4 ms·

I had an idea recently to try out Fedora silverblue with Guix on top. Silverblue gives you an immutable root filesystem, which is great for building a reliable

by bogwog 4y ago

I had an idea recently to try out Fedora silverblue with Guix on top. Silverblue gives you an immutable root filesystem, which is great for building a reliable and reproducible system, but it makes installing software more complicated. Containers are the main solution, and stuff like flatpaks and toolbox. That (mostly) works, but it’s a bit heavy handed and not without annoyances. But with guix, your packages live in the guix store, and don’t touch your os packages. So that seems like a good way to manage software on top of an immutable OS. Unfortunately when I went to try it out, I learned that the only way to change the default location of the guix store (since /gnu/store won’t work in silverblue, and Guix isn’t available as a package for fedora) is to build it from source... and then I ran into some build issues when trying to do that and gave up. ...So maybe someone less lazy than I will pull it off and report back whether it’s actually a good idea or not!

deleted 4y ago
[deleted]
deleted 4y ago
[deleted]
Infernal 4y ago
I'm downloading the silverblue iso right now to play with this in a VM. It is surprising to me that ostree does not let you do any sort of bind mount or symlink of a non-reserved location like /gnu to some other filesystem, so I'll have a whack at it.
- bogwog 4y ago
  > It is surprising to me that ostree does not let you do any sort of bind mount or symlink of a non-reserved location like /gnu to some other filesystem, so I'll have a whack at it. ...Well, it might. I actually had zero experience with both ostree/silverblue and guix when I tried doing this, and may have made some hasty assumptions. EDIT: I do know however that guix doesn't work if the store is a symlink. I tried doing that a while back and it didn't work.
- Infernal 4y ago
  So you can create /gnu/store on Silverblue with the commands (as root) chattr -i / mkdir -p /gnu/store chattr +i / The last command restores the immutable attribute on the root filesystem. I am able to write arbitrary files (e.g. `touch /gnu/store/test`) even with that attribute set, so it isn't inherited by subdirectories (maybe obvious). Now, persistence of the /gnu/store data could be an issue, I'm not sure, but maybe this gets you started? EDIT: next step is to get Guix installed and then try to update the system, we shall see how it goes
  - bogwog 4y ago
    I just tried doing that to create the bind mount at /gnu/store via fstab, and it disappeared on reboot (and threw me into an emergency console). Removing the fstab line allowed me to boot normally again. I think the solution will require using systemd to recreate that folder on boot, and do it early enough to not make the system panic like that. Maybe that's a bad idea, I don't know enough about ostree/silverblue. However, after some more digging it seems like this solution would be preferable to changing the default guix store with a custom build, since doing that means you can't use any of the pre-compiled binary packages from the official guix servers.
  - Infernal 4y ago
    So, having removed the immutable attribute from / and run the guix-install.sh script, the first issue I have is that the script thinks the group 'kvm' exists, because 'getent group kvm' returns successfully. However, if you try to create a user and add them to the kvm group, you get an error about the group not existing. Looking at the contents of /etc/group, there are only 5 groups and none of them are 'kvm'. At the very least it seems that the Guix install script is making some assumptions about the system that Silverblue breaks, which does make me wonder a bit about using the two side by side. Additionally, I have found some posts as far back as 2017 regarding using Guix or Nix on Fedora Atomic Linux or Fedora Container Linux (it seems the Silverblue name is more recent) and the fact that we're still puzzling it out 5 years later without much in the way of documented success does make me question the viability of the idea a bit.
- yjftsjthsd-h 4y ago
  Wouldn't that require that the mountpoint exists in the underlying filesystem? That is, you can't create a /gnu directory to mount into if root is read-only EDIT: Or is the filesystem not literally read-only? Sibling comment seems to imply that it's just chattr +I'd
  - bogwog 4y ago
    I just tried it, and the folder created via chattr disappered after rebooting. So it seems like there's more to it.
podiki 4y ago
Not on Silverblue but I've used a bindmount to have /gnu/store elsewhere (due to disk space on a laptop). I can dig up some notes if that is helpful.
- bogwog 4y ago
  I didn't think to try doing a bind mount, so that might actually work. I'll need to try it again at some point!
- 0xCMP 4y ago
  Used this same trick to use `$HOME/nix` for my nix store on a remote system that had a slow and ephemeral disk for the root fs, but a fast and persistent one for my home folder.
pca006132 4y ago
Not sure about guix, but for nixos we have https://github.com/nix-community/nix-user-chroot https://github.com/nix-community/nix-user-chroot
- pxc 4y ago
  You can do a pivot_root based install of Guix: https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROOT.org https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROO...
colordrops 4y ago
What does silverblue give you on top of what Guix and Nix already provide?
- bogwog 4y ago
  In Guix's case, a working desktop with wayland + proprietary Nvidia drivers. (I'm actually using Kinoite, which is the KDE spin of silverblue) I could install Guix on top of something like Ubuntu or Fedora workstation for the same effect, but then I'll have two system package managers side by side, which is pointless and probably error prone.
  - von_lohengramm 4y ago
    You can do that with NixOS trivially.
    - rekado 4y ago
      And of course with Guix System. (odd to always see Nix* mentioned when someone talks about Guix.)
      - striking 4y ago
        Comparing https://wiki.systemcrafters.cc/guix/nvidia/ https://wiki.systemcrafters.cc/guix/nvidia/ with https://nixos.wiki/wiki/Nvidia https://nixos.wiki/wiki/Nvidia makes me think that in this specific case there's a difference.
        pxc 4y ago
        A question for nonguix contributors, including OP: is there a reason that nonguix has an nvidia package but not an nvidia service that handles more of this in a streamlined way, even just some stuff copied and pasted from this wiki?
        podiki 4y ago
data_maan 4y ago
So would guix be something like an even slimmer version of docker (which in turn isna slim version of a VM)?

