3 ms·

how does it enforce FS and network isolation?

by ghostwriter 4y ago

InvaderFizz 4y ago
It doesn't. Nix is basically a whole load of compiled dependencies pathed to /nix/hash/dependency So you can have things that would ordinarily be dependency hell running side by side because foo that requires bar6 is compiled against that, and baz that requires bar7 is linked against that. Both versions of bar are present in the nix structure, on a specific path that the software is compiled against.
- pxc 4y ago
  To summarize this in a metaphor: Nix 'isolates' packages by ensuring that they do not know where to look for each other, rather than ensuring that they cannot possibly see each other. In addition to the example given by the parent poster, here are some other steps taken towards that end in the Nix ecosystem: Nix-built programs look for their libs, they don't see libs other than what they were built with because each package has its own little FHS-shaped tree, which it thinks of in the way a 'normal' package might think of as 'the system'— that thing which has a `/usr/lib` in which to find libraries and a `/etc` in which to find config files and a `/usr/share` in which to find assets, etc. In addition to linking against hardcoded full paths to dependencies, outlined above, maintainers also take steps to ensure that, e.g., external programs referenced in shell scripts in a Nix package also refer to full paths into the Nix store.
- ghostwriter 4y ago
  How do you mean it doesn't if the manual itself says that: "In addition, on Linux, builds run in private PID, mount, network, IPC and UTS namespaces to isolate them from other processes in the system"? https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-sandbox https://nixos.org/manual/nix/stable/command-ref/conf-file.ht...
  - callahad 4y ago
    "Builds" is the operative word there: that specific isolation is optional and only applies during compilation.

3 ms·

how does it enforce FS and network isolation?

by ghostwriter 4y ago

how does it enforce FS and network isolation?

InvaderFizz 4y ago
It doesn't. Nix is basically a whole load of compiled dependencies pathed to /nix/hash/dependency So you can have things that would ordinarily be dependency hell running side by side because foo that requires bar6 is compiled against that, and baz that requires bar7 is linked against that. Both versions of bar are present in the nix structure, on a specific path that the software is compiled against.
- pxc 4y ago
  To summarize this in a metaphor: Nix 'isolates' packages by ensuring that they do not know where to look for each other, rather than ensuring that they cannot possibly see each other. In addition to the example given by the parent poster, here are some other steps taken towards that end in the Nix ecosystem: Nix-built programs look for their libs, they don't see libs other than what they were built with because each package has its own little FHS-shaped tree, which it thinks of in the way a 'normal' package might think of as 'the system'— that thing which has a `/usr/lib` in which to find libraries and a `/etc` in which to find config files and a `/usr/share` in which to find assets, etc. In addition to linking against hardcoded full paths to dependencies, outlined above, maintainers also take steps to ensure that, e.g., external programs referenced in shell scripts in a Nix package also refer to full paths into the Nix store.
- ghostwriter 4y ago
  How do you mean it doesn't if the manual itself says that: "In addition, on Linux, builds run in private PID, mount, network, IPC and UTS namespaces to isolate them from other processes in the system"? https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-sandbox https://nixos.org/manual/nix/stable/command-ref/conf-file.ht...
  - callahad 4y ago
    "Builds" is the operative word there: that specific isolation is optional and only applies during compilation.