6 ms·
There's one extra process that takes up a tiny bit of CPU and memory. For that, you get an immutable host, simple configuration, a minimal SBOM, a distributable
by staticassertion 5mo ago
There's one extra process that takes up a tiny bit of CPU and memory. For that, you get an immutable host, simple configuration, a minimal SBOM, a distributable set of your dependencies, x-platform for dev, etc.
- amusingimpala75 5mo agoYes but NixOS does all of these things already, without the process overhead
- umvi 5mo agoEven the minimal SBOM part? It's hard to be more minimal than a busybox binary.
- amusingimpala75 5mo agoThat’s fair, NixOS avoids the direct stuff from Docker itself but if you’re basing on an Alpine image or something that would probably be more minimal / smaller
- staticassertion 5mo agoNix wraps your process in namespaces and seccomp?
- amusingimpala75 5mo agoNot by default but tools like agent-sandbox.nix (bwrap, seccomp) or other nixpak (just bwrap but more popular) can provide those capabilities if you want in a fairly simple interface