Live data from Hacker News

NixOS and my descent into insanity

ersei.net

81–90 of 120 posts

Re: NixOS and my descent into insanity

#81

Earlier quoted context omitted.

Ansible does not even begin to accomplish what Nix does.

I’d be curious to learn more if you could share please

What Ansible does is just one part of the Nix picture. Nix brings a lot more:

- Language agnostic software packaging

- Package manager

- Ephemeral dev environments

- A purely functional config language (it has lambdas - you can build abstractions)

- Closures - Nix knows every single dependency your system needs down to git revisions

- Binary caching. Everything is built from source, but you can safely download binaries that are known to be built from the exact same deps you need.

- Ergonomic cross-compilation

- NixOS modules allow for composable, modular system config. For instance, my home computers all import a shared scanner.nix file that sets up scanner drivers and installs scanner software. Sharing config across machines is so easy with Nix.

- Rollbacks - you can edit your system (even swapping out gfx drivers or the kernel) and if it doesn't work, trivially rollback. As in you can restart your computer and choose to boot into the previous config.

- Easily modify _any_ dependency. You can apply patches, point at a fork, or just tweak its packaging.

- I am surely forgetting stuff! It does a lot.

Re: NixOS and my descent into insanity

#82

Earlier quoted context omitted.

Ansible does not even begin to accomplish what Nix does.

I’d be curious to learn more if you could share please

Not the person that said, but let me try. First, Nix isn't for configuration management, it can do bunch of other things, but even when it comes to configuration management it is still superior to the popular tools:

Ansible/Chef/Puppet/Saltstack

They try to be declarative (following less popular CFEngine) but they are still iterative. Saltstack is closest as originally the order of operation was based on the declared dependencies.

They still ultimately come down to just perform iterative steps, with the difference that operations are idempotent.

The biggest drawback they do have is coming from the fact that they have system with a state and they modify the system state to get selected files/services/packages/etc in new state.

Nix lives up to its name, and when configuration happens it starts from nothing and then builds everything based on the configuration.

The result of it is, let say you use the traditional CM tool to install a package. Then later on you decide the package is no longer needed so you remove "pkg.installed" declaration. What actually happens though is that the existing systems will continue to have the package installed (until you add "pkg.removed"). What's even worse is that any new instance you spin up will not have the package installed, so everything will be drifting. This is the primary reason why there was the immutable system movement. That's all to avoid those scenarios.

In contrast, in Nix, if you remove package from list of installed packages, or you remove file that you declared by nix config, they will be gone from the system. The configuration is basically describing your system.

Now, as mentioned above, that's just one piece of things Nix can do. I primarily use it for reproducible builds I really like that if a package won't build on your computer it probably will fail to build on mine as well (it's something that docker promised, but IMO failed to deliver), but let's stick to configuration management.

Another big thing is that all changes are atomic, you either get your change or the change did not apply due to error, you will not get in a in-between state, like frequently happens with CM.

Another thing is (and what I wrote above is prerequisite for this to work correctly) is that you can do rollbacks. And it works with things that are considered hard. For example NixOS by default use X11, but you can enable Wayland with some configuration changes. Then you can just revert the config back and get back to your old X11 installation.

This also makes system upgrades less dreadful.

Let's say you have your setup, but you need to use different version of openssl or maybe compile it with different flags. In traditional OS you probably would not do that or if there was a vulnerability you would wait for help from vendor as there might need to be multiple packages updated. But if it is something smaller, maybe you need python package, you would build your own version, you would place it in artifactory, then have ansible task to upgrade it on your instances.

With nix you will use overrides[1]. Nix then will see it, and if the compiled version is not in its cache it will pull all dependencies and recompile it automatically then place it in its cache.

If you set up a binary cache yourself (you can either use SaaS solution, or even just set up an S3 bucket) you can have your machines automatically pull the compiled version from it. Nix doesn't care about versions of packages either (the versions are only for the user) instead it uses cryptographic hash generated from things like source code, package dependencies, architecture, compile options, etc) this means if you cache compiled version and modify package to add some other options, it won't accidentally use the other package it will either pull the right one or recompile the code.

[1] https://nixos.org/manual/nixpkgs/stable/#chap-overrides

Re: NixOS and my descent into insanity

#83

I don't really have a need for home-manager on a single-user NixOS system. Whatever configuration home-manager would typically manage is now contained in my global configuration.nix.

