Thread

Dutch governments builds alternative for Microsoft based on NixOS

1021 points · 583 comments · fjfaase

solarkraft · 1790327717 · focus · HN ↗
Awesome! I believe NixOS is perfect for systems you just want to work and track reproducibly, like appliances (which a lot of server software is supposed to be). I’m glad people smarter than me are actually able to realize its advantages =)
In the same space, also check out openDesk initiated by the German Government (<a href="https://www.opendesk.eu/en" rel="nofollow">https://www.opendesk.eu/en) and La Suite by the French one (<a href="https://lasuite.numerique.gouv.fr/" rel="nofollow">https://lasuite.numerique.gouv.fr/).
AFAIK, there has been some collaboration with the German government on La Suite, not sure about the others.
1. skohan · 1790336306 · focus · HN ↗
  I recently got my feet wet with Nix for the purpose of agent sandboxing, and it's a really great concept!
  The issue I have run into is that for running llama.cpp, which is a very actively developed bleeding-edge software, it seems like experimenting with different versions/configs/patches etc. was fighting with the Nix philosophy of immutable software, so I ended up just managing it outside of nix.
  But this could be user-error, I've only spent a couple of weeks with it.
  1. fsiefken · 1790338614 · focus · HN ↗
    one can use direnv, nix-direnv and flake.nix to get an immutable and reproducible build toolchain protected from nix garbage collection, while keeping the llama.cpp branches and/or compiled binaries mutable on the local filesystem. <a href="https://github.com/nix-community/nix-direnv" rel="nofollow">https://github.com/nix-community/nix-direnv
    for agentic execution sandboxing, preventing 'rm -rf /home' nix or nix-direnv doesn't help, podman could be used next to nix. <a href="https://discourse.nixos.org/t/what-is-sandboxing-and-what-does-it-entail/15533" rel="nofollow">https://discourse.nixos.org/t/what-is-sandboxing-and-what-do...
    ireadmevs · 1790356066 · focus · HN ↗
    If it’s just filesystem sandboxing that you are after, then bubblewrap can help you stay in nix by just wrapping the agent’s derivation
  2. kevincox · 1790340594 · focus · HN ↗
    llama.cpp has a flake in-repo that I often use for trying out different branches and patches. I also have yet to have an issue just replacing the src and build number attribute in the nixpkgs build (in one cases I wanted to add an additional CMake flag but that was also easy).
    IMHO this is way easier than without Nix in many cases as figuring out the upstream build process and getting it running can often be quite the chore. With Nix it is all set up for you.
  3. rgoulter · 1790342445 · focus · HN ↗
    > The issue I have run into is that for running llama.cpp, which is a very actively developed bleeding-edge software, it seems like experimenting with different versions/configs/patches etc. was fighting with the Nix philosophy of immutable software
    May be. I'd guess it probably does it in a high-friction way compared to what you expect.
    e.g. in a typical linux distro, you can just replace the (globally installed) version of the package and use that.
    With Nix, you've got a declaration of how to build a package, including its dependencies; and each of those dependencies is also a declaration of how to build that package, and so on. -- And so, "just change this version" results in rebuilding the full chain of dependencies.
    If you want multiple readily-available versions of llama.cpp each with different configs/patches, then using Nix would make this easier I'd think. But for "I just wanna try this, then try that", it's going to add overhead.
    rounce · 1790344208 · focus · HN ↗
    It requires rebuilding the nodes whose inputs have been affected by the change, not the entire tree.
  4. overtone1000 · 1790353763 · focus · HN ↗
    When I just want to make something work and there isn't a nix package that can instantly give me what I want with `nix-shell -p $PACKAGE` then I use containers. That's what I've done when playing around with llama.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.