by bogwog 4y ago

deleted 4y ago

[deleted]

deleted 4y ago

[deleted]

Infernal 4y ago

I'm downloading the silverblue iso right now to play with this in a VM. It is surprising to me that ostree does not let you do any sort of bind mount or symlink of a non-reserved location like /gnu to some other filesystem, so I'll have a whack at it.

bogwog 4y ago
> It is surprising to me that ostree does not let you do any sort of bind mount or symlink of a non-reserved location like /gnu to some other filesystem, so I'll have a whack at it. ...Well, it might. I actually had zero experience with both ostree/silverblue and guix when I tried doing this, and may have made some hasty assumptions. EDIT: I do know however that guix doesn't work if the store is a symlink. I tried doing that a while back and it didn't work.
Infernal 4y ago
So you can create /gnu/store on Silverblue with the commands (as root) chattr -i / mkdir -p /gnu/store chattr +i / The last command restores the immutable attribute on the root filesystem. I am able to write arbitrary files (e.g. `touch /gnu/store/test`) even with that attribute set, so it isn't inherited by subdirectories (maybe obvious). Now, persistence of the /gnu/store data could be an issue, I'm not sure, but maybe this gets you started? EDIT: next step is to get Guix installed and then try to update the system, we shall see how it goes
- bogwog 4y ago
  I just tried doing that to create the bind mount at /gnu/store via fstab, and it disappeared on reboot (and threw me into an emergency console). Removing the fstab line allowed me to boot normally again. I think the solution will require using systemd to recreate that folder on boot, and do it early enough to not make the system panic like that. Maybe that's a bad idea, I don't know enough about ostree/silverblue. However, after some more digging it seems like this solution would be preferable to changing the default guix store with a custom build, since doing that means you can't use any of the pre-compiled binary packages from the official guix servers.
- Infernal 4y ago
  So, having removed the immutable attribute from / and run the guix-install.sh script, the first issue I have is that the script thinks the group 'kvm' exists, because 'getent group kvm' returns successfully. However, if you try to create a user and add them to the kvm group, you get an error about the group not existing. Looking at the contents of /etc/group, there are only 5 groups and none of them are 'kvm'. At the very least it seems that the Guix install script is making some assumptions about the system that Silverblue breaks, which does make me wonder a bit about using the two side by side. Additionally, I have found some posts as far back as 2017 regarding using Guix or Nix on Fedora Atomic Linux or Fedora Container Linux (it seems the Silverblue name is more recent) and the fact that we're still puzzling it out 5 years later without much in the way of documented success does make me question the viability of the idea a bit.
yjftsjthsd-h 4y ago
Wouldn't that require that the mountpoint exists in the underlying filesystem? That is, you can't create a /gnu directory to mount into if root is read-only EDIT: Or is the filesystem not literally read-only? Sibling comment seems to imply that it's just chattr +I'd
- bogwog 4y ago
  I just tried it, and the folder created via chattr disappered after rebooting. So it seems like there's more to it.

podiki 4y ago

Not on Silverblue but I've used a bindmount to have /gnu/store elsewhere (due to disk space on a laptop). I can dig up some notes if that is helpful.

bogwog 4y ago
I didn't think to try doing a bind mount, so that might actually work. I'll need to try it again at some point!
0xCMP 4y ago
Used this same trick to use `$HOME/nix` for my nix store on a remote system that had a slow and ephemeral disk for the root fs, but a fast and persistent one for my home folder.

pca006132 4y ago

Not sure about guix, but for nixos we have https://github.com/nix-community/nix-user-chroot https://github.com/nix-community/nix-user-chroot

pxc 4y ago
You can do a pivot_root based install of Guix: https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROOT.org https://github.com/pjotrp/guix-notes/blob/master/GUIX-NO-ROO...

colordrops 4y ago

What does silverblue give you on top of what Guix and Nix already provide?

bogwog 4y ago
In Guix's case, a working desktop with wayland + proprietary Nvidia drivers. (I'm actually using Kinoite, which is the KDE spin of silverblue) I could install Guix on top of something like Ubuntu or Fedora workstation for the same effect, but then I'll have two system package managers side by side, which is pointless and probably error prone.
- von_lohengramm 4y ago
  You can do that with NixOS trivially.
  - rekado 4y ago
    And of course with Guix System. (odd to always see Nix* mentioned when someone talks about Guix.)
    - striking 4y ago
      Comparing https://wiki.systemcrafters.cc/guix/nvidia/ https://wiki.systemcrafters.cc/guix/nvidia/ with https://nixos.wiki/wiki/Nvidia https://nixos.wiki/wiki/Nvidia makes me think that in this specific case there's a difference.
      - pxc 4y ago
        A question for nonguix contributors, including OP: is there a reason that nonguix has an nvidia package but not an nvidia service that handles more of this in a streamlined way, even just some stuff copied and pasted from this wiki?
        podiki 4y ago

data_maan 4y ago

So would guix be something like an even slimmer version of docker (which in turn isna slim version of a VM)?