I'm a single user and still use home-manager. And I wouldn't be surprised that's the majority of cases.

The thing is that while NixOS configuration.nix also contains modules for software, it primarily concentrates on global services and might not have modules for programs that are meant to be run under user.

Re: NixOS and my descent into insanity

#84
post #71

Earlier quoted context omitted.

> NixOS is awful except for everything else out there. Except Qubes OS that allows using original GNU/Linux distributions virtualized with a convenient interface.

And what exactly do you run as those distributions? They will have all the same problems. That’s the same idea that Docker has — containers don’t solve packaging, they only push the problem down a layer.

Which the same problems? For example I do not worry that something can be broken, because I have, e.g., automatic system snapshots and dedicated VMs for testing.

I run Fedora and Debian, but you can run many other distros: https://www.qubes-os.org/doc/#operating-system-guides.

> they only push the problem down a layer

This is an interesting interpretation. For me Qubes fully solves, e.g., both the problems of system stability and flexibility.

Re: NixOS and my descent into insanity

#85

Earlier quoted context omitted.

> NixOS is awful except for everything else out there. Except Qubes OS that allows using original GNU/Linux distributions virtualized with a convenient interface.

I don’t associate convenience and QubesOS. Maybe convenient security, but thats about it.

Security is just one feature of Qubes OS. Another one is convenient separation of contexts. Works well for me: you do not see VMs but colorful windows with simple exchange of clipboard and files whenever needed.

I am curious, what is inconvenient in it for you?

Re: NixOS and my descent into insanity

#86
Not the best thing to see pop up on the day that I'm supposed to get my new work laptop that I plan to nixify using home manager... I guess since I'm going to be running nix inside of MacOS it's a little less disastrous if I have to just pack it in and uninstall.

Re: NixOS and my descent into insanity

#87
post #9

> Home-manager needs to add a channel to install it. This will not do. FWIW, I see that nix-portable does support nix flakes, and home-manager also supports nix flakes. (And flakes are a feature which replaces use of channels).

Yea, i'm using home manager with flakes. Though i forget what initial setup is like. I've found bootstrapping new systems to be a bit odd with Nix + Flakes.

Re: NixOS and my descent into insanity

#88
I think Nix is cool as a dev tool, but I have near zero interest in NixOS. The newer immutable distros (CoreOS, Silverblue, etc.) get you the actually important features and it's still good old Linux. I'm talking about (easy) declarative config, atomic upgrades, and guaranteed rollbacks. I don't need any more than that.

Re: NixOS and my descent into insanity

#89

Earlier quoted context omitted.

I agree that NixOS (and Nix) is difficult to learn and the documentation is generally poor, which I realise is what you’re getting at in your comment, But I do think we should keep in mind what an incredible project NixOS is. NixOS isn’t just some other Linux distro, repeating pretty much what every distro has done for 40 years. It’s a complete rethink of how a Linux distribution and package manager should work, from…

It would probably function way smoother if it didn't have to be built on top of Linux. But then nobody would use it, of course.

The dystopian future of OS dev: Linux, Linux, Linux

I get that backwards compatibility is really important, but still. Gotta be POSIX compatible at least or else next to no one is going to use it as a daily driver.

For example:

> Coming up with a custom shell language was fun, but ultimately does not solve any real problems for us.

> Having a POSIX compliant shell would allow us to, well, run POSIX shell scripts. (This currently requires installing a 3rd party shell.)

https://github.com/SerenityOS/serenity/issues/6847

Where's some variety? I hope to get into the field myself eventually, so maybe I should take it upon myself to create interesting things that might be useful.

Re: NixOS and my descent into insanity

#90
post #70

Earlier quoted context omitted.

I tend to agree. I was trying to follow the guide on how to install NixOS with root-on-zfs[0]. I’ve followed it before with my own tweaks just fine, but recently it was updated to include some random guy’s modules that automate a couple steps. They’re mostly shallow abstractions on first-party NixOS modules, but following it was such a pain. I’ve been putting off reverse engineering the guy’s code so I can understand…

What module do you mean? I didn’t find it in your link.

The repo in step one of this sub-page: https://openzfs.github.io/openzfs-docs/Getting%20Started/Nix...
Post reply on HN