4 ms·

Nix seems great for build servers. This is a great introduction to the motivations behind it. I'm not sold on using it for managing developer environments (ano

Nix seems great for build servers. This is a great introduction to the motivations behind it. I'm not sold on using it for managing developer environments (another use case it is often used for). It "solves" the problem that developers might be using different versions of libraries or compilers on their machines... but it comes at the cost of having to learn a whole new programming language, a configuration language, a whole new jargon, and workflow. It's a bit like using Docker as a development environment. It introduces a non-trivial amount of friction. Some folks get excited about package management and configuration. Personally I don't care for it enough to over-come such a high learning curve. And I don't particularly like the workflow it enforces. However it is pretty great for reproducible CI/CD systems like Hydra: https://github.com/NixOS/hydra https://github.com/NixOS/hydra

xyzzy_plugh 4y ago
Hydra is arguably one of the scariest parts of Nix: A giant, bespoke CI system written in C++. Arguably it shouldn't exist. Nix can and should easily slot into any CI tool.
- pxc 4y ago
  There are couple of CI/CD systems being produced by startups that aim to fill that role, based on BuildKit/Docker. For now, Nix is still way better than they are in many ways, with the notable exception of Windows support. Maybe visible interest in them can push forward Nix community developer interest in polishing Nix for the same use cases.
- octoberfranklin 4y ago
  And, unlike nixpkgs, Hydra is pretty unfriendly to contributions. There is one master trusted public key for nix: 6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= It is hardwired into the nix source code and every (unpatched) build of nix from the last decade or so. There is no revocation system. There is no public key infrastructure. If that key gets compromised, there is no backup plan. I love Nix, but this is batshit crazy. The Hydra instance has access to the corresponding private key. So the people who merge changes to Hydra are understandably paranoid. Unfortunately this has turned the codebase into a mess.
  - infogulch 4y ago
    > There is one master trusted public key .. It is hardwired into the nix source code .. There is no revocation system .. The Hydra instance has access to the private key > it is built in C++
KingMachiavelli 4y ago
In my experience Nix works pretty great for developer environments when you don't previously have anything more than manually configured dev servers. (In general Nix is much easier to buy into if you don't already extensively use Docker, k8s, etc.) For smaller teams with less experienced developers any tool is going to have a fairly high learning curve. Instead of having everyone learn Nix or Docker, it's very easier to have a few, more Linux experienced devs configure servers and devshells using Nix while providing simple TUI for developers to access various tools. There are some headaches, if you want to use a full NixOS environment then there are some complications with tools like VSCode and NodeJS that download dynamically linked binaries but its terrible difficult to workaround.

xyzzy_plugh 4y ago

Hydra is arguably one of the scariest parts of Nix: A giant, bespoke CI system written in C++. Arguably it shouldn't exist. Nix can and should easily slot into any CI tool.

pxc 4y ago
There are couple of CI/CD systems being produced by startups that aim to fill that role, based on BuildKit/Docker. For now, Nix is still way better than they are in many ways, with the notable exception of Windows support. Maybe visible interest in them can push forward Nix community developer interest in polishing Nix for the same use cases.
octoberfranklin 4y ago
And, unlike nixpkgs, Hydra is pretty unfriendly to contributions. There is one master trusted public key for nix: 6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= It is hardwired into the nix source code and every (unpatched) build of nix from the last decade or so. There is no revocation system. There is no public key infrastructure. If that key gets compromised, there is no backup plan. I love Nix, but this is batshit crazy. The Hydra instance has access to the corresponding private key. So the people who merge changes to Hydra are understandably paranoid. Unfortunately this has turned the codebase into a mess.
- infogulch 4y ago
  > There is one master trusted public key .. It is hardwired into the nix source code .. There is no revocation system .. The Hydra instance has access to the private key > it is built in C++

KingMachiavelli 4y ago

In my experience Nix works pretty great for developer environments when you don't previously have anything more than manually configured dev servers. (In general Nix is much easier to buy into if you don't already extensively use Docker, k8s, etc.) For smaller teams with less experienced developers any tool is going to have a fairly high learning curve. Instead of having everyone learn Nix or Docker, it's very easier to have a few, more Linux experienced devs configure servers and devshells using Nix while providing simple TUI for developers to access various tools. There are some headaches, if you want to use a full NixOS environment then there are some complications with tools like VSCode and NodeJS that download dynamically linked binaries but its terrible difficult to workaround.