7 ms·
Nitro: A tiny but flexible init system and process supervisor
- GuinansEyebrows 1y agolove to see new init projects. how does it stack up against runit (the last one i really familiarized myself with on void linux)?
- kragen 1y agoShe credits runit and daemontools as inspiration, and it looks extremely similar. I hope that at some point she writes a comparison explaining what Nitro does differently from runit and why.
- cbzbc 1y agorunit doesn't propagate SIGTERM to services it starts.
- kragen 1y agoHmm, is that desirable? If someone's going around sending SIGTERM to random processes they might also send SIGKILL, and there's no way Nitro can propagate SIGKILL to processes it starts.
- cbzbc 1y agoIt does, because SIGTERM is traditionally understood as the trigger for a shutdown. Docker - for instance - will send a SIGTERM to pid 1 when a container is stopped - which goes back to a previous comment here about using a real init as pid 1 if the thing in your container forks: https://news.ycombinator.com/item?id=44990092 https://news.ycombinator.com/item?id=44990092
- kragen 1y agoInteresting! I didn't know that—I thought that when you told sysvinit to change its runlevel you normally used some slightly richer interface than signals.
- atahanacar 1y agoIt does if you use SIGHUP.
- Flux159 1y agoHow does this compare to s6? I recently used it to setup an init system in docker containers & was wondering if nitro would be a good alternative (there's a lot of files I had to setup via s6-overlay that wasn't as intuitive as I would've hoped).
- nine_k 1y agoS6 is way more complex and rich. Nitro or runit would be simpler alternatives; maybe even https://github.com/krallin/tini https://github.com/krallin/tini.
- Flux159 1y agoThanks! Reading some of your other comments, it seems like runit or nitro may not have been a good choice for my usecase? (I'm using dependencies between services so there is a specific order enforced & also logging for 3 different services as well). You seem to know quite a bit about init systems - for containers in particular do you have some heuristics on which init system would work best for specific usecases?
- ItsHarper 1y agodinit is another one with service dependency support
- andrewstuart2 1y agoI'm always torn when I see anything mentioning running an init system in a container. On one hand, I guess it's good that it's designed with that use case in mind. Mainly, though, I've just seen too many overly complicated things attempted (on greenfield even) inside a single container when they should have instead been designed for kubernetes/cloud/whatever-they-run-on directly and more properly decoupled. It's probably just one of those "people are going to do it anyway" things. But I'm not sure if it's better to "do it better" and risk spreading the problem, or leave people with older solutions that fail harder.
- simonw 1y agoI've used several hosting providers that charge by the container - Fly.io and Render and Google Cloud Run. I often find myself wanting to run more than one process in s container for pricing reasons.
- mikepurvis 1y agoFrom my experience in the robotics space, a lot of containers start life as "this used to be a bare metal thing and then we moved it into a container", and with a lot of unstructured RPC going on between processes, there's little benefit in breaking up the processes into separate containers. Supervisor, runit, systemd, even a tmux session are all popular options for how to run a bunch of stuff in a monolithic "app" container.
- yjftsjthsd-h 1y ago> Supervisor, runit, systemd, even a tmux session are all popular options for how to run a bunch of stuff in a monolithic "app" container. Did docker+systemd get fixed at some point? I would be surprised to hear that it was popular given the hoops you had to jump through last time I looked at it
- mikepurvis 1y agoIt's only really fixed in podman, with the special `--systemd=always` flag. Docker afaik still requires manually disabling certain services that will conflict with the host and then running the whole thing as privileged— basically, a mess.
- lrvick 1y agoAt Distrust, we wrote a dead simple init system in rust that is used by a few clients in production with security critical enclave use cases. <500 lines and uses only the rust standard library to make auditing easy. https://git.distrust.co/public/nit https://git.distrust.co/public/nit
- nine_k 1y agoLikely neat (33% larger than nit), but the readme only explains how to build it, not its interface or functioning.
