4 ms·

Yeah I've never used Nix so I don't know how it relates to cloud systems. As a developer, how would I use Nix to develop an app on my machine, and ship it to 1,

Yeah I've never used Nix so I don't know how it relates to cloud systems. As a developer, how would I use Nix to develop an app on my machine, and ship it to 1,000 cloud-orchestrated systems, using the same immutable image? Is there any reason why one would use Nix with Docker instead of Debian with Docker? Keep in mind that all large-scale systems work based on deploying container images. If it's not in a container image, it's not getting deployed.

sterlind 5y ago
Nix basically lets you compile to Docker containers, rather than running a pipeline of scripts with Dockerfiles. You can do that really fast, since you don't have to run the container to build it, and you can make images really small, because they'll contain exactly what they need. It's like the difference between shipping an app and shipping an OS with the app-preinstalled, except in this case neither has any external dependencies to worry about.
- fwip 5y ago
  Also, the nix expression you build an image with is deterministic, unlike Dockerfiles, which by-design aren't. (Dockerfiles are not the only way to build images, of course, but they are a common one).
- throwaway984393 5y ago
  Well that's good that it can make container images. Sounds like the main advantage is it's faster to install packages in the container image. But I don't understand how this could prevent you from still needing a pipeline of scripts. Installing packages is only a small part of building a typical container image, especially for custom apps being built to run in the cloud. Even if you have your dependencies, you need to compile, run tests, and potentially customize the files inside the container, typically using the programs already installed in the container. So since you're already running a pipeline of scripts in a container right after installing package deps, I'm not sure why one would use Nix for this when Debian works just as well?
  - aidenn0 5y ago
    > Sounds like the main advantage is it's faster to install packages in the container image. I think the main advantage is the builds are actually deterministic. Any Dockerfile with the equivalent of apt-get update in it becomes non-deterministic.
  - sterlind 5y ago
    Nix isn't an OS, Nix is a build system, sort of like Bazel. The way you use Nix as an OS (NixOS) is to make Nix build an OS for you. Every time you install a package or whatever, that's just an incremental recompilation. So say that you need to make a Docker container running nginx hosting a static website that you build with Jekyll. At a high level you'd write a Nix file like (very much pseudocode): with let site = buildWithJekyll src={"./src";}; let mynginx = nginx { wwwroot = site; }; docker.buildLayeredImage { inputs: mynginx, entrypoint: "./nginx" } Nix will run Jekyll to build the site, hash the build output and "site" gets that path. Then Nix takes Jekyll and writes a configuration file that sets wwwroot to the Jekyll output. Then Nix builds a container that runs nginx when it starts. If you just change the Nginx config it won't rerun Jekyll because it knows Jekyll's build inputs haven't changed. Nix is a build system that runs other build systems. Comparing Nix to Debian doesn't really make sense, it's like comparing build pipelines to makefiles.
- lom 5y ago
  I was building a docker image today with nix, but to my demise it ended up being over 90mb (loaded into the docker daemon). How can I make a docker image smaller?
  - sterlind 5y ago
    Make sure you're not bringing in superfluous dependencies. Use nativeBuildInputs (like devDependencies) when appropriate rather than buildInputs (like dependencies).
    - lom 5y ago
      Can I override stdenv to not pull in GNU stuff, but instead busybox. Or none at all? Stuff like that makes the image really small…
      - sterlind 5y ago
        stdenv shouldn't end up in the container at all. the container should literally just contain your derivation and its transitive dependencies. your app, its actual dependencies, and nothing else. it won't even contain bash unless you or something you reference adds it. stdenv stuff is just used to build, it doesn't end up in there. maybe use one of the nix tools to show the actual dependencies you're bringing in and cut the fat.
SkyMarshal 5y ago
I'm still relatively new to NixOS, having switched all my personal systems over to it this spring/summer. I don't do cloud dev atm, so haven't explored that use case yet. But I believe NixOPs is the canonical way to do what you're describing in production/at scale: https://github.com/NixOS/nixops https://github.com/NixOS/nixops https://nixos.org/nixops/manual/ https://nixos.org/nixops/manual/ (more below) If you want a more experienced answer, I suggest asking on the NixOS forum or subreddit, people are quick to answer in both places. https://discourse.nixos.org/ https://discourse.nixos.org/ https://www.reddit.com/r/NixOS/ https://www.reddit.com/r/NixOS/ ---- More useful NixOPs guides https://www.thedroneely.com/posts/nixops-towards-the-final-frontier/ https://www.thedroneely.com/posts/nixops-towards-the-final-f... https://ops.functionalalgebra.com/nixops-by-example/ https://ops.functionalalgebra.com/nixops-by-example/ https://nixops.readthedocs.io/en/latest/ https://nixops.readthedocs.io/en/latest/

sterlind 5y ago

Nix basically lets you compile to Docker containers, rather than running a pipeline of scripts with Dockerfiles. You can do that really fast, since you don't have to run the container to build it, and you can make images really small, because they'll contain exactly what they need. It's like the difference between shipping an app and shipping an OS with the app-preinstalled, except in this case neither has any external dependencies to worry about.

