Nix. for Functional Systems

Size: px

Start display at page:

Download "Nix. for Functional Systems"

Collin Nash
6 years ago
Views:

1 Nix for Functional Systems

2 1. What Nix is 2. How Nix works 3. How I use Nix

3 "Every build tool sucks" "Every dependency manager sucks"

4 What is it? Programming language Package/build manager Operating system

5 1. Nix started around Been using Nix since late Switched to NixOS early 2015

7 Code reuse Reproducibility Atomic upgrades

8 Functions! f(x) =???

9 { stdenv, fetchurl }: stdenv.mkderivation rec { name = "hello-2.10"; src = fetchurl { url = "mirror://gnu/hello/${name}.tar.gz"; sha256 = "0ssi1wpaf7plaswqqjwigppsg5fyh99vdlb9kzl"; }; docheck = true; }

10 $ nix-instantiate --no-gc-warning '<nixpkgs>' -A hello /nix/store/bzqrpq-hello-2.10.drv

11 $ pp-aterm < $(!!) Derive( [("out", "/nix/store/h3k6gm-hello-2.10", "", "")], [ ("/nix/store/sfpnlg-stdenv.drv", ["out"]), ("/nix/store/jhaz7i-bash-4.4-p12.drv", ["out"]), ("/nix/store/dqkx5-hello-2.10.tar.gz.drv", ["out"]) ], ["/nix/store/02c25b-default-builder.sh"], "x86_64-linux", "/nix/store/s59hbs-bash-4.4-p12/bin/bash", ["-e", "/nix/store/02c25b-default-builder.sh"], [ ("buildinputs", ""), ("builder", "/nix/store/hbs-bash-4.4-p12/bin/bash"), ("docheck", "1"), ("name", "hello-2.10"), ("nativebuildinputs", ""), ("out", "/nix/store/h3k6gm-hello-2.10"), ("propagatedbuildinputs", ""), ("propagatednativebuildinputs", ""), ("src", "/nix/store/z0qh8g-hello-2.10.tar.gz"), ("stdenv", "/nix/store/cpd6h7-stdenv"), ("system", "x86_64-linux") ] )

12 # Masked Derive( [("out", "", "", "")], [ ("/nix/store/sfpnlg-stdenv.drv", ["out"]), ("/nix/store/jhaz7i-bash-4.4-p12.drv", ["out"]), ("/nix/store/dqkx5-hello-2.10.tar.gz.drv", ["out"]) ], ["/nix/store/02c25b-default-builder.sh"], "x86_64-linux", "/nix/store/s59hbs-bash-4.4-p12/bin/bash", ["-e", "/nix/store/02c25b-default-builder.sh"], [ ("buildinputs", ""), ("builder", "/nix/store/hbs-bash-4.4-p12/bin/bash"), ("docheck", "1"), ("name", "hello-2.10"), ("nativebuildinputs", ""), ("out", ""), ("propagatedbuildinputs", ""), ("propagatednativebuildinputs", ""), ("src", "/nix/store/z0qh8g-hello-2.10.tar.gz"), ("stdenv", "/nix/store/cpd6h7-stdenv"), ("system", "x86_64-linux") ] )

13 /nix/store drvhash inputs maskedcontent = "bzqrpq" outhash maskedcontent = "h3k6gm" Outputs: 1. Normal 2. Fixed output

14 default-builder.sh source $stdenv/setup genericbuild

15 stdenv/setup genericbuild() { if [ -z "$phases" ]; then phases="$prephases unpackphase patchphase \ configurephase buildphase checkphase \ installphase fixupphase installcheckphase \ $predistphases distphase $postphases"; fi } for curphase in $phases; do eval "${!curphase:-$curphase}" done

16 stdenv/setup configurephase() { runhook preconfigure configurescript=./configure if [ -z "$dontaddprefix" -a -n "$prefix" ]; then configureflags="---prefix=$prefix \ $configureflags" fi if [ -n "$configurescript" ]; then echo "configure flags: $configureflags" $configurescript $configureflags else echo "no configure script, doing nothing" fi } runhook postconfigure

