4 ms·

IMO initial value of docker for local development is enabling me to run two copies of postgres without them shitting on each other. I get that nix is supposed t

IMO initial value of docker for local development is enabling me to run two copies of postgres without them shitting on each other. I get that nix is supposed to be hermetic, but does it enable two of something? nix being really good at package management is something docker needs to imitate -- out of order apt-get without requiring a re-downloading all the packages, for example, seems like it would shrink most cloud build costs. I guess this is what the article means by trouble 'sharing layers' docker buildkit (or moby buildx or wherever the branding has settled) is supposed to to improve caching, but creating a simple API for caching that plays nicely with system + language package managers would really move the needle here; reorderable package installs would be the v2

jonstewart 5y ago
You can use Nix to create a tarball that can then be launched as a Docker container. However, I haven’t figured out a way to make Nix play nicely with container image layering—you get a small container image for deployment, but you’ll have lots of such largely-duplicative tarballs in the CI pipeline and the latency for generating them is annoying.
- clhodapp 5y ago
  Have you tried dockerTools.buildLayeredImage (https://nixos.org/manual/nixpkgs/stable/#ssec-pkgs-dockerTools-buildLayeredImage https://nixos.org/manual/nixpkgs/stable/#ssec-pkgs-dockerToo...)? It applies some smart heuristics (https://grahamc.com/blog/nix-and-layered-docker-images https://grahamc.com/blog/nix-and-layered-docker-images) to create images made of pretty reusable layers. This is subject to some false cache misses due to some laziness in the docker's cache implementation (https://github.com/moby/moby/issues/38446 https://github.com/moby/moby/issues/38446), but that is Docker's fault not nix's and it affects dockerfile builds too.
  - jonstewart 5y ago
    No, hadn’t seen that. Thanks!
- chriswarbo 5y ago
  I do this, but I don't use Docker; I just create a .tar.gz file for each layer, run them through the `sha256sum` command to get a digest, and generate a JSON config file (via builtins.toJSON). The result can be run by anything that supports OCI containers (e.g. AWS ECS).
otabdeveloper4 5y ago
> I get that nix is supposed to be hermetic, but does it enable two of something? No, it doesn't solve the TCP port isolation problem. (But Docker doesn't really either. Linux network namespaces should, but nobody bothered to develop tools for that yet.)
- awinter-py 5y ago
  on docker for linux you get different hosts for the containers. you'll still need to BYO way to assign them names -- I personally use direnv for this I think this doesn't work as well on docker desktop for mac
- nextaccountic 5y ago
  Doesn't docker-compose set up a private network interface?
xxpor 5y ago
Nix supports this quite well. https://nixos.org/manual/nix/stable/#multiple-versions https://nixos.org/manual/nix/stable/#multiple-versions The Nix and container mindset are very similar in that they refer to all of their dependencies, including down to glibc.
- xyzzy_plugh 5y ago
  Not quite. This is true for dependencies such as libraries but for services it's significantly trickier. Postgres, for example, would require configuring each version to use a distinct space for storage and configuration if you want to run them concurrently. It's still pretty easy with NixOS, but not as simple as you make it seem.
  - xxpor 5y ago
    It's one line of override configuration, how is that not trivial? Edit: Totally granted, figuring out that one line the first time might take 6 hours, but once you know how to do it you're good to go the next time. The documentation could certainly be improved.
- tyingq 5y ago
  Does Nix understand network namespacing? Or would 2 postgres instances clash over tcp listen ports? I get you could configure different ports, or virtual interfaces, but it sounds like either of those would be outside of the nix tooling.
  - wyager 5y ago
    I don't think it would be possible to do this in an OS-agnostic way. LXC and jails are too different, and I'm not even sure what the option would be in macOS.
    - ratorx 5y ago
      I don’t think NixOS (where service configuration would live) is system-agnostic. It relies heavily on systemd already.
soraminazuki 5y ago
You can, if you take steps to containerize the postgres processes. This can be done with NixOS's nixos-container, or any other container runtimes including Docker. nixos-container is easy to use if you already use NixOS. This separation of concerns is one of things I like about Nix when compared to something like Docker. For instance, if you use the Docker image format for packaging, then you're also forced to buy into its specific sandboxing model. With Nix, you can choose to run applications the way you see fit.

