3 ms·

Regarding the second point, ("it's not enough to have the same /etc/nixos/configuration.nix file, because of environment variables, other files, and commit revi

Regarding the second point, ("it's not enough to have the same /etc/nixos/configuration.nix file, because of environment variables, other files, and commit revisions of repos used"), this is one thing which Nix Flakes solves. With nix flakes, all the Nix sources you use must be checked into source control, and impurities like environment variables can't be used (by default).

Reventlov 4y ago
This is actually the opposite, by default, impurities like environment variables can still be used, as well as binaries, or other things ! A small example : ``` [remy@typhoon:~/Blog]$ cat flake.nix { inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11"; }; outputs = { self, nixpkgs }: let pkgs = nixpkgs.legacyPackages.x86_64-linux; in { devShell.x86_64-linux = with pkgs; pkgs.mkShell { buildInputs = [ python3Packages.pelican python3Packages.markdown ]; }; }; } [remy@typhoon:~/Blog]$ export HELLO="WORLD" [remy@typhoon:~/Blog]$ nix develop warning: Git tree '/home/remy/Blog' is dirty [remy@typhoon:~/Blog]$ echo $HELLO WORLD ``` And, because flakes are not stable, you need to enable them with e.g. `--experimental-features 'nix-command flakes'`. And by default, you can still access outside binaries, like let's say ls ! Which is why, to have real hermetic builds, in Guix for example, it's advised to run in containers and so on.
- rgoulter 4y ago
  > by default, impurities like environment variables can still be used In a `nix develop` shell? Ah, sure. -- I don't think the new nix commands have the same functionality that `nix-shell --pure` had. But, in nix expressions used, in order to use environment variables (or to fetch from URLs without using a known sha256), the `--impure` flag needs to be passed.
  - abathur 4y ago
    I haven't used it, but afaict the --ignore-environment flag is intended for roughly the same usecase. https://github.com/NixOS/nix/issues/4359#issuecomment-907768110 https://github.com/NixOS/nix/issues/4359#issuecomment-907768... notes some differences.
- abathur 4y ago
  A dev shell is designed to allow the outside environment to be accessible (so you've got access to tools you'd want to invoke while working that aren't strictly project dependencies).
- nalllar 4y ago
  The dev shell inherits environment, but the builds don't. Having a dev shell inherit none of your environment is possible but an inconvenient default, you can do this with `--ignore-environment`. `nix build .#somePackage` is pure by default, as is `nix flake check` I believe `nix shell` also inherits environment by default for the same reason. People expect to be able to run the packages they installed system wide after entering a shell.

Reventlov 4y ago

This is actually the opposite, by default, impurities like environment variables can still be used, as well as binaries, or other things ! A small example : ``` [remy@typhoon:~/Blog]$ cat flake.nix { inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11"; }; outputs = { self, nixpkgs }: let pkgs = nixpkgs.legacyPackages.x86_64-linux; in { devShell.x86_64-linux = with pkgs; pkgs.mkShell { buildInputs = [ python3Packages.pelican python3Packages.markdown ]; }; }; } [remy@typhoon:~/Blog]$ export HELLO="WORLD" [remy@typhoon:~/Blog]$ nix develop warning: Git tree '/home/remy/Blog' is dirty [remy@typhoon:~/Blog]$ echo $HELLO WORLD ``` And, because flakes are not stable, you need to enable them with e.g. `--experimental-features 'nix-command flakes'`. And by default, you can still access outside binaries, like let's say ls ! Which is why, to have real hermetic builds, in Guix for example, it's advised to run in containers and so on.

rgoulter 4y ago
> by default, impurities like environment variables can still be used In a `nix develop` shell? Ah, sure. -- I don't think the new nix commands have the same functionality that `nix-shell --pure` had. But, in nix expressions used, in order to use environment variables (or to fetch from URLs without using a known sha256), the `--impure` flag needs to be passed.
- abathur 4y ago
  I haven't used it, but afaict the --ignore-environment flag is intended for roughly the same usecase. https://github.com/NixOS/nix/issues/4359#issuecomment-907768110 https://github.com/NixOS/nix/issues/4359#issuecomment-907768... notes some differences.
abathur 4y ago
A dev shell is designed to allow the outside environment to be accessible (so you've got access to tools you'd want to invoke while working that aren't strictly project dependencies).
nalllar 4y ago
The dev shell inherits environment, but the builds don't. Having a dev shell inherit none of your environment is possible but an inconvenient default, you can do this with `--ignore-environment`. `nix build .#somePackage` is pure by default, as is `nix flake check` I believe `nix shell` also inherits environment by default for the same reason. People expect to be able to run the packages they installed system wide after entering a shell.