17 stdenv/setup installphase() { runhook preinstall if [ -n "$prefix" ]; then mkdir -p "$prefix" fi installtargets=${installtargets:-install} echo "install flags: $installtargets $makeflags" make ${makefile:+-f $makefile} $installtargets \ $makeflags "${makeflagsarray[@]}" \ $installflags "${installflagsarray[@]}" } runhook postinstall

18 Substitutes $ nix-store --realise \ --ignore-unknown /nix/store/h3k6gm-hello-2.10 these paths will be fetched (5 MiB download): /nix/store/h3k6gm-hello-2.10 /nix/store/q3wx1g-glibc-2.24

19 Runtime dependencies Nix looks for the hashes of inputs in the build output. Graph is stored in the Nix SQLite database.

20 Nix profiles $ readlink ~/.nix-profile /nix/var/nix/profiles/per-user/brian/profile $ readlink $(readlink ~/.nix-profile) profile-276-link $ export PATH="$HOME/.nix-profile/bin:$PATH"

21 $ nix-env -i hello $ readlink $(readlink ~/.nix-profile) profile-277-link $ readlink ~/.nix-profile/bin/hello /nix/store/jl72gxms9rg3czv3wj1rsk-hello-2.10/bin/hello

22 Garbage collection $ nix-collect-garbage --delete-older-than 60d 6544 store paths deleted, MiB freed

23 nixpkgs Packages: ~7385 top level ~11444 Haskell ~12609 R NixOS Build support: Docker images Virtual machine images deb & rpm packages

24 $ nix-shell -p 'haskellpackages.ghcwithpackages \ (p: [ p.hint p.lens-aeson p.brick ])' [nix-shell:~]$ ghci GHCi, version 8.0.1: Loaded GHCi configuration from /home/brian/.ghci Prelude λ

25 $ cabal2nix./. { mkderivation, base, optparse-applicative, process,, stdenv, temporary, unix }: mkderivation { pname = "editpipe"; version = " "; src =./.; islibrary = false; isexecutable = true; executablehaskelldepends = [ base optparse-applicative process temporary unix ]; homepage = " description = "Edit stdin using an editor"; license = stdenv.lib.licenses.bsd3; } $ nix-build -E 'with import <nixpkgs> { }; \ haskellpackages.callpackage./. { }'

26 Pinning with import ((import <nixpkgs> { }).fetchgit { url = " rev = "b2e431b49e25c69c7cb68dce79d b7c47"; sha256 = "0a45i9nfv2h9i4graqvam49d7w86gl3by2c1s"; }) { };

27 NixOS { config, pkgs,... }: { imports = [./hardware-configuration.nix ]; boot.loader.grub.enable = true; hardware.pulseaudio.enable = true; networking.hostname = "bmckenna-m3800-nixos"; environment.systempackages = with pkgs; [ gitfull file htop tmux which wget haskellpackages.xmobar ]; virtualisation.docker.enable = true; nixpkgs.config.allowunfree = true; hardware.bumblebee.enable = true; services.xserver = { enable = true; videodrivers = [ "intel" "vesa" ]; windowmanager.xmonad.enable = true; }; users.extrausers.brian = { uid = 1000; extragroups = [ "wheel" "docker" "vboxusers" ]; }; }

28 $ nixos-install $ nixos-rebuild switch

29 submenu "NixOS - All configurations" { menuentry "NixOS - Configuration 93 (cbf3d03)" { search linux ($drive1)//kernels/500k-linux bzimage systemconfig=/nix/store/qnhn-nixos-cbf3d03 init=/nix/store/qnhn-nixos-cbf3d03/init loglevel=4 initrd ($drive1)//kernels/ga2i7-initrd-initrd } menuentry "NixOS - Configuration 92 (40de598)" { search linux ($drive1)//kernels/462w-linux bzimage systemconfig=/nix/store/f25m-nixos-40de598 init=/nix/store/f25m-nixos-40de598/init loglevel=4 initrd ($drive1)//kernels/nhxk-initrd-initrd } }

30 $ ls /nix/var/nix/profiles/system activate init-interface-version append-initrd-secrets initrd bin kernel configuration-name kernel-modules etc kernel-params extra-dependencies nixos-version fine-tune sw firmware system init systemd

