3 ms·

NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal se

NixOS may be helping multiuser make a comeback, at least it is for me and my home servers. I no longer have to containerize my apps, i can have one baremetal server with a dozen+ services, all with their own users and permissions, and i don't have to actually think about any of the separation. Plus there’s network shares. Multiple people in my home with linux PCs, each with their own slice of the NFS pie based on user perms. Sure, it’s not secure, but these are people I live with, not state-sponsored hackers. All that said, I’d also love a simpler single-user perm setup. For VMs, containers, etc it would be amazing

airocker 2y ago
NixOS at it again :)
adastra22 2y ago
I’m not sure how “I don’t have to actually think about any of the separation” meshes with the fact that you explicitly setup multiple users and configured file and group permissions accordingly. You clearly put a lot of thought into it. Alternatively, containers really are a no-thinking-required solution. Everything maximally isolated by default.
- oceanplexian 2y ago
  Containers are isolated but a far, far cry from maximally isolated. They’re still sharing a Linux Kernel with some hand waving and cgroups. The network isolation and QoS side is half-baked even in the most mature implementations. HVM hypervisors were doing stronger, safer, better isolation than Docker was 10 years ago. They are certainly no-thinking required though which leads to the abysmal state of containerized security and performance we have currently.
- airocker 2y ago
  There have been no big cves of container escapes for a while now. I guess it can be considered secure enough.
  - lyu07282 2y ago
    A lot of Kernel privescs are also technically container escapes, so 2 months ago was the last one actually: https://www.cvedetails.com/cve/CVE-2024-1086/ https://www.cvedetails.com/cve/CVE-2024-1086/
    - airocker 2y ago
      but then even traditional multi-user would be compromised in this case.
- matrss 2y ago
  > I’m not sure how “I don’t have to actually think about any of the separation” meshes with the fact that you explicitly setup multiple users and configured file and group permissions accordingly. You clearly put a lot of thought into it. That's the thing, with NixOS you usually don't have to explicitly setup users and permissions. For most simple services, the entire setup is a single line of code in your NixOS configuration. E.g. services.uptime-kuma.enable = true; will make sure that your system is running an uptime-kuma instance, with its own user and all. Some more complex software might require more configuration, but most of the time user and group setup is not part of that.
tetris11 2y ago
DietPi does exactly the same using Debian
inhumantsar 2y ago
> i can have one baremetal server with a dozen+ services, all with their own users and permissions I've used nixos and I don't really see how nixos is special apart from the declarative config. The same can/should be done with any distro and any config manager. And unless you were running Podman in rootless mode, the same setup applies to containers too.
- rpgwaiter 2y ago
  Sure i could do this on debian, but like, i wont. Some software comes packaged with nice scripts to provision new users for running systemd services, but a lot do not. For me and my home network, if the default security mode is “manage users yourself”, i chmod -R 777 on all applicable files and call it a day. Nixos lets me be lazy, as all nixos modules (that I’ve ever used) have their own user setups with minimal permissions by default
eru 2y ago
Containerisation (either with containers or via VMs) doesn't have to be expensive. In principle, you can have just exactly the binary (or binaries) you need in the container or VM, without having a full Linux install. See eg Unikernels like Mirage.

airocker 2y ago

NixOS at it again :)

adastra22 2y ago

I’m not sure how “I don’t have to actually think about any of the separation” meshes with the fact that you explicitly setup multiple users and configured file and group permissions accordingly. You clearly put a lot of thought into it. Alternatively, containers really are a no-thinking-required solution. Everything maximally isolated by default.

oceanplexian 2y ago
Containers are isolated but a far, far cry from maximally isolated. They’re still sharing a Linux Kernel with some hand waving and cgroups. The network isolation and QoS side is half-baked even in the most mature implementations. HVM hypervisors were doing stronger, safer, better isolation than Docker was 10 years ago. They are certainly no-thinking required though which leads to the abysmal state of containerized security and performance we have currently.
airocker 2y ago
There have been no big cves of container escapes for a while now. I guess it can be considered secure enough.
- lyu07282 2y ago
  A lot of Kernel privescs are also technically container escapes, so 2 months ago was the last one actually: https://www.cvedetails.com/cve/CVE-2024-1086/ https://www.cvedetails.com/cve/CVE-2024-1086/
  - airocker 2y ago
    but then even traditional multi-user would be compromised in this case.
matrss 2y ago
> I’m not sure how “I don’t have to actually think about any of the separation” meshes with the fact that you explicitly setup multiple users and configured file and group permissions accordingly. You clearly put a lot of thought into it. That's the thing, with NixOS you usually don't have to explicitly setup users and permissions. For most simple services, the entire setup is a single line of code in your NixOS configuration. E.g. services.uptime-kuma.enable = true; will make sure that your system is running an uptime-kuma instance, with its own user and all. Some more complex software might require more configuration, but most of the time user and group setup is not part of that.

tetris11 2y ago

DietPi does exactly the same using Debian

inhumantsar 2y ago

> i can have one baremetal server with a dozen+ services, all with their own users and permissions I've used nixos and I don't really see how nixos is special apart from the declarative config. The same can/should be done with any distro and any config manager. And unless you were running Podman in rootless mode, the same setup applies to containers too.

rpgwaiter 2y ago
Sure i could do this on debian, but like, i wont. Some software comes packaged with nice scripts to provision new users for running systemd services, but a lot do not. For me and my home network, if the default security mode is “manage users yourself”, i chmod -R 777 on all applicable files and call it a day. Nixos lets me be lazy, as all nixos modules (that I’ve ever used) have their own user setups with minimal permissions by default

eru 2y ago

Containerisation (either with containers or via VMs) doesn't have to be expensive. In principle, you can have just exactly the binary (or binaries) you need in the container or VM, without having a full Linux install. See eg Unikernels like Mirage.