6 ms·
Linux kernel will support $ORIGIN, sort of
- Imustaskforhelp 3mo agoThis is really awesome, can't wait for this to land in the linux kernel. I have made appseed[0] (asciinema link[1]) which used zapps[2] which did a lot of tricks to achieve in end what this kernel patch could help in doing and hopefully more in the future! My appseed project didn't work for large projects like OBS but I feel like the approach that this does could lead to mass adoption given that its now a kernel feature. It could in theory allow more portable binaries across Linux which is really cool :) [0]: https://github.com/SerJaimeLannister/appseed https://github.com/SerJaimeLannister/appseed [1]: https://asciinema.org/a/zK0T3WXAxalMYCVUY1vp8FAv3 https://asciinema.org/a/zK0T3WXAxalMYCVUY1vp8FAv3 [2]: https://zapps.app/ https://zapps.app/
- nextaccountic 3mo agoI was confused on what $ORIGIN means, so, macroexpanding the article a bit https://fzakaria.com/2026/06/21/nix-needs-relocatable-binaries https://fzakaria.com/2026/06/21/nix-needs-relocatable-binari... > The loader in Linux however natively supports the variable $ORIGIN which translates to “the directory containing the executable.” https://man7.org/linux/man-pages/man8/ld.so.8.html https://man7.org/linux/man-pages/man8/ld.so.8.html But, if ld.so supports $ORIGIN already, why does the kernel needs to support it also? Or rather, why can't the kernel leverage ld.so and do this entirely on userspace?
- jz391 3mo agoOne point mentioned in the first link you included is support of $ORIGIN in #! scripts - that would need kernel support.
- setheron 3mo agoThis also can be handled by binfmt_misc; I include a demo of it in a gist.
- dgrunwald 3mo ago$ORIGIN was only supported when the loader was looking for other dependencies. The loader itself (field PT_INTERP) is loaded by the kernel. So prior to this change, every program must hardcode the absolute path to ld.so. With support for an $ORIGIN-relative loader, each program could use its own copy of ld.so.
- charcircuit 3mo agoEach program having its own loader is an anti pattern. Such a requirement is overkill. You can have a single loader that supports everything on the system.
- roblabla 3mo agoNot with NixOS. ld.so is tied to a version of glibc, in ways that can be subtly incompatible. And nixos can have multiple glibc version installed on a single machine. Besides, it allows for upgrades/downgrades to be done in a way that's much less error-prone.
- charcircuit 3mo ago>in ways that can be subtly incompatible There is much more value to be had in making glibc properly backward compatible so you can have a single one that can be used with everything than trying to make it so that you can swap everything around, creating extra complexity and compatibility risks.
- roblabla 3mo agoHow is that more valuable? It comes with two big pitfalls: - It would still not allow downgrades to work properly - It would cause glibc/ld.so to have a harder time adding new features, as they now need to worry about incompatible versions being used together Meanwhile, having different ld.so has many good use-cases, like simplifying development of ld.so itself, allowing them to swapped during updates in ways that are safer, etc... And the eBPF binfmt support is a rather simple, generic mechanism that is likely to have many other use-cases beyond ld.so. So it's overall a pretty good resolution to the issue?
- reinitctxoffset 3mo agoYou have the right idea but the wrong specifics. The boundary you're alluding to isn't the kernel/userspace boundary, it's the `libc` boundary, which is admittedly privileged by convention if not by Ring 0. On most Linux systems this is regrettably `glibc` (in a container where you get to choose everyone chooses the superior option of `musl`), on all Darwin systems this is `libstandard`. This thread is more concerned with Linux, so you are probably dealing with `/lib64/ld-linux-x86-64.so.2`, which operates in userspace but is by convention and opacity quite clearly part of "the system". The kernel modification is a much bigger, much weirder side effect of a weird Nix loyalty test around shebang lines in shell scripts, on which is has opted to be intentionally and violently incompatible with everything for no benefit other than incompatibility.
- seanhunter 3mo agoThat’s a weird rant which is manifestly false. On Nix the benefit you get from the incompatibility is the system can roll forward and back while it’s running so you can do big changes (eg updating or rolling back) the entire system without affecting running processes. You can also run groups of processes in isolation with different sets (or versions) of packages from the rest of the system. It’s fair to argue about whether those things are really important or whether nix does this in the best way, but to claim that the only benefit is incompatibility is just obvious nonsense.
