4 ms·

> The basic idea is to image with some lean/vanilla image, then run the script to put the system into the desired state. Spot on. Much better than most CM tool

> The basic idea is to image with some lean/vanilla image, then run the script to put the system into the desired state. Spot on. Much better than most CM tools. The Nix setup is pretty hackish and does not track files changed by running applications. What we really need is automatic version history on whole filesystems.

pas 7y ago
ZFS (and btrfs) snapshot diff does that easily. Also any overlay filesystem. But after a point combing through the diff becomes an insurmountable task. Nix forces the user to declare what goes where up front. (And yes, it's not exactly a user friendly syntax/style. systemd has support for WorkingDirectory, RootDirectory, RootImage, RuntimeDirectory, StateDirectory, CacheDirectory, LogsDirectory and ConfigurationDirectory, but so far most unit files don't take advantage of that.)
- downerending 7y ago
  This is nice to have, but it doesn't really distinguish between the "logical" differences and the "physical" differences. As a trivial example, one step in one's setup script might be "install package X". That can end up creating/modifying a lot of files, but many of those differences aren't necessarily meaningful or something one would want to carry into future reimages. And as things progress over time, those diffs might even be "wrong". I liken it to whittling vs CNC. Either can be the right way to go, but usually at scale we end up doing better with CNC. And the best CNC program is a compact one.
  - pas 7y ago
    That's the advantage of Nix's top-down approach. You declare everything on as high level as you want/can/wish. You specify the package plus your customization for it. It's not that much different than a one-liner that installs the package plus uses echo to write your config file. The magic is the "forced" reproducibility by default.
    - downerending 7y ago
      Conceptually, I think nix is great. Most of us can appreciate the value of a perfectly reproducible system, etc. That said, unfortunately nix is a practical option for about zero percent of commercial shops. Sigh. I did actually work at a place that tried it once. Summarizing, the introduction failed through some combination of politics and the perception that nix would introduce a lot of complexity vs a standard vendor distro.
- eeZah7Ux 7y ago
  No, it's not automated and does not track changes with the required granularity: what file is changed by what application, what OS package and what reason.
  - pas 7y ago
    If you use docker (which uses overlay2) for every application you can easily track these changes. I don't think even Nix can/does track anything on this level. That said, yes, something like that would be great. Using overlay + namespaces/cgroups could get us close to that. Then we'd have to detect which packages are completely passive (read only, shared dependency of many others) which are shared but have their own state, which are shared but their state is a mix of per-dependant states (so if multiple packages/apps depend on a DB service then the schemas/tables ought to be isolated), and so on.
    - eeZah7Ux 7y ago
      > If you use docker (which uses overlay2) for every application you can easily track these changes No: it can only create a serialized sequence of changes that cannot be reordered. Also it's not aware of the context and meaning of a change. > That said, yes, something like that would be great. Using overlay + namespaces/cgroups could get us close to that. Then we'd have to detect which packages are completely passive (read only, shared dependency of many others) which are shared but have their own state, which are shared but their state is a mix of per-dependant states (so if multiple packages/apps depend on a DB service then the schemas/tables ought to be isolated), and so on. apt-get based distribution already track which files and directories are related to which package. Also systemd unit files already can ensure that daemons are not making changes elsewhere. Indeed, what's missing is tracking dependencies across applications and across hosts. Linux distributions got most of it right decades ago (before the container dumpster fire)
eeZah7Ux 7y ago
How comes that every time I post from this account I get few immediate downvotes and when I use other accounts it does not happen? Interesting...
- downerending 7y ago
  Perhaps you mixed tabs and spaces in a past life.

pas 7y ago

ZFS (and btrfs) snapshot diff does that easily. Also any overlay filesystem. But after a point combing through the diff becomes an insurmountable task. Nix forces the user to declare what goes where up front. (And yes, it's not exactly a user friendly syntax/style. systemd has support for WorkingDirectory, RootDirectory, RootImage, RuntimeDirectory, StateDirectory, CacheDirectory, LogsDirectory and ConfigurationDirectory, but so far most unit files don't take advantage of that.)

downerending 7y ago
This is nice to have, but it doesn't really distinguish between the "logical" differences and the "physical" differences. As a trivial example, one step in one's setup script might be "install package X". That can end up creating/modifying a lot of files, but many of those differences aren't necessarily meaningful or something one would want to carry into future reimages. And as things progress over time, those diffs might even be "wrong". I liken it to whittling vs CNC. Either can be the right way to go, but usually at scale we end up doing better with CNC. And the best CNC program is a compact one.
- pas 7y ago
  That's the advantage of Nix's top-down approach. You declare everything on as high level as you want/can/wish. You specify the package plus your customization for it. It's not that much different than a one-liner that installs the package plus uses echo to write your config file. The magic is the "forced" reproducibility by default.
  - downerending 7y ago
    Conceptually, I think nix is great. Most of us can appreciate the value of a perfectly reproducible system, etc. That said, unfortunately nix is a practical option for about zero percent of commercial shops. Sigh. I did actually work at a place that tried it once. Summarizing, the introduction failed through some combination of politics and the perception that nix would introduce a lot of complexity vs a standard vendor distro.
eeZah7Ux 7y ago
No, it's not automated and does not track changes with the required granularity: what file is changed by what application, what OS package and what reason.
- pas 7y ago
  If you use docker (which uses overlay2) for every application you can easily track these changes. I don't think even Nix can/does track anything on this level. That said, yes, something like that would be great. Using overlay + namespaces/cgroups could get us close to that. Then we'd have to detect which packages are completely passive (read only, shared dependency of many others) which are shared but have their own state, which are shared but their state is a mix of per-dependant states (so if multiple packages/apps depend on a DB service then the schemas/tables ought to be isolated), and so on.
  - eeZah7Ux 7y ago
    > If you use docker (which uses overlay2) for every application you can easily track these changes No: it can only create a serialized sequence of changes that cannot be reordered. Also it's not aware of the context and meaning of a change. > That said, yes, something like that would be great. Using overlay + namespaces/cgroups could get us close to that. Then we'd have to detect which packages are completely passive (read only, shared dependency of many others) which are shared but have their own state, which are shared but their state is a mix of per-dependant states (so if multiple packages/apps depend on a DB service then the schemas/tables ought to be isolated), and so on. apt-get based distribution already track which files and directories are related to which package. Also systemd unit files already can ensure that daemons are not making changes elsewhere. Indeed, what's missing is tracking dependencies across applications and across hosts. Linux distributions got most of it right decades ago (before the container dumpster fire)

eeZah7Ux 7y ago

How comes that every time I post from this account I get few immediate downvotes and when I use other accounts it does not happen? Interesting...

downerending 7y ago
Perhaps you mixed tabs and spaces in a past life.