Rebuildable system & appliance by nikstur · Pull Request #263462 · NixOS/nixpkgs

nikstur · 2023-10-25T23:14:58Z

Description of changes

Add system.rebuildable flag

This flag allows the user to optionally exclude
switch-to-confguration.pl from toplevel.

This is interesting for appliance images where you don't want to re-build
the system. This flag is called rebuildable because the standard
interface to do this is nixos-rebuild which will not work anymore with
this change.

When #263295 lands, environment.defaultPackages = mkDefault [ ]; can be removed from the minimal profile.

Things done

roberth

Really cool, but I think this needs to distinguish between general appliances and virtual appliances. I'll have some more thoughts regarding the distinction, but first I'll lazily quote Wikipedia Software appliance:

A software appliance is a software application combined with just enough operating system (JeOS) to run optimally on industry-standard hardware (typically a server) or in a virtual machine.

This PR elaborates what is just enough, and it seems to get it right for virtual appliances. However, for a hardware appliance you probably want to have more drivers and some upgrade mechanism.

By default the upgrade mechanism should probably be SSH + Nix store. Emphasis on store because it only has to work for root, and does not have to come with an interpreter.

nixos/modules/profiles/appliance.nix

nixos/modules/system/activation/activatable-system.nix

nikstur · 2023-10-26T09:57:55Z

However, for a hardware appliance you probably want to have more drivers and some upgrade mechanism.

I should've made this clearer: the update mechanism I envision is image-based A/B booting via the systemd toolchain. At the center of this is systemd-sysupdate for which I have added a module in a previous PR #243995 In this universe you would receive a completely new store image instead of only a new store closure, so Nix isn't necessary at all.

You would build images with the repart builder which I have also already added in a previous PR: #245250

Hardware and virtual appliance in this world are the same, you can update them the same way. However with a virtual appliance, you can also just completely exchange the disk image (but then you don't get the automatic fallback from systemd-boot and systemd-bless-boot)

roberth · 2023-10-26T10:12:34Z

via the systemd toolchain

How about systemd-sysupdate-appliance.nix then?

I'd be happy to start with very specific profiles and consider factoring this out into common profiles only when the other use cases have profiles and the commonality is "proven".

nikstur · 2023-10-26T12:10:18Z

How about systemd-sysupdate-appliance.nix then?

I called it image-based-appliance because that's the differentiating factor between our approaches in my mind. If you do image based updates, you do not need Nix.

roberth · 2023-10-26T12:42:40Z

I called it image-based-appliance

If systemd-sysupdate doesn't require overly specific changes to the config, then that sounds great to me, and if that changes, you can always add an extra profile specifically for it.

nikstur · 2023-10-26T15:11:30Z

This should be good to go now.

@ofborg test non-switchable-system switchTest

roberth

Implementation lgtm.

Needs documentation and maybe promote it with a release note?

nixos/tests/non-switchable-system.nix

This flag allows the user to optionally exclude switch-to-confguration.pl from toplevel. This is interesting for appliance images where you don't want to re-build the system. This flag is called `rebuildable` because the standard interface to do this is `nixos-rebuild` which will not work anymore with this change.

nixos/modules/profiles/image-based-appliance.nix

nikstur · 2023-10-26T16:32:58Z

Added docs and release notes.

@ofborg test non-switchable-system switchTest

nixos/doc/manual/development/non-switchable-systems.section.md

lheckemann · 2023-10-28T08:25:49Z

nixos-rebuild should probably detect when it's built a system that can't be switched to, and provide a helpful error message in such a case. I'm not sure how important that is for this PR though.

nikstur · 2023-10-28T11:29:30Z

nixos-rebuild should probably detect when it's built a system that can't be switched to, and provide a helpful error message in such a case. I'm not sure how important that is for this PR though.

That would be nice, however, I think it's not needed for this PR.

roberth · 2023-10-29T06:59:18Z

nixos-rebuild should probably detect

I feel like nixos-rebuild, in the state it is currently in, is saturated with all sorts of complexity.
switch-to-configuration: No such file or directory doesn't seem all that bad for this rather specialized use case.

I would love to have such a check after nixos-rebuild is refactored, but until then, let's keep it simple.

emilylange · 2023-11-05T00:03:37Z

nixos/modules/profiles/minimal.nix

+  # Perl is a default package.
+  environment.defaultPackages = mkDefault [ ];
+
+  # The lessopen package pulls in Perl.
+  programs.less.lessopen = mkDefault null;
+
+  # This pulls in nixos-containers which depends on Perl.
+  boot.enableContainers = mkDefault false;
+


Can we please add a release note entry for boot.enableContainers?

https://discourse.nixos.org/t/breaking-changes-announcement-for-unstable/17574 would have been fitting as well.

