That being said, I think there could be a good use case for "meta" NixOS distributions. I'm working on such a thing for a NixOS based RetroArch type thing. But could see a PopOS like configuration, focused on on an “out the box experience”
Anyone with the hardware is welcome to contribute to nixos-hardware!
Even "no-op empty configs" are good imo as they show "there's no magic sauce needed".
Created an issue for this for anyone interested!
I plan on keeping my M1 for a 2-3 more years, then we will have to see what Framework has come up with then.
I like them a lot in principle (peripherals that can be switched to what I need? Yes please. Upgradable RAM? thanks), but I also won't compromise on battery time, performance or "linux works outside the box". Battery time could have been an easy fix if they had made it so I could switch the battery without taking the laptop apart.
https://guix.gnu.org/manual/devel/en/guix.html#Services
That is, the only difference in practice would be replacing 'herd' with 'systemctl' when stopping and starting services manually. Anything else, such as modifying a service, has to go through the configuration system.
Similarly, for service authors, whether the API you design ends up creating a systemd unit file or shepherd service object is an implementation detail and would be mostly transparent.
import framework.nix {}my code is possible if people want it :) the real value of NixOS is hardware and OS config can be turned into libraries!
And then Linux in general is notorious for having issues with USB WiFi adapters. More info on that can be found here https://github.com/morrownr/USB-WiFi
We allow runaway complexity to obscure the inner workings of an important software package, to the point, where having source access no longer makes a practical difference to a "casual" power-user or even a software engineer. I can source-dive runit, s6, OpenBSD's rc, or OpenRC and within a weekend, have a pretty OK understanding, fix a bug, or add a feature. Having software as complex as systemd taking so many roles, and making itself so ubiquitous and irreplaceable, makes me feel that I no longer have any control or understanding of my system, bugs or misfeatures just become things you live with, or you riddle yourself with arcane workarounds. Portability suffers, monoculture takes root.
I've lost faith in "mainstream" Linux distros. I use macOS and OpenBSD for workstations, and Alpine where I need e.g. Docker. It must either be simple enough to understand, or provide enough utility/convenience that the lack of (practical) source access is compensated. systemd fits neither category.
Boot Loader Interface, Discoverable Partitions Specification, etc.
I’m sure the implementation details are very interesting.
But where is the “Configure and Start a Service” option? Which is arguably the most important.
For a quick intro to new services, see the examples here: https://www.freedesktop.org/software/systemd/man/systemd.ser... (they should cover most basic needs) then read above for the details on the parameters. You stick the file in /etc/systemd/system/your_thing.service and enable/start it.
No, it's not as easy as "man systemd.service".
What's probably most useful in that documentation is the "hello world" example, which is buried at the bottom of the documentation. Also, key details are elsewhere, in "man systemd.exec" and "man systemd.unit".
The systemd docs a great comprehensive reference, but the man pages are poor introductory documentation.
Some useful tips that are hard to find:
* man systemd.directives documents every directory and will tell you which man page as the full documentation for it.
* man systemd.index lists every man page related to systemd.For example, `systemd-analyze` is a good tool for boot performance analysis, so + for systemd, but if I want/need to use perf for boot performance analysis, then systemd stands in my way, while for initd it's just yet another boot mode.
However having used it, NixOS seems like it mitigates the worst aspects of systemd. It gets rid of that that /etc/systemd /lib/systemd symlink "cleverness" for overriding/enabling units. Being functional makes it so that when systemd mysteriously breaks - for example if there is a loop in dependencies - it's easy to track down the change that caused it. And rather than splaying the config out in a bunch of random "unit" files, it's all contained in the nix config. About the worst thing I can say is that defining your own service is a bit more obtuse that it needs to be, with the arbitrary terms of the systemd unit format carrying over into the Nix config.
Just use `systemctl cat`, it prints the whole effective configuration.
I'm no fan of SysV init either, and I appreciate the advancements that systemd does bring to the table. But it is hard to shake the feeling of it having done the system software equivalent of sucking in a bunch of bloated javascript frameworks. Sure they made life easier for the developer, but everyone else has to live with the mess.
