Introduction to Immutable Linux Systems • Hacker News Board

Re: Introduction to Immutable Linux Systems

#111

Post by nrabulinski » Mon, Sep 18, 2023, 1:40 PM UTC

qazxcvbnm wrote: post #108

Off topic, but does anyone know how to find out where mutable data for NixOS modules are stored at (e.g. the data directory for a database) without reading the source? Occasionally, it's mildly annoying, and would be comforting to know with certainty where all my state is.

If it’s a systemd service (which it usually is) you can simply run systemctl cat which pretty much always will have WorkingDirectory property set or RuntimeDirectory or similar (RuntimeDirectory you’ll have to prefix with /var/run which you just sort of have to know but that’s not NixOS specific)

Re: Introduction to Immutable Linux Systems

#112

Post by jcastro » Mon, Sep 18, 2023, 1:41 PM UTC

crabbone wrote: post #105

surrTurr wrote: post #104

How does working with Docker work on Immutable systems like Fedora Silverblue. Like e.g. developing an application (in a Devcontainer like e.g. Toolbox to avoid having to install all the devtools on os-tree) and then building and debugging a Docker container from within the devcontainer? Or am I thinking in a wrong way? Any good blogposts on developer workflows on Silverblue?

This sounds painful for no reason. Especially the debugging part. Why would you want that? Is it really such a strain to install the tools you need for development on your computer? I can understand wanting an immutable system for a server, as it will likely cut down on maintenance, but for personal use... that just sends shivers down my spine... As someone having to support other (especially not very savvy) programm…

You don't know anyone who develops in containers? It's a pretty common pattern these days.

Re: Introduction to Immutable Linux Systems

#113

Post by PrimeMcFly » Mon, Sep 18, 2023, 1:46 PM UTC

psd1 wrote: post #96

FireInsight wrote: post #47

What these sort of introductions to immutable always fail to consider is the other side of the coin, image-based. I'm working on https://universal-blue.org/ along with many people much more skilled than me. We build OCI container images on top of vanilla Fedora Silverblue & many other editions with different desktops. Those images can then be booted to (or rather rebased to) using rpm-ostree. This is a more robust wa…

Tangential, but I had my mind blown in about 2009 by a big hypervisor running Windows remote desktop hosts. I believe it was Citrix. The VMs booted from images. The image and the mutable differencing disks were entirely in RAM (although user profiles were on spinning rust). A desktop host for 25 users would boot to accepting remote logins in about 4 seconds. Least painful Windows system to patch.

> spinning rust

Weird phrasing. Haven't seen that before.

Re: Introduction to Immutable Linux Systems

#114

Post by wi5eif6E » Mon, Sep 18, 2023, 1:49 PM UTC

nrabulinski wrote: post #111

qazxcvbnm wrote: post #108

Off topic, but does anyone know how to find out where mutable data for NixOS modules are stored at (e.g. the data directory for a database) without reading the source? Occasionally, it's mildly annoying, and would be comforting to know with certainty where all my state is.

If it’s a systemd service (which it usually is) you can simply run systemctl cat which pretty much always will have WorkingDirectory property set or RuntimeDirectory or similar (RuntimeDirectory you’ll have to prefix with /var/run which you just sort of have to know but that’s not NixOS specific)

It's rather unlikely the RuntimeDirectory= contains state as it's wiped on service stop unless RuntimeDirectoryPreserve= is set. NB: these days, /var/run/ is a symlink to /run/

Re: Introduction to Immutable Linux Systems

#115

Post by jcastro » Mon, Sep 18, 2023, 1:50 PM UTC

gettodachoppa wrote: post #41

softirq wrote: post #7

Been using Fedora Silverblue since its release and it's absolutely the future. ostree is what everyone should be using.

I like the idea of ostree but having glanced at it, as a casual/intermediate user, it didn't seem as user-friendly as, say, Docker was (which a home user can learn in an afternoon). It wasn't obvious how to get to "Debian distro deployed as an ostree snapshot". Is this one of those things designed for career sysadmins/system builders only?

You don't consume ostree directly like that, what happens is someone would make Debian ostree-enabled OCI images for users to consume and adapt.

https://opendev.org/starlingx/apt-ostree is one such effort to bring ostree to debian.

Re: Introduction to Immutable Linux Systems

#116

Post by thinkmassive » Mon, Sep 18, 2023, 1:50 PM UTC

Glad to see EndlessOS included!

Silverblue/Sircea gets all the attention these days, but Endless is the oldest OSTree-based user distro by a long shot, and it’s still actively developed by the Endless Foundation.

It’s also the one most suitable for non-technical users. Definitely worth considering for that use case, particularly for very young users since it now includes plenty of tutorial content intended for that audience.

Re: Introduction to Immutable Linux Systems

#117

Post by Cheeeetah » Mon, Sep 18, 2023, 2:01 PM UTC

softirq wrote: post #7

Been using Fedora Silverblue since its release and it's absolutely the future. ostree is what everyone should be using.

Don't represent everyone.

Re: Introduction to Immutable Linux Systems

#118

Post by intangible » Mon, Sep 18, 2023, 2:02 PM UTC

Another really nice Immutable Linux system that I'm using is VyOS.. It's targeted primarily at a router OS, but you can run containers on it now to make it pretty versatile.

Basically, it's an image based OS that configures everything from a single config file on boot. https://docs.vyos.io/en/latest/introducing/about.html

Re: Introduction to Immutable Linux Systems

#119

Post by vinay_ys » Mon, Sep 18, 2023, 2:12 PM UTC

Why are we still talking about broken notions of immutable systems when we actually have trusted execution environments and secure boot and cryptographically sealed strong assurances of what is executing at any point and can do secure upgrades, even with remotely attached secure storage and do it across a huge fleet of machines at very large scales?

Re: Introduction to Immutable Linux Systems

#120

Post by crabbone » Mon, Sep 18, 2023, 2:27 PM UTC

jcastro wrote: post #112

crabbone wrote: post #105

Earlier quoted context omitted.

This sounds painful for no reason. Especially the debugging part. Why would you want that? Is it really such a strain to install the tools you need for development on your computer? I can understand wanting an immutable system for a server, as it will likely cut down on maintenance, but for personal use... that just sends shivers down my spine... As someone having to support other (especially not very savvy) programm…

You don't know anyone who develops in containers? It's a pretty common pattern these days.

Yes, of course I do, but there's always some degree of mutability. Eg. typically you'd mount some local volumes into container for example...

But even with "escape hatches" programming in container is very painful and uncomfortable. I've only ever seen this done by people who chose to work on a very restrictive system (perhaps for its appeal to their aesthetic feelings rather than any practical concerns). Or, maybe, their employer has bad IT, which both strictly enforces the rules and creates rules that acutely inconvenience the employees. In either case, it's a big hit to productivity. But, in some cases, there weren't much in terms of productivity to begin with (the programmer was bad with or without good programming environment), so the losses are imperceptible.