Created #269970 for a simple eval warning when containers are used but disabled (e.g. by importing the minimal profile).

nikstur requested a review from dasJ as a code owner October 25, 2023 23:14

nikstur requested review from RaitoBezarius and roberth October 25, 2023 23:15

github-actions bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Oct 25, 2023

nikstur changed the title ~~Rebuildable system~~ Rebuildable system & appliance Oct 25, 2023

nikstur requested review from blitz and lheckemann October 25, 2023 23:21

ofborg bot added 10.rebuild-darwin: 1-10 This PR causes between 1 and 10 packages to rebuild on Darwin. 10.rebuild-linux: 1-10 This PR causes between 1 and 10 packages to rebuild on Linux. labels Oct 26, 2023

roberth reviewed Oct 26, 2023

View reviewed changes

nikstur force-pushed the rebuildable-system branch from a713590 to 4f6d2ef Compare October 26, 2023 12:06

nikstur force-pushed the rebuildable-system branch from 4f6d2ef to f4e05f1 Compare October 26, 2023 15:10

nikstur requested a review from roberth October 26, 2023 15:20

roberth reviewed Oct 26, 2023

View reviewed changes

nixos/tests/non-switchable-system.nix Outdated Show resolved Hide resolved

nixos/tests/non-switchable-system.nix Outdated Show resolved Hide resolved

nikstur force-pushed the rebuildable-system branch from f4e05f1 to d17a647 Compare October 26, 2023 15:47

dasJ reviewed Oct 26, 2023

View reviewed changes

nixos/modules/profiles/image-based-appliance.nix Outdated Show resolved Hide resolved

nikstur force-pushed the rebuildable-system branch from d17a647 to 9dc4d68 Compare October 26, 2023 16:16

github-actions bot added 8.has: documentation This PR adds or changes documentation 8.has: changelog This PR adds or changes release notes labels Oct 26, 2023

nikstur force-pushed the rebuildable-system branch 2 times, most recently from 959ea19 to 0b823c5 Compare October 26, 2023 16:26

roberth reviewed Oct 26, 2023

View reviewed changes

nixos/doc/manual/development/non-switchable-systems.section.md Outdated Show resolved Hide resolved

nikstur force-pushed the rebuildable-system branch from 0b823c5 to a9d1495 Compare October 26, 2023 17:54

nikstur requested review from dasJ and roberth October 26, 2023 18:47

lheckemann reviewed Oct 28, 2023

View reviewed changes

nixos/doc/manual/development/non-switchable-systems.section.md Outdated Show resolved Hide resolved

lheckemann reviewed Oct 28, 2023

View reviewed changes

nixos/doc/manual/development/non-switchable-systems.section.md Outdated Show resolved Hide resolved

nikstur and others added 4 commits October 28, 2023 13:26

nixos/docs: add non-switchable-systems section

996cf6a

nixos: release notes for system.switch.enable

79eba74

nixos/profiles/minimal: remove some perl

8dfe8e4

nixos/profiles: add image-based-appliance profile

e8bed1e

nikstur force-pushed the rebuildable-system branch from a9d1495 to e8bed1e Compare October 28, 2023 11:28

nikstur requested a review from lheckemann October 28, 2023 11:29

roberth approved these changes Oct 29, 2023

View reviewed changes

roberth merged commit 8b385c9 into NixOS:master Oct 29, 2023

blitz mentioned this pull request Oct 29, 2023

Retire systemdMinimal #264163

Closed

13 tasks

emilylange reviewed Nov 5, 2023

View reviewed changes

RaitoBezarius mentioned this pull request Nov 5, 2023

Tracking issue: Boot security in NixOS #265640

Open

nikstur mentioned this pull request Nov 16, 2023

Perlless Activation - Tracking Issue #267982

Closed

emilylange mentioned this pull request Nov 25, 2023

nixos/containers: warn if containers are used but disabled #269970

Merged

13 tasks

Uh oh!

Conversation

nikstur commented Oct 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description of changes

Things done

Uh oh!

roberth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nikstur commented Oct 26, 2023

Uh oh!

roberth commented Oct 26, 2023

Uh oh!

nikstur commented Oct 26, 2023

Uh oh!

roberth commented Oct 26, 2023

Uh oh!

nikstur commented Oct 26, 2023

Uh oh!

roberth left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

nikstur commented Oct 26, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

lheckemann commented Oct 28, 2023

Uh oh!

nikstur commented Oct 28, 2023

Uh oh!

roberth commented Oct 29, 2023

Uh oh!

emilylange Nov 5, 2023

Choose a reason for hiding this comment

Uh oh!

emilylange Nov 25, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

nikstur commented Oct 25, 2023 •

edited

Loading