31 $ ls /bin sh $ ls /usr/bin env

32 #! /nix/store/hi4j-bash-4.4-p12/bin/bash systemconfig=/nix/store/1wrc-nixos-system-nixos.f0fac3b export PATH=/empty for i in /nix/store/ar26-coreutils-8.27 /nix/store/w9rn-gnugrep-3.0 /nix/store/rga4-findutils /nix/store/09il-glibc-2.25-bin /nix/store/rb2w-shadow-4.4 /nix/store/5zi0-net-tools-1.60_p /nix/store/7hn6-util-linux bin; do PATH=$PATH:$i/bin:$i/sbin done

33 ln -sfn /proc/self/fd /dev/fd ln -sfn /proc/self/fd/0 /dev/stdin ln -sfn /proc/self/fd/1 /dev/stdout ln -sfn /proc/self/fd/2 /dev/stderr mkdir -m p /bin ln -sfn "/nix/store/9kiv-bash-4.4-p12/bin/sh" /bin/sh /nix/store/qxq7-perl /bin/perl \ -I/nix/store/j8n-perl-File-Slurp/lib/perl5/site_perl \ /nix/store/r620-setup-etc.pl /nix/store/mayy-etc/etc /nix/store/qxq74-perl /bin/perl -w \ -I/nix/store/j8n-perl-File-Slurp/lib/perl5/site_perl \ -I/nix/store/xmfa-perl-JSON-2.90/lib/perl5/site_perl \ /nix/store/1hkp-update-users-groups.pl \ /nix/store/00cp-users-groups.json

34 mkdir -m p /var/log mkdir -m p /var/tmp mkdir -p /var/empty /nix/store/183f-openresolv-3.9.0/bin/resolvconf -u if! [ -e /etc/machine-id ]; then /nix/store/lvzx-systemd/bin/systemd-machine-id-setup fi mkdir -m p /usr/bin ln -sfn /nix/store/ar26-coreutils/bin/env /usr/bin/env ln -sfn "$(readlink -f "$systemconfig")" \ /run/current-system exit $_status

35 Docker FROM ubuntu RUN apt-get install -y software-properties-common RUN add-apt-repository ppa:chris-lea/node.js RUN apt-get update RUN apt-get install -y nodejs RUN mkdir /var/www ADD app.js /var/www/app.js CMD ["/usr/bin/node", "/var/www/app.js"]

36 Dockerfile Immutability Side effects

37 "Mostly functional" programming does not work.... The idea of "mostly functional programming" is unfeasible. It is impossible to make imperative programming languages safer by only partially removing implicit side effects. Leaving one kind of effect is often enough to simulate the very effect you just tried to remove. On the other hand, allowing effects to be "forgotten" in a pure language also causes mayhem in its own way.

38 dockertools.buildimage { name = "nix-docker"; fromimage = alpine_3_3; contents = redis; config = { Entrypoint = [ "/bin/redis" ]; }; }

39 dockertools.buildimage { name = config.networking.hostname; contents = [ config.system.build.binsh (linkas config.environment.usrbinenv "usr/bin/env") (linkas config.system.build.toplevel "run/current-system") config.system.build.etc ]; config = { Env = exportvariables; WorkingDir = "/root"; }; }

40 $ nix-build $ tar tf result././f58d61a874bedb7cdcb5a409ebb0c53b0656b880695/./f58d61a874bedb7cdcb5a409ebb0c53b0656b880695/version./f58d61a874bedb7cdcb5a409ebb0c53b0656b880695/json./f58d61a874bedb7cdcb5a409ebb0c53b0656b880695/layer.tar./1588e83015e9fd52df7c835b9e9621b54655ead5f32/./1588e83015e9fd52df7c835b9e9621b54655ead5f32/version./1588e83015e9fd52df7c835b9e9621b54655ead5f32/json./1588e83015e9fd52df7c835b9e9621b54655ead5f32/layer.tar./repositories./3dfdadbd8992aaf2435f9eb151f7e43ce38f1b3caf7/./3dfdadbd8992aaf2435f9eb151f7e43ce38f1b3caf7/version./3dfdadbd8992aaf2435f9eb151f7e43ce38f1b3caf7/json./3dfdadbd8992aaf2435f9eb151f7e43ce38f1b3caf7/layer.tar./f8a6eff170d41f381ddaa47f85d988371b89964d61c/./f8a6eff170d41f381ddaa47f85d988371b89964d61c/version./f8a6eff170d41f381ddaa47f85d988371b89964d61c/json./f8a6eff170d41f381ddaa47f85d988371b89964d61c/layer.tar

