606: Nix's Magic Cookbook  ## Metadata - Author: [[LINUX Unplugged]] - Full Title: 606: Nix's Magic Cookbook - Category: #podcasts - URL: https://share.snipd.com/episode/99eb17ab-ca65-43c1-86ae-b9bac92f1498 ## Document Notes ## Highlights - **Nix as Veggie Goulash** - Ron from Flox compared Nix to his mom's veggie goulash, a recipe passed down through generations. - He then imagined a magic cookbook that materializes exact ingredients, highlighting Nix's reproducibility. Transcript: Chris Then that's what you get. That's not why we were there. So, you know, got the job done. We got the bodies clean and the stank off of us, so that way we could go sit down and attend the keynote of Planet Nix. It's just about time for the kickoff of Planet Nix. We've got our seats, and Brent brought a gigantic backpack. Brent How much food is in there versus gear? It's probably 50-50, and most of it's for me. I don't know what you guys brought for food. Chris Yeah, well, you didn't bring us food? Brent Oh, no, no, no, no. Never. Chris Now, Wes, do you have something to take notes with over there? I have my phone, and I have LogSeek. All right, and I've got the audio. I'll take the audio notes, Wes takes the text notes, and Brent will do the snacking. And it works pretty well. It does. Like you took copious notes. Indeed. Yeah. Wes I'm trying to get back into log seek. I was using it pretty consistently kind of fell off and this seemed like a perfect use case. Chris And I was doing the old handwritten thing. And Brent always is watching for potential guests. And so you take our notes and Brent's observations when he's been fed. And we kind of have like after different talks, we kind of go off and like do interview strikes. You know, it's like we this person gets done or that. So we're we're not only watching what talks are happening, but then we're thinking about it on the flip side. OK, so who is available when and where can we find them? Because you can show up. You show up just at the end of the talk. You can catch them in the room. Hey, could you step outside for a few minutes and do a chat with us? That kind of thing. So we're both trying to take in as much information and we're trying to strategize who we want to talk to next. The keynote was pretty good. And there was a moment where Ron from Phlox talked about why Planet Nix and thought I'd share that with you. A journey into Planet Nix. Speaker 5 So this is a little sneak peek. I don't know if we have any Magic the Gathering fans out here. I'm kind of a geek on it. We're going to do something. You'll see in like 30 minutes. But otherwise, planet Nix. So Nix, obviously it's Nix. The other fact is that for years we've been trying to reinstate Pluto as a planet. Hasn't been really successful. One of its moons is called Nix, right? That's why Ilko called Nix Nix. You can ask him later about that. I won't stand for this. We don't fact check on this platform. The thing is, we're starting a mission to try and re-insate Pluto as a planet and then eventually have a real moon for a real planet called Nyx. That's why we call it Planet Nyx. Chris I can get behind that. I think Pluto deserves it. It's been hanging out there a long time. ([Time 0:07:50](https://share.snipd.com/snip/e26f59af-c92e-49e5-b662-294f7408ee5e)) - **Nix's Enterprise Value** - Wes Payne observed that Nix's precise specification of software components is increasingly valuable in enterprise settings. - This aligns with the industry's growing demand for reproducible builds and detailed software bills of materials. Transcript: Chris And I think one of the insights and takeaways I had from Planet Nix this year was what you just described is becoming more and more something that the software industry is expected to Provide to the enterprise. The enterprise wants to know exactly what's in this. They want to know if it, you know, if it complies with certain requirements and they want to be able to reproduce it and move it around every single ([Time 0:12:38](https://share.snipd.com/snip/fe0e85da-eaf0-4502-be17-af2e876245f7)) - **Nix: A Buried Treasure** - Kelsey Hightower, after reading the Nix white paper, sees Nix as a "buried treasure" that could have significantly altered the path of software development. - He argues that while Docker addresses the messy reality of current software development practices, Nix offers a more precise approach. Transcript: Chris And he went in further detail about his discovery when he finally had a little bit of time to read the Knicks white paper. Speaker 5 Kind of what you think about Knicks and maybe having kind of a frank conversation about it. Kelsey Hightower Yeah, I read the Nix paper last year and I was like, look at this, in my view, this buried treasure. And it feels like there was a fork in the road a couple of decades ago where this problem was definitely apparent. Back then, I was a big user of systems like Red Hat. I started my career on free BSD. And there was this situation like, how do you get more than one thing on a system without them overriding each other or fighting each other? Then I spent the rest of my career putting one app per VM because no one solved the problem 10 years later. That just came to think you did. Then we got tools like RVM in the Ruby community because your gem files would literally fight with each other and you taught them to behave. I also worked on tools like virtual imps in the Python community and then Docker came out. And I think Docker leaned into the reality was that no one had solved this problem because every programming