jonstewart 5y ago

You can use Nix to create a tarball that can then be launched as a Docker container. However, I haven’t figured out a way to make Nix play nicely with container image layering—you get a small container image for deployment, but you’ll have lots of such largely-duplicative tarballs in the CI pipeline and the latency for generating them is annoying.

clhodapp 5y ago
Have you tried dockerTools.buildLayeredImage (https://nixos.org/manual/nixpkgs/stable/#ssec-pkgs-dockerTools-buildLayeredImage https://nixos.org/manual/nixpkgs/stable/#ssec-pkgs-dockerToo...)? It applies some smart heuristics (https://grahamc.com/blog/nix-and-layered-docker-images https://grahamc.com/blog/nix-and-layered-docker-images) to create images made of pretty reusable layers. This is subject to some false cache misses due to some laziness in the docker's cache implementation (https://github.com/moby/moby/issues/38446 https://github.com/moby/moby/issues/38446), but that is Docker's fault not nix's and it affects dockerfile builds too.
- jonstewart 5y ago
  No, hadn’t seen that. Thanks!
chriswarbo 5y ago
I do this, but I don't use Docker; I just create a .tar.gz file for each layer, run them through the `sha256sum` command to get a digest, and generate a JSON config file (via builtins.toJSON). The result can be run by anything that supports OCI containers (e.g. AWS ECS).

otabdeveloper4 5y ago

> I get that nix is supposed to be hermetic, but does it enable two of something? No, it doesn't solve the TCP port isolation problem. (But Docker doesn't really either. Linux network namespaces should, but nobody bothered to develop tools for that yet.)

awinter-py 5y ago
on docker for linux you get different hosts for the containers. you'll still need to BYO way to assign them names -- I personally use direnv for this I think this doesn't work as well on docker desktop for mac
nextaccountic 5y ago
Doesn't docker-compose set up a private network interface?

xxpor 5y ago

Nix supports this quite well. https://nixos.org/manual/nix/stable/#multiple-versions https://nixos.org/manual/nix/stable/#multiple-versions The Nix and container mindset are very similar in that they refer to all of their dependencies, including down to glibc.

xyzzy_plugh 5y ago
Not quite. This is true for dependencies such as libraries but for services it's significantly trickier. Postgres, for example, would require configuring each version to use a distinct space for storage and configuration if you want to run them concurrently. It's still pretty easy with NixOS, but not as simple as you make it seem.
- xxpor 5y ago
  It's one line of override configuration, how is that not trivial? Edit: Totally granted, figuring out that one line the first time might take 6 hours, but once you know how to do it you're good to go the next time. The documentation could certainly be improved.
tyingq 5y ago
Does Nix understand network namespacing? Or would 2 postgres instances clash over tcp listen ports? I get you could configure different ports, or virtual interfaces, but it sounds like either of those would be outside of the nix tooling.
- wyager 5y ago
  I don't think it would be possible to do this in an OS-agnostic way. LXC and jails are too different, and I'm not even sure what the option would be in macOS.
  - ratorx 5y ago
    I don’t think NixOS (where service configuration would live) is system-agnostic. It relies heavily on systemd already.

soraminazuki 5y ago

You can, if you take steps to containerize the postgres processes. This can be done with NixOS's nixos-container, or any other container runtimes including Docker. nixos-container is easy to use if you already use NixOS. This separation of concerns is one of things I like about Nix when compared to something like Docker. For instance, if you use the Docker image format for packaging, then you're also forced to buy into its specific sandboxing model. With Nix, you can choose to run applications the way you see fit.