- reinitctxoffset 3mo agoThe privileged path is already there. `/usr/bin/env` is no different from `/bin/bash`, `/bin/sh`, or any other ELF artifact at a known place. The argument is made, the argument is spurious. It is made in the other direction regarding the driver run path, just as religious, opposite ruling from purity court. No one even knows why, the trail goes cold in a mysterious 2012 commit about Mesa, it's literally a performance to bring the plane cargo back. Receipts for claim: #141803. Disagreeing with you doesn't make something a rant. If it's not clear how deep my Nix expertise is I will demonstrate it to any level you like: I'm just as entitled to an opinion as you are and I would appreciate it if the nixpkgs community was a little less rude to anyone who disagrees with some dogma no matter their knowledge. The nixpkgs community is not regarded as healthy or friendly after an internecine faction war that split three ways twice, producing four implementations none of which work, and if that reputation is ever going to mend, it will be because less than every Nix person has precisely zero chill the nanosecond anyone disagrees with them about anything.
- matheusmoreira 3mo ago> why can't the kernel leverage ld.so and do this entirely on userspace? Because Linux is completely independent from its user space. There is no "the loader in Linux", it just happens that GNU wrote one and it's widely used.
- reinitctxoffset 3mo agoThe correct fix is to store the metadata outside the CAS, in for example, the loader, which can trivially delegate to another loader (does on my machine now). bazel's wrong solution is $ORIGIN, Nix's wrong solution is "floating" CA / "realizations". The technical debt / precedent argument doesn't apply: Nix never had this bug (for once), you the choices on this bug are 1. port the bazel bug to Nix 2. don't port the bug. I predict... the bug is a shoe in, the bug lands eight days a week.
- stabbles 3mo agoNice, PT_INTERP is the only non-relocatable thing of ELF files and typically requires wrapper scripts/executables. Regarding shebangs, I've never understood why the kernel cannot resolve e.g. `#!sh` relative to PATH instead of CWD. Posix prescribes that you should look for `sh` in PATH and don't expect it to be in `/bin/sh`. And using `/usr/bin/env sh` has the same issue: what if coreutils is installed elsewhere.
- pm215 3mo agoI suspect it's a mix of historical reasons (#! support was added pretty early, in 1980 or so, when the unix development philosophy I think tended quite strongly to "do the simple thing", and there wasn't so much variation in where you might put important binaries like the shell), plus the fact that the kernel doesn't know anything about PATH (it's only your shell that does), plus vague worries about potentially accidentally breaking existing #! lines that used to work.
- chuckadams 3mo ago> plus the fact that the kernel doesn't know anything about PATH (it's only your shell that does) glibc is what deals with PATH, not the shell. On Linux, it's execvp(3) in libc which is implemented in terms of execve(2) in the kernel, but POSIX doesn't make a distinction between syscalls and library functions, so a kernel could implement either or none directly.
- stabbles 3mo agoTo be fair, many shells have command caching, so they effectively roll their own exec syscall wrapper: $ python3 -c 'print("hi")' hi $ hash hits command 1 /usr/bin/python3
- inigyou 3mo agoThe kernel never looks at PATH, that's why. It's a shell construct.
- charcircuit 3mo agoNix has caused so much busywork to be created through the entire Linux ecosystem. Rather than fixing their own project they force work upon so many others. Instead of looking for ways Nix could work with ensuring else they force everything else to be modified to work with Nix. You will constantly seem them trying to get projects to adapt a flake.nix or to replace bash scripts with a different shebang since they hardcode a single binary that is rare for people to use in the real world.
- rcxdude 3mo ago>Rather than fixing their own project they force work upon so many others. Nix has put in a ton of work to make their project work, and the assumptions in the rest of the ecosystem have been fighting every step of the way. And I would argue they've been changing it for the better, considering that if you were to just 'try to make nix work' you'd probably mainly come to the conclusion that it was impossible to make work sensibly due to the huge number of places where hardcoded relationships have been baked in.
- charcircuit 3mo ago>and the assumptions in the rest of the ecosystem have been fighting every step of the way There is an arrogance in the way of thinking that when you see everyone breaking your arbitrary rules you think to yourself "there is no way my rules are at fault, it's everyone else's fault for breaking them." >due to the huge number of places where hardcoded relationships have been baked in. And why are hardcoded relationships bad for developers or users of the operating system? "Because they break Nix" is not a good excuse. Plenty of other operating systems work just fine with such things hardcoded, I don't see developers complaining about these hardcoded things, and moving things around can only make things more confusing for the user. To me it looks like Nix picked a poor design and instead of going back to the drawing board and trying to come up with a better design they have gone all in on trying to force their bad design to work. How much work do you think iOS or Android spend on app packaging / installation per year. Despite having millions of more developers and billions of more users they spend orders of magnitude less than NixOS does. Edit: I can't reply since I'm rate limited. Debian already supports installing multiple php versions. You can use the update-alternatives command to set which one is default for the php command. Via your web server's config you can config which php version a site will use.