language also came with its own package manager and ways of doing things. And then Golang came out and it was like, forget LibC altogether. Build static binaries and we just skipped that entire step. And in many ways, it felt like Docker had won, not just because it figured out reproducible software, because it did. It figured out how to match the reality of the way people write software. It's messy. It's non-deterministic. People do all kinds of weird things because the focus went from operating systems to applications. And Docker became the perfect format for people to get that done and distribute it to each other. And so I read Nick's paper after going through this whole journey. It's like, where were you two decades ago when I was at that fork in the road? Maybe we would have went in a different way. And so a lot of my initial feedback has been, this ain't usable. Microsoft Word. How do I get out of this thing? It's like, why'd you turn off your computers? Like, that was the only way. And I did that before, right? To get out of Vim, I had shame. I just turned the whole thing off. Turned my computer back on. I was like, I'm out of there. I'm never doing that again. Chris That felt sort of fair. That felt like a fair analogy. It is a bit like showing people Vim for the first time. Yeah, you could sub Nano for Word. It's the same deal. Now, he got to your point specifically around, you know, the bomb or the bill of materials and how maybe Nix could improve software distribution even if we stuck with Docker. ([Time 0:13:21](https://share.snipd.com/snip/d404b455-c135-4c0a-8c2a-18ab06525bea)) - **Integrating Nix with Docker** - Kelsey Hightower suggests using Nix within Dockerfiles to improve reproducibility without sacrificing Docker's ease of use and distribution. - He emphasizes pragmatism and meeting developers where they are, rather than demanding a complete switch to Nix. Transcript: Kelsey Hightower And so the hands-on approach is like, how could you make Docker better if you had something like Nix in the middle? So if you've never used Docker before, there's this Docker file. And if you look at people's Docker files, it's like a big ass bash script the way most people do things, right? Yum, install everything. Download all the NPM modules just in case I need one. And then my app. And then you ship this four terabyte thing to servers. You're like, it's repeatable software. And then you spend half your time scanning, looking for vulnerabilities. We're right back to where we were 20 years ago. If you look at some of the biggest problems in that community, they're literally fighting the same battles we were doing with bare metal and VMs. They just packaged it in another artifact this time. And so people have worked on slinging technologies where, you know, you try to start the app, look at the system calls, run the S-Trace, and figure out exactly what it needs. You run it in production and you find out you miss one. So we've been doing a lot of reverse engineering. And I was like, what if we were able to do this differently? So after the whole SolarWinds debacle, there has been a rise in interest in secure software supply chains. And I think now people are open to a different approach. I think people are a little tired of the brute force. And so the promise of Nix is that we can be a little bit more exact. So instead of generating an S-bomb after you built the application through reverse engineering, what if you could be way more explicit upfront? So that's been appealing to me so i've been looking at like how do we take the current situation we're in especially one that's baked in containers and then can nix add value to that scenario That seems like a pretty realistic goal yeah kelsey had a i think that maybe one of the high level takes is you know be pragmatic and meet in the middle you know uh and a little bit of a reminder Wes Of what success of infrastructure-type projects looks like. So we don't need to necessarily have everything with Nix on the tin, especially in a world that's already gone full Kubernetes, but there's a lot of pieces in that process that can really Chris Benefit from either Nix itself or a Nix-like approach. And of course, he was asked one spicy question, and that was if you could only choose one, Knicks or Docker, which would you choose? Speaker 5 Like you mentioned Docker, obviously, Knicks or Docker. Kelsey Hightower You had to choose one. Woo! Look at the Knicks people. There's like a church of Knicks out there. Speaker 5 I have to say, Kelsey was like, I'm super excited about talking. I'm like, wow, you're talking to them at big stages. Like, no, I feel this is going to be different. I'm like, hell yeah, that's going to be different. Kelsey Hightower Look, if I had to choose one, I'm choosing Docker. And you would say, why would I do that? Think through it. Most people that are writing code, your whole number one objective isn't the packaging tool nor format. Your goal is to ship something. So if you're a developer, you look at all the things that you can ship to Heroku, Cloud Run, Lambda, IBM, and then you got to work on a team of other people. And the hardest thing I've seen in technology is to get global consensus. We agree on something, IP addresses, DNS, Linux as a distribution. That stuff takes decades sometimes. And so the Docker ecosystem is rich. Why is it rich? Is it a better packaging tool than Nix? No. Do people know it? Yes. That cute little whale did something. People identify with it. So when you say Docker, a lot of people understand what that means. You're