Writing a basic service for GNU Guix
tannerhoelzel.com
Writing a basic service for GNU Guix
1–10 of 30 posts
Re: Writing a basic service for GNU Guix
#2Two notes from reading the first several paragraphs:
1. It seems one needs to know some Scheme in order to write these files:
I don't think it's possible to just "wing it" by copy-and-paste.
2. I did not understand the introductory paragraph about how services "extend" each other. Does every service have hooks for possible extensions? What if a new service doesn't fit existing extension hooks?
(I can understand service dependencies of course, but it seems to go beyond that.)
Re: Writing a basic service for GNU Guix
#3Does GNU Shepherd support some form of sanboxing?
systemd has many options to reduce the privileges of a service: like running as a normal user with only certain POSIX capabilities, setting up a mount namespace with a limited view of the root filesystem, locking down which system calls can be invoked, etc.
Re: Writing a basic service for GNU Guix
#4From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
Re: Writing a basic service for GNU Guix
#5From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
Correct, and it's Linux-only and more hardcore FOSS (i .e. they don't have any blessed way to use non-free software).
I'm not sure why it's being sold as an alternative to Nix/NixOS
Re: Writing a basic service for GNU Guix
#6From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
Correct, and it's Linux-only and more hardcore FOSS (i .e. they don't have any blessed way to use non-free software). I'm not sure why it's being sold as an alternative to Nix/NixOS
Because it's an alternative which guarantees freedom?
Re: Writing a basic service for GNU Guix
#7From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
Guix is a reimagining of the concepts of Nix with Guile/Scheme instead of the Nix language, so they are very similar in overall feel, but differ in the details (e.g. GNU Shepherd vs systemd).
As for learning curve, I find Nix substantially easier, since the language is much simpler (JSON-like with lazy-functions) and doesn't need all that weirdness that result from using Scheme as configuration language (lots of quoting, module system, etc.)
Re: Writing a basic service for GNU Guix
#8Earlier quoted context omitted.
Correct, and it's Linux-only and more hardcore FOSS (i .e. they don't have any blessed way to use non-free software). I'm not sure why it's being sold as an alternative to Nix/NixOS
Because it's an alternative which guarantees freedom?
just not freedom to use propriety software
Re: Writing a basic service for GNU Guix
#9From a quick glance, Guix seems to have a similar learning curve as Nix (at least it's based on Scheme, which I know). Is that impression correct? Anyway, I didn't find this “intuitively comprehensible” as an outsider.
Correct, and it's Linux-only and more hardcore FOSS (i .e. they don't have any blessed way to use non-free software). I'm not sure why it's being sold as an alternative to Nix/NixOS
If you regard it as an alternative to NixOS rather than Nix the package manager then both are Linux.
Some people want FOSS only, some people dislike systemd, some people like Scheme....
Re: Writing a basic service for GNU Guix
#10Does GNU Shepherd support some form of sanboxing? systemd has many options to reduce the privileges of a service: like running as a normal user with only certain POSIX capabilities, setting up a mount namespace with a limited view of the root filesystem, locking down which system calls can be invoked, etc.
Shepherd doesn't include this as it is quite lean and extensible (service start/stop hooks are functions that can do anything) but Guix includes a Linux container implementation and an abstraction built on top for use by services. The long term vision is to use an object capability security model so, rather than "locking down", a service can only interact with the resources to which it has been passed a reference. No ambient authority, no confused deputies.