3 ms·
I'm a big fan of Guix/Nix and would love to see them in greater use. Whilst I agree that they provide many of the reproducibly benefits of containers, isn't th
by mands 11y ago
I'm a big fan of Guix/Nix and would love to see them in greater use.
Whilst I agree that they provide many of the reproducibly benefits of containers, isn't the other big advantage of containers the (theoretical) security benefits they bring? i.e. a process can't break out of its container and access other data.
Perhaps I'm missing something but can such isolation be provided by Guix/Nix?
- davexunit 11y agoYes it can. The build daemon already uses containers to create the isolated environments to perform builds in so that we can view builds as pure functions. Nix uses systemd-nspawn for making NixOS containers. Guix uses a Scheme interface that I wrote called call-with-container to build GuixSD containers or simple containers without an init system via 'guix environment'. call-with-container is a work in progress, but some of the code has already made it to master, and the rest of it should land in master in time for the next release.
- mands 11y agoThat's great to hear, thanks for the work, I look forward to trying it out. Using Guix with systemd-nspawn sounds like it could be a formidable combination.
- davexunit 11y agoGuix doesn't use systemd, but maybe you could still use systemd-nspawn somehow? call-with-container will be the preferred mechanism on Guix, since it will integrate tightly with the rest of the system.
- mands 11y agoApologies for the confusion - I assume call-with-container talks to the required kernel functionality directly instead.