probably going to have a Docker file that moved the needle in terms of at least knowing how to rebuild software. There's still a lot of companies, maybe you work for some of them, they pride themselves that only one person knows how to build certain software on a specific laptop and no one touches That laptop because the only thing that can build a thing. And for a lot of people, Docker moved the needle for them. And the ecosystem's rich. There's Docker registries, there's metadata, there's all of these things. So if I had to choose only one, it would probably be Docker. So what would you take away from that? What makes Docker work? It's not one versus the other. It's just this usability curve. It meets people where they are, then shows them what's next. And I've been a part of a lot of technology movements that just focused on, here's the next thing. It's like, so what do I do now to go from where I am to that? And you're like, I don't know, man. Delete everything you have and start the right way. Just doesn't work, right? But I'm hoping that the two can find some synergies where it's pragmatic. And I do think Nick's inside of a Docker file for a lot of people will solve the reproducible build problem without giving up the distribution and ease of use for other platform problem. And I think that's probably where you're going to get a lot of new people learning about this technology for the first time. So when you see them, welcome them. I ([Time 0:16:08](https://share.snipd.com/snip/d6d68d37-9a10-433f-8a6b-f598e5411cf8)) - **Anthropic's Docker Escape** - Anish Agrawal from Anthropic shared how their 35GB Docker images led to slow build and pull times, hindering CI and development workflows. - This situation pushed them to explore Nix as a solution for managing their large and complex software dependencies. Transcript: Chris And he was kind of still new. So he was coming in and discovering some of the issues they were having scaling. Anish Agrawal When I got to Anthropic a year ago, you know, they told me we used industry standard tools, obviously a lot of Python because it's an AI shop. We're using Kubernetes. And at the time, we used one image for everything. That image was 35 gigabytes large, uncompressed. Normally, when people talk about a large Docker image, they're talking like a couple hundred megabytes is big, a couple gigabytes is enormous. This was another level of very large. There's good reasons for it. ML libraries will monomorphize their kernels for different hardware architectures of accelerators. You have researchers adding things that they needed one time and maybe didn't remove since then. There's good reasons for it. But there was also just some inefficiency in the build that hadn't been cleaned up. You know, when I got there, I pretty quickly cut out about 20% of it, but there was still a pretty big image left. And this causes problems. Build times are slow, pull times are slow, push times are slow, and we were seeing four-minute times to pull anything, which is really painful. This all meant that the rebuild times were almost an hour. This was slow enough, we couldn't run in CI, and we actually had to have a manual process for who was going to build next. Most of our code is Python, so people didn't have to rebuild so often, so it wasn't too bad. But a few months into my tenure, we had a new, very high-priority initiative that required compiled software, where people were going to be changing this multiple times a day, and so We knew that this existing process was not going to work for us. So today I'm going to talk about kind of our story from escaping Docker because it wasn't going to work, obviously going to Nix. We're going to talk about Nix Sidecar, which is the thing I built to address this. And then we'll give some closing thoughts at the end. ([Time 0:24:39](https://share.snipd.com/snip/7b4d485d-7987-41a4-8738-8f7173e331eb)) - **Configurable Flakes** - Eelco Dolstra introduced configurable flakes, allowing arguments to be passed into flakes and enabling greater flexibility. - This addresses a previous limitation and offers a way to combine reproducibility with configurability. Transcript: Chris That we wanted to attend was the creator of Nix. Elko Dostras had a bit of, I guess, an announcement and a demo to give on configurable flakes. And he had our attention. Speaker 5 Okay, yeah. So this is about configurable flakes. So I submitted this stock proposal and it got accepted. So then I actually had to go and implement it. But as proof that it actually works, I mean, I should say this is very work in progress and there are a lot of rough edges and certainly the design needs to be you know figured out completely But yeah it's it works so I'll give a quick demo and then talk a bit more about the details but yeah so the goal is to make flakes configurable so up to now as you know flakes are fully hermetic So you can you can do things with them, like build them, but you can't pass any configuration flags to them on the command line. And now you can. So here I have a little flake. Chris Explain this to me, Wes, why this is a significant development, the fact that you can now pass arguments to a flake and whatnot. Yeah, okay. Wes So you could use Nix to just sort of build a program that takes its own command line arguments, but you're doing it totally outside of Nix, and you can't take advantage of any of the stuff That Nix has, right? You're sort of post-Nix. In a pre-Flakes world, where you did Nix-build, you could pass arguments into it in a way that Nix kind of supported