- lrvick 1y agoYeah we only recently broke it out as a standalone repo/binary, as everyone historically vendored it, so docs will get love soon, but it will be part of the next stagex release built and signed by multiple parties deterministically as stagex/user-nit. To run it all your need to know is put it in your filesystem as "/init" and then add this to your kernel command line for the binary you want nit to pivot to after bringing the system up: nit.target=/path/to/binary That's it. Minimum viable init for single application appliance/embedded linux use cases. nit and your target binary are the only things you actually need to have in your CPIO root filesystem. Can be empty otherwise.
- nine_k 1y agoSo it's basically like tini (keep a single executable running), but in Rust?
- lrvick 1y agoYep. The less C code in production the better.
- lrvick 1y agoOf note, it also will handle platform specific bring-up system calls, basic filesystem setup, etc, so it is much more suitable for embedded, server, or enclave use cases than tini, imo. It is mostly used for Nitro enclaves today.
- axlee 1y agoI'd recommend changing names, nitro is already a semi-popular server engine for node.js https://nitro.build/ https://nitro.build/
- nine_k 1y agoAny well-known generic word is very likely to already have been used by a bunch of projects, some of them already prominent. By now, the best project name is a pronounceable but unique string, for ease of search engine use. Ironically, "systemd" is a good name in this regard, as are "runit" or even "s6".
- lrvick 1y agoI use tiny init systems regularly in AWS Nitro Enclaves. Having the enclave and init system both named nitro is not ideal.
- nine_k 1y agoDinit, runit, tini -- all avoid the name clash :)
- entropie 1y agonitronit obviuously
- Y_Y 1y ago> Any well-known generic word is very likely to already have been used by a bunch of projects, Are you sure? There are lots of words, and not so many projects that use words like these as their names. Of the 118179 packages I see on this Ubuntu 18.04 system I can roughly roughly ask how many have names that are dictionary (wamerican) words: comm -12 <(apt-cache dumpavail | awk -F': ' '/^Package:/{sub(/^lib/,"",$2); print $2}') /usr/share/dict/words | wc -l This gives 820 (or about 1000 if you allow uppercase). Not so scientific, but I think a reasonable starting point.
- mperham 1y agoI think I would have gone with nitr0.
- nine_k 1y agoI would like a comparison with runit, which is a very minimal but almost full-fledged init system. I see many similarities: control directories, no declarative dependencies, a similar set of scripts, the same approach to logging. The page mentions runit in passing, and even suggests using the chpst utility from it. One contrasting feature is parametrized services: several similar processes (like agetty) can be controlled by one service directory; I find it neat. Another difference is the ability to initiate reboot or shutdown as an action of the same binary (nitroctl). Also, it's a single binary; runit has several.
- imiric 1y agoI've gotten used to runit via Void Linux, and while it does the job of an init system, its UI and documentation leave something to be desired. The way logging is configured in particular was an exercise in frustration the last time I tried to set it up for a service. I wouldn't mind trying something else that is as simple, but has sane defaults, better documentation, and a more intuitive UI.
- nine_k 1y agoLogging in runit seems simple (I don't remember running into problems), but indeed, the documentation leaves much to be desired. Could be a good thing to contribute to Void Handbook.
- cbzbc 1y agorunit doesn't always take care of services it manages in the same way as a proper init . From the man page: "If runsvdir receives a TERM signal, it exits with 0 immediately"
- Arch-TK 1y agoThis is by design. runsvdir receiving TERM should only happen when stage 2 is triggered to end. Once that happens, the individual runsv processes are still supervising their individual tasks and can be requested to stop through their respective control sockets. It's how standard stage 3 is implemented.
- Ericson2314 1y agoIf I my plug my friend and colleague's work, https://nixos.org/manual/nixos/unstable/#modular-services https://nixos.org/manual/nixos/unstable/#modular-services has just landed in Nixpkgs. This will be a game changer for porting to NixOS to new init systems, and even new kernels. So, it's good time to be experimenting with things like Nitro here!
- runako 1y agoThe name & function overlap with AWS Nitro is severe: https://docs.aws.amazon.com/whitepapers/latest/security-design-of-aws-nitro-system/the-nitro-system-journey.html https://docs.aws.amazon.com/whitepapers/latest/security-desi...
