch --profile-name whatever

The profile names show up in your boot menu.

Re: Hard User Separation with NixOS

#14

Post by Ixiaus »

nineteen999 wrote: post #11
ninefathom wrote: post #9

This makes me nostalgic for Trusted Solaris. Nearly identical motivations, but also allowed for runtime context switching (even within running X11 sessions) without a reboot. It combined Zones, ZFS filesystems, Crossbow network virtualization, a modified X11 server, and an auth framework to glue it all together. I don't know how widely Trusted Solaris was ever adopted, but I know that I haven't seen it in use in many…

> Maybe this particular NixOS strategy will gain more traction. Is anybody even vaguely relevant (ie. "non startup") using it in production? Right now it seems to be a plaything for developers.

We use it in production at Arista-NDR (for both CI and our Linux rootfs that we deploy on prem and in AWS).

Definitely more than just a developer play thing.

Re: Hard User Separation with NixOS

#15

Post by eddsh1994 »

nineteen999 wrote: post #11
ninefathom wrote: post #9

This makes me nostalgic for Trusted Solaris. Nearly identical motivations, but also allowed for runtime context switching (even within running X11 sessions) without a reboot. It combined Zones, ZFS filesystems, Crossbow network virtualization, a modified X11 server, and an auth framework to glue it all together. I don't know how widely Trusted Solaris was ever adopted, but I know that I haven't seen it in use in many…

> Maybe this particular NixOS strategy will gain more traction. Is anybody even vaguely relevant (ie. "non startup") using it in production? Right now it seems to be a plaything for developers.

I used it at Cardano for CI and dev machines

Re: Hard User Separation with NixOS

#16

Post by freedinosaur »

spindle wrote: post #12
freedinosaur wrote: post #2

TIL specialisations: https://nixos.wiki/wiki/Specialisation I plan to use this for testing changes to my boot units. In theory, plain old generations allow you to safely test changes to boot units, by allowing you to jump to the previous generation. In practice, this involves remembering which generations have known-good boots. Specialisations will allow me to run a stable and candy track, on per generation. What oth…

> In practice, this involves remembering which generations have known-good boots. Another option is to use named profiles for this: nixos-rebuild switch --profile-name whatever The profile names show up in your boot menu.

TIL. Maybe I could get into the habit of using branches for experiments, and then including the branch name in --profile-name.

Re: Hard User Separation with NixOS

#17

Post by yewenjie »

Nix and NixOS has an incredible number of features and use-cases that have almost no documentation around. The only way to discover those, it seems to me, is to look up people's nixos configurations on GitHub etc.

Beginner level blogposts (that are plenty) talk about the same few features like ad-hoc development shell.

Re: Hard User Separation with NixOS

#18

Post by vlr »

> You don’t necessarily need to understand all the commands. The system disk will be erased during the process.

Unfortunately this article is a dump of commands and configs which presents no high level picture of the solution. Just run this.

Re: Hard User Separation with NixOS

#19

Post by spindle »

freedinosaur wrote: post #16
spindle wrote: post #12

Earlier quoted context omitted.

> In practice, this involves remembering which generations have known-good boots. Another option is to use named profiles for this: nixos-rebuild switch --profile-name whatever The profile names show up in your boot menu.

TIL. Maybe I could get into the habit of using branches for experiments, and then including the branch name in --profile-name.

Please do. I get the impression that not many people use --profile-name, and I live in fear of them taking it away. It needs critical mass. Two of us should be enough!

Re: Hard User Separation with NixOS

#20

Post by CuriousCosmic »

eddsh1994 wrote: post #15
nineteen999 wrote: post #11

Earlier quoted context omitted.

> Maybe this particular NixOS strategy will gain more traction. Is anybody even vaguely relevant (ie. "non startup") using it in production? Right now it seems to be a plaything for developers.

I used it at Cardano for CI and dev machines

IOG?
Post reply on HN