and knew about. So you could say, like, dash dash arg, and then you could say like, I want to pass this key and value into the program you're running via Nix. But it wasn't discoverable in any way. It was kind of just like entirely dynamic. It was a way to pass just a bundle of keys and values into the build, but without hermeticism, right? It wasn't fully controlled. It wasn't going to be reproducible in any meaningful way. And you either had to look at the code or if there were docs or whatever for what arguments it take, there was no way to actually like use the system itself to discover it. Okay. Then flakes happened and flakes really put an emphasis on that reproducibility and the hermeticism and like having it be, you know, blocking everything that they can that will be dynamic Which has pain points but also a lot of benefits as we've been talking about already today so this meant that you couldn't pass arguments into flakes in the way that you could previously This meant in in the language they're using here they weren't configurable and this is one of the one of the criticisms that you'll definitely see leverage especially when flakes were Introduced of like this design seems flawed you can't configure these things we've lost the ability to pass in arguments and so this is sort of an approach to solve that and this is ilko's Idea of how we can solve that and he kind of stressed uh in the setup of the talk he said you know i submitted this talk in the abstract and then it was accepted. So I had to go finish the implementation. So I don't think it's intended to be this, this is what we, you know, the 100% thing to do or like it has to go this way, but it's presented as an approach to configurability for Flakes. I ([Time 0:32:30](https://share.snipd.com/snip/fbea586c-8c2f-4f6d-8f9b-49cd747bb396)) - **Nixbooks: Chromebook Alternative** - Olympia Mike developed "Nixbooks," Chromebook replacements using NixOS for easy maintenance and updates. - He has deployed these to friends, family, and the local community, demonstrating NixOS's suitability for non-technical users. Transcript: Speaker 7 Man, this is wild, right? If you think about, I was thinking about this in the room. We went from the summer of immutability and I was like, what are these guys talking about this Nix thing? And now we're sitting here, what, two, three years later at planet Nix, you know, um, which is just wild. Brent Are you blaming us for your trajectory? Yeah, 100%. Yeah. I think I had a slide dedicated to blaming you guys for my discovery of NixOS. So what are you doing with NixOS these days? Speaker 7 So, oh boy. Well, I'm doing a bunch of stuff. So I just got done finishing my talk on building a Chromebook replacement with NixOS, which is basically, I almost named it NixOS for your mom, you know, because the idea is like setting Up NixOS for a general user, basic user to use. But like NixOS for your mom, I was like, eh, that might not get approved. So you decided on a different name? Yeah. So basically, you know, people that want a Chromebook-like experience, but without the creepy Google stuff, right? They just want it to be automatic. They just want everything to work. They want everything to like be one-click install. And so, yeah, that's why I've built that with Nix OS and I've been deploying it out there in the real world for friends, family, and local people. And yeah, so I give a talk on how I did that and hopefully get more eyes on the project. Brent Cool. So tell us a little bit more about why you built this, because it sounds like you have a project in which you're giving back to the community and that was kind of a thrust to use Nix to make Your job a little easier. Speaker 7 Yeah, absolutely. So if you were to look at a heat map of Linux users, there's probably a giant red spot in Olympia, Washington. And that's because for the past five years, I've been getting donation computers from people, people that are just, I have this old laptop sitting in my closet, don't know what to do With it. And they give it to me. And I've even buddied up with like school districts and companies that are getting rid of old hardware. And so they know that I'm a safe place to bring it because I securely wipe everything before anything goes out. And some people want data off their drives or whatever. So what I do is I take these machines and I Linux them up and donate them back out to the community. And what I was doing was doing Linux Mint. Because Linux Mint is, you know, love it or hate it, it is definitely the most friendly environment and UI for somebody coming from Windows. And overall that worked great, but I noticed there were some issues with Linux Mint. People not doing updates, a little package confusion stuff. And so what I thought was, what if I built this in Nix and was able to rebuild Linux Mint in Nix with all the upgrades that I wanted to do? And I did. Brent You said you basically built your own distribution, but I would imagine Nix enabled you to do that in a way that you would have never considered doing without it. Oh, absolutely. Speaker 7 Yeah. Yeah. Linux from scratch or even, you know, back in the day before I discovered Nix, how I did this was basically like Arch shell scripts, like install Arch and then run this script. It sounds scary already. It sounds scary already. Brent Yeah. Yeah. Sure enough. And yeah, never bit me. Sure. I'm lying. Yeah, it sounds like a little bit of pain points, but also just, you mentioned you're now taking care of 400 to 500 laptops. Speaker 7 Yeah, so I have, there's probably