5 ms·

In my case, I define, "reproducible," to mean, "immutable." After a few days of testing, I broke NixOS. Simple test was swapping different Desktop Environments,

In my case, I define, "reproducible," to mean, "immutable." After a few days of testing, I broke NixOS. Simple test was swapping different Desktop Environments, eventually broke Nix, thus I'm not at the point where I'd agree with Nix being truly reproducible, at least not in that context :(

tmnvdb 2y ago
Those things are not the same though. Reproducible just means it will break again if you configure your system in the same way.
bsimpson 2y ago
One problem is that the applications themselves are impure. Just running KDE litters a bunch of dotfiles into your user folder, even for settings you didn't adjust. This is true for many applications. If you had an empty home folder and passively tried a handful of desktops, you'd no longer have an empty home folder. Hopefully your environment is resilient to clutter being leaked into your home folder, but if your filesystem isn't truly immutable, rolling back to a particular Nix config might not get you the exact state your system was in when you first built that. There's a project that wipes all local changes when you restart your machine, with the goal of making Nix systems more reproducible. I think it's called Impermanence.
- alfiedotwtf 2y ago
  I do all my stuff in temporary docker containers, and when I’m done, the container gets blown away. If the point of Nix is to keep a filesystem immutable as long as every app sticks to certain rules, is it actually the right till for the job? Sorry… I actually don’t know much about Nix given I’ve been using VMs and now containers for over a decade, so just trying to understand the problem that nix actually solves
  - alfiedotwtf 2y ago
    Just chatgpt’d it. I see… what I’m thinking about more was NixOS. Ok, I think I see how it could work, but I’d apps aren’t really isolated, then couldn’t a system still get to a broken if it spills out? At the moment I’m using Ansible for the host and Docker for guests, but I see NixOS as combining these two lasers so everything just runs on the host? Is that fair to say how NixOS works? If so and I have it wrong, maybe I should check it out and I’ve been sleeping on Nix all this time
    - alfiedotwtf 2y ago
      Hmm.. nix-shell and “nix develop” do look interesting! Edit: ok I HAVE been sleeping on NixOS! I couldn’t understand how isolation worked with /etc files, but it turns out /etc is not modified but you do it all through modifying the nix config and rebuild the system which generates /etc! Ok, super interesting
    - c0balt 2y ago
      A "normal" NixOS system will only give you a full sandboxed isolation for apps at build time and not a runtime. nixpkgs (the thing packaging the stuff for NixOS) provides packages for apps similar to Debian afterwards and not flatpak in terms of runtime isolation (if I understand your use case). My recommendation would be to test it out and look at how it does things. Maybe checkout the live installer with a gui to get a feel for a desktop system.
      - alfiedotwtf 2y ago
        Ah! Ok that makes more sense now… lol I was wondering how they went about that. Even the table about /etc being immutable but you can edit seems a bit weird. But I kind of got the picture now
  - tombert 2y ago
    I do something similar with Nix Flakes for a lot of my applications. I get my stuff working in a Flake, then I execute it with `nix run`; this is an ephemeral thing; once I kill the app then it's unlinked and can be garbage collected eventually. It can still write to folders, so it's not completely silo'd off like a full-on Docker container, but I still really like it.

tmnvdb 2y ago

Those things are not the same though. Reproducible just means it will break again if you configure your system in the same way.

bsimpson 2y ago

One problem is that the applications themselves are impure. Just running KDE litters a bunch of dotfiles into your user folder, even for settings you didn't adjust. This is true for many applications. If you had an empty home folder and passively tried a handful of desktops, you'd no longer have an empty home folder. Hopefully your environment is resilient to clutter being leaked into your home folder, but if your filesystem isn't truly immutable, rolling back to a particular Nix config might not get you the exact state your system was in when you first built that. There's a project that wipes all local changes when you restart your machine, with the goal of making Nix systems more reproducible. I think it's called Impermanence.

alfiedotwtf 2y ago
I do all my stuff in temporary docker containers, and when I’m done, the container gets blown away. If the point of Nix is to keep a filesystem immutable as long as every app sticks to certain rules, is it actually the right till for the job? Sorry… I actually don’t know much about Nix given I’ve been using VMs and now containers for over a decade, so just trying to understand the problem that nix actually solves
- alfiedotwtf 2y ago
  Just chatgpt’d it. I see… what I’m thinking about more was NixOS. Ok, I think I see how it could work, but I’d apps aren’t really isolated, then couldn’t a system still get to a broken if it spills out? At the moment I’m using Ansible for the host and Docker for guests, but I see NixOS as combining these two lasers so everything just runs on the host? Is that fair to say how NixOS works? If so and I have it wrong, maybe I should check it out and I’ve been sleeping on Nix all this time
  - alfiedotwtf 2y ago
    Hmm.. nix-shell and “nix develop” do look interesting! Edit: ok I HAVE been sleeping on NixOS! I couldn’t understand how isolation worked with /etc files, but it turns out /etc is not modified but you do it all through modifying the nix config and rebuild the system which generates /etc! Ok, super interesting
  - c0balt 2y ago
    A "normal" NixOS system will only give you a full sandboxed isolation for apps at build time and not a runtime. nixpkgs (the thing packaging the stuff for NixOS) provides packages for apps similar to Debian afterwards and not flatpak in terms of runtime isolation (if I understand your use case). My recommendation would be to test it out and look at how it does things. Maybe checkout the live installer with a gui to get a feel for a desktop system.
    - alfiedotwtf 2y ago
      Ah! Ok that makes more sense now… lol I was wondering how they went about that. Even the table about /etc being immutable but you can edit seems a bit weird. But I kind of got the picture now
- tombert 2y ago
  I do something similar with Nix Flakes for a lot of my applications. I get my stuff working in a Flake, then I execute it with `nix run`; this is an ephemeral thing; once I kill the app then it's unlinked and can be garbage collected eventually. It can still write to folders, so it's not completely silo'd off like a full-on Docker container, but I still really like it.