6 ms·

Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time

by koe123 20d ago

andsens 20d ago
Agreed. With all the improvements in namespacing I’m seeing the potential of all desktop apps being namespaced in a reasonable way, where filesystem access to e.g. /home is controlled through a kernel-hook prompt callback, with something like “always allow for this directory” etc. That’d be so awesome!
kodoman 20d ago
Only issue is with Nix as a long time user, it does not provide a standard way to run your nix builds in some kind of container, there are so many different competing third party systems and some first party systems built in nixpkgs it's self like building oci or docker containers or running systemd containers or even building qcow2 images, each with their own draw back and positives. More and more I have found myself simply using podman and dockerfiles finding that building nix systems simply gets error prone and annoying and all the containerization systems leave a lot to be desired. Though I have some custom scripts for utilizing btrfs snapshots to create different nix store snap shots for containers or vms running with nix stores with virtiofs. This works quite well but not ready to be released and fiddly when things break and requires BTRFS. I do agree flatpak and friends are not great though.
tancop 20d ago
Nix is always doing its own thing. The community is fragmented and there are no enforced packaging conventions. They have a "best practices" page that lists language features you're not supposed to use because they break reproducible builds, aka the whole point of Nix. And they don't even restrict network access by default. It's also not doing runtime sandboxing at all. Isolated builds protect you from supply chain attacks but not malware or vulns in the actual code, and they don't do anything for closed source apps. Flatpak runs everything in a container with access limited to what is declared in the manifest and you can restrict it even more with Flatseal. It's not as secure as a Firecracker VM but it works way better than any other package system on Linux when it comes to security and distro independence.
- koe123 20d ago
  Maybe I am vastly underestimating it, but I could imagine this being buildable atop of nix quite straightforward?
  - omnimus 20d ago
    Yes because both flatpak and nix use bubblewrap and linux. So it is indeed possible to build it with bubblewrap. GUI apps on NixOS rarely care about sandboxing so while you can do it yourself i bet almost noone does. Flatpak is trying to give you basic protections out of the box.
  - iamnothere 20d ago
    It already exists and is called nixpak
yjftsjthsd-h 20d ago
Nix doesn't sandbox applications, flatpak can.

Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time

by koe123 20d ago

Maybe I am too propagandized, but honestly after going Nix I can’t help but feel like this stuff is fundamentally a waste of time

andsens 20d ago

Agreed. With all the improvements in namespacing I’m seeing the potential of all desktop apps being namespaced in a reasonable way, where filesystem access to e.g. /home is controlled through a kernel-hook prompt callback, with something like “always allow for this directory” etc. That’d be so awesome!

kodoman 20d ago

Only issue is with Nix as a long time user, it does not provide a standard way to run your nix builds in some kind of container, there are so many different competing third party systems and some first party systems built in nixpkgs it's self like building oci or docker containers or running systemd containers or even building qcow2 images, each with their own draw back and positives. More and more I have found myself simply using podman and dockerfiles finding that building nix systems simply gets error prone and annoying and all the containerization systems leave a lot to be desired. Though I have some custom scripts for utilizing btrfs snapshots to create different nix store snap shots for containers or vms running with nix stores with virtiofs. This works quite well but not ready to be released and fiddly when things break and requires BTRFS. I do agree flatpak and friends are not great though.

tancop 20d ago

Nix is always doing its own thing. The community is fragmented and there are no enforced packaging conventions. They have a "best practices" page that lists language features you're not supposed to use because they break reproducible builds, aka the whole point of Nix. And they don't even restrict network access by default. It's also not doing runtime sandboxing at all. Isolated builds protect you from supply chain attacks but not malware or vulns in the actual code, and they don't do anything for closed source apps. Flatpak runs everything in a container with access limited to what is declared in the manifest and you can restrict it even more with Flatseal. It's not as secure as a Firecracker VM but it works way better than any other package system on Linux when it comes to security and distro independence.

koe123 20d ago
Maybe I am vastly underestimating it, but I could imagine this being buildable atop of nix quite straightforward?
- omnimus 20d ago
  Yes because both flatpak and nix use bubblewrap and linux. So it is indeed possible to build it with bubblewrap. GUI apps on NixOS rarely care about sandboxing so while you can do it yourself i bet almost noone does. Flatpak is trying to give you basic protections out of the box.
- iamnothere 20d ago
  It already exists and is called nixpak

yjftsjthsd-h 20d ago

Nix doesn't sandbox applications, flatpak can.