fwip 5y ago
Also, the nix expression you build an image with is deterministic, unlike Dockerfiles, which by-design aren't. (Dockerfiles are not the only way to build images, of course, but they are a common one).
throwaway984393 5y ago
Well that's good that it can make container images. Sounds like the main advantage is it's faster to install packages in the container image. But I don't understand how this could prevent you from still needing a pipeline of scripts. Installing packages is only a small part of building a typical container image, especially for custom apps being built to run in the cloud. Even if you have your dependencies, you need to compile, run tests, and potentially customize the files inside the container, typically using the programs already installed in the container. So since you're already running a pipeline of scripts in a container right after installing package deps, I'm not sure why one would use Nix for this when Debian works just as well?
- aidenn0 5y ago
  > Sounds like the main advantage is it's faster to install packages in the container image. I think the main advantage is the builds are actually deterministic. Any Dockerfile with the equivalent of apt-get update in it becomes non-deterministic.
- sterlind 5y ago
  Nix isn't an OS, Nix is a build system, sort of like Bazel. The way you use Nix as an OS (NixOS) is to make Nix build an OS for you. Every time you install a package or whatever, that's just an incremental recompilation. So say that you need to make a Docker container running nginx hosting a static website that you build with Jekyll. At a high level you'd write a Nix file like (very much pseudocode): with let site = buildWithJekyll src={"./src";}; let mynginx = nginx { wwwroot = site; }; docker.buildLayeredImage { inputs: mynginx, entrypoint: "./nginx" } Nix will run Jekyll to build the site, hash the build output and "site" gets that path. Then Nix takes Jekyll and writes a configuration file that sets wwwroot to the Jekyll output. Then Nix builds a container that runs nginx when it starts. If you just change the Nginx config it won't rerun Jekyll because it knows Jekyll's build inputs haven't changed. Nix is a build system that runs other build systems. Comparing Nix to Debian doesn't really make sense, it's like comparing build pipelines to makefiles.
lom 5y ago
I was building a docker image today with nix, but to my demise it ended up being over 90mb (loaded into the docker daemon). How can I make a docker image smaller?
- sterlind 5y ago
  Make sure you're not bringing in superfluous dependencies. Use nativeBuildInputs (like devDependencies) when appropriate rather than buildInputs (like dependencies).
  - lom 5y ago
    Can I override stdenv to not pull in GNU stuff, but instead busybox. Or none at all? Stuff like that makes the image really small…
    - sterlind 5y ago
      stdenv shouldn't end up in the container at all. the container should literally just contain your derivation and its transitive dependencies. your app, its actual dependencies, and nothing else. it won't even contain bash unless you or something you reference adds it. stdenv stuff is just used to build, it doesn't end up in there. maybe use one of the nix tools to show the actual dependencies you're bringing in and cut the fat.

SkyMarshal 5y ago

I'm still relatively new to NixOS, having switched all my personal systems over to it this spring/summer. I don't do cloud dev atm, so haven't explored that use case yet. But I believe NixOPs is the canonical way to do what you're describing in production/at scale: https://github.com/NixOS/nixops https://github.com/NixOS/nixops https://nixos.org/nixops/manual/ https://nixos.org/nixops/manual/ (more below) If you want a more experienced answer, I suggest asking on the NixOS forum or subreddit, people are quick to answer in both places. https://discourse.nixos.org/ https://discourse.nixos.org/ https://www.reddit.com/r/NixOS/ https://www.reddit.com/r/NixOS/ ---- More useful NixOPs guides https://www.thedroneely.com/posts/nixops-towards-the-final-frontier/ https://www.thedroneely.com/posts/nixops-towards-the-final-f... https://ops.functionalalgebra.com/nixops-by-example/ https://ops.functionalalgebra.com/nixops-by-example/ https://nixops.readthedocs.io/en/latest/ https://nixops.readthedocs.io/en/latest/