For enabling/sequencing, I'd say the preferable way would be to have a top level config file that pulls in the specified units explicitly rather than stitching together units based on their internal contents (akin to persistent structure rather than mutable cells). Juxtaposition is the most syntactically powerful operator and prevents loops intrinsically. Whereas by splaying dependencies in unit files, if you make one errant backreference the system is likely to not boot at all. I'm sure there's another clever command to check for that, but shrug.
No, for that you would use `systemctl edit UNIT...` to create or edit a drop-in file, e.g. to add local overrides for an existing service, or `systemctl edit --full UNIT...` to open a copy of the existing unit file for editing which will replace the packaged version. Add `--force` to create a new unit file for a service which doesn't already exist.
I've been doing fine on Debian dropping files in /etc/systemd, with a possible hook to `systemctl enable`. A rudimentary ad-hoc object system with overrides etc for every program is like the exact opposite of what I want when doing sysadmin. I think NixOS's approach does a good job of coping with systemd, in that it bundles all that complexity up in a way so it doesn't propagate, despite still having to look up what the Wants/Needs/Likes/Prayers/Requires/Binds designations mean every time I touch the config.
Don't forget `systemctl daemon-reload` to update the in-memory state when the unit files change. The `edit` command takes care of that for you. It also provides a template for the override files (when not using `--full`) which shows the current settings.
You are free to just drop files in /etc/systemd, of course. This is a fully-supported workflow. The `edit` command is only there for the convenience of the system administrator.
> A rudimentary ad-hoc object system with overrides etc for every program is like the exact opposite of what I want when doing sysadmin.
Are we talking about systemd, or NixOS? Their approaches to configuration really aren't all that different in this regard but you still seem to prefer one over the other. Or is the problem perhaps that you have two different programs trying to manage the configuration?
Personally, from the POV of distributions other than NixOS, I think the systemd approach is far superior to alternatives without overrides, where the only choice is to clone & modify the vendor-provided scripts. With overrides you can fine-tune the parts that matter for your environment without taking over the maintenance of the entire script (or unit file). For example, it's more likely to keep working after an upgrade.
Personally I'd rather clone and modify a full config file rather than only overriding portions. Once I own it, I want to keep owning it - it's more straightforward to track down a problem due to my own assumptions being invalidated, than due to a distribution's assumptions being invalidated. And it's much nicer to read one file for the settings, than having to jump between a few different ones and know the overriding rules (referring to configuration in general here, not just systemd which provides the tools to work with them).
Good point about the daemon-reload. I actually don't have many custom systemd unit files, and they generally don't change. But to be fully correct and not require manual intervention or a full reboot I do need to include that step (although I'm moving away from Debian towards NixOS so shrug).
The biggest recurring issue is with graphic cards that have poor support in Linux and require firmware blobs and with WiFi cards that have no free drivers / firmware.
It is trivial to use vanilla Linux with these machines as Guix System lets you use any other package for the `kernel` field in the configuration. The "nonguix" channel (hosted on Github) provides packages for vanilla Linux ("linux") in various versions, and also includes firmware packages that you can use in your config file.
If that's the only thing keeping you from using Guix System then I'm happy to say that it's a hurdle that is very easy to overcome.
Intel, AMD, and Nvidia GPUS - all of them need firmware blobs to work as expected. Intel and AMD offer free drivers but not free firmware.
And if you want to WiFi 5 (ac) or WiFi 6 (ax), chances are that you'll need non-free drivers/firmware as well.
> The "nonguix" channel (hosted on Github) provides packages for vanilla Linux ("linux") in various versions, and also includes firmware packages that you can use in your config file.
Ah, that's good to know.
I'll probably give the Guix package manager a shot some day.
If the whole reason you're doing it is to migrate back to upstart's syntax then it seems that would be not so useful, you might as well go in the other direction: write an upstart generator for systemd, and then you can just plug that into ordinary NixOS.
Edit: Actually I think at some point NixOS did support upstart? Not sure whatever happened to that.
There is no chance that my Nix changes would affect existing configurations. They would be completely self contained.
I had some users too but it still wasn't really worth it. I can't suggest it as a business model or a hobby project, you are basically going to be highly constrained by everything else on the system and your setup will just start looking like everything else eventually. Systemd also works fine as a session manager for whatever.
