Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What Is Nix?

engineering.shopify.com

Post reply on HN
Print view View original

91–100 of 344 posts

Re: What Is Nix?

#91

Post by downerending »

tomberek wrote: post #86

Nix is a powerful package manager. I can confidently compile and run multiple incompatible versions of software simultaneously. I can build projects from years ago. I can package large projects from different ecosystems (python 2/3, c/c++, go, javascript) and be confident they will not interfere with each other. I can try bleeding edge software with no risk to it interfering with my system. It is faster and less hass…

As an example, what's minimally required to run two different versions of program-x from the command line. Can I do something like this easily?

    cat-8.22 /etc/passwd | cat-8.3 -A

Re: What Is Nix?

#92

Post by maytc »

throwaway894345 wrote: post #80
WatchDog wrote: post #74

Earlier quoted context omitted.

I haven't used Nix, but I would have thought that builds would be fast, due to how cache-able the dependencies should be.

Sounds like they were building everything from scratch, for some reason.

That’s how nix guarantees reproducibility. The compiled artifacts can be cached but that didnt quite work out of the box

Re: What Is Nix?

#94

Post by mehrdadn »

paul_milovanov wrote: post #81
throwaway894345 wrote: post #50

Earlier quoted context omitted.

> the DockerFiles themselves can also describe a reproducible process This is true, but Docker does almost nothing to support reproducibility. As soon as you do an apt-get, reproducibility goes out the window. > they are certainly "incremental" due to caching Caching is layer-based. Docker has no awareness of whether or not a particular dependency has changed or what is necessary to rebuild it. Docker only understand…

Bazel is buggy?! Bazel is not a clone, it's the refactoring of the internal build system, basically. I am 99% certain that Blaze currently has Bazel at the core. And it's pretty damn robust.

Bazel is definitely buggy. One of the silliest ones is this one (and as far as this one goes, I do not understand how this issue exists when Blaze has been used in Google for such a long itme): https://github.com/bazelbuild/bazel/issues/9419

One of the more fundamental bugs is this one: https://github.com/bazelbuild/bazel/issues/4558

I've even had to clean --expunge and clear my disk cache to fix some build errors before. Bazel paints a rosy picture of the world, but the real world is messy, and Bazel builds aren't as reproducible as it makes you want to think. (Which BTW is one thing that's had me asking so many questions about Nix.) At least the fact that it does not track changes outside the workspace means you can update your system compilers (or Python, or whatever) and end up with build outputs that will not be reproduced from scratch.

It takes a lot of time to track the issues down, so I don't necessarily know what goes wrong every time; these are just two issues I remember off the top of my head. But if you haven't run into bugs with Bazel then you haven't used it seriously enough.

And then there's the Python support which is even more half-baked right now. Their own comments readily mention that the Python support is not idiomatic. (Not just in terms of syntax, but some of it goes against Bazel's underlying design.)

Of course I say this with the full realization that "fixing" these things can be a huge undertaking (up to and including hooking the compiler programs manually), but that doesn't mean they're not bugs.

Re: What Is Nix?

#95

Post by Ericson2314 »

mehrdadn wrote: post #11
pjkundert wrote: post #6

Earlier quoted context omitted.

POSIX (eg. Linux), Mac and Windows. Yes, it is magnificent. Immutable, deterministic software on all 3 major platforms. Combined with cached build artifacts, builds and their outputs (including complete target system updates/upgrades) are blisteringly fast, cryptographically secure and completely deterministic. EDIT: Sorry, yes; Windows only via WSL, not natively on Windows proper.

Windows ? You're kidding me! Where do I see Windows support? On their website I only see Mac and Linux.

https://github.com/NixOS/nix/pull/3185 please somebody throw github.com/volth or me money to finish this

Re: What Is Nix?

#96

Post by Ericson2314 »

genr8 wrote: post #69

Stumbled upon NixOS yesterday and today its frontpage, 1st link. Same thing happened with OpenBSD the day before. Whats tomorrow, Qubes? I wonder what the chances of coincidence are if I investigate one new OS per day. https://www.foxypossibilities.com/2018/02/04/running-matrix-... https://en.wikipedia.org/wiki/NixOS

No tomorrow could be BSD and Nix https://github.com/NixOS/nixpkgs/pull/82131

Re: What Is Nix?

#97

Post by aeontech »

ninetax wrote: post #63
tel wrote: post #20

Earlier quoted context omitted.

It's kind of a mess. Nix is a collection of tools and systems that together form a highly reproducible build system. Nix is also a declarative, largely pure and lazy programming language that you use to design and specify the different build outputs for the Nix build system. Nixpkgs is, more or less, the only project written using Nix (and a lot of shell). It's a collection of many thousands of "derivations", many of…

Unfortunately there's a pretty annoying bug with MacOS which resulted from Apple making /nix non-writable by default. And since /nix is hard coded in all the cached packages it's not easy to fix. This is one big thing that's preventing us from adopting nix https://github.com/NixOS/nix/issues/2925

It's not a bug in macOS, it's a security feature.

However, you can use synthetic firmlinks to define arbitrary root-level paths that _are_ writable.

See `man synthetic.conf` and check out https://derflounder.wordpress.com/2020/01/18/creating-root-l... for an example usage.

PS: It looks like nix has a PR open to test that solution here: https://github.com/NixOS/nix/pull/3212

Re: What Is Nix?

#98

Post by throwaway894345 »

maytc wrote: post #92
throwaway894345 wrote: post #80

Earlier quoted context omitted.

Sounds like they were building everything from scratch, for some reason.

That’s how nix guarantees reproducibility. The compiled artifacts can be cached but that didnt quite work out of the box

Nix guarantees reproducibility, which means anything can be rebuilt from scratch, but that's a very abnormal use case. If it didn't work out of the box, it's a problem with the package scripts (the "derivations"). That said, all of our software tends to bottom out in a bunch of shitty C libraries that are all delicately cobbled together with autotools and cmake, so anything that aspires to reproduce these things is going to have issues. This tends to make Nix difficult to use, because it doesn't have nearly the same investment/manpower (yet) as other package ecosystems that is necessary to wrangle these dependencies into a stable foundation that doesn't leak its underlying havoc to higher levels of the stack.

Re: What Is Nix?

#99

Post by mehrdadn »

Kinrany wrote: post #83
illumin8 wrote: post #70

Earlier quoted context omitted.

I've had the (dis)pleasure of working with several projects that have been built by developers that have religion around Nix. These projects were contract work where the client paid a significant amount of money, and the final product was really poor quality. One of them is a financial application that has strict security requirements, so having a reproducible build system and some of the other qualities of Nix sound…

So the auditors said that the system was hard to audit?

Putting it this way it misses the point of that statement, but yes, that does appear to be what they said.

Re: What Is Nix?

#100

Post by CapriciousCptl »

woah wrote: post #82
illumin8 wrote: post #70

Earlier quoted context omitted.

I've had the (dis)pleasure of working with several projects that have been built by developers that have religion around Nix. These projects were contract work where the client paid a significant amount of money, and the final product was really poor quality. One of them is a financial application that has strict security requirements, so having a reproducible build system and some of the other qualities of Nix sound…

Ah yes.. cryptocurrency, where bizarre programming practices secure large sums of money

LOL. Reading that audit report made me immediately wonder who in the heck is blowing money on bringing new tech to their critical finance systems. And then I saw your post and, yes, that answers that.
Post reply on HN