Nix: the functional Package Manager

and

@ Lambda World Cádiz 2015

Domen Kožar / @iElectric

declarative Linux distribution

NixOS

Problem?

Functional approach

GHC runtime dependency graph

Nix

• purely functional language to describe how to build packages and their dependencies
• build results only depend on declared inputs.
• packages never change after they have been built (they're immutable)

• "The Purely Functional Software Deployment Model" - Eelco Dolstra PhD thesis (2006)
• solves dependency hell set of problems

Nix

• lazy evaluated, dynamically typed
• C++
• runs on POSIX (Linux / OS X / FreeBSD/ Cygwin)
• (could work on Windows, if there was interest)
• multi-user support
• source/binary model

$ tree `nix-build -A zlib`
/nix/store/31w31mc8immhpnmxvcl4l0fvc3i5iwh0-zlib-1.2.8
├── include
│   ├── zconf.h
│   └── zlib.h
├── lib
│   ├── libz.a
│   ├── libz.so -> libz.so.1.2.8
│   ├── libz.so.1 -> libz.so.1.2.8
│   ├── libz.so.1.2.8
│   └── pkgconfig
│       └── zlib.pc
└── share
    └── man
        └── man3
            └── zlib.3.gz

$PREFIX

$ ldd `which perl`
        linux-vdso.so.1 (0x00007ffc9fdd0000)
        libperl.so => /nix/store/lhgkssg79bxdba541h75mgdvjh35b8ic-perl-5.20.2/lib/perl5/5.20.2/x86_64-linux-thread-multi/CORE/libperl.so (0x00007fa537f3b000)
        libnsl.so.1 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libnsl.so.1 (0x00007fa537d23000)
        libdl.so.2 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libdl.so.2 (0x00007fa537b1f000)
        libm.so.6 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libm.so.6 (0x00007fa53781c000)
        libcrypt.so.1 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libcrypt.so.1 (0x00007fa5375e1000)
        libutil.so.1 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libutil.so.1 (0x00007fa5373de000)
        libpthread.so.0 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libpthread.so.0 (0x00007fa5371c1000)
        libc.so.6 => /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/libc.so.6 (0x00007fa536e21000)
        /nix/store/npfsi1d9ka8zwnxzn3sr08hbwvpapyk7-glibc-2.21/lib/ld-linux-x86-64.so.2 (0x00007fa5382f4000)

Dynamic libraries are linked deterministically

Profiles and User Environments

{ stdenv, fetchurl, fetchgit, openssl, zlib, pcre, libxml2 }:

stdenv.mkDerivation rec {
  name = "nginx-${version}";
  version = "1.4.4";

  src = fetchurl {
    url = "http://nginx.org/download/nginx-${version}.tar.gz";
    sha256 = "1f82845mpgmhvm151fhn2cnqjggw9w7cvsqbva9rb320wmc9m63w";
  };

  buildInputs = [ openssl zlib pcre libxml2 ];
  configureFlags = [ "--with-http_spdy_module" ];
  postInstall = "mv $out/sbin $out/bin";

  meta = with stdenv.lib; {
    description = "A reverse proxy and lightweight webserver";
    maintainers = [ maintainers.domenkozar ];
    platforms = platforms.all;
    license = licenses.bsd2;
  };
}

• functional language
• chroot
• disabled networking
• patch shebangs
• /nix/store/ mounted as read-only
• patches to tooling

Lazy language (hackable)

nix-shell - start an interactive shell based on a Nix expression

Haskell

• ~50% of the packages available from Hackage

• well over 8,000 builds in total

• Stack support

• 60+ Haskell package sets

• maintained by Peter Simons

$ nix-build
/nix/store/4jzj9qwknqz24cx6zvn7y4cmnq19hvv4-my-ghc-app-0.0.1

$ ls -la result
result -> /nix/store/4jzj9qwknqz24cx6zvn7y4cmnq19hvv4-my-ghc-app-0.0.1

$ ./result/bin/mybin
>>>

$ nix-shell --pure

$ nix-copy-closure --sign result/ domenkozar@example.com

Build the app

Run it

Develop the app

Deploy it

Toolset

$ cabal2nix --shell . > shell.nix

Generate Nix expresssion based on Cabal

NixOS: packages + systemd + Linux kernel

{
  boot.loader.grub.device = "/dev/sda";
  fileSystems."/".device = "/dev/sda1";

  networking.firewall = {
    enable = true;
    allowedTCPPorts = [ 80 ];
  };

  environment.systemPackages = with pkgs; [
    wget
    git
    gnupg
    tmux
  ];
  
  services = {
    sshd.enable = true;
    munin-node.enable = true;
    munin-cron = {
      enable = true;
      hosts = ''
        [${config.networking.hostName}]
        address localhost
      '';
    };
  };
}

NixOS modules

{ config, lib, pkgs, ... }:

let
  configFile = pkgs.writeText "nginx.conf" ''
    user nginx nginx
    daemon off;
  '';
in {
  options = {
    services.nginx = {
      enable = lib.mkOption {
        default = false;
        description = "Enable the nginx Web Server.";
        types = types.bool;
      };
    };
  };

  config = mkIf config.services.nginx.enable {
    environment.systemPackages = [ pkgs.nginx ];

    systemd.services.nginx = {
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
      path = [ pkgs.nginx ];
      serviceConfig = {
        ExecStart = "${nginx}/bin/nginx -c ${configFile}";
      };
    };
  };
}

Rollback!

Hydra build farm

Challanges

• private nix store files
• P2P / IPFS distribution of binary packages
• statically typed Nix (2.0?)
• get rid of Perl as dependency in Nix source
• native Windows support
• multiple outputs
• binary determinism
• low-level speed/memory improvements
• GuixSD

conf.nixos.org

14th and 15 November @ Berlin

2 days of talks by core contributors

Thanks!