- stock_toaster 1y agoIt will be interesting to compare this to dinit[1], which is used by chimera-linux. Giving the readme a brief scan, it doesn't look like it currently handles service dependencies? [1]: https://github.com/davmac314/dinit https://github.com/davmac314/dinit
- nine_k 1y agoNitro does not declaratively handle service dependencies, you cannot get a neat graph of them in one command. You can still request other services to start in your setup script, and expect nitro to wait and retry starting your service when the dependent service is running. To get a nice graph, you can write a simple script using grep. OTOH it's easy to forget to require the shutdown of the dependent services when your service goes down, and there's no way to discover it using a nitro utility.
- stock_toaster 1y agoThanks for the info!
- hippospark 1y agoI used dinit in Artix Linux. It is lightweight and impressive (https://artixlinux.org/faq.php https://artixlinux.org/faq.php)
- deleted 1y ago[deleted]
- unit149 1y ago[dead]
- prettyman 1y ago[dead]
- garganzol 1y agoI am interested in using it as a process supervisor in server docker containers. It is clear that it can be compiled from sources, but something like vuxu.org/nitro/install.sh would be super helpful.
- CartwheelLinux 1y agoBring back the init wars! /S Username relevant... I got into Linux right before the init wars, and while they were hectic times they brought a lot of attention, discussions, and options to Linux.
- awestroke 1y agoAn init system without the ability to specify dependencies? Without user/group configuration? Ordering must be manually configured? No parallel service launching? No resource management? Please don't call this an init systern. It's a barebones process supervisor.
- beagle3 1y agoIt actually does all these things. Quite well, even - in my experience better than systemd. I didn’t use nitro, I’ve been using daemontools (which nitro is an evolution of) for decades. Incredibly easy to use, incredibly stable, understand, and control. There is no well defined way to do dependencies (what if your dependency dies 3 seconds into the process? There are many right answers). The djb/daemontools way is just “it’s your problem. But here are the reliable simple cheap tools to start, stop and monitor your dependencies”.
- vhantz 1y agoWhat makes it better than systemd for you?
- beagle3 1y agoIt is lightweight, very easy to understand and reason about (much more than systemd - and it’s not just an issue of familiarity - it has much fewer moving parts than systemd’s service management part). It’s rock solid. It goes to great length to never lose process output, not even a single char, across service restarts. (it might be possible to achieve same on systemd - but it isn’t trivial) And it’s been that way for me for two decades now - Ubuntu moved from system v to upstart to systemd; my systems still use the same daemontools setup they used 15 years ago, they do it on FreeBSD and Linux. And they just work, no surprises.
- usr1106 1y agoI wrote my own init system in C from scratch some 13 years ago. It was more work than anticipated by myself and the manager who approved it. It served the purpose to bring up a Linux GUI and some backend for it on not so capable hardware in n seconds (don't remember n, but it was impressive). It was a nice programming exercise. Wouldn't be suprised if even back then something like that already existed and the whole effort just demonstrated a lack of insight of what is readily available. Probably the code still exists on some backup I should not have. Have not looked back and don't know... The company who owned the rights has gone out of business. Edit: After typing this it came to my mind a colleague of mine wrote yet another init in the same company. Mine had no dependencies except libc and not many features. The new one was built around libevent, probably a bit more advanced.
- networked 1y agoGitHub repository with the issue tracker: https://github.com/leahneukirchen/nitro https://github.com/leahneukirchen/nitro.
- pdmccormick 1y agoI love projects like these. They touch upon so many low level aspects of Unix userlands. I appreciate how systemd ventured beyond classical SysV and POSIX, and explored how Linux kernel specific functionality could be put to good use. But I also hope that it is not the last word, and that new ideas and innovations in this space can be further explored. Recently I implemented a manufacturing-time device provisioning process that consisted of a Linux kernel (with the efistub), netbooted directly from the UEFI firmware, with a compiled-in bundled initramfs with a single init binary written in Go as the entire userland. It's very freeing when the entire operating environment consists of code you import from packages and directly program in your high level language of choice, as opposed to interacting with the system through subprocesses and myriad whacky and wonderfully different text configuration files.
- zoobab 1y agoDoes it require Pid1?