at least 400 to 500 of these, I call them Nixbooks, out there in the world. And many of them are in my house as well. So I have my kids, I have my parents, they're all using Nixbook. And it's just, it's fantastic. It really is that perfect, zero maintenance, open it up and it just works. All the updates are done for you. You just never need to worry about anything. And it's just that all the guarantees and the security that you get with Nix for a general user. I mean, it kind of is perfect. ([Time 0:50:57](https://share.snipd.com/snip/e911a8ee-48c2-4ef1-8651-759d9bba6906)) - **Openness on Commercial Nix Use** - Ron Efroni observed increased openness at Planet Nix regarding commercial Nix use. - He attributes this to a more welcoming environment for beginners and professionals seeking practical solutions. Transcript: Chris And we wanted to wrap it up with Ron, who we started this adventure with Ron, who is the co-founder of Phlox and, of course, the chair of the NixOS Foundation. And we wanted to check in with him a day after things just to see, you know, how it had gone for him. And now that he's just attending regular old scale, what's it been like just with the average folks who are coming for a general Linux convention? How do you feel the first Planet Nix went? Speaker 5 I mean, I think it was incredible. Yeah. I can only speak for myself or just the energy in the room, but seeing over 300 people, standing room only on two tracks. Yeah. Workshops, talks, all that. I think that was incredible. Chris You know what I noticed, and I wonder if you picked up on this, is it felt like both in terms of talks and in terms of attendees, people were talking about how they use Nix at work more out In the open. Like, we're using it here. We're replacing this with Nix. Did you see more of that? Did you hear more of that this year? Speaker 5 I 100% did. And I think that was the thing when we intentionally really tried to communicate with Planet Nix. It's going to be a bit different. It's going to be a bit more, you know, Nix beginners, Nix at work doing that. And I think it was received so well that that's kind of the ecosystem that showed up here, right? We have a good mix of advanced contributors, but also a good mix of folks that finally felt really comfortable, you know, being able to talk about, hey, I just want to bring it in. I'm not an expert. What do I do? And I love those conversations. Chris Yeah, because you walk away with like real solutions. Like, oh, that's how you fix that. Like there's been a couple of conversations where people just had breakthroughs. Like, oh, that's how you're doing that? Oh, what a brilliant idea. Because there's always a lot of ways to solve problems. Speaker 5 Exactly, exactly. And I think it's, look, I mean, think about it. We're a pretty tight-knit community. We're a pretty extreme technical community. It must be, and it probably is, kind of scary to come in and say, hey, how do I do this thing for a commercial reason, right? Open commercial, that already has a little bit of friction. So when you're like, all I wanted to do is to solve a problem at Apple, at Anthropic, at take name of presenter that attended this year, I think it's kind of scary. And I'm really happy to see that folks were talking about it. I think it means that we kind of removed the barriers a bit and opened our arms a bit wider for folks like that. Chris So putting your Phlox head on, we're standing right here at the Phlox booth in the scale side of the event in the expo hall. What's the average scale attendee interest been in Phlox and the solving problems that Phlox solves? I mean, I think we're seeing the transition, right? Speaker 5 We're seeing kind of that. We were here two years ago, actually at a Nix booth, right? Because we hosted the first Nix booth ever at scale two years ago. And folks were coming by and being like, what's Nix? Now folks are coming by and being like, oh, you're that. Are you that thing that bridges all the gaps that I currently have with containers? And they're coming to us with a, hey, I've started to use this instead of homebrew, or this has improved my life over here. So that's a really amazing feeling, right? Folks are starting to that discovery phase and the excitement phase, both about Nix and about Flux. And I'm seeing a lot of scale attendees who are not specifically from the Nix ecosystem come up, recognize, mention already being, you know, looking into it, which is always a more lovely, Deep conversation. Chris It's such a great opportunity because the conversations are so high bandwidth. So you just get so much more context. You know, that's something that I really appreciated about us being here is I feel like we just understand a lot more about what people are working on and what's really kind of on front Of people's mind right now, they're thinking of. Like there's just the bandwidth you get in these conversations. It's so much richer than the online communications. I almost wish we could do it more than once a year. Speaker 5 I do too. I think that would be lovely. I mean, the fact that we can, you know, user, a person, an attendee shows up and it's like, here's my problems. Show me how you solve them for me. And what we do is like crack open a laptop and, you know, the person leaves with like, hey, holy cow. Chris I think I got this licked. I can, I can solve this. Yes. Yeah. Yeah. Speaker 5 It's hard to get not in person, not face to face. And that's incredible. Well, Ron, ([Time 0:54:50](https://share.snipd.com/snip/fdc60ad0-9f68-4eea-8c1c-a4ac26d5d026))