ruffsl

joined 3 years ago
MODERATOR OF
 

cross-posted from: https://programming.dev/post/36980791

This is a quick and painless tutorial on how to install and configure NixOS from Scratch. It involves starting off with Home manager and Flakes before even rebuilding your system.

I thought the example using builtins.mapAttrs with create_symlink for xdg.configFile was cleverly simple.

 

This is a quick and painless tutorial on how to install and configure NixOS from Scratch. It involves starting off with Home manager and Flakes before even rebuilding your system.

I thought the example using builtins.mapAttrs with create_symlink for xdg.configFile was cleverly simple.

 

cross-posted from: https://programming.dev/post/36875851

As a developer I often need to run code I cannot trust, especially dependencies from NodeJS and Python projects, on my dev machine. In order to protect my system from potentially malicious code, I built NixWrap, an adhoc sandboxing tool for NixOS.

NixWrap wraps bubblewrap (oh dear), running it with convenient defaults and offering easy to use command line flags to toggle custom options. An invocation to NixWrap is typically way shorter than the bubblewrap equivalent.

E.g. npm install can be wrapped with wrap -n npm install to gain network access and write access to the current working directory.

 

As a developer I often need to run code I cannot trust, especially dependencies from NodeJS and Python projects, on my dev machine. In order to protect my system from potentially malicious code, I built NixWrap, an adhoc sandboxing tool for NixOS.

NixWrap wraps bubblewrap (oh dear), running it with convenient defaults and offering easy to use command line flags to toggle custom options. An invocation to NixWrap is typically way shorter than the bubblewrap equivalent.

E.g. npm install can be wrapped with wrap -n npm install to gain network access and write access to the current working directory.

 

Any suggested changes since this was published a year prior?

 

Any notable advance in this regard as compared to when the original article was published in 2015?

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

 

cross-posted from: https://programming.dev/post/36703523

It does not require root, user namespaces support or disabling SELinux, but it relies on proot and other hacks instead. It uses a fork of Termux-the-terminal-emulator app, but has no relation to Termux-the-distro.

[–] ruffsl@programming.dev 4 points 1 year ago (1 children)

FYI, VSCode can now natively show commit info inline, no GitLens extension required:

https://code.visualstudio.com/docs/getstarted/tips-and-tricks#_git-blame

[–] ruffsl@programming.dev 1 points 1 year ago

Mainly the official git CLI for controlling branches and sub modules, and sometimes the GitHub CLI if quickly checking out a pull request from a forked repo.

Also use the source control tab in VSCode rather often, as it's really convenient to review and stage individual line changes from its diff view, and writing commit messages with a spell check extension.

If it's a big diff or merge conflict, I'll break out the big guns like Meld, which has better visualizations for comparing file trees and directories.

About a decade ago, I used to use SmartGit, then tried GitKraken when that came around, but never really use much of the bells and whistles and wasn't keen on subscription pricing. Especially as the UX for GitHub and other code hosting platforms online have matured.

[–] ruffsl@programming.dev 2 points 1 year ago* (last edited 1 year ago)

If you just want to quickly create a local python develop environment on the side using Python module metadata, installing uv from nixpkgs, and enabling nix-ld to run pre-compiled binaries from PyPI keeps things simple, and replicating the same virtual python environment workflow you to have on any other distribution:

https://discourse.nixos.org/t/i-want-understanding-nix-packages-and-flake-basics/67365/3

If you wanted to package a python module for nix or for proper distribution via nixpkgs, you'd want to add a nix derivation file that encapsulates all the inputs, i.e. software building materials (SBOM). There are existing nix library functions that can automate most of the packaging, not unlike Debian macros:

https://wiki.nixos.org/wiki/Python

The second approach is more rigorous, and combined with something like flakes for pinning the exact hash for all inputs via lock file ensures reproducibility, like when sharing with other nix users. While as the first approach is more subject to your current system, i.e. linking to whatever system wide libraries are presently installed, but it's less upfront effort to reuse existing python-package-managers than to nixify everything.

[–] ruffsl@programming.dev 2 points 1 year ago

Thank you for your work!
I would not have liked encountering this bug in the wild.

[–] ruffsl@programming.dev 6 points 1 year ago (2 children)

What user software are folks using to monitor and log PSU sensor data?

Would be nice to correlate power usage and efficiency with system load percentage over time and type (CPU vs GPU).

[–] ruffsl@programming.dev 2 points 1 year ago (1 children)

I'll preface that NixOS may not be for everyone, as deviating from a conventional hierarchical file system is a radical departure from conventional distributions; but for those that want precise control over their system environment, it has a good deal of appeal.

For example, I appreciate being able to use the latest bleeding release of a number of tools while sticking with older trusted versions of other utilities, but if both relied upon different versions of similar dependencies, such package conflicts can be troublesome to resolve, as few Linux package managers gracefully deal with multi version installs.

For NixOS using the nix store, installing leaf packages that traditionally conflict is trivial, and as a user, I can spend less time managing every transitive dependency in order to use the software I want. Not having to wait for a disjointed ecosystem of packages to synchronize around dependencies, or resorting to compromise in package version selection is very liberating.

The functional language and documentation for nix itself is a bit quirky, as I wish it was stronger typed, but being able to declaratively express and version control my setup across workstations has been a time saver; installing/configuring something once and then have-done with it.

[–] ruffsl@programming.dev 2 points 1 year ago

Nix-ld is only used by unpatched executables that use the link loader at /lib or /lib64. If you use for example python from nixpkgs than it will not pick up NIX_LD_LIBRARY_PATH and NIX_LD since these types of binaries are configured to use a glibc from the nix store.

Ah, I guess that's why I've seen folks recommend just having uv install the python interpreter as well, so everything python uses the same link loder from nix-ld.

[–] ruffsl@programming.dev 2 points 1 year ago

I would have liked the PyCon25 talk directly, but I don't think the recordings have been published yet:

https://slides.com/bittner/pycon25-nixos-for-python-developers#/2/4

Hopefully the presenter discusses more on their later slides in using python on NixOS and working around python packaging's use of dynamic linking.

[–] ruffsl@programming.dev 4 points 1 year ago (4 children)

I'm still using an old UC Gateway, doubt my homelab will outgrow it.

[–] ruffsl@programming.dev 2 points 1 year ago

I'd love to find an example NixOS config to simply reproduce and import Clear Linux's kernel config. There are a few already for replicating CachyOS's kernel variants:

Although I'm not sure that those approachs still use clang instead of gcc?

[–] ruffsl@programming.dev 2 points 1 year ago

I hope this rust library can make its way back into Moonlight and Sunshine projects.

[–] ruffsl@programming.dev 1 points 1 year ago

Another related video from a nice channel I posted here previously:

view more: ‹ prev next ›