Live data from Hacker News

Hard User Separation with NixOS

tweag.io

21–27 of 27 posts

Re: Hard User Separation with NixOS

#21

Nix and NixOS has an incredible number of features and use-cases that have almost no documentation around. The only way to discover those, it seems to me, is to look up people's nixos configurations on GitHub etc. Beginner level blogposts (that are plenty) talk about the same few features like ad-hoc development shell.

You are right of course. NixOS ain't for the faint of heart.

OTOH it finally got me over my fear of being a n00b and just use the source.

Re: Hard User Separation with NixOS

#22

This makes me nostalgic for Trusted Solaris. Nearly identical motivations, but also allowed for runtime context switching (even within running X11 sessions) without a reboot. It combined Zones, ZFS filesystems, Crossbow network virtualization, a modified X11 server, and an auth framework to glue it all together. I don't know how widely Trusted Solaris was ever adopted, but I know that I haven't seen it in use in many…

> Maybe this particular NixOS strategy will gain more traction. Is anybody even vaguely relevant (ie. "non startup") using it in production? Right now it seems to be a plaything for developers.

Pretty sure Target use{sd} it, because they're the ones who sponsored original flakes implementation.

Re: Hard User Separation with NixOS

#23
If Nix(OS) just had a better documentation ... sigh. Using it feels more like discovering stuff, not utilizing it properly. It's like an adventure, not a tool. Neither is bad, but I think the other way around it would benefit the project.

Re: Hard User Separation with NixOS

#24
post #19

Earlier quoted context omitted.

TIL. Maybe I could get into the habit of using branches for experiments, and then including the branch name in --profile-name.

Please do. I get the impression that not many people use --profile-name, and I live in fear of them taking it away. It needs critical mass. Two of us should be enough!

TIL too. This makes 3 now.

Re: Hard User Separation with NixOS

#25

Nix and NixOS has an incredible number of features and use-cases that have almost no documentation around. The only way to discover those, it seems to me, is to look up people's nixos configurations on GitHub etc. Beginner level blogposts (that are plenty) talk about the same few features like ad-hoc development shell.

You are right of course. NixOS ain't for the faint of heart. OTOH it finally got me over my fear of being a n00b and just use the source.

NixOS for busy developers ain't for the faint of heart.

But I am extremely faint of heart, and I love NixOS.

The trick is that I'm not a developer, and I happen not to need to ask it to do anything complicated or non-standard. I expect lots of other people are in my position (although maybe not many of those people read HN).

Re: Hard User Separation with NixOS

#26

Nix and NixOS has an incredible number of features and use-cases that have almost no documentation around. The only way to discover those, it seems to me, is to look up people's nixos configurations on GitHub etc. Beginner level blogposts (that are plenty) talk about the same few features like ad-hoc development shell.

The problem is that this isn't a feature that it supports, it's just that someone noticed the way you can combine the existing features leads to this possibility. It's the same with a programming language - until someone noticed that you could use javascript and web browsers to make a PDF viewer or an email client, maybe there was no documentation about how to do that.

I think it's not so much a problem of Nix/NixOS, but a consequence of the power of composability. For the next n years, people will keep discovering new things you can do. As the knowledge spreads, people will work out how to document the features and present them in ways that can be easily grasped. But the final success of NixOS will be when every distribution adopts more and more NixOS-like composability and NixOS is well understood and even boring, like the final success of Unix.

Post reply on HN