Those other things you mention are confusing to me, gvisor and KVM are mostly orthogonal to container management. And FreeBSD jails don't work on Linux.
Google Cloud uses gvisor for their K8s offering; AWS and Fly.io use firecracker for their container offerings.
Cgroups in v2 can be delegated easily and cleanly. As well as namespaced. Systemd or no systemd. Systemd just makes your life harder if you want to do rootless containers without integrating with them.
IIRC the GP comment was asking about NixOS, not Nix. If you have everything already going through managed K8s or firecracker then I don't understand what you are using NixOS for. You could just install Nix on some other distribution that uses whatever init/container setup you want.
"Cgroups in v2 can be delegated easily and cleanly. As well as namespaced."
Right but none of those other things that were mentioned support cgroups delegation at an OS service level, only systemd does. Unless they have added this recently and I missed it. And if you're just using this to run a hypervisor then you're bypassing all that completely.
I don't see what you mean systemd makes it harder, you have to do basically the same process in any container manager if you want delegation. This is part of the design of cgroupsv2, it's not something systemd came up with. I'm sorry if I'm asking stupid questions but I honestly am really confused what your use case is, and your explanations are just making me more confused, so maybe something got lost here.
Delegating a cgroups doesn't take systemd, by the way. You can do it with mkdir().
Systemd puts user processes in a part of the cgroups tree where they can't work freely, by default. You have to use a systemd unit or the dbus api to break out of that box. That is a design decision on system's part. If I was putting user processes in cgroups, I would give them space to work amongst themselves.
AFAIK you actually should not be using mkdir, because it is racy to have more than one process writing to the toplevel hierarchy. It's only safe to do that from the cgroup manager. That's what I've seen with all the existing implementations anyway.
"Systemd puts user processes in a part of the cgroups tree where they can't work freely, by default. You have to use a systemd unit or the dbus api to break out of that box. That is a design decision on system's part."
It's a design decision that was made because of cgroupsv2. You should really read systemd's documentation on this if you haven't, it describes in detail why this is. https://systemd.io/CGROUP_DELEGATION/
Edit: and also the kernel documentation on delegation. https://www.kernel.org/doc/html/latest/admin-guide/cgroup-v2...
In particular, any other container manager that wants delegation needs to do this same thing using a similar mechanism that you initiate by configuring it somehow. (It doesn't have to be a unit file or dbus call obviously.) Processes cannot just freely break out of their cgroup, that wouldn't be secure. Sorry if you know all this already, maybe a reader doesn't. Or maybe this is helpful to you if you want to add this to startup, I don't know.
"If I was putting user processes in cgroups, I would give them space to work amongst themselves. "
Ok now you lost me again... is this not exactly the purpose of cgroup delegation?
Source? And define top level hierarchy? The top level isn't really special.
This is why locks exist btw.
I'm not convinced you have to manage cgroups from one process. That is not how most implementations do it.
>Processes cannot just freely break out of their cgroup, that wouldn't be secure.
Processes can freely migrate ("break out" if you insist on that terminology) if they have write access to one level above them in the tree. Systemd does not put you in that situation, but it could.
E.g. if you are in /user/<uid> you have nowhere to go, but if your are in /user/<uid>/default you can go to /user/<uid>/<container_runtime>/<unique_container_id>/default.
"Because the resource control interface files in a given directory control the distribution of the parent’s resources, the delegatee shouldn’t be allowed to write to them."
You could add locking but that would be basically doing what systemd/docker/runc does and adding a new API on top of it which is then available through D-Bus or whatever. The top-level hierarchy is the top of any cgroup tree, if you have two processes writing to that without synchronization then they will potentially stomp over each other's values. You technically can go and run "sudo mkdir" inside your docker's toplevel cgroup but that would probably break things.
"if they have write access to one level above them in the tree. Systemd does not put you in that situation, but it could."
Well it does do that if you turn on delegation by giving you your own sub-tree, it doesn't do it by default because most services are not container managers and don't need an additional sub-tree. If you don't do that then write access is not allowed by the cgroups API, see above. It would not really make sense to allow a child process to say "I am going to take 100% of the cpu controller now and you get none sorry", that would defeat the purpose of cgroups.