Hacker News Reader

Comment by stephen_cagle | Hacker News Reader

Have you heard of any good projects for running isolated containers in NixOS that are cheaply derived from your own NixOS config? Because that is what I want. I want a computer where I can basically install every non stock app in its own little world, where it thinks "huh, that is interesting, I seem to be the only app installed on this system".

Basically, I want to be able to run completely unverified code off of the internet on my local machine, and know that the worst thing it can possibly due is trash its own container.

I feel like NixOS, is one path toward getting to that future.

View on HN

You mean like https://wiki.nixos.org/wiki/NixOS_Containers ?

There is also https://microvm-nix.github.io/microvm.nix/ if you want increased isolation.

I can recommend MicroVM.nix, since it allows for multiple VM runtimes like QEMU, Firecracker, etc.

There's also nixos-shell for ad-hoc virtual machines: https://github.com/mic92/nixos-shell

Can you do those ad-hoc though? I was looking into this too. I feel like it requires a system config change, apply, and then you need to do container start + machinectl login to actually get a shell.

That's definitely what I want... most of the time.

Yes, NixOS containers can be run in:

* declarative mode, where your guest config is defined within your host config, or

* imperative mode, where your guest NixOS config is defined in a separate file. You can choose to reuse config between host and guest config files, of course.

It sounds like you want imperative containers. Here's the docs: https://nixos.org/manual/nixos/stable/#sec-imperative-contai...

Oh I totally missed that!

sounds like you want qubes os https://www.qubes-os.org/

> I want a computer where I can basically install every non stock app in its own little world, where it thinks "huh, that is interesting, I seem to be the only app installed on this system".

NixOS containers are the most convenient way to do this, but those will map the entire global nix store into your container. So while only one app would be in your PATH, all other programs are still accessible in principle. From a threat-modelling perspective, this isn't usually a deal-breaker though.

There's also dockerTools, which lets you build bespoke docker/podman images from a set of nix packages. Those will have a fully self-contained and minimal set of files, at the expense of copying those files into the container image instead of just mapping them as a volume.

https://spectrum-os.org/ is trying to marry QubesOS (everything runs inside a VM) with Nix. It's still very much in development, though.

If containers are safe enough for ur use case then just use nixos containers they just a few more lines to setup in a regular nixos config

If it isn't enough there's microvm.nix which is pretty much the same in difficulty /complexity, but runs inside a very slim and lightweight VM with stronger isolation than a container

Sounds like Ghaf might be what you're after: https://ghaf.tii.ae/ghaf/overview

depends whether you consider rootless Docker "cheap". I tried running ZeroClaw in a Nix-derived Docker (spoiler - it was a bad idea to use ZeroClaw at all since the harness is very buggy) and there is still a potential for container escape zero-days, but that's the best I've found. also, Nix's own containerization is not as hermetic as Docker; they warn about that in docs

That's hard given most apps have dependencies and often share them.

It will always look like curl is available or bash or something

What's wrong with another user account for such isolation?

They can be isolated to namespaces and cgroups. Docker and Nix are just wrappers around a lot of OS functionality with their own semantics attempting to describe how their abstraction works.

Every OS already ships with tools for control users access to memory, disk, cpu and network.

Nix is just another chef, ansible, cfengine, apt, pacman

Building ones own distro isn't hard anymore. If you want ultimate control have a bot read and build the LFS documentation to your needs.

Nothing more powerful than the raw git log and source. Nix and everything else are layers of indirection we don't need

> Nix is just another chef, ansible, cfengine, apt, pacman

No, because Nix code is actually composable. These other tools aren't.

Not only is it composable, but it is generalizable. So yes there is also chef, ansible, apt, uv, nodeenv, etc... or there is just nix. It is able to be the "one tool" to rule them all, often with better reproducibility guarantees.

Reply on news.ycombinator.com