4 ms·

I recently set up a new server for a toy project with nixos and it was a pleasurable experience, even if I did have to pull together several sources of somewhat

I recently set up a new server for a toy project with nixos and it was a pleasurable experience, even if I did have to pull together several sources of somewhat thin documentation. Recommended. Next time I set up a new dev machine I'm going to give nix a try for dev environment management. Using nixops to push a closure from your local system up to ec2 is very pleasing. It feels like the future.

arianvanp 10y ago
I did this too until there was a glibc vulnerability. and it took ages for a 'patch' to come out that had to be installed in an obscure way. For a toy project this is not a problem of course. But before I'd use nixos in production, it needs a better story for security patches. If you try to look up the word 'security' you get viagra spam on their wiki. and there is no security mailinglist whatsoever iirc. I'm sure this will improve over time though. And for development, nix is still a saviour.
- lfam 10y ago
  In Guix, we address this problem with grafting. Rather than rebuild everything that depends on the fixed glibc, we build the fixed glibc, then rewrite all references to the old glibc to refer to the new one. That rewriting happens in new copies of the referring packages, of course, since the "store" is immutable. https://www.gnu.org/software/guix/manual/html_node/Security-Updates.html https://www.gnu.org/software/guix/manual/html_node/Security-... https://savannah.gnu.org/forum/forum.php?forum_id=8470 https://savannah.gnu.org/forum/forum.php?forum_id=8470
  - jb55 10y ago
    Nix has a way of doing this as well, just needs a better UX (like most of nix).
    - technomancy 10y ago
      > just needs a better UX Luckily guix is a better UX for nix. =)
    - msiebuhr 10y ago
      I was quite surprised that `nix install vim` didn't work out of the box. More so after realising that there's not even a `nix` command. I see that there's a bunch of `nix-whatever` tools around, but even their names aren't much sensible. I'm not in doubt that nix is technically superior to homebrew, but UX-wise it's at least been a disappointing experience for me.
      - panglott 10y ago
        What Nix for Mac needs more than anything is a great, simple overview of how to use it in practice, for casual users. I use it as my main package manager, but I install software with it rarely enough that I need to dig around in the manpages every time.
  - zenlikethat 10y ago
    Doesn't this affect the promised reproducibility of builds?
    - davexunit 10y ago
      No, there's no compromise there.
    - lfam 10y ago
      You end up with a new, grafted dependency graph, which can be reproduced just like the un-grafted graph. Is there some other reproducibility issue you see?
_query 10y ago
NixOS is pretty awesome :) For anyone trying to start with NixOS, I suggest trying it out on a small DigitalOcean server. Check out this[0] blog post on some hints how to install NixOS there. A big help is IMO to get a solid understanding about how nix itself works[1]. Also check out some existing `configuration.nix` files on GitHub. Just google for "github configuration.nix". This might give you some inspiration what you can do with the `configuration.nix`. If you have some trouble with customizing vim on NixOS/via nix, checkout this[2] blog post I wrote a month ago. Hope it helps :) [0] http://blog.tinco.nl/2016/02/05/nixos-on-digital-ocean.html http://blog.tinco.nl/2016/02/05/nixos-on-digital-ocean.html [1] https://nixos.org/nix/about.html https://nixos.org/nix/about.html [2] https://www.mpscholten.de/nixos/2016/04/11/setting-up-vim-on-nixos.html https://www.mpscholten.de/nixos/2016/04/11/setting-up-vim-on...
- JonnieCache 10y ago
  I found this blogpost helpful: http://zef.me/blog/5981/deploying-a-simple-node-js-application-with-nixops?rq=nixos http://zef.me/blog/5981/deploying-a-simple-node-js-applicati...
- lgas 10y ago
  Is there a reason you suggest trying it on DO instead of a local VM?

arianvanp 10y ago

I did this too until there was a glibc vulnerability. and it took ages for a 'patch' to come out that had to be installed in an obscure way. For a toy project this is not a problem of course. But before I'd use nixos in production, it needs a better story for security patches. If you try to look up the word 'security' you get viagra spam on their wiki. and there is no security mailinglist whatsoever iirc. I'm sure this will improve over time though. And for development, nix is still a saviour.

lfam 10y ago
In Guix, we address this problem with grafting. Rather than rebuild everything that depends on the fixed glibc, we build the fixed glibc, then rewrite all references to the old glibc to refer to the new one. That rewriting happens in new copies of the referring packages, of course, since the "store" is immutable. https://www.gnu.org/software/guix/manual/html_node/Security-Updates.html https://www.gnu.org/software/guix/manual/html_node/Security-... https://savannah.gnu.org/forum/forum.php?forum_id=8470 https://savannah.gnu.org/forum/forum.php?forum_id=8470
- jb55 10y ago
  Nix has a way of doing this as well, just needs a better UX (like most of nix).
  - technomancy 10y ago
    > just needs a better UX Luckily guix is a better UX for nix. =)
  - msiebuhr 10y ago
    I was quite surprised that `nix install vim` didn't work out of the box. More so after realising that there's not even a `nix` command. I see that there's a bunch of `nix-whatever` tools around, but even their names aren't much sensible. I'm not in doubt that nix is technically superior to homebrew, but UX-wise it's at least been a disappointing experience for me.
    - panglott 10y ago
      What Nix for Mac needs more than anything is a great, simple overview of how to use it in practice, for casual users. I use it as my main package manager, but I install software with it rarely enough that I need to dig around in the manpages every time.
- zenlikethat 10y ago
  Doesn't this affect the promised reproducibility of builds?
  - davexunit 10y ago
    No, there's no compromise there.
  - lfam 10y ago
    You end up with a new, grafted dependency graph, which can be reproduced just like the un-grafted graph. Is there some other reproducibility issue you see?

_query 10y ago

NixOS is pretty awesome :) For anyone trying to start with NixOS, I suggest trying it out on a small DigitalOcean server. Check out this[0] blog post on some hints how to install NixOS there. A big help is IMO to get a solid understanding about how nix itself works[1]. Also check out some existing `configuration.nix` files on GitHub. Just google for "github configuration.nix". This might give you some inspiration what you can do with the `configuration.nix`. If you have some trouble with customizing vim on NixOS/via nix, checkout this[2] blog post I wrote a month ago. Hope it helps :) [0] http://blog.tinco.nl/2016/02/05/nixos-on-digital-ocean.html http://blog.tinco.nl/2016/02/05/nixos-on-digital-ocean.html [1] https://nixos.org/nix/about.html https://nixos.org/nix/about.html [2] https://www.mpscholten.de/nixos/2016/04/11/setting-up-vim-on-nixos.html https://www.mpscholten.de/nixos/2016/04/11/setting-up-vim-on...

JonnieCache 10y ago
I found this blogpost helpful: http://zef.me/blog/5981/deploying-a-simple-node-js-application-with-nixops?rq=nixos http://zef.me/blog/5981/deploying-a-simple-node-js-applicati...
lgas 10y ago
Is there a reason you suggest trying it on DO instead of a local VM?