News for hackers. Stuff that matters.

A comment on NixOS is a good server OS, except when it isn't. Parent comment

Re:NixOS is a good server OS, except when it isn't by ahachete on Wednesday October 02, 2024 @05:38AM (#41718777)
I was thinking of a similar approach, but mounting /nix/store from the host into the guest will only work if you have a single guest.

For multiple guests, you should rely instead on: * A snapshot-able filesystem with the option to create clones (like ZFS). I think this is a great idea actually. * Exporting /nix/store via NFS, so you can have multiple writers (but this creates some tight coupling in that accidentally deleting stuff there may disrupt all guests).

[ Parent | on HN ]
Re:NixOS is a good server OS, except when it isn't by evgpbfhnr on Wednesday October 02, 2024 @09:17AM (#41720296)
mounting /nix/store from the host into the guest works with as many guests as you like - this is what the nixos tests framework does all the time, you just need a different "system" derivation for each (different) VM.

The problem with that is that the VM can see all the needless software, so if your goal is isolation, having a smaller closure is much better from a security point of view: if there's no coreutils bash etc then there's no risk of getting a shell spawned by an attack...

[ Parent | on HN ]