Earlier quoted context omitted.
GNU Shepherd itself doesn't implement sandboxing, but you can use the least-authority-wrapper to do namespaces. There are other tools to do more comphrensive sandboxing, which Shepherd can use, e.g. nsjail. least-authority-wrapper: https://codeberg.org/guix/guix/src/commit/e3fbaeee1386fd447f...
Uoh, nsjail ha? The namespace for project names seems exhausted. No germans on the dev team, ey?
Writing a basic service for GNU Guix
21–30 of 30 posts
Re: Writing a basic service for GNU Guix
#22Earlier quoted context omitted.
Shepherd doesn't include this as it is quite lean and extensible (service start/stop hooks are functions that can do anything) but Guix includes a Linux container implementation and an abstraction built on top for use by services. The long term vision is to use an object capability security model so, rather than "locking down", a service can only interact with the resources to which it has been passed a reference. No…
I really like systemd but am also Guix-curious. This sandboxing topic has been a bit of a blocker for me to properly go deeper with Guix. Do you know of any good places to read more about this vision? Sounds powerful and unique.
Re: Writing a basic service for GNU Guix
#23Earlier quoted context omitted.
GNU Shepherd itself doesn't implement sandboxing, but you can use the least-authority-wrapper to do namespaces. There are other tools to do more comphrensive sandboxing, which Shepherd can use, e.g. nsjail. least-authority-wrapper: https://codeberg.org/guix/guix/src/commit/e3fbaeee1386fd447f...
Uoh, nsjail ha? The namespace for project names seems exhausted. No germans on the dev team, ey?
What is the problematic connotation for 'nsjail' in German?
Re: Writing a basic service for GNU Guix
#24From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
As someone who has tried both, I found the learning curve for Guix much more pleasant than for Nix. With Nix, the community is for sure a lot larger, and more things are available (notably it is a lot faster, too). But I could never get everything clear in my head, how it hangs together, and the community seemed very much more fragmented than with Guix. I think the Guix documentation and manual, as well as the CLI and secondary docs written in people's blogs, were much easier to get a handle on than with Nix. Flakes are a great example, I still have no idea what a flake is, they are still an experimental feature, and I have no idea how I should think about them. I've been using NixOS full time for 3 years by the way.
I also think the shepherd alone is almost a killer app relative to something like systemd. I had to write a service myself for restarting ssh tunnels, and I could even do "advanced" things like templated configuration, almost trivially. It felt like a superpower, relative to systemd services.
Re: Writing a basic service for GNU Guix
#25Earlier quoted context omitted.
Shepherd doesn't include this as it is quite lean and extensible (service start/stop hooks are functions that can do anything) but Guix includes a Linux container implementation and an abstraction built on top for use by services. The long term vision is to use an object capability security model so, rather than "locking down", a service can only interact with the resources to which it has been passed a reference. No…
I really like systemd but am also Guix-curious. This sandboxing topic has been a bit of a blocker for me to properly go deeper with Guix. Do you know of any good places to read more about this vision? Sounds powerful and unique.
Just to be clear, sandboxing is possible with Guix, with least-authority-wrapper as a built-in option. Regarding the long term vision of capability security, you can read the Spritely (the nonprofit I work for) whitepaper about capabilities and the work we're doing in Guile to make it happen [0]. The paper isn't about Guix, but Guix stands to benefit from the effort. Getting to the point where Guix services are capability secure will take many steps, but one step is bringing capabilities to Shepherd, which we have made progress on through an NLnet grant [1].
[0] https://files.spritely.institute/papers/spritely-core.html
Re: Writing a basic service for GNU Guix
#26Re: Writing a basic service for GNU Guix
#27From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
As someone who has tried both, I found the learning curve for Guix much more pleasant than for Nix. With Nix, the community is for sure a lot larger, and more things are available (notably it is a lot faster, too). But I could never get everything clear in my head, how it hangs together, and the community seemed very much more fragmented than with Guix. I think the Guix documentation and manual, as well as the CLI an…
the nix community is mostly from js so they have a tendency to quickly rushing to solve some problem, and this leads to a lot of cargo cult nonsense that often involves lot of blind copy and paste
Re: Writing a basic service for GNU Guix
#28Earlier quoted context omitted.
As someone who has tried both, I found the learning curve for Guix much more pleasant than for Nix. With Nix, the community is for sure a lot larger, and more things are available (notably it is a lot faster, too). But I could never get everything clear in my head, how it hangs together, and the community seemed very much more fragmented than with Guix. I think the Guix documentation and manual, as well as the CLI an…
the nix community is mostly from js so they have a tendency to quickly rushing to solve some problem, and this leads to a lot of cargo cult nonsense that often involves lot of blind copy and paste
Huh? Do the community surveys indicate that or something? JS definitely isn't the language I think of first when I think of Nix users.
Re: Writing a basic service for GNU Guix
#29From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
As someone who has tried both, I found the learning curve for Guix much more pleasant than for Nix. With Nix, the community is for sure a lot larger, and more things are available (notably it is a lot faster, too). But I could never get everything clear in my head, how it hangs together, and the community seemed very much more fragmented than with Guix. I think the Guix documentation and manual, as well as the CLI an…
> Flakes are a great example, I still have no idea what a flake is
A package that fully specifies its dependencies (via flake.nix/flake.lock) instead of depending on whatever the user has in their Nix channels. You enable them via:
nix.settings.experimental-features = [ "nix-command" "flakes" ];
The fun part with flakes is that they turn git repositories into full packages, meaning you can do stuff like:
nix run github:user/project?ref=v0.2.0rc1
That flakes are still marked as experimental is annoying, but they have been working fine for well over three years.