- wzdd 3mo agoMy reaction was negative when I read the title (policy!), but the actual outcome was very reasonable. "Hey, can we add $ORIGIN to the VFS layer to support relocatable interpreters?" "You can already do that with binfmt_misc and ebpf, here's an example." Then, later, a couple of patches to make binfmt_misc more ergonomic. Seems like a good outcome.
- Siyo 3mo agoI wonder if something equivalent exists for loading other kinds of assets. Take files that would normally live under `/usr/share`. References to these files are typically hardcoded with an absolute path as well. It's usually possible to relocate them at build time by specifying a different absolute prefix, but making them relative the conventional way would likely require patching.
- aboardRat4 3mo agoYou can always set "RESOURCE_PATH" and load your files from there.
- Siyo 3mo agoSure, assuming this is your own software. The context of the article is on working towards a general approach to relocatable nix binaries so I don't think that's going to scale across nixpkgs.
- aboardRat4 3mo agoIf you don't own the software, the software can do many things to break nix' relocatable binaries too.
- Asmod4n 3mo agoWait, does this mean we can „virtualize“ ld.so now? This could finally solve the compatibility issues glibc causes.
- sylware 3mo agolinux ELF code is loading the ELF loader only. $ORIGIN may not be a good idea since that would add more ELF complexity to the kernel. If we are honest with ourself, ELF is the core of the issue: for executables and dynamic libraries we _now_ know it is severely obsolete on modern hardware architectures. I am currently using my own format, excrutiatingly simple, no loader, basically a program segment, "userland syscalls" with hardware CPU synchronization. I do wrap the executables into ELF capsules to run them transparently. So simple a small RFC will be enough. With that, I discovered that the hard part is c++ and other similar languages which are very expensive in runtime infrastructure and linking complexity. I would need to build a mesa vulkan driver with that format, and it seems the blocker is c++ (and similar language namely with grotesque and absurd syntax complexity). Thx to valve to have removed a lot of c++, for less c++... would have been much better if plain and simple C.
- setheron 3mo agoI would love to learn more about this; I'm deeply interested in replacing ELF with something either simpler or maybe leveraging sqlite for much of the functionality.
- setheron 3mo agoFeel free to email me! (author)
- sylware 3mo agoOnce I have something satisfying, I'll post the "RFC-like" draft and preliminary reference toolchain on HN (well, if I can since HN is going 'whatwg cartel' web engines only then I may be blocked for good). For the moment, I am 'testing' all that while writting my own wayland compositor for linux (that's why I will try to build mesa AMD vulkan driver for this format... or stick to wl_shm in the end). Well, for a new executable and dynamic library format, the computer language syntax complexity and its runtime complexity do matter A LOT, c++ is massive pain, and since, if I am not mistaken, sqlite is going microsoft rust, that's bad omens since microsoft rust syntax seems to be now as brain damaged than c++ syntax... but with an even worse runtime (unless all that is not actually true, I have not checked). That said, ISO f*cked up C with things like '__thread' which requires some level of OS support.
- bobajeff 3mo agoMany people here seem to think this change will allow for people to package their Linux apps to be portable across distros/distro releases. If this is true then this a great! On Debian-based distros it kind of sucks when the version of a package is only available in a newer release so the only way to get it is either compile it yourself or upgrade your system. I remember trying to hack around this once by downloading dependencies from a newer release and helping the program locate them but I think I ran into a issue with the linker version being hardcoded or something and gave up.
- aboardRat4 3mo ago>Many people here seem to think this change will allow for people to package their Linux apps to be portable across distros/distro releases. There is no need to make binaries portable across the distros, because Linux is a source based OS. You can always just compile anything for your own system, just don't forget to submit the buildscript to the repo.
- accelbred 3mo agoIts unfortunate that this is using eBPF and not cBPF. I'd want to enable this in a namespace using binfmt-misc's namespace support, but eBPF requires root.
- valentynkit 3mo agoAnything that assumes /proc/self/exe points at the real binary, sandboxes and supervisors especially, quietly breaks under this. Worth a grep across that class of code before it lands broadly.