41 $ tar xof result./f8a6eff170d41f381ddaa47f85/json jq { "Size": , "architecture": "amd64", "config": { "AttachStderr": false, "AttachStdin": false, "AttachStdout": false, "Cmd": null, "Domainname": "", "Entrypoint": null, "Hostname": "b14cd ", "Image": "", "OpenStdin": false, "StdinOnce": false, "Tty": false, "User": "", "Volumes": null, "WorkingDir": "" }, "container": "b14cd " }

42 $ nix-build $ docker load -i result

43 Virtual machines

44 Qemu build $ nix-build '<nixpkgs/nixos>' -A vm

45 ISO build $ nix-build '<nixpkgs/nixos>' \ -A config.system.build.isoimage

46 import <nixpkgs/nixos/lib/make-disk-image.nix> rec { name = "nixos-vdi-${config.system.nixoslabel}"; config = (import <nixpkgs/nixos> { inherit configuration; }).config; inherit pkgs lib disksize; partitioned = true; } configfile = pkgs.writetext "configuration.nix" "{ imports = [ <virtualbox-image.nix> ]; }"; postvm = '' mkdir -p $out fn="$out/nixos-${config.system.nixoslabel}.vdi" ${pkgs.vmtools.qemu}/bin/qemu-img convert \ -f raw -O vdi \ $diskimage $fn rm $diskimage '';

47 Cross compilation

48 let pkgs = import <nixpkgs> { }; staticarm = drv: (drv.overridederivation (d: { buildinputs = d.buildinputs ++ [ pkgs.libccross.static ]; postunpack = '' export NIX_CROSS_CFLAGS_LINK="-static \ $NIX_CROSS_CFLAGS_LINK" ''; })).crossdrv; crosssystem = rec { config = "arm-linux-gnueabi"; bigendian = false; arch = "armv5te"; float = "soft"; withtls = true; libc = "glibc"; platform = pkgs.platforms.sheevaplug; openssl.system = "linux-generic32"; }; in staticarm (import <nixpkgs> {inherit crosssystem; }).rsync;

49 Tricks

50 patchshebangs $ patchshebangs. patching script interpreter paths in../example.sh: interpreter directive changed from "/usr/bin/bash" to "/nix/store/hi4j75r-bash-4.4-p12/bin/bash"

51 patchelf $ patchelf --print-interpreter random-binary /lib64/ld-linux.so.2 $ patchelf --set-interpreter \ $(< $NIX_CC/nix-support/dynamic-linker) random-binary $ patchelf --print-rpath random-binary /nix/store/m-file-5.28/lib:/nix/store/r-zlib-1.2.8/lib

52 libredirect open, open64, fopen, fopen64 xstat, xstat64, access posix_spawn, execv LD_PRELOAD="${libredirect}/lib/libredirect.so" NIX_REDIRECTS="/etc/example.conf=${myexampleconf}"

53 makewrapper $ wrapprogram $out/bin/foo \ --add-flags "--config=${fooconfig}"

54 Projects NixOps disnix Guix Dhall nix kubernetes

55 TODO Redesigned/single CLI interface Better Windows support More and better documentation IPFS!?

56 Resources Nix pills Nix manual nixpkgs manual NixOS manual

NIX THE PURELY FUNCTIONAL PACKAGE MANAGER MARIUSZ GLIWIŃSKI

NIX THE PURELY FUNCTIONAL PACKAGE MANAGER MARIUSZ GLIWIŃSKI TWO APPROACHES [] --[]+A--> [A] --[A]+B--> [A,B] --[A,B]-B--> [A] OR [] --[]+A--> [A] --[]+A+B--> [A,B] --[A